Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,292 Commits 1 Branch 1 Tag
8b645135bc7b56215b9cc5b7ae7db286f93f8fa9
Commit Graph
3292 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
yorkhellenandXubin Ren 8b645135bc fix(pairing): restore durable atomic writes 2026-07-04 21:19:19 +08:00
axelray-devandXubin Ren 28011413bc fix(copilot): guard token refresh with asyncio.Lock to prevent race condition 
_get_copilot_access_token had a check-then-act race: concurrent chat()
calls after token expiry both fetched new tokens and clobbered each other.
Add asyncio.Lock with double-checked locking so only one fetch happens
per expiry window.

Closes #4677
 2026-07-04 21:19:12 +08:00
chengyongruandXubin Ren 614ea86a81 test: align MCP transient reconnect coverage 
maintainer edit: update the existing transient retry tests for reconnect-first behavior and keep structured retry-failure coverage in the focused MCP transient suite.
 2026-07-04 21:15:18 +08:00
chengyongruandXubin Ren 6d28db3248 fix: reconnect MCP sessions on transient stream failures 
maintainer edit: treat transient MCP stream failures as dead sessions so the existing reconnect handler can refresh the session before retrying. Also cover retry failure as a structured tool error.
 2026-07-04 21:15:18 +08:00
Yuxin LouandXubin Ren 0d1221bece fix(mcp): contain malformed tool results 2026-07-04 21:15:18 +08:00
Xubin Ren 8b9f93d7d1 test(config): lock model presets alias serialization 2026-07-04 11:44:28 +08:00
Yuxin LouandXubin Ren a119c35b1e fix(config): serialize model presets as camelCase 2026-07-04 11:44:28 +08:00
Xubin RenandGitHub 067e0c4a40 feat(cli): add safe WebUI first-run launcher (#4688) 2026-07-03 18:58:04 +08:00
chengyongruGitHubXubin Ren
 		5283ceae85 Add optional Nanobot plugin controls (#4396) 
* feat: add optional nanobot features

* test: update azure install hint expectation

* fix: validate optional feature extras

maintainer edit: verify requested dependency extras before treating optional features as installed, propagate restart state from feature enablement, and align docs with the new plugins enable command.

* fix: bound optional feature installs

maintainer edit: make optional feature installs time out as a normal install failure instead of leaving the WebUI or CLI action waiting indefinitely.

* feat: slim optional channel dependencies

* fix: log optional install commands

* fix(webui): gate remote feature installs

* docs: clarify webhook plugin example

* fix(webui): harden optional feature installs

* fix: install optional deps without package fallback

* fix(cli): refine plugin feature controls

* fix(webui): count enabled nanobot features

* fix(webui): allow slow feature install routes

* fix(webui): allow disabling websocket channel

* fix(plugins): simplify optional feature controls

* fix(webui): polish apps catalog states

* fix(webui): confirm nanobot support installs

* fix(webui): polish nanobot install dialog

* fix(webui): suppress empty websocket handshakes

* fix(webui): clarify apps plugin summary

* fix(webui): localize workspace access copy

* fix(plugins): polish optional feature controls (#4691)

---------

Co-authored-by: Xubin Ren <52506698+Re-bin@users.noreply.github.com>
 2026-07-03 18:17:52 +08:00
Hamb_yandGitHub 00cc0da530 fix(providers): omit temperature for sonnet 5 
Add sonnet-5 to the Anthropic omit-temperature model families and cover adaptive, enabled, and non-thinking request paths.

Fixes #4683
 2026-07-03 15:48:46 +08:00
LILACandGitHub b19a744110 fix(providers): update Anthropic default model to claude-sonnet-4-6 
Update the Anthropic provider default model and matching docs/tests from claude-sonnet-4-20250514 to claude-sonnet-4-6.

Fixes #4675
 2026-07-03 15:46:19 +08:00
Xubin Ren c9c69e4316 fix(memory): cap workspace Dream prompt overrides 2026-07-03 00:41:51 +08:00
chengyongruandXubin Ren 8a79eb1aaa fix(memory): clarify Dream prompt init UX 2026-07-03 00:41:51 +08:00
chengyongruandXubin Ren 979f038ded fix(channels): align Dream prompt Telegram copy 2026-07-03 00:41:51 +08:00
chengyongruandXubin Ren f38fd7d5d3 feat(memory): add workspace Dream prompt override 2026-07-03 00:41:51 +08:00
chengyongruandXubin Ren 5af22042ec fix(trigger): keep local worker alive on turn cancel 2026-07-03 00:36:29 +08:00
chengyongruandXubin Ren aecb5fbc33 fix(agent): avoid tool compaction echo loops 2026-07-03 00:36:22 +08:00
chengyongruandXubin Ren 34535b4e7c fix(webui): hide subagent backfill payloads 2026-07-02 14:36:23 +08:00
Stellar鱼andXubin Ren 5abe06f808 test: cover runner blocked tool-call finish reasons 2026-07-02 14:36:18 +08:00
yu-xin-candXubin Ren 64c7ff5fdc test(cron): cover stale instance mutation consistency 2026-07-02 14:36:12 +08:00
chengyongruandXubin Ren 54bcdb5a62 fix(exec): return early when session command exits 2026-07-02 14:36:06 +08:00
Xubin Ren ffdf05a603 fix(trigger): cap local trigger audit records 2026-07-02 13:46:27 +08:00
Xubin Ren fd9e57703c fix(trigger): tolerate unsupported directory fsync 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 661ab00656 feat(trigger): add local trigger run audit records 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren b941233138 fix(trigger): clean up deleted trigger deliveries 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren acb0e853ff refactor(trigger): share automation turn delivery 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren afef27dd6c fix(webui): show pending local triggers 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren f32007c83f fix(trigger): defer local triggers until session idle 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 09bde468eb fix(webui): narrow local trigger source label 
maintainer edit: avoid optional source access after extracting automation source kind for TypeScript build.
 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 2ebf5c4972 refactor(trigger): name CLI trigger source as local 
maintainer edit: cron is also a trigger source, so keep the new CLI-delivered source explicitly named as local trigger across backend, WebUI, docs, and tests.
 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 1ed2c9a213 fix(trigger): recover interrupted deliveries 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 55b550ee01 fix(trigger): hide external trigger inputs 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren b690a48336 fix(trigger): require names for trigger creation 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 7178ea3f13 docs: explain local triggers 2026-07-02 13:32:46 +08:00
chengyongruandXubin Ren 2a0cd19a74 feat(trigger): add session-bound local triggers 2026-07-02 13:32:46 +08:00
Xubin Ren c78421cf16 fix(bus): preserve legacy outbound metadata events 2026-07-01 20:17:00 +08:00
Xubin Ren 03be51ade5 fix(channels): preserve legacy stream hook signatures 2026-07-01 20:17:00 +08:00
chengyongruandXubin Ren c757c5466c docs: update channel plugin runtime event contract 2026-07-01 20:17:00 +08:00
chengyongruandXubin Ren 5f4cfbcb16 refactor(bus): type outbound runtime events 2026-07-01 20:17:00 +08:00
chengyongruandXubin Ren f6d1dba32a fix(cron): tolerate unsupported directory fsync 2026-07-01 19:51:43 +08:00
chengyongruXubin RenAlan Chen
 		2ec4044217 feat(webui): add dollar skill shortcuts 
Add a WebUI-only $<skill> completion shortcut without changing slash command behavior.

Keep slash autocomplete command-only and allow dollar skill shortcuts anywhere in the composer.

Co-authored-by: Alan Chen <zc2610@nyu.edu>
 2026-07-01 19:51:01 +08:00
Xubin Ren a6d5e4f3b5 docs(api): document wildcard bind authentication 2026-07-01 13:09:49 +08:00
chengyongruandXubin Ren ed48325346 fix: cover API auth guard regressions 
Maintainer edit: restore CI by updating serve/onboard tests, add auth/config coverage, and keep auth failures on the OpenAI-compatible error shape.
 2026-07-01 13:09:49 +08:00
dajiaohuangandXubin Ren 56443ac6e2 @ 
feat(api): require api_key when binding to all interfaces (parity with WS gateway)

The OpenAI-compatible API server had no authentication option, unlike the
WebSocket gateway which already refuses wildcard binds without a token.
When bound to 0.0.0.0, any caller who could reach the port could drive
the agent with its default tool posture.

- Add api_key field to ApiConfig (schema.py).
- Add wildcard_host_requires_auth validator that rejects wildcard binds
  without api_key, mirroring the WS gateway pattern.
- Add Bearer-token auth middleware to the API server (server.py).
  /health remains unauthenticated.
- Replace the wildcard-host CLI warning with a hard error when api_key
  is unset, and pass api_key to create_app.

Fixes #4490
@
 2026-07-01 13:09:49 +08:00
chengyongruandXubin Ren 21aa900d64 fix: honor MCP tool error results 2026-07-01 13:03:47 +08:00
chengyongruandXubin Ren b0258e8b20 fix: preserve legacy plugin tool errors 2026-07-01 13:03:47 +08:00
chengyongruandXubin Ren 8493560976 refactor(tools): use structured tool error results 2026-07-01 13:03:47 +08:00
chengyongruandXubin Ren 8d2c31eb6a refactor(webui): derive provider model catalog kind 2026-07-01 12:59:06 +08:00
chengyongruandXubin Ren a6a489e0fa refactor: tighten session recency cleanup 
maintainer edit: remove defensive branches that normal session storage cannot produce and keep the idle-expiry helper direct.
 2026-06-30 23:38:32 +08:00
chengyongruandXubin Ren 840ba5af33 fix: simplify session recency activity tracking 
maintainer edit: remove the _last_compacted_at maintenance state, gate idle compaction on whether a session still has a removable tail, and sort WebUI sessions by the latest visible transcript activity.
 2026-06-30 23:38:32 +08:00