starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-10-06 00:02:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,296 Commits 2 Branches 80 Tags
e8a9dbc8104cf798dfdecc1cfb43331c0cab3ca5
Commit Graph
3296 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Matthew Meszaros e8a9dbc810 Merge pull request #837 from warmbly/devin/1791175783-slack-link-auto-and-oidc 
feat: auto-link Slack members by email, Continue with Slack for mismatched emails, standalone /slack/link page
 2026-10-05 05:56:40 +00:00
Matthew Meszaros 53dea06fe1 Merge pull request #835 from warmbly/devin/1791174729-signup-session 
fix: keep a new account signed in when the post-signup sign-in is slow, and report it when it fails
 2026-10-05 05:56:23 +00:00
Matthew MeszarosandDevin AI 1d06475e44 feat: add qa/flows/slack-link.flow.ts proof flow for the standalone /slack/link page and raise contrast of its expiry, account labels and footer links, hiding the decorative Slack glyph from the Continue with Slack button name 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:38:51 +00:00
Matthew MeszarosandDevin AI 5e6047198c feat: sign a new account in after signup on its own 10s context detached from the request in sessionForNewAccount (internal/app/auth/registration.go), report a failed post-signup sign-in to Sentry instead of dropping it, and record that session under the email auth provider 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:35:31 +00:00
Matthew Meszaros ce99b9b162 Merge pull request #836 from warmbly/feat/node-heartbeat-update-path 
feat: node heartbeat update path survives a node token change
 2026-10-05 05:07:07 +00:00
Matthew MeszarosandDevin AI 55d1b9a634 feat: link Slack members to Warmbly automatically by matching email, add Continue with Slack (Sign in with Slack) for mismatched emails, and move the Slack link page to a standalone /slack/link screen 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:00:22 +00:00
Matthew Meszaros cbee2d3073 feat: answer a node heartbeat sent with INTERNAL_API_TOKEN where NODE_BROKER_TOKEN is required with the node's desired version only, recording nothing, through NodeHeartbeatAuthMiddleware and fleetnode UpdateOnly, so a node on an older release always updates itself onto the broker token without NODE_ACCEPT_INTERNAL_TOKEN, and say so in the configuration and split-deployment docs 2026-10-05 06:54:31 +02:00
Matthew Meszaros 7be5b82568 Merge pull request #832 from warmbly/devin/war-10-fix-security-workflow 
fix(security): unblock security workflow on main (jwt-go CVE, Rust audit)
 2026-10-05 04:38:59 +00:00
Matthew MeszarosandDevin AI 5301e79d84 ci: don't fail Go CI when codecov upload crashes 
codecov-action v4 can throw (e.g. TLS EPROTO fetching the CLI) before
fail_ci_if_error applies, which failed the merge-queue run for #832.

Refs WAR-10

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 04:22:42 +00:00
Matthew MeszarosandDevin AI 0ea856537e fix(security): drop jwt-go via first-party Apple auth, bump yoke-derive, grant checks:write to rust audit 
Refs WAR-10

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 18:36:28 +00:00
Matthew Meszaros 7e8bad00e6 Merge pull request #830 from warmbly/refactor/dashboard-tanstack-start-spa 
feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent actions
 2026-10-04 18:21:33 +00:00
Matthew MeszarosandDevin AI b54b840bd1 Merge origin/main into refactor/dashboard-tanstack-start-spa 
Port the Pipedrive CRM work onto TanStack Router: add the
integrations/pipedrive route, move ConnectionDetail, CrmSettings and
crmMode off react-router-dom, and drop hubspotCrm.tsx (replaced by
crmMode.tsx on main).

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 18:17:21 +00:00
Matthew Meszaros 211cf76230 Merge pull request #831 from warmbly/devin/1791136163-skip-onboarding-seeded-accounts 
fix: skip the onboarding wizard for seeded, sandbox, bootstrap, and warmblyctl-created accounts
 2026-10-04 18:12:49 +00:00
Matthew MeszarosandDevin AI 4da11c4933 fix: keep bootstrap provisioning the owner's org and admin when marking onboarding fails 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 18:01:53 +00:00
Matthew Meszaros b828723889 feat: keep the dashboard unibox loader to a cold cache so opening a thread never reloads the list, retry a dashboard boot that failed, undo optimistic edits only where the cache still holds them, hold blocked navigations during the unsaved-changes confirm, keep shell scroll offsets apart from list offsets, share the label count query, and trim new comments 2026-10-04 10:59:19 -07:00
Matthew MeszarosandDevin AI acb5b8f9f4 fix: skip the onboarding wizard for seeded, sandbox, bootstrap, and warmblyctl-created accounts 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 17:49:23 +00:00
Matthew Meszaros 7980079f3e feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent mailbox, campaign, CRM, label and template actions 2026-10-04 10:38:14 -07:00
Matthew Meszaros 02ada198ea Merge pull request #829 from warmbly/feature/pipedrive-crm-integration 
feat: Pipedrive CRM mode and integration popups
v0.6.27 		2026-10-04 17:32:22 +00:00
Matthew Meszaros 36149cdebd feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer 2026-10-04 19:20:48 +02:00
Matthew Meszaros bb74f41f86 Merge pull request #828 from warmbly/devin/1791122781-privacy-ico-number 
feat: add ICO registration reference to the privacy policy
 2026-10-04 15:09:38 +00:00
Matthew Meszaros ea3341358f Merge pull request #826 from warmbly/feature/slack-app-agent 
feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup
 2026-10-04 14:19:44 +00:00
Matthew Meszaros a993c0f97a feat: keep the integration OAuth start request's failure handled when the connect window was closed before it answered 2026-10-04 07:15:08 -07:00
Matthew Meszaros 06c2bdb6e1 feat: link the Slack installer in the background so the OAuth callback never waits on Slack, and fail the integration connect popup as soon as its window is closed while the authorization URL is still loading 2026-10-04 07:10:33 -07:00
Matthew MeszarosandDevin AI e9430e96d1 feat: add Mindroot Ltd's ICO data protection fee registration reference ZB958997 to the Who we are section of the privacy policy and bump its last updated date 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 14:06:30 +00:00
Matthew Meszaros f23c04ddd8 Merge remote-tracking branch 'origin/main' into feature/slack-app-agent 
# Conflicts:
#	deploy/slack/manifest.json
#	docs/content/docs/development/slack-app.mdx
#	docs/content/docs/guides/slack.mdx
#	internal/app/integration/slack.go
#	internal/app/slackapp/agent.go
#	internal/app/slackapp/client.go
#	internal/app/slackapp/slackapp_test.go
#	web/src/lib/integrations/oauthPopup.ts
 2026-10-04 06:54:19 -07:00
Matthew Meszaros 2dc7e33da9 Merge pull request #827 from warmbly/chore/casa-al1-reassessment 
feat: hold every credential, session and workspace boundary to the CASA AL1 controls across authentication, sessions, access control, OAuth, the AI assistant, crypto, input handling and configuration
 2026-10-04 12:58:08 +00:00
Matthew Meszaros 4bd5c1283c feat: refuse assistant connect links for integrations this instance has no credentials for, give a second OAuth account the first free label so it never replaces another account's connection, open the integration OAuth window inside the click so browsers do not block it, and stub the Slack test repository so link prompts run with APP_URL set 2026-10-04 05:32:44 -07:00
Matthew Meszaros f092b71a30 feat: answer a spent confirmation budget with reauth_limited and say so in the dashboard and admin dialogs, keep an open confirmation dialog from timing out under the person, and stop the OAuth app webhook secret reveal from re-prompting after a cancel 2026-10-04 05:25:32 -07:00
Matthew Meszaros 4b09d03482 feat: treat the workspace owner as holding every permission when the HubSpot card resolves its matched member 2026-10-04 05:23:49 -07:00
Matthew Meszaros fd940d905b feat: answer a click on a Slack approval card that carries no tool call with a private note to ask again or approve in the dashboard 2026-10-04 05:23:36 -07:00
Matthew Meszaros c5ff613c5d feat: start the invite-link clipboard write inside the click so Safari keeps the gesture, say that earlier copied links stop working, and show the new link when the copy fails 2026-10-04 05:23:16 -07:00
Matthew Meszaros df0949a019 feat: mask invite and next URL parameters in dashboard and admin analytics, clear a copied invite link when the invitation is sent again, and read hex.info's newest stable release without consuming the gate's package list 2026-10-04 05:22:40 -07:00
Matthew Meszaros 5083bcbd54 feat: carry webhook and OAuth app signing secrets still stored as whsec_ plaintext into a workspace export as is, so they arrive sealed under the destination key instead of blank 2026-10-04 05:21:56 -07:00
Matthew Meszaros 79bf9a15c4 feat: refuse a pasted list of addresses where one recipient address is expected, so no listed recipient is silently dropped 2026-10-04 05:21:36 -07:00
Matthew Meszaros 3de01f25b3 feat: gate MCP and /ai/tools per tool for keys and tokens, with AI_AGENT on the web and playbook tools, and require use_ai for member sessions on /ai/tools 2026-10-04 05:21:18 -07:00
Matthew Meszaros 8cb5893e37 feat: keep accepting API keys and OAuth tokens in the realtime socket URL as a deprecated fallback for existing clients, preferring the x-warmbly-token header and keeping the value out of logs 2026-10-04 05:20:20 -07:00
Matthew Meszaros ab39429e37 feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS 2026-10-04 05:19:22 -07:00
Matthew Meszaros c178dadf81 feat: keep the key and blob brokers on NODE_BROKER_TOKEN only, and let an operator admit INTERNAL_API_TOKEN on the other node routes with NODE_ACCEPT_INTERNAL_TOKEN=true while nodes joined before the split upgrade 2026-10-04 05:18:01 -07:00
Matthew Meszaros a6e72f1a92 feat: keep linking and unlinking Warmbly Cloud and adopting the cloud workspace's mailboxes with the instance administrator, and let members with manage_emails read the link and put their own workspace's mailboxes on it 2026-10-04 05:17:20 -07:00
Matthew Meszaros af1c6cdfcd feat: let a workspace import keep references that name another workspace's row by design (warmup partners, placement seeds, third-party OAuth apps) while every other reference must resolve to the importing workspace 2026-10-04 05:16:14 -07:00
Matthew Meszaros cbf0667d8f feat: hold every API key to its creator's current workspace role on each gated route and AI tool, and stop a key, including on the realtime socket, once its creator leaves the workspace (api_key_holder_left) 2026-10-04 05:15:30 -07:00
Matthew Meszaros 801c87ffe1 feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup 2026-10-04 05:15:07 -07:00
Matthew Meszaros 5d4b0ad6e5 feat: hold the invite_member, update_member_role and rotate_webhook_secret AI tools to the same recent confirmation their REST routes require, answering reauth_required on /ai/tools and refusing them where no confirmed session exists 2026-10-04 05:14:30 -07:00
Matthew Meszaros aca1aff4d6 feat: count a completed sign-in as a fresh confirmation for the first five minutes of the session, so accounts with no password or second factor can confirm an action by signing in again 2026-10-04 05:13:23 -07:00
Matthew Meszaros b9b13344b4 feat: remember the refresh token each OAuth grant last rotated away from (migration 000261) and revoke the grant when that token is presented again, whether in a race or after the rotation finished 2026-10-04 03:49:13 -07:00
Matthew Meszaros 8b842bd6f7 feat: give the mailbox erasure live test's snooze fixture its organization, which unibox_snoozes now requires 2026-10-04 03:48:12 -07:00
Matthew Meszaros 663c3013d1 feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization 2026-10-04 03:45:02 -07:00
Matthew Meszaros 886756ae0f feat: share one api_key_mailbox_limited code and keyMailboxLimited check across the campaign, AI tool and MCP handlers 2026-10-04 03:43:26 -07:00
Matthew Meszaros b9d96825a2 feat: require an admin to hold every admin permission a grant or revoke takes away from another admin, and keep the last super admin through a grant that would replace the role 2026-10-04 03:43:10 -07:00
Matthew Meszaros 3a360ad422 feat: list golang.org/x/sync as a direct dependency in go.mod, matching the singleflight import in internal/app/integration 2026-10-04 03:42:48 -07:00