refactor(channels): make built-in channels self-contained (#4908)

* refactor(channels): own setup and instance contracts

* refactor(channels): isolate management contracts

* refactor(channels): normalize activation contracts

* fix(channels): enforce management contracts

* refactor(channels): finish setup ownership migration

* fix(channels): harden management contracts

* fix(channels): enforce lazy loading and runtime ownership

* fix(feishu): make multi-instance startup idempotent

* fix(webui): render channel setup contracts cleanly

* fix(feishu): stop websocket clients cleanly

* fix(channels): enforce persistence and activation gates

* fix(channels): preserve global feature action scope

* fix(channels): apply defaults for single plugins

* fix(channels): enforce management contract boundaries

* refactor(feishu): remove identity helper indirection

* fix(channels): preserve management setup contracts

* refactor(channels): generalize instance settings UI

* refactor(channels): package channel plugins with web UI metadata

* refactor(channels): make built-ins self-contained packages

* test(channels): colocate tests with channel packages

* fix(dingtalk): use official brand icon

* feat(channels): colocate webui translations

* docs(channels): clarify plugin ownership

* test(exec): remove output wait race

* refactor(channels): unify plugin descriptors

* fix(channels): enforce descriptor-owned contracts

* refactor(channels): finish package-owned plugin setup

* refactor(channels): use repository-owned packages only

* fix(channels): self-describe dependencies and runtime state

* fix(channels): warn about legacy entry points

This commit is contained in:

chengyongru

2026-07-19 23:30:49 +08:00

committed by

GitHub

parent 7aaac37bca

commit 462a0dfb0f

388 changed files with 17093 additions and 5110 deletions

									
										SECURITY.md
									
		+1
		-1
	
												View File
												
				@@ -129,7 +129,7 @@ pip install --upgrade nanobot-ai

				**Important Notes:**

				- Keep `litellm` updated to the latest version for security fixes

				- Run `pip-audit` regularly, including optional channel dependencies such as `nanobot-ai[whatsapp]`

				- Run `pip-audit` regularly after enabling the channels used in production; their manifest-declared dependencies are installed into the same environment

				- Subscribe to security advisories for nanobot and its dependencies

				### 7. Production Deployment