Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
bf47984cd5
feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations
2026-10-04 02:59:10 -07:00
Matthew Meszaros
8bb60e9449
feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers
2026-10-04 02:58:43 -07:00
Matthew Meszaros
5bd8dbfab9
feat: bind Warmbly Cloud brokered mailbox sign-ins to PKCE, a single-use state and a cloud consent page naming the requesting instance and workspace that sets the browser cookie the callback requires, return only to the instance's registered address, add PKCE and an OIDC nonce to Workspace and Microsoft 365 admin-proof sign-ins, post OAuth callback codes only to a configured dashboard origin, cap CLI-approved keys to the approver's role behind a fresh sign-in, and accept only same-origin login next paths
2026-10-04 02:53:16 -07:00
Matthew Meszaros
9f7d45a1fb
feat: charge every password, emailed-code and TOTP attempt atomically before comparing it (Redis INCR+expire script) with a per-account TOTP budget across challenges, put the signed-in password change on the reauth budget, set the per-account login limit to 50 per hour, give tester passwords an expiry (users.password_expires_at, migration 000257) and clear them plus every session on revoke, mint warmblyctl reset links with the password-reset purpose, expire fleet join tokens (7 days default, 30 max, reusable inside the window), derive captcha from the resolved Turnstile secret, refuse weak bootstrap argon2id hashes, make registration codes single-use, rate-limit the v1 invitation lookup, and draw RIDs and user codes without modulo bias
2026-10-04 02:52:22 -07:00
Matthew Meszaros
f0ec39febd
feat: scope automation and sequence unsubscribes to the caller's organization, require manage_settings to create, edit, enable or delete automations, run each integration action only on its own provider's connection (400 action_provider_mismatch), refuse org-permission gates when no organization service is wired, read /integrations/bookings like contacts, scope lead claims, research runs and CRM list cursors to the organization, and bind contact note edits to the contact in the path
2026-10-04 02:47:10 -07:00
Matthew Meszaros
e1c4a91ad1
feat: confirm a Slack link only for the Warmbly member whose email matches the Slack account's confirmed profile email (read via users.info with the new users:read and users:read.email scopes, refused as slack_link_email_mismatch), show the Slack account's name and avatar on the link page and after linking, return the Slack connection in GET /integrations/slack/status only to manage_settings or use_integrations, scope agent-thread lookups by organization, and check a Draft a reply card's conversation belongs to the clicker's workspace before starting the assistant
2026-10-04 02:45:04 -07:00
Matthew Meszaros
d505508997
feat: audit OAuth app moderation and developer blocks under their own entity types, refuse logo removal on suspended apps, delete a replaced workspace-uploaded app logo once no other app shows it, confirm before revoking every token in the admin panel, open store cards on Space, retry a new logo URL after a failed one, toast only after the clipboard write succeeds, and freeze the listing form baseline while it is open
2026-10-04 01:20:28 -07:00
Matthew Meszaros
1a483cb27f
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# internal/app/integration/service.go
# web/src/app/app/integrations/page.tsx
# web/src/hooks/useDocumentTitle.ts
2026-10-04 00:45:48 -07:00
Matthew Meszaros
4bc2417618
Merge remote-tracking branch 'origin/main' into feature/integrations-page-redesign
...
# Conflicts:
# docs/content/docs/api/error-codes.mdx
# docs/content/docs/guides/integrations.mdx
# web/src/app/app/integrations/page.tsx
2026-10-04 00:32:54 -07:00
Matthew Meszaros
7555f641a5
feat: turn Integrations into an app store with sidebar views, search, sorting and filters, list community apps by link until featured or widely installed, redesign the OAuth app registration dialog, store app logos re-encoded per app like the workspace logo, and add admin suspension, token revocation and developer blocks for OAuth apps
2026-10-04 00:31:52 -07:00
Matthew Meszaros
6b7e254e56
feat: add native Salesforce sync with Lead and Contact matching and links, a leased activity outbox that logs sends, replies, bounces, opt-outs and meetings as Tasks, Lead Status and Email Opt Out writeback, a pull loop with CRM pause rules, list view and Campaign imports, sandbox and My Domain OAuth that refreshes expired sessions, a Salesforce settings page with contact and inbox cards in web, and docs
2026-10-04 08:54:27 +02:00
Matthew Meszaros
900806f328
feat: make HubSpot sync jobs lease-safe with per-claim tokens and one-at-a-time claims, log each email once across retries with the interested-reply outcome as its own job, move merged HubSpot contacts in a transaction, run backfill as one cursor job that skips refused records, rebuild the HubSpot client after a reconnect, accept a single portalId on card requests, and remember the Warmbly property group only after it exists
2026-10-04 08:18:16 +02:00
Matthew Meszaros
37e91fc89f
feat: add HubSpot CRM mode where HubSpot deals, pipelines, tasks, notes and owners are mirrored and written through, sends and replies log as HubSpot emails, exit rules hold campaigns, list import, sync health, setup wizard in web, HubSpot app project with record card and workflow action, and docs
2026-10-04 07:47:51 +02:00
Matthew Meszaros
8883a1df6b
feat: connect Microsoft 365 organizations through Microsoft's v2.0 admin consent page followed by a sign-in on the same state, read the approving admin's directory role from the Graph token as well as the ID token, return an organization-wide approval link for single-mailbox Outlook sign-in (admin_consent_url) and show it in the connect panel, and document publisher verification and the admin approval path
2026-10-03 20:17:38 +02:00
Matthew Meszaros
4957214431
feat: redesign the Integrations page with search, category chips, recommended and popularity-ranked integrations, add a community app directory where OAuth apps are published unverified by link and verified in a new admin review queue, with docs and OpenAPI
2026-10-03 09:24:34 -07:00
Matthew Meszaros
61d16dfe9a
feat: add Warmbly for Slack with the AI assistant in DMs, mentions and the assistant pane, unified inbox threads with reply, AI draft and lead actions, per-category notification routing and DMs, account linking, dashboard Slack settings, manifest and docs
2026-10-03 15:35:11 +02:00
Claude
bb580164e6
feat: compute each active campaign's send plan in a background snapshotter (internal/app/campaign) stored in campaign_send_plan_snapshots so GET /campaigns/:id/send-plan serves a stored snapshot instead of walking the planner on the request
2026-10-03 11:04:22 +00:00
Claude
3288238cc0
feat: paginate and batch GET /analytics/accounts so account status reads are bounded per page and the overflow past 1000 mailboxes is reachable via cursor
2026-10-03 06:46:20 +00:00
Matthew Meszaros
54a05027cc
feat: save the unibox scope rail's favorites, row and section order and hidden rows to the member's account per workspace through a unibox_rail view with a validated layout on /me/views, synced from the dashboard store so every device shows the same rail while folds and widths stay per browser
2026-10-01 22:37:23 -07:00
Matthew Meszaros
e920b61371
feat: clear a reported warmup send failure only on a confirmed delivery, word the not-loaded send failure as a possible cause, leave placement seeds out of the adopted-mailbox warmup repair, and describe send_failure as a failure reason in the API schema
2026-10-01 03:20:41 -07:00
Matthew Meszaros
a844c506a0
feat: make Warmbly Cloud warmup start and explain itself for linked mailboxes: apply the instance's warmup settings, start warmup on adopted mailboxes, read the warmup day mask Monday-first, report the last refused warmup send and the partner cap to the instance and dashboard, hand changed SMTP credentials to the cloud, refuse cleartext mailboxes at enrollment, and show cloud warmup with the warming animation and a clear Cloud marker
2026-10-01 03:01:36 -07:00
Matthew Meszaros
d64adcc191
Merge remote-tracking branch 'origin/main' into feat/cloud-domain-redirects
2026-09-30 07:18:51 -07:00
Matthew Meszaros
75f764dc67
feat: require a verified Cloud Tasks token with a pinned audience on task webhooks, manage_settings on integration OAuth and a fresh membership check at every mailbox and integration OAuth finish, user verification for passkey sign-in, ended sessions before a password reset or ban reports success, and a revoked session when a rotated refresh token is replayed; remove the internal DEK delete route, log credential path parameters by name, hold remote images in received mail until the reader loads them, add Calendly and Cal.com signing keys with inbound URL rotation, keep automation signing secrets out of connection responses, and apply the password rules to the bootstrap password
2026-09-30 06:46:24 -07:00
Matthew Meszaros
41d43f64be
feat: check that a verified root redirect actually reaches visitors by opening the domain over http and https and naming what answered instead (Traefik, nginx, Caddy, a rewritten Host header, a missing certificate, a closed port) with per-proxy fix steps in the sending domain drawer, and let a self-hosted instance linked to Warmbly Cloud have Cloud serve and certify its redirects (connect in place from the redirect tab, the bulk dialog or a page banner), with Cloud-side linked-instance redirect endpoints under a per-instance limit, migration 000237, labelled tracking answers and a 503 when the redirect lookup is unavailable, and the sending domains, Warmbly Cloud, data control, install, OpenAPI, API and error code docs updated
2026-09-30 06:04:00 -07:00
Matthew Meszaros
1f0c6ca6d6
feat: send each mailbox's reply-to as a Reply-To header on campaign, unibox, test and placement mail (never warmup), record it on every campaign send attempt (tasks.reply_to, migration 000236) and credit a reply landing in that shared reply inbox to the campaign and its sending mailbox across reply attribution, the sync priority lane and copied-contact replies, show the sending mailbox on thread messages, recent activity and the reply webhook, start unibox and inbox-agent replies from the mailbox that emailed the contact, flag an untracked reply-to in mailbox settings, let the sandbox simulator answer Reply-To, and document the shared reply inbox ( #756 )
2026-09-30 05:33:34 -07:00
Matthew Meszaros
b2d6d100dd
feat: relay unibox Archive, Delete and Move to inbox to the mailbox itself through a new MESSAGE_FOLDER worker command (Gmail label batchModify, Outlook well-known folder moves with the message map re-keyed around each Graph id change, IMAP MOVE after locating each message by Message-ID), answered by relayed UPDATE_FOLDER events that write only provider_folder and the moved handles, relaying every row a filing moved so an Undo right after Archive still reaches the mailbox, with a per-mailbox Mirror Archive and Delete switch (email_accounts.relay_folder_moves, migration 000235, on by default), warmup receipts, drafts and non-Gmail sent copies left in place, and the unibox, mailboxes, API, events and OpenAPI docs updated
2026-09-30 04:41:03 -07:00
Matthew Meszaros
d3c0f76002
Merge remote-tracking branch 'origin/main' into calm-marlin-jks7
2026-09-30 06:52:32 +02:00
Matthew Meszaros
57a26c4ee6
feat: attribute a received warmup email moved to spam on the evidence around it before charging anyone, never for mail that arrived in spam (warmup_received.landed_spam), holding each move 30 minutes in warmup_spam_moves and deciding provider on a cross-workspace correlation or a move straight after arrival with nobody there, owner on provider-reported read, unread or star activity in mailbox_owner_activity or a repeated uncorrelated pattern in a used mailbox, nobody otherwise, weighting a spam move as one strike, withdrawing owner verdicts a later correlation explains, clearing the strikes behind a hold an admin lifts or an appeal approves, migration 000233, docs and guide
2026-09-30 06:52:32 +02:00
Matthew Meszaros
184e26a427
feat: call contact categories and inbox labels one name, Labels, across the dashboard (contacts tab moved to /app/contacts/labels with a redirect, pickers, filters, import, export, forms, segment field, timeline, and the Add label, Remove label and Label conversation automation actions), backend messages, AI tool descriptions and docs, keeping every API field name unchanged
2026-09-30 06:17:57 +02:00
Matthew Meszaros
045d13d281
feat: let segment membership writes take the same contact selection limits as every other bulk action, raise select-all to 250,000 contacts and explicit id batches to 10,000, check the research batch cap in the dashboard before confirming, and document the new limits in the guides, error codes and OpenAPI spec
2026-09-30 06:13:14 +02:00
Matthew Meszaros
e76cdc6f3a
Merge remote-tracking branch 'origin/main' into fix/recent-posthog-errors-2
2026-09-29 20:13:29 +02:00
Matthew Meszaros
4b0446042a
Merge pull request #750 from warmbly/feature/batch-inbox-placement-tests
...
feat: run one inbox placement test across many sending mailboxes as a placement batch, with server-side sender scopes, sampling, bounded concurrent execution, fleet grouping and coverage
2026-09-29 17:59:48 +00:00
Matthew Meszaros
d162f0aaf6
Merge pull request #748 from warmbly/fix/gmail-archive-unibox-inbox-sync
...
feat: file Gmail mail where Gmail moves it (archive, delete, spam, back to inbox) via an UPDATE_FOLDER event resolved against provider_folder, repair rows already stranded in the unibox Inbox with a six-hourly Gmail folder reconciliation, and close the open unibox conversation on a scope change with a close button in the reader header
2026-09-29 17:57:41 +00:00
Matthew Meszaros
80ecadb1e6
Merge remote-tracking branch 'origin/main' into feature/batch-inbox-placement-tests
2026-09-29 10:51:41 -07:00
Matthew Meszaros
ca66b25d8d
feat: register the release's bus schemas from the booting backend and hold the fleet on its current release until the backend runs the new one and the schema registry accepts them, check every published schema against a recorded snapshot in CI (make schemas) so a change the registry would refuse fails before merge, pin a FORWARD or FULL registry subject to BACKWARD on refusal, bound advisor narration so the run still lands, store unlabelled 8-bit mail with its invalid UTF-8 replaced, treat a pending or credential-less passkey ceremony as a cancellation, and drop link-scanner rejections from site error tracking
2026-09-29 19:20:07 +02:00
Matthew Meszaros
d99a09825f
feat: run one inbox placement test across many sending mailboxes as a placement batch (issue #736 ): server-side sender scopes (a campaign's senders or the whole workspace, filtered by provider, domain, tag and untested days) and sampling (random, percent stratified by provider or domain, per domain, per provider) snapshotted at creation, a runner that starts senders under per-workspace and instance-wide concurrency and a start rate with defer or skip for unavailable mailboxes, aggregate placement by sending domain, sending provider and recipient provider, fleet coverage, cancel, credits agreed per batch, org transfer, operator settings in the admin panel, dashboard pages and dialog, CLI commands, agent tools, OpenAPI and docs
2026-09-29 10:19:46 -07:00
Matthew Meszaros
0ed98a8c55
feat: copy up to two colleagues on every email a campaign sends one lead (campaign_lead_cc, migrations 000230-000231) with a drawer CC editor that suggests same-company contacts, hold a copied contact's own lead so nobody gets two threads, count a copy's reply as the lead's, opt out every copy on a link unsubscribe, drop a bounced or refused copy without bouncing the lead, skip suppressed campaign CC and BCC addresses, and document the endpoints, CLI, skills and OpenAPI
2026-09-29 09:53:27 -07:00
Matthew Meszaros
e2f319cfd8
feat: file Gmail mail where Gmail moves it (archive, delete, spam, back to inbox) via an UPDATE_FOLDER event resolved against provider_folder, repair rows already stranded in the unibox Inbox with a six-hourly Gmail folder reconciliation, and close the open unibox conversation on a scope change with a close button in the reader header
2026-09-29 09:43:13 -07:00
Matthew Meszaros
06db0c7cf5
Merge pull request #738 from warmbly/feat/campaign-create-flow
...
feat: rebuild the new campaign flow as Leads, Emails, Schedule and Review with a live launch plan and server drafts that reopen from the campaigns list, simulate the campaign estimate day by day under warmup graduation and warmup sharing the send spacing, and retire one-time emails
2026-09-29 12:19:52 +00:00
Matthew Meszaros
ad4104c57a
feat: never add a warmup strike from a recheck (confirm it, or withdraw it when the message is still in the mailbox or retention removed it since), revise a tampering hold before its strike is deleted so a retry completes it, compare-and-swap the revision on the hold's term, scope the ledger revision to the whole address, keep tampering events 37 days so a live hold's strikes survive pruning, answer an inconclusive search as unknown so IMAP rechecks stop, and return an IMAP transport failure as an error
2026-09-29 05:12:36 -07:00
Matthew Meszaros
e5eb3b0ff1
feat: re-decide a withdrawn warmup tampering hold on the strikes left in the seven days before it was imposed (on the pool row, or the reputation ledger for a mailbox out of every pool), stamp an old strike verified only when a worker answers its search and ask again after six hours, retry a removal check for a mailbox still loading, redeliver a failed strike, search IMAP folders in one session hold, and share the Message-ID search helpers
2026-09-29 04:57:45 -07:00
Matthew Meszaros
b6075391a3
feat: count only a draft's non-segment leads alongside its chosen lists in the campaign estimate and fill unsent estimate settings from the saved campaign, keep branches added on the Steps tab while the new campaign flow is open, renumber automatic step names, and read a draft's lead count without analytics access
2026-09-29 04:52:37 -07:00
Matthew Meszaros
9ed3c6eaae
feat: keep campaigns.kind until every node stops reading it, count a saved draft's own leads and hand-picked senders in the campaign estimate via campaign_id with the 08:00-18:00 window as the default, make a failed draft save retry as an update, keep Steps-tab step names, gate draft reopening on manage campaigns and save schedule-only edits on close
2026-09-29 04:43:25 -07:00
Matthew Meszaros
c5a981d86c
feat: record a warmup deletion strike only after the worker searches the mailbox and finds the message in the trash or gone, so a move reported as a removal (Graph, a provider filter, a mailbox rule, a second Warmbly instance, our own filing) is never charged, withdraw strikes whose message is still in the mailbox and lift the pause or block they imposed, recheck deletion strikes recorded before the search once via warmup_tampering_events.verified_at (000229), and clarify the tampering reasons and warmup guide
2026-09-29 04:28:34 -07:00
Matthew Meszaros
f88ecd7b4c
feat: rebuild the new campaign flow as Leads, Emails, Schedule and Review with a lead-list picker, the full step editor and a live launch plan, keep unlaunched campaigns as server drafts that reopen in the flow from the campaigns list and a Continue setup button, simulate POST /campaigns-estimate day by day under warmup graduation, warmup mail sharing the send spacing, other campaigns, health holds and follow-up waits, retire one-time emails (migration 000229 drops campaigns.kind, the list type filter and badge go), enlarge the step subject field, and lift the editor popovers above dialogs
2026-09-29 01:37:07 -07:00
Matthew Meszaros
4c1fc9604b
Merge pull request #729 from warmbly/fix/cloud-warmup-standing-gates
...
feat: hold Warmbly Cloud's warmup standing on a linked self-hosted instance so campaign gates, pacing, lifecycle and account health enforce a cloud quarantine, block or throttle
2026-09-28 17:58:49 +00:00
Matthew Meszaros
92ff20155b
Merge pull request #730 from warmbly/fix/warmup-plan-entitlements
...
feat: limit the Warmup plan to the premium pool and uncapped mailboxes, and lock sending, inbox, AI and integrations behind a plan that sends
2026-09-28 16:36:08 +00:00
Matthew Meszaros
f9ef16a36b
feat: let a Stripe subscription to a sending plan outrank a Warmup plan grant, report the daily send cap from the sender's own gate (unlimited when uncapped) and refuse a daily-send request that would cap an unlimited plan, detect the Warmup plan by id in the dashboard, show a mailbox override on the Warmup plan card, fall back to period length for the yearly price, derive WarmupPlanID from config, and correct the billing guide on what the server refuses
2026-09-28 09:24:27 -07:00
Matthew Meszaros
a268e3c54a
feat: limit the Warmup plan to the premium pool and uncapped mailboxes by gating sending, the inbox, AI, integrations, placement tests and paid storage on a plan that sends (HasProductPlan, with HasPremiumWarmup for pool placement), report 0 daily sends and refuse non-mailbox limit requests for workspaces that do not send, lock Warmup workspaces in the dashboard like free ones, show only the mailbox meter for them, and show the yearly price on yearly subscriptions
2026-09-28 09:16:42 -07:00
Matthew Meszaros
Claude