Repository navigation

dev → master - #52

Merged

im4codes merged 2221 commits into

masterfrom

dev

Oct 20, 2026

Merged

dev → master#52
im4codes merged 2221 commits into
masterfrom
dev

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 7, 2026
Commits on Oct 8, 2026
Commits on Oct 9, 2026
Commits on Oct 10, 2026
- fix(security): a participant-started turn gets no open-pair titles, models or briefs from send_list_targets / pair_list / pair_get
  
  T
  and
  claude
  committed
  5849ef7
- fix(security): attachment downloads are never rendered as a document on the app origin (SVG/HTML stored XSS)
  
  T
  and
  claude
  committed
  934ebf1
- fix(security): the chat attachment chip no longer renders a downloaded file as a document on the app origin
  
  T
  and
  claude
  committed
  7f5e152
- fix(security): a share's browser projection of pairs carries no titles, models or brief text; pair_task_get is not for participant turns
  
  T
  and
  claude
  committed
  580ab99
- fix(web): previewAttachment loads the download helper lazily so api.ts no longer installs @capacitor/core's global at module load
  
  T
  and
  claude
  committed
  35db69c
- fix(security): sniff upload types and verify safe composer previews
  T
  committed
  a2b56f7
- test(security): preserve authorized pair relay access
  T
  committed
  e42cb05
- fix(security): redact raw pair event attrs in participant views
  T
  committed
  3ae4bb1
- fix(security): omit private pair notices from shared event projections
  T
  committed
  597deea
- fix(security): allowlist shared pair event operational metadata
  T
  committed
  080cc1c
- fix(security): fail closed on unknown participant origin hook replies
  T
  committed
  aa0e835
- Restrict daemon server tokens to explicit shared REST routes
  T
  committed
  43eb2dd
- Preserve mounted server base paths in daemon route clients
  T
  committed
  3067dcc
- Separate account fixtures from daemon route admission tests
  T
  committed
  884f66d
- Make daemon source guard distinguish calls from imported route prefixes
  T
  committed
  e1ff0ff
- Apply daemon admission before CORS short-circuit responses
  T
  committed
  b1deb24
- fix(auth): preserve account credentials with incidental daemon routing headers
  T
  committed
  2dfe466
- fix(tests): keep daemon collection independent of server installs
  T
  committed
  2192d11
- test: isolate dependency graph analysis from suite worker state
  T
  committed
  15e5f9b
- fix: limit participant-turn refusal to exec_remote
  T
  committed
  5b5fe9b
- fix: require live actor shares on controlled node entry points
  T
  committed
  af86e0e
- fix: preserve ES2020 policy compatibility and FULL desktop access
  T
  committed
  db0ef02
- fix: fence unknown node authority and actor-scoped upload stages
  T
  committed
  8f56a03
- fix: revoke controlled node metadata subscriptions on lost actor access
  T
  committed
  e25335c
- feat(node): add pinned headless glibc217 ABI profile and systemd219 lifecycle support
  T
  committed
  c2a11a6
- fix(node): embed watchdog transport in compiled daemon distribution
  T
  committed
  36fcfd0
- test: include compat artifact job in required release gate
  T
  committed
  fbc8490
- fix: simplify task titles and pair session identities
  T
  committed
  65e0f8d
- fix: keep cached labels as fallback and honor cleared session names
  T
  committed
  cf7af3c
- fix: retain label fallback for normalized old-peer rows
  T
  committed
  bfd5ec3
- fix: cover protocol task IDs in legacy pair labels
  T
  committed
  adf2d9b
- fix(test): yield worker IPC between synchronous daemon fixtures
  T
  committed
  aae4a75
- test(task-pairs): drain scheduler fixture work before replacing globals
  T
  committed
  dd65e3a
- test(transport): wait for actual replay completion before assertions
  T
  committed
  8ddb93c
- fix: preserve Linux desktop installer success and readiness failures
  
  IM.codes
  authored and
  T
  committed
  e43481b
- fix: restore actor-scoped shared group device visibility and read access
  T
  committed
  56a26d3
- fix: fence machine group revocation across server pods
  T
  committed
  55d1c7e
- fix: fence pending desktop admission and lease snapshots
  T
  committed
  1f84a9a
- fix: load group notification driver only at LISTEN startup
  T
  committed
  8369ad6
- fix: route supplied SSH targets directly in generated contracts
  T
  committed
  70c99b5
- test: guard each stable desktop authorization phase
  T
  committed
  bac7875
- merge: CI, desktop installer and shared-group authorization fixes
  IM.codes Brain
  committed
  7ce954b
- feat: add agy-sdk (Antigravity CLI) transport agent with grouped quota display
  T
  committed
  37bcb8a
- fix(agy-sdk): add MCP integration, dynamic model discovery, quota parsing, and cumulative streaming
  T
  committed
  241fc64
- fix(ci): relax jsonl-watcher worker test timeouts and ignore missing files on coverage upload
  T
  committed
  7a89a70
- test(agy-sdk): assert getMemoryMcpStatus using connected provider instead of real binary in PATH
  T
  committed
  58cbe9b
- fix: support git branch visibility in shared sessions and prioritize antigravity provider
  T
  committed
  d55a431
- fix(agy-sdk): resolve agy from user install paths, enrich spawn PATH, and safely format provider errors
  T
  committed
  326e1fd
- fix(agy-sdk): fix text truncation, quota precision, idle detection and queue append
  T
  committed
  ef9d978
- fix: preserve native append admission and confirm Stop fallback
  
  T
  authored and
  IM.codes Brain
  committed
  d93afff
- fix: admit mixed command appends independently and preserve partial facts
  
  T
  authored and
  IM.codes Brain
  committed
  d89c3e9
- fix: resolve queue policy shared import for all consumers
  
  T
  authored and
  IM.codes Brain
  committed
  1d572f0
- fix(transport): preserve unconfirmed Stop barrier across priority cancels
  
  T
  authored and
  IM.codes Brain
  committed
  2674077
- test(transport): distinguish connected append fixtures from provider recovery
  IM.codes Brain
  committed
  dccf925
Commits on Oct 11, 2026
Commits on Oct 12, 2026
Commits on Oct 13, 2026
Commits on Oct 14, 2026
Commits on Oct 15, 2026
- fix(server): allow offline deletion with atomic dependent cleanup and accessible UI
  T
  committed
  cf4668e
- fix(ci): avoid redundant unretried macOS ticket validation
  T
  committed
  babaacf
- fix(agy-sdk): retire quota-poisoned CLI processes without replaying turns
  T
  committed
  bf21d42
- Revert "fix(agy-sdk): retire quota-poisoned CLI processes without replaying turns"
  T
  committed
  5d365ac
- fix(agy-sdk): recover completed native turns lost behind historical quota errors
  T
  committed
  c6fb2ba
- fix(share): synchronize participant thinking levels without exposing private settings
  T
  committed
  e6da130
- fix(ci): align release guards with validated notarization gate
  T
  committed
  94f1057
- fix(pairs): show titles to verified task-authorized participants
  T
  committed
  07aaec9
- fix(pairs): preserve title grants across concurrent metadata updates
  T
  committed
  1ca29a7
- fix(pairs): retain authoritative title grants in lifecycle snapshots
  T
  committed
  637fe8c
- fix(mcp): refresh bootstrap catalog for title viewer grants
  T
  committed
  fc95a58
- fix(pairs): give shared participants owner-equivalent Pair access
  T
  committed
  e99939a
- docs(pairs): remove obsolete participant title-grant guidance
  T
  committed
  fbafa30
- feat(pairs): persist pause and dependency waits without model polling
  T
  committed
  68d6dc3
- fix(pairs): invalidate recovery handoffs across pause epochs
  T
  committed
  87f0a72
- fix(pairs): release failed resume admissions and fit MCP catalog budget
  T
  committed
  1d662c6
Commits on Oct 16, 2026
- feat(mcp): read current-session texts and summaries across providers
  T
  committed
  715fcae
- fix(mcp): read session summaries from their persisted namespace
  T
  committed
  1cbac70
- fix(handoff): keep at least thirty recent text messages
  T
  committed
  d15c9ad
- fix(macos): keep background app launches out of the Dock
  T
  committed
  9f7f618
- fix(sdk): propagate runtime-bound MCP identity across session providers
  T
  committed
  ed0d714
- test(runtime): assert enriched SDK session identity at initialization
  T
  committed
  179a0b5
- fix(muse): migrate anonymous host MCP registration to session scope
  T
  committed
  ede40d3
- feat(history): read texts and tools within the same main session tree
  T
  committed
  56dcaa3
Commits on Oct 17, 2026
- fix(web): bound collapsed tool previews without losing full output
  T
  committed
  3fe5e3a
- test(agy): verify child identity independently of startup order
  T
  committed
  2aad934
- fix: make picker searches case-insensitive
  IM.codes
  committed
  2483774
- fix: prevent chat file preview rerender loop
  IM.codes
  committed
  76f3879
- test: stress unstable preview translation identity
  IM.codes
  committed
  60e9b5f
- test: stress unstable preview translation identity
  IM.codes
  committed
  6feeee4
- fix: prevent chat file preview reentry
  IM.codes
  committed
  4186789
- fix(web): fit mobile server menu to viewport
  IM.codes
  committed
  0b8a89d
- merge: record integrated chat preview fix
  IM.codes
  committed
  9c171c2
- fix(web): recover failed chat file previews
  IM.codes
  committed
  f6496ff
- fix: keep preview errors out of congested core lane
  IM.codes
  committed
  c233e12
Commits on Oct 18, 2026
- fix: expose image copy and save actions
  IM.codes
  committed
  578236d
- fix: reconnect core lane after socket errors
  IM.codes
  committed
  41776da
Commits on Oct 19, 2026
- test(web): prove hidden preview alias dedup
  IM.codes
  committed
  c79fa4b
- fix(web): canonicalize hidden chat preview paths
  IM.codes
  committed
  2def66f

Commits

Commits on Oct 7, 2026

Commits on Oct 8, 2026

Commits on Oct 9, 2026

Commits on Oct 10, 2026