starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-10-07 16:02:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,334 Commits 12 Branches 84 Tags
db8efd04d74c772c82f45e7ba00d14da337cf5df
Commit Graph
983 Commits
Author SHA1 Message Date
Matthew MeszarosandDevin AI 9d0f43780b feat: provision onboarding-complete reviewer workspaces with expiring Test access, bounded credits and Test header labels 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 16:15:56 +00:00
Matthew Meszaros fc18d8c186 Merge pull request #842 from warmbly/devin/1791201936-google-oauth-frontend-flag 
feat: configure Google mailbox OAuth and trusted multi-dashboard returns
 2026-10-05 13:31:17 +00:00
Matthew MeszarosandDevin AI d6c8d9e54c feat: document trusted dashboard origin refusals for Google and Microsoft mailbox OAuth under HTTP 400 errors 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:58:22 +00:00
Matthew MeszarosandDevin AI 849cf18f55 feat: bind password recovery, invitations, mailbox and integration OAuth, referral and billing returns to trusted initiating dashboards 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:51:37 +00:00
Matthew Meszaros b2bde4ed92 Merge pull request #840 from warmbly/devin/1791198671-admin-health-notices 
feat: correct admin setup and health notices and add safe invitation cleanup
 2026-10-05 12:35:00 +00:00
Matthew MeszarosandDevin AI caa1633dac feat: verify main and TAC assessment dashboard origins share configurable backend CORS and OAuth routing 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:24:11 +00:00
Matthew MeszarosandDevin AI 6a5d76004a feat: cover Google reauthorization origin rejection and unchanged Microsoft routing with clearer error documentation 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:20:28 +00:00
Matthew MeszarosandDevin AI f58a6c1ff9 feat: control Gmail mailbox OAuth per frontend deployment and bind callbacks to allowlisted dashboard origins 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:16:34 +00:00
Matthew MeszarosandDevin AI f56278488f feat: keep worker farewell heartbeats independent of IP discovery and identify CPU-set resource scope accurately 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 11:43:16 +00:00
Matthew MeszarosandDevin AI 5ae09e0e15 feat: separate fleet mailbox targets from measured CPU and RAM, report node public egress IPv4 and add workload share analytics 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 11:24:32 +00:00
Matthew MeszarosandDevin AI ded4e5f700 feat: correct split-host admin health checks and registration notices, distinguish informational context from problems, and add audited expired-invitation cleanup 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 11:17:13 +00:00
Matthew Meszaros 4e59bfd4d5 Merge pull request #839 from warmbly/feature/admin-redesign 
feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link
 2026-10-05 10:26:14 +00:00
Matthew Meszaros 1de33d9f41 feat: guard configuration tab links against losing unsaved edits, keep the login captcha mounted for resend, confirm warmup appeal decisions by mailbox, show header tabs only on section pages, show the update pill in the mobile drawer, make admin sign-in alerts opt-in per channel, check the admin bit before loading the account, and alert on admin access only when it changes 2026-10-05 03:21:44 -07:00
Matthew Meszaros d6533a4aa5 Merge pull request #838 from warmbly/devin/1791190573-release-pages-dashboard 
feat: deploy configured Cloudflare Pages projects only after stable releases
 2026-10-05 10:01:26 +00:00
Matthew Meszaros e506544119 Merge origin/main into feature/admin-redesign 2026-10-05 03:01:22 -07:00
Matthew Meszaros 8910b02198 feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link 2026-10-05 03:01:22 -07:00
Matthew Meszaros 549a0f7293 Merge pull request #833 from warmbly/devin/1791173929-safari-oauth-popups 
fix: open OAuth sign-in windows inside the click so Safari stops blocking them, and keep listening when one is blocked
 2026-10-05 10:00:02 +00:00
Matthew MeszarosandDevin AI a865db3386 feat: deploy configurable Cloudflare Pages project lists from exact releases with isolated dashboard, admin, site and docs builds 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 09:48:40 +00:00
Matthew MeszarosandDevin AI 94cd8b1692 feat: reuse Cloudflare Pages production configuration for exact-release dashboard builds and cover safe runtime imports in CI 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 09:14:37 +00:00
Matthew MeszarosandDevin AI e7b6877ba4 feat: deploy the dashboard to the existing Cloudflare Pages production project only after stable releases with opt-in configuration and cutover docs 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 09:00:34 +00:00
Matthew Meszaros 01aae25483 Merge pull request #834 from warmbly/devin/1791174213-turnstile-trusted-device 
feat: light, input-width Turnstile, one captcha per sign-in, and opt-in remembered devices
 2026-10-05 08:37:40 +00:00
Matthew Meszaros 76ae0fcef2 Merge remote-tracking branch 'origin/main' into devin/1791173929-safari-oauth-popups 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

# Conflicts:
#	web/src/router.tsx
 2026-10-05 06:10:59 +00:00
Matthew Meszaros 38f1cdb517 Merge remote-tracking branch 'origin/main' into devin/1791174213-turnstile-trusted-device 2026-10-05 05:58:16 +00:00
Matthew Meszaros e8a9dbc810 Merge pull request #837 from warmbly/devin/1791175783-slack-link-auto-and-oidc 
feat: auto-link Slack members by email, Continue with Slack for mismatched emails, standalone /slack/link page
 2026-10-05 05:56:40 +00:00
Matthew MeszarosandDevin AI 9eb109559f feat: send OAuth sign-in windows that lost their opener (allowed from a blocked-popup prompt) back to the waiting dashboard tab via a new /oauth-return page and same-origin BroadcastChannel, marking dashboard-started mailbox states so the native app keeps its warmbly:// callback 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:40:23 +00:00
Matthew MeszarosandDevin AI 55d1b9a634 feat: link Slack members to Warmbly automatically by matching email, add Continue with Slack (Sign in with Slack) for mismatched emails, and move the Slack link page to a standalone /slack/link screen 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:00:22 +00:00
Matthew Meszaros cbee2d3073 feat: answer a node heartbeat sent with INTERNAL_API_TOKEN where NODE_BROKER_TOKEN is required with the node's desired version only, recording nothing, through NodeHeartbeatAuthMiddleware and fleetnode UpdateOnly, so a node on an older release always updates itself onto the broker token without NODE_ACCEPT_INTERNAL_TOKEN, and say so in the configuration and split-deployment docs 2026-10-05 06:54:31 +02:00
Matthew MeszarosandDevin AI e77e2dd98b feat: light, input-width Turnstile on the auth screens, one captcha per sign-in instead of a second one on the code step, and an opt-in 30-day remembered device that skips the emailed login code with a random server-hashed account-bound token, revoked on password reset or change and on signing out everywhere or other sessions 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 04:32:15 +00:00
Matthew Meszaros 36149cdebd feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer 2026-10-04 19:20:48 +02:00
Matthew Meszaros f23c04ddd8 Merge remote-tracking branch 'origin/main' into feature/slack-app-agent 
# Conflicts:
#	deploy/slack/manifest.json
#	docs/content/docs/development/slack-app.mdx
#	docs/content/docs/guides/slack.mdx
#	internal/app/integration/slack.go
#	internal/app/slackapp/agent.go
#	internal/app/slackapp/client.go
#	internal/app/slackapp/slackapp_test.go
#	web/src/lib/integrations/oauthPopup.ts
 2026-10-04 06:54:19 -07:00
Matthew Meszaros f092b71a30 feat: answer a spent confirmation budget with reauth_limited and say so in the dashboard and admin dialogs, keep an open confirmation dialog from timing out under the person, and stop the OAuth app webhook secret reveal from re-prompting after a cancel 2026-10-04 05:25:32 -07:00
Matthew Meszaros 3de01f25b3 feat: gate MCP and /ai/tools per tool for keys and tokens, with AI_AGENT on the web and playbook tools, and require use_ai for member sessions on /ai/tools 2026-10-04 05:21:18 -07:00
Matthew Meszaros 8cb5893e37 feat: keep accepting API keys and OAuth tokens in the realtime socket URL as a deprecated fallback for existing clients, preferring the x-warmbly-token header and keeping the value out of logs 2026-10-04 05:20:20 -07:00
Matthew Meszaros c178dadf81 feat: keep the key and blob brokers on NODE_BROKER_TOKEN only, and let an operator admit INTERNAL_API_TOKEN on the other node routes with NODE_ACCEPT_INTERNAL_TOKEN=true while nodes joined before the split upgrade 2026-10-04 05:18:01 -07:00
Matthew Meszaros a6e72f1a92 feat: keep linking and unlinking Warmbly Cloud and adopting the cloud workspace's mailboxes with the instance administrator, and let members with manage_emails read the link and put their own workspace's mailboxes on it 2026-10-04 05:17:20 -07:00
Matthew Meszaros cbf0667d8f feat: hold every API key to its creator's current workspace role on each gated route and AI tool, and stop a key, including on the realtime socket, once its creator leaves the workspace (api_key_holder_left) 2026-10-04 05:15:30 -07:00
Matthew Meszaros 801c87ffe1 feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup 2026-10-04 05:15:07 -07:00
Matthew Meszaros 5d4b0ad6e5 feat: hold the invite_member, update_member_role and rotate_webhook_secret AI tools to the same recent confirmation their REST routes require, answering reauth_required on /ai/tools and refusing them where no confirmed session exists 2026-10-04 05:14:30 -07:00
Matthew Meszaros aca1aff4d6 feat: count a completed sign-in as a fresh confirmation for the first five minutes of the session, so accounts with no password or second factor can confirm an action by signing in again 2026-10-04 05:13:23 -07:00
Matthew Meszaros b9b13344b4 feat: remember the refresh token each OAuth grant last rotated away from (migration 000261) and revoke the grant when that token is presented again, whether in a race or after the rotation finished 2026-10-04 03:49:13 -07:00
Matthew Meszaros 663c3013d1 feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization 2026-10-04 03:45:02 -07:00
Matthew Meszaros a6b72299ae feat: store workspace invitation tokens only as SHA-256 digests (migration 000260 converts pending ones), mint a separate link token each time a manager copies an invite link so the emailed link keeps working, and resolve invitations by either digest 2026-10-04 03:37:41 -07:00
Matthew Meszaros 497f58bb5a feat: hold a mailbox-limited API key to explicit sender lists of its own mailboxes when it creates, edits or starts a campaign, and refuse it on /ai/tools and /mcp, which act across the workspace, with api_key_mailbox_limited 2026-10-04 03:24:25 -07:00
Matthew Meszaros 48c65611b5 feat: require view_contacts / READ_CONTACTS for an AI variable preview rendered against a named contact, matching test sends and template previews 2026-10-04 03:22:09 -07:00
Matthew Meszaros 137f7359ff feat: accept an A/B variant's step_id only when the step belongs to the campaign named in the path 2026-10-04 03:22:09 -07:00
Matthew Meszaros 1c555934a5 feat: authorize warmup ban status and warmup appeals by the caller's organization and its view_campaigns / manage_emails gates, so any member who manages mailboxes can appeal, answering 404 for a mailbox outside the workspace 2026-10-04 03:22:09 -07:00
Matthew Meszaros 6c36be44aa feat: require the actor to hold every permission a role edit, re-role or member removal takes away as well as every one it grants, matching role deletion, with the workspace owner holding all permissions 2026-10-04 03:22:09 -07:00
Matthew Meszaros 5f180f5c76 feat: hold an API key with allowed_email_accounts to its mailboxes across the unibox (list, thread, message, count and overview reads; compose with auto pick within the list, drafts, agent-draft approve and discard, seen, folder, labels and snooze writes), campaign sender pools, analytics account statuses and GET /analytics/accounts/:id, and store a compose draft's mailbox only when it belongs to the caller's organization 2026-10-04 03:22:09 -07:00
Matthew Meszaros 043d877b58 feat: let one organization per instance verify a custom tracking host across mailbox and campaign tracking domains (database trigger plus 409 tracking_domain_taken on save, verify, sending-domain apply and bulk setup; the sweep leaves a held host unverified), and re-verify tracking domains on the destination after a workspace import 2026-10-04 03:22:02 -07:00
Matthew Meszaros 9d461ad40e feat: gate advisor apply and undo on view_analytics / READ_ANALYTICS and run the fix as the caller: a member under their org permissions, or an API key or OAuth grant under its own scope mask, with a fix for a mailbox outside the key's allowlist refused 2026-10-04 03:21:58 -07:00