Devin AI
24b0130c45
feat: reconcile mailbox sync recovery with merged worker Kafka retry and broker-confirmed delivery safeguards
2026-10-09 18:18:26 +00:00
Devin AI
1ca77a431b
feat: integrate merged monitoring updates with ordered worker command recovery
2026-10-09 16:57:57 +00:00
Devin AI
4758216dbf
feat: integrate current monitoring and member access changes with durable mailbox synchronization
2026-10-09 16:56:53 +00:00
Matthew Meszaros
5ab4b5e544
feat: drain Kafka worker commands through bounded ordered mailbox lanes and accelerate safe startup recovery while backing off duplicate filing retries
2026-10-09 16:35:26 +00:00
Matthew Meszaros
9a09740c84
feat: add permission-shaped operational monitoring snapshots with aggregate recovery evidence and read-only broker diagnostics
2026-10-09 15:12:54 +00:00
Devin AI
445e014b5e
feat: recover mailbox synchronization across Gmail Outlook and IMAP with encrypted arrival replay and safe worker lifecycle
2026-10-09 14:24:10 +00:00
Matthew Meszaros and Devin AI
d7a9563e3f
feat: expire stale warmup failure warnings and alert persistent fleet stalls while safely retrying blocked dispatches
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-09 05:37:56 +00:00
Matthew Meszaros
1386dac607
Merge pull request #892 from warmbly/feature/campaign-positive-reply-analytics
...
feat: positive replies, positive reply rate and interested leads in campaign analytics
2026-10-09 04:28:22 +00:00
Matthew Meszaros
daf95ba790
feat: seed fixture mailboxes with test_mode legacy so a fresh make seed and QA stack can join them to their warmup pools again after migration 000273 defaulted new mailboxes to off
2026-10-09 06:08:28 +02:00
Matthew Meszaros
6d88588350
feat: filter the Analytics dashboard by campaigns and campaign folders (campaign_ids/folder_ids on GET /analytics/dashboard, resolved server-side to one deduplicated org-scoped set), with a picker on web, a filter sheet on iOS, CLI flags, an AI tool argument, and API, OpenAPI and guide docs
2026-10-09 06:04:31 +02:00
Matthew Meszaros
166637b395
Merge pull request #886 from warmbly/devin/1791479588-cloud-standing-refresh
...
feat: refresh Cloud-linked pool status without inventing reputation bans
2026-10-08 17:42:14 +00:00
Matthew Meszaros and Devin AI
b16dadd264
feat: refresh self-hosted Cloud pool standing from validated mailbox listings and separate availability holds from reputation bans
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 17:19:02 +00:00
Matthew Meszaros and Devin AI
d3c6efdc46
feat: retire proven-unstarted warmup reservations and request worker reloads for missing mailboxes
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 16:55:05 +00:00
Matthew Meszaros and Devin AI
e02655fd89
feat: coordinate TypeSafe billing recovery across backend and consumer, attribute token usage and reuse copy judgments during cache outages
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-08 04:28:37 +00:00
Devin AI
8a45508e79
feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates
2026-10-07 14:02:11 +00:00
Devin AI
8e53fc7027
feat: integrate warmup observation evidence canonical diagnostics send-result recovery cloud trust exact-parent lineage durable dispatch portability and legacy compatibility
2026-10-07 12:38:58 +00:00
Matthew Meszaros and Devin AI
b8303060dc
feat: integrate current main with a single consumer schema and relation visibility guard while preserving migration cancellation diagnostics and regression coverage
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 07:49:50 +00:00
Matthew Meszaros
bbd0d9f785
Merge pull request #863 from warmbly/devin/1791356256-posthog-root-causes
...
feat: fix PostHog root causes in API validation, Gmail recovery and frontend asset delivery
2026-10-07 07:35:04 +00:00
Matthew Meszaros and Devin AI
dfed1e1593
feat: validate API UUIDs, recover expired Gmail history and guard consumer startup and stale frontend assets
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 07:19:15 +00:00
Matthew Meszaros and Devin AI
3acfe64109
feat: preserve self-host upgrades with exact realtime CSP discovery, consumer migration readiness and backend-compatible fleet targets
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 06:53:14 +00:00
Matthew Meszaros
a92e40b4d1
feat: show Cloud warmup analytics and placement alongside local history on linked self-hosted instances with scoped report APIs
2026-10-07 06:12:04 +00:00
Matthew Meszaros and Devin AI
5fe22b3b6a
feat: preserve warmup identity across mailbox reconnects and retry provider filing with pre-disconnect cleanup
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 12:03:17 +00:00
Matthew Meszaros and Devin AI
849cf18f55
feat: bind password recovery, invitations, mailbox and integration OAuth, referral and billing returns to trusted initiating dashboards
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-05 12:51:37 +00:00
Matthew Meszaros
1de33d9f41
feat: guard configuration tab links against losing unsaved edits, keep the login captcha mounted for resend, confirm warmup appeal decisions by mailbox, show header tabs only on section pages, show the update pill in the mobile drawer, make admin sign-in alerts opt-in per channel, check the admin bit before loading the account, and alert on admin access only when it changes
2026-10-05 03:21:44 -07:00
Matthew Meszaros
e506544119
Merge origin/main into feature/admin-redesign
2026-10-05 03:01:22 -07:00
Matthew Meszaros
8910b02198
feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link
2026-10-05 03:01:22 -07:00
Matthew Meszaros and Devin AI
0ea856537e
fix(security): drop jwt-go via first-party Apple auth, bump yoke-derive, grant checks:write to rust audit
...
Refs WAR-10
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-04 18:36:28 +00:00
Matthew Meszaros
211cf76230
Merge pull request #831 from warmbly/devin/1791136163-skip-onboarding-seeded-accounts
...
fix: skip the onboarding wizard for seeded, sandbox, bootstrap, and warmblyctl-created accounts
2026-10-04 18:12:49 +00:00
Matthew Meszaros and Devin AI
acb5b8f9f4
fix: skip the onboarding wizard for seeded, sandbox, bootstrap, and warmblyctl-created accounts
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-04 17:49:23 +00:00
Matthew Meszaros
36149cdebd
feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer
2026-10-04 19:20:48 +02:00
Matthew Meszaros
f23c04ddd8
Merge remote-tracking branch 'origin/main' into feature/slack-app-agent
...
# Conflicts:
# deploy/slack/manifest.json
# docs/content/docs/development/slack-app.mdx
# docs/content/docs/guides/slack.mdx
# internal/app/integration/slack.go
# internal/app/slackapp/agent.go
# internal/app/slackapp/client.go
# internal/app/slackapp/slackapp_test.go
# web/src/lib/integrations/oauthPopup.ts
2026-10-04 06:54:19 -07:00
Matthew Meszaros
801c87ffe1
feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup
2026-10-04 05:15:07 -07:00
Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
e852a106a9
feat: serve every node-only internal route (data keys, message map, sync lookups, worker config, fleet heartbeat) on NODE_BROKER_TOKEN and leave only tracked links, domain redirects, page hits and forms on INTERNAL_API_TOKEN, render nodes only the node token when one is set, and have the installer generate a distinct NODE_BROKER_TOKEN for new installs and its own UPDATER_TOKEN
2026-10-04 03:21:58 -07:00
Matthew Meszaros
bf47984cd5
feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations
2026-10-04 02:59:10 -07:00
Matthew Meszaros
8bb60e9449
feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers
2026-10-04 02:58:43 -07:00
Matthew Meszaros
3a2d80b8bf
feat: accept realtime API keys and OAuth tokens only in the x-warmbly-token handshake header with the ws ticket alone in the query string, filter token and key params from Phoenix connect logs, refuse realtime keys, OAuth tokens and pool link tokens held by a login-banned user or a suspended app with an uncached key check, and send the key as a header from warmbly events tail
2026-10-04 02:56:18 -07:00
Matthew Meszaros
33f99b97e5
feat: end every session on sign-out-everywhere through RevokeOtherSessions with cache eviction after commit, refuse refresh on a revoked session, close a user's realtime sockets on any session revocation via a SESSIONS_REVOKED event, and verify tokens without a purpose claim for no flow
2026-10-04 02:56:18 -07:00
Matthew Meszaros
9f7d45a1fb
feat: charge every password, emailed-code and TOTP attempt atomically before comparing it (Redis INCR+expire script) with a per-account TOTP budget across challenges, put the signed-in password change on the reauth budget, set the per-account login limit to 50 per hour, give tester passwords an expiry (users.password_expires_at, migration 000257) and clear them plus every session on revoke, mint warmblyctl reset links with the password-reset purpose, expire fleet join tokens (7 days default, 30 max, reusable inside the window), derive captcha from the resolved Turnstile secret, refuse weak bootstrap argon2id hashes, make registration codes single-use, rate-limit the v1 invitation lookup, and draw RIDs and user codes without modulo bias
2026-10-04 02:52:22 -07:00
Matthew Meszaros
585c7ff85a
feat: end every credential a login-banned user holds by refusing their API keys, OAuth grants and Slack links at resolution, and run the Slack assistant only for members whose role includes use_ai, matching the dashboard gate
2026-10-04 02:34:01 -07:00
Matthew Meszaros
1a483cb27f
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# internal/app/integration/service.go
# web/src/app/app/integrations/page.tsx
# web/src/hooks/useDocumentTitle.ts
2026-10-04 00:45:48 -07:00
Matthew Meszaros
4bc2417618
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# docs/content/docs/api/error-codes.mdx
# docs/content/docs/guides/integrations.mdx
# web/src/app/app/integrations/page.tsx
2026-10-04 00:32:54 -07:00
Matthew Meszaros
7555f641a5
feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps
2026-10-04 00:31:52 -07:00
Matthew Meszaros
d112657cf2
feat: wire suppression, subscription and hold dependencies into the consumer's Salesforce service, give Salesforce token refreshes their own single-flight keyspace, release the outbox lease in memory after each terminal write so writeback notes land and only on rows with a logged Task, drop stale Salesforce import previews, keep keys from the import row menu from opening the edit dialog, and document the Salesforce callback URL and OAuth variables
2026-10-04 09:10:37 +02:00
Matthew Meszaros
6b7e254e56
feat: add native Salesforce sync with Lead and Contact matching and links, a leased activity outbox that logs sends, replies, bounces, opt-outs and meetings as Tasks, Lead Status and Email Opt Out writeback, a pull loop with CRM pause rules, list view and Campaign imports, sandbox and My Domain OAuth that refreshes expired sessions, a Salesforce settings page with contact and inbox cards in web, and docs
2026-10-04 08:54:27 +02:00
Matthew Meszaros
37e91fc89f
feat: add HubSpot CRM mode where HubSpot deals, pipelines, tasks, notes and owners are mirrored and written through, sends and replies log as HubSpot emails, exit rules hold campaigns, list import, sync health, setup wizard in web, HubSpot app project with record card and workflow action, and docs
2026-10-04 07:47:51 +02:00
Matthew Meszaros
4957214431
feat: redesign the Integrations page with search, category chips, recommended and popularity-ranked integrations, add a community app directory where OAuth apps are published unverified by link and verified in a new admin review queue, with docs and OpenAPI
2026-10-03 09:24:34 -07:00
Matthew Meszaros
61d16dfe9a
feat: add Warmbly for Slack with the AI assistant in DMs, mentions and the assistant pane, unified inbox threads with reply, AI draft and lead actions, per-category notification routing and DMs, account linking, dashboard Slack settings, manifest and docs
2026-10-03 15:35:11 +02:00
Claude
bb580164e6
feat: compute each active campaign's send plan in a background snapshotter (internal/app/campaign) stored in campaign_send_plan_snapshots so GET /campaigns/:id/send-plan serves a stored snapshot instead of walking the planner on the request
2026-10-03 11:04:22 +00:00
Matthew Meszaros
50d50d0fbc
Merge pull request #793 from warmbly/fix/inbox-follow-up-sweep-paging
...
feat: page the hourly inbox follow-up sweep through each mailbox newest first in bounded keyset pages that resolve thread state only for the threads on the page, resume each workspace's cycle from a cursor persisted in inbox_follow_up_sweeps under a per-pass time budget, check recently active threads first every pass, and add the unibox_emails (email_id, internal_date, id) index the walk reads
2026-10-02 06:33:14 +00:00
Devin AI
Matthew Meszaros
Matthew Meszaros
Claude