starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-10-06 08:02:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,296 Commits 3 Branches 80 Tags
e8a9dbc8104cf798dfdecc1cfb43331c0cab3ca5
Commit Graph
1144 Commits
Author SHA1 Message Date
Matthew MeszarosandDevin AI 1d06475e44 feat: add qa/flows/slack-link.flow.ts proof flow for the standalone /slack/link page and raise contrast of its expiry, account labels and footer links, hiding the decorative Slack glyph from the Continue with Slack button name 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:38:51 +00:00
Matthew MeszarosandDevin AI 55d1b9a634 feat: link Slack members to Warmbly automatically by matching email, add Continue with Slack (Sign in with Slack) for mismatched emails, and move the Slack link page to a standalone /slack/link screen 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 05:00:22 +00:00
Matthew MeszarosandDevin AI b54b840bd1 Merge origin/main into refactor/dashboard-tanstack-start-spa 
Port the Pipedrive CRM work onto TanStack Router: add the
integrations/pipedrive route, move ConnectionDetail, CrmSettings and
crmMode off react-router-dom, and drop hubspotCrm.tsx (replaced by
crmMode.tsx on main).

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-04 18:17:21 +00:00
Matthew Meszaros b828723889 feat: keep the dashboard unibox loader to a cold cache so opening a thread never reloads the list, retry a dashboard boot that failed, undo optimistic edits only where the cache still holds them, hold blocked navigations during the unsaved-changes confirm, keep shell scroll offsets apart from list offsets, share the label count query, and trim new comments 2026-10-04 10:59:19 -07:00
Matthew Meszaros 7980079f3e feat: move the dashboard to TanStack Router with lazy route chunks, hover preloading, route loaders that prefetch each page's data, a parallel session boot behind an app-frame skeleton, self-hosted preloaded Inter to end the load flash, and optimistic updates for frequent mailbox, campaign, CRM, label and template actions 2026-10-04 10:38:14 -07:00
Matthew Meszaros 36149cdebd feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer 2026-10-04 19:20:48 +02:00
Matthew Meszaros a993c0f97a feat: keep the integration OAuth start request's failure handled when the connect window was closed before it answered 2026-10-04 07:15:08 -07:00
Matthew Meszaros 06c2bdb6e1 feat: link the Slack installer in the background so the OAuth callback never waits on Slack, and fail the integration connect popup as soon as its window is closed while the authorization URL is still loading 2026-10-04 07:10:33 -07:00
Matthew Meszaros f23c04ddd8 Merge remote-tracking branch 'origin/main' into feature/slack-app-agent 
# Conflicts:
#	deploy/slack/manifest.json
#	docs/content/docs/development/slack-app.mdx
#	docs/content/docs/guides/slack.mdx
#	internal/app/integration/slack.go
#	internal/app/slackapp/agent.go
#	internal/app/slackapp/client.go
#	internal/app/slackapp/slackapp_test.go
#	web/src/lib/integrations/oauthPopup.ts
 2026-10-04 06:54:19 -07:00
Matthew Meszaros 4bd5c1283c feat: refuse assistant connect links for integrations this instance has no credentials for, give a second OAuth account the first free label so it never replaces another account's connection, open the integration OAuth window inside the click so browsers do not block it, and stub the Slack test repository so link prompts run with APP_URL set 2026-10-04 05:32:44 -07:00
Matthew Meszaros f092b71a30 feat: answer a spent confirmation budget with reauth_limited and say so in the dashboard and admin dialogs, keep an open confirmation dialog from timing out under the person, and stop the OAuth app webhook secret reveal from re-prompting after a cancel 2026-10-04 05:25:32 -07:00
Matthew Meszaros c5ff613c5d feat: start the invite-link clipboard write inside the click so Safari keeps the gesture, say that earlier copied links stop working, and show the new link when the copy fails 2026-10-04 05:23:16 -07:00
Matthew Meszaros df0949a019 feat: mask invite and next URL parameters in dashboard and admin analytics, clear a copied invite link when the invitation is sent again, and read hex.info's newest stable release without consuming the gate's package list 2026-10-04 05:22:40 -07:00
Matthew Meszaros a6e72f1a92 feat: keep linking and unlinking Warmbly Cloud and adopting the cloud workspace's mailboxes with the instance administrator, and let members with manage_emails read the link and put their own workspace's mailboxes on it 2026-10-04 05:17:20 -07:00
Matthew Meszaros 801c87ffe1 feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup 2026-10-04 05:15:07 -07:00
Matthew Meszaros 663c3013d1 feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization 2026-10-04 03:45:02 -07:00
Matthew Meszaros 43a9d004f2 feat: bound user-authored templates (range only over data fields, two-deep nesting, no template calls, 1 MiB output, capped compile cache) for campaign and automation rendering, accept only single addresses and single Message-IDs for to/cc/bcc/in_reply_to on every send path with invalid_recipient and invalid_message_id, refuse multi-line headers in the Gmail, Graph and SMTP writers, always apply a no-script CSP and drop non-http(s)/mailto/tel link targets in email previews, treat only single-slash paths as internal Remie links, accept integration OAuth callbacks only from the API origin, and follow only http(s) form redirects and app install links 2026-10-04 03:02:37 -07:00
Matthew Meszaros f9a2e9af10 feat: state dependency floors, the Sentry HTTP client choice and auth cache budgets as the guarantees they hold, with no advisory identifiers or past behaviour in comments 2026-10-04 03:00:56 -07:00
Matthew Meszaros bf47984cd5 feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations 2026-10-04 02:59:10 -07:00
Matthew Meszaros 8bb60e9449 feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers 2026-10-04 02:58:43 -07:00
Matthew Meszaros 32da32a0a8 feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match 2026-10-04 02:57:17 -07:00
Matthew Meszaros 2bc7ef55f1 feat: mount the confirm-it-is-you prompt on the standalone pool link connect page so approving an instance link can complete its required recent confirmation outside the dashboard layout 2026-10-04 02:56:18 -07:00
Matthew Meszaros 5bd8dbfab9 feat: bind Warmbly Cloud brokered mailbox sign-ins to PKCE, a single-use state and a cloud consent page naming the requesting instance and workspace that sets the browser cookie the callback requires, return only to the instance's registered address, add PKCE and an OIDC nonce to Workspace and Microsoft 365 admin-proof sign-ins, post OAuth callback codes only to a configured dashboard origin, cap CLI-approved keys to the approver's role behind a fresh sign-in, and accept only same-origin login next paths 2026-10-04 02:53:16 -07:00
Matthew Meszaros f0ec39febd feat: scope automation and sequence unsubscribes to the caller's organization, require manage_settings to create, edit, enable or delete automations, run each integration action only on its own provider's connection (400 action_provider_mismatch), refuse org-permission gates when no organization service is wired, read /integrations/bookings like contacts, scope lead claims, research runs and CRM list cursors to the organization, and bind contact note edits to the contact in the path 2026-10-04 02:47:10 -07:00
Matthew Meszaros e1c4a91ad1 feat: confirm a Slack link only for the Warmbly member whose email matches the Slack account's confirmed profile email (read via users.info with the new users:read and users:read.email scopes, refused as slack_link_email_mismatch), show the Slack account's name and avatar on the link page and after linking, return the Slack connection in GET /integrations/slack/status only to manage_settings or use_integrations, scope agent-thread lookups by organization, and check a Draft a reply card's conversation belongs to the clicker's workspace before starting the assistant 2026-10-04 02:45:04 -07:00
Matthew Meszaros 23c57f35c2 Merge pull request #822 from warmbly/feature/integrations-page-redesign 
feat: turn Integrations into an app store with search, filters and app pages, add a link-only community directory, a new OAuth app registration dialog, per-app re-encoded logos and admin moderation for OAuth apps
 2026-10-04 08:27:13 +00:00
Matthew Meszaros d505508997 feat: audit OAuth app moderation and developer blocks under their own entity types, refuse logo removal on suspended apps, delete a replaced workspace-uploaded app logo once no other app shows it, confirm before revoking every token in the admin panel, open store cards on Space, retry a new logo URL after a failed one, toast only after the clipboard write succeeds, and freeze the listing form baseline while it is open 2026-10-04 01:20:28 -07:00
Matthew Meszaros bc9caba267 feat: validate OAuth app names through displayname and websites as http(s), clean dynamically registered client names and stop storing their logo_uri, refuse edits and logo uploads on suspended apps or blocked developers, scope logo deletion to the app's own images, keep hidden listings from being unpublished, count only installs from other aged workspaces toward the directory threshold, refresh integration popularity outside the lock, and count only live connections in the Integrations store 2026-10-04 01:10:39 -07:00
Matthew Meszaros 2983d3ca1e Merge pull request #823 from warmbly/feat/remie-assistant 
feat: Remie, the dashboard AI assistant: animated blob mark, floating panel, live run UI, and Advisor-driven suggestions and tips
 2026-10-04 07:59:05 +00:00
Matthew Meszaros 6565197a60 feat: close Remie tips through useClickOutside and put them away when a dialog opens, reset hover on close, read Advisor findings only under View analytics, keep a typed draft when a fix is handed to Remie, celebrate only runs that end without an error or a stop, group suggestions with the Advisor's groupFindings, count the tip day in local time, and scope the dev demo to its own approvals 2026-10-04 00:49:08 -07:00
Matthew Meszaros 1a483cb27f Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign 
# Conflicts:
#	internal/app/integration/service.go
#	web/src/app/app/integrations/page.tsx
#	web/src/hooks/useDocumentTitle.ts
 2026-10-04 00:45:48 -07:00
Matthew Meszaros 7672924a72 feat: rename the dashboard assistant to Remie with an animated blue blob mark, open it as a floating window by default, show live runs with a shimmering status, elapsed timer, collapsible tool-step trace, streamed text with a blurred tail and a redesigned approval card, and add Remie suggestions and rate-limited tips built from open Advisor findings that Remie fixes through its own approvals 2026-10-04 00:36:27 -07:00
Matthew Meszaros 4bc2417618 Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign 
# Conflicts:
#	docs/content/docs/api/error-codes.mdx
#	docs/content/docs/guides/integrations.mdx
#	web/src/app/app/integrations/page.tsx
 2026-10-04 00:32:54 -07:00
Matthew Meszaros 7555f641a5 feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps 2026-10-04 00:31:52 -07:00
Matthew Meszaros d112657cf2 feat: wire suppression, subscription and hold dependencies into the consumer's Salesforce service, give Salesforce token refreshes their own single-flight keyspace, release the outbox lease in memory after each terminal write so writeback notes land and only on rows with a logged Task, drop stale Salesforce import previews, keep keys from the import row menu from opening the edit dialog, and document the Salesforce callback URL and OAuth variables 2026-10-04 09:10:37 +02:00
Matthew Meszaros 6b7e254e56 feat: add native Salesforce sync with Lead and Contact matching and links, a leased activity outbox that logs sends, replies, bounces, opt-outs and meetings as Tasks, Lead Status and Email Opt Out writeback, a pull loop with CRM pause rules, list view and Campaign imports, sandbox and My Domain OAuth that refreshes expired sessions, a Salesforce settings page with contact and inbox cards in web, and docs 2026-10-04 08:54:27 +02:00
Matthew Meszaros 37e91fc89f feat: add HubSpot CRM mode where HubSpot deals, pipelines, tasks, notes and owners are mirrored and written through, sends and replies log as HubSpot emails, exit rules hold campaigns, list import, sync health, setup wizard in web, HubSpot app project with record card and workflow action, and docs 2026-10-04 07:47:51 +02:00
Matthew Meszaros 75840247c8 feat: replace the stored Outlook admin approval link on every Outlook sign-in start in useMailboxOAuth, clearing it when the start response carries none 2026-10-03 20:33:53 +02:00
Matthew Meszaros 8883a1df6b feat: connect Microsoft 365 organizations through Microsoft's v2.0 admin consent page followed by a sign-in on the same state, read the approving admin's directory role from the Graph token as well as the ID token, return an organization-wide approval link for single-mailbox Outlook sign-in (admin_consent_url) and show it in the connect panel, and document publisher verification and the admin approval path 2026-10-03 20:17:38 +02:00
Matthew Meszaros 92456279ed Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign 2026-10-03 09:24:34 -07:00
Matthew Meszaros 4957214431 feat: redesign the Integrations page with search, category chips, recommended and popularity-ranked integrations, add a community app directory where OAuth apps are published unverified by link and verified in a new admin review queue, with docs and OpenAPI 2026-10-03 09:24:34 -07:00
Matthew Meszaros f05bd572d2 feat: repaint dither charts on a theme switch, apply cross-tab theme changes from the current storage value without writing them back, treat HTML colour attributes as designed mail, keep editor dark text to light inline fills, and give the step button spinner its colour 2026-10-03 08:58:36 -07:00
Matthew Meszaros 232d226211 Merge remote-tracking branch 'origin/main' into feat/dark-theme 2026-10-03 08:49:37 -07:00
Matthew Meszaros f1e3ea5bd9 feat: add a Linear-style dark theme to the dashboard (web/) with Light, Dark and System options in the user menu, Settings > Profile > Appearance and the command palette, light by default, and an Appearance guide in docs 2026-10-03 08:49:37 -07:00
Matthew Meszaros 61d16dfe9a feat: add Warmbly for Slack with the AI assistant in DMs, mentions and the assistant pane, unified inbox threads with reply, AI draft and lead actions, per-category notification routing and DMs, account linking, dashboard Slack settings, manifest and docs 2026-10-03 15:35:11 +02:00
Matthew Meszaros c3da0d684b Merge pull request #805 from Skylinerffm97/feat/unibox-long-press-menu 
feat(unibox): open the row menu on a long press on touch screens
 2026-10-03 07:57:35 +00:00
Matthew Meszaros c84368f2c4 feat: ignore Android's native contextmenu in useAnchoredMenu once a touch press has moved past the 10 px drift, so a scroll that stalls on a unibox row never opens its menu, with a hook test for the moved press 2026-10-03 08:59:01 +02:00
Claude 3288238cc0 feat: paginate and batch GET /analytics/accounts so account status reads are bounded per page and the overflow past 1000 mailboxes is reachable via cursor 2026-10-03 06:46:20 +00:00
Matthew Meszaros a184877cc7 Merge pull request #802 from Skylinerffm97/fix/click-outside-iframe-taps-ios 
fix(web): close dropdowns on a tap inside the email body on iOS Safari
 2026-10-03 05:11:54 +00:00
Matthew Meszaros 9ef54798dc Merge pull request #804 from Skylinerffm97/fix/unibox-mark-unread 
fix(unibox): make Mark as unread stick, and let it reach a sent-only conversation
 2026-10-03 05:11:39 +00:00