starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-10-13 16:02:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,611 Commits 41 Branches 99 Tags
ec46f57d229ae430e2570e40cd0bc3c140daad7e
Commit Graph
549 Commits
Author SHA1 Message Date
Matthew Meszaros ec46f57d22 feat: redesign the iOS app (inbox with inbox agent drafted replies edited in the full composer, Remie, home, analytics, CRM, contacts, settings hubs, mailbox connect flow covering every dashboard source) and replace Turnstile in the app with Apple App Attest (attested keys in app_attest_keys, challenge and key endpoints, verifyHuman gate on login, registration and password reset, auth config flag, docs and OpenAPI) 2026-10-11 19:00:50 +02:00
Matthew Meszaros 9712ea5262 Merge pull request #926 from warmbly/devin/1791630200-combined-restricted-member-security 
feat: close all restricted-member data leaks and resource-scope escapes
 2026-10-10 12:07:57 +00:00
Devin AI 9a45259527 feat: release failed filing commands only after exact backend proof of pending durable recovery while preserving acknowledgements and legacy retries 2026-10-10 11:52:47 +00:00
Matthew Meszaros a581225102 feat: restrict auth and unibox category registries and thread labels to mailbox grants and constrain email cursors by organization and allowed mailboxes 2026-10-10 10:54:59 +00:00
Devin AI 3eef4399c3 feat: redact campaign activity metadata and embedded mailbox details against caller grants and count dashboard campaigns after grant intersection 2026-10-10 10:54:59 +00:00
Matthew Meszaros 314223345e feat: enforce grant-scoped organization summaries and account-wide workspace creation with target membership checks for limit requests 2026-10-10 10:54:59 +00:00
Matthew Meszaros 21b56fce08 Merge pull request #921 from warmbly/devin/1791619490-retire-stale-mailbox-sync 
feat: retire stale mailbox generations on authoritative ownership loss without acknowledging arrivals
 2026-10-10 08:30:04 +00:00
Matthew MeszarosandDevin AI f2876f1fc9 feat: retire stale worker mailbox generations only on authenticated ownership-loss admission evidence while retaining failed arrival bodies and provider cursors 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-10 08:17:59 +00:00
Matthew Meszaros 507c98e008 feat: preserve retry-safe locked fleet enrollment identities and trusted canonical CLI credential roots while disclosing unavailable generic runtime log sources 2026-10-10 07:55:46 +00:00
Matthew Meszaros fb955f054b feat: document authenticated UUID-preserving fleet evidence re-enrollment and regress the original node identity without broadening shared broker authority 2026-10-10 07:25:22 +00:00
Matthew Meszaros d3455c5373 feat: integrate released recovery main with admission request identifiers and stored result replay migration while retaining separate administrator operations 2026-10-10 07:17:43 +00:00
Matthew Meszaros 582c1aaaa4 feat: preserve fail-closed fleet enrollment fixtures and independent broker deadlines while honoring bounded evidence upload rate limits 2026-10-10 06:57:13 +00:00
Matthew MeszarosandDevin AI 9efc162fb8 feat: preserve bounded non-UUID request tracing identifiers in admission diagnostics while rejecting unsafe or oversized values 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-10 06:31:23 +00:00
Matthew MeszarosandDevin AI 48087b6a40 feat: categorize arrival admission failures with safe control-plane UUID diagnostics while retaining cursor and durable acknowledgement protections 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-10 06:20:33 +00:00
Matthew Meszaros 23a81409ab feat: omit unresolved administrator identity from pending device responses and retain approved-session auditing with a precise polling schema 2026-10-10 06:19:03 +00:00
Matthew Meszaros 9081b1bce0 feat: add proof-preserving one-use admin device sessions and bounded enrollment-authenticated worker evidence with scoped Kafka partition diagnostics 2026-10-10 06:14:52 +00:00
Devin AI 4758216dbf feat: integrate current monitoring and member access changes with durable mailbox synchronization 2026-10-09 16:56:53 +00:00
Matthew Meszaros 1c325b7a87 Merge pull request #903 from warmbly/devin/1791559441-admin-monitoring-final 
feat: show evidence-based admin monitoring and truthful mailbox refresh states
 2026-10-09 16:38:53 +00:00
Matthew Meszaros 2cf19ebedf feat: add permission-aware operational monitoring to admin Overview and health with evidence clocks, backlog signals, coverage docs and typed permission regressions 2026-10-09 15:34:18 +00:00
Matthew Meszaros 9a09740c84 feat: add permission-shaped operational monitoring snapshots with aggregate recovery evidence and read-only broker diagnostics 2026-10-09 15:12:54 +00:00
Devin AI 445e014b5e feat: recover mailbox synchronization across Gmail Outlook and IMAP with encrypted arrival replay and safe worker lifecycle 2026-10-09 14:24:10 +00:00
Matthew Meszaros bb4156cc6a feat: add resource-scoped member access that restricts a member to selected campaign folders, campaigns and mailboxes read-only, enforced in the API route gate, SQL filters, permission trigger, realtime channels and dashboard 2026-10-09 13:34:05 +02:00
Matthew Meszaros 1ce4a75545 Merge pull request #890 from warmbly/feature/unibox-forwarded-email-threading 
feat: show forwarded emails inside the original Unibox thread
 2026-10-09 04:27:52 +00:00
Matthew Meszaros 6d88588350 feat: filter the Analytics dashboard by campaigns and campaign folders (campaign_ids/folder_ids on GET /analytics/dashboard, resolved server-side to one deduplicated org-scoped set), with a picker on web, a filter sheet on iOS, CLI flags, an AI tool argument, and API, OpenAPI and guide docs 2026-10-09 06:04:31 +02:00
Matthew Meszaros 11b56b7031 feat: file Unibox forwards into the conversation they were forwarded from via email_tasks.forward_thread_id and unibox_emails.filed_forward, sent with no provider thread or In-Reply-To and skipped by reply threading 2026-10-09 06:03:21 +02:00
Matthew MeszarosandDevin AI b4ef37fe82 feat: restore existing self-host realtime connections through normalized legacy gateway URLs and an authenticated API-origin WebSocket proxy, preserve ticket-bound client IP limits and direct retry fallback, and remember workspace mailbox tag filters across navigation with deterministic default account grouping 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-08 06:57:48 +00:00
Matthew Meszaros 706beca2f7 feat: integrate workspace-scoped Cloud ownership with durable consent restrictive standing and send safety while preserving legacy enrollments and renumbering unreleased upgrade migrations 2026-10-07 16:32:30 +00:00
Devin AI d090b8e021 feat: complete native and Cloud diagnostic consent immutable shared provider attempt accounting authorized bounded IMAP timing retries conservative feedback pacing and released-schema correction fixtures 2026-10-07 15:12:45 +00:00
Devin AI 8a45508e79 feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates 2026-10-07 14:02:11 +00:00
Matthew MeszarosandDevin AI 2926f888c2 feat: allow unlimited self-hosted workspaces and bind Cloud billing access to individual workspace links while preserving legacy enrollments 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 13:49:42 +00:00
Devin AI 8e53fc7027 feat: integrate warmup observation evidence canonical diagnostics send-result recovery cloud trust exact-parent lineage durable dispatch portability and legacy compatibility 2026-10-07 12:38:58 +00:00
Matthew MeszarosandDevin AI b8303060dc feat: integrate current main with a single consumer schema and relation visibility guard while preserving migration cancellation diagnostics and regression coverage 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 07:49:50 +00:00
Matthew Meszaros bbd0d9f785 Merge pull request #863 from warmbly/devin/1791356256-posthog-root-causes 
feat: fix PostHog root causes in API validation, Gmail recovery and frontend asset delivery
 2026-10-07 07:35:04 +00:00
Matthew MeszarosandDevin AI dfed1e1593 feat: validate API UUIDs, recover expired Gmail history and guard consumer startup and stale frontend assets 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 07:19:15 +00:00
Matthew MeszarosandDevin AI 7667a836ec feat: resolve backend-compatible fleet images before node enrollment so failed joins cannot create duplicate orphan nodes on retry 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 07:05:38 +00:00
Matthew MeszarosandDevin AI 3acfe64109 feat: preserve self-host upgrades with exact realtime CSP discovery, consumer migration readiness and backend-compatible fleet targets 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-07 06:53:14 +00:00
Matthew Meszaros a92e40b4d1 feat: show Cloud warmup analytics and placement alongside local history on linked self-hosted instances with scoped report APIs 2026-10-07 06:12:04 +00:00
Matthew MeszarosandDevin AI 416c4feee3 feat: prevent private API response storage and remove wildcard CORS from the static Pages dashboard 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-06 12:05:54 +00:00
Matthew MeszarosandDevin AI f52ef240b4 feat: add audited repeat-safe sample data provisioning for active dedicated Test workspaces in Admin Testers 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-06 09:23:31 +00:00
Matthew MeszarosandDevin AI 925e0edc31 feat: proxy dashboard and editor image previews with SSRF-safe bounded fetching while preserving original customer email URLs 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-06 07:28:25 +00:00
Matthew MeszarosandDevin AI 0f12b3b250 feat: preserve static CSP preview and runtime configuration cache rules with current main 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-06 06:05:17 +00:00
Matthew MeszarosandDevin AI bb0b822cb0 feat: reject unsupported request text and secure local dashboard responses 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-06 04:45:36 +00:00
Matthew MeszarosandDevin AI 9d0f43780b feat: provision onboarding-complete reviewer workspaces with expiring Test access, bounded credits and Test header labels 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 16:15:56 +00:00
Matthew Meszaros fc18d8c186 Merge pull request #842 from warmbly/devin/1791201936-google-oauth-frontend-flag 
feat: configure Google mailbox OAuth and trusted multi-dashboard returns
 2026-10-05 13:31:17 +00:00
Matthew MeszarosandDevin AI 849cf18f55 feat: bind password recovery, invitations, mailbox and integration OAuth, referral and billing returns to trusted initiating dashboards 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:51:37 +00:00
Matthew Meszaros b2bde4ed92 Merge pull request #840 from warmbly/devin/1791198671-admin-health-notices 
feat: correct admin setup and health notices and add safe invitation cleanup
 2026-10-05 12:35:00 +00:00
Matthew MeszarosandDevin AI caa1633dac feat: verify main and TAC assessment dashboard origins share configurable backend CORS and OAuth routing 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:24:11 +00:00
Matthew MeszarosandDevin AI f58a6c1ff9 feat: control Gmail mailbox OAuth per frontend deployment and bind callbacks to allowlisted dashboard origins 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 12:16:34 +00:00
Matthew MeszarosandDevin AI 5ae09e0e15 feat: separate fleet mailbox targets from measured CPU and RAM, report node public egress IPv4 and add workload share analytics 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 11:24:32 +00:00
Matthew MeszarosandDevin AI ded4e5f700 feat: correct split-host admin health checks and registration notices, distinguish informational context from problems, and add audited expired-invitation cleanup 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
 2026-10-05 11:17:13 +00:00