Commit graph

19655 commits

Author SHA1 Message Date
ethernet
3975e9d753 fix(npm): npm 11.10-12.0 support min-release-age but NOT min-release-age-exclude.
that would break stuff :)
2026-07-31 13:42:04 -04:00
ethernet
9c85d68bcc fix(js): update vite 2026-07-31 13:42:03 -04:00
ethernet
fabc2d7d33 fix(js): hoist eslint shared devDeps to workspace root 2026-07-31 13:42:03 -04:00
ethernet
f7082c5172 fix(sec): pin exact npm package versions in website/, lock. 2026-07-31 13:42:03 -04:00
ethernet
94c27cae60 fix(sec): add min-release-age = 2 wks in website/.npmrc 2026-07-31 13:42:03 -04:00
ethernet
a4ffe39f73 fix(sec): add allowScripts to website/ 2026-07-31 13:42:03 -04:00
ethernet
88aed1b797 feat(sec): add exclude-newer = 14 days to uv.lock
disabled for 2 packages that are too new
2026-07-31 13:42:03 -04:00
ethernet
43f18cca81 feat(sec): add min-release-age = 2 wks in .npmrc
has some exclusions for packages with recent security fixes, which are
to be removed in >= 2wks
2026-07-31 13:42:03 -04:00
ethernet
515e88a80f fix(sec): pin exact npm package versions everywhere 2026-07-31 13:42:03 -04:00
ethernet
2158f2a5ad fix(sec): add allowScripts 2026-07-31 13:42:03 -04:00
ethernet
f976284245 nix: update nixpkgs, update nodejs to 26
brings npm 12 :)
2026-07-31 13:42:03 -04:00
ethernet
390a1771b2 fix(sec): update npm deps to resolve npm audit warnings
pin brace-expansion to 5.0.8
update concurrently to 10.0.4
update electron-builder to 26.15.3
update eslint to 10.8.0
update eslint-plugin-perfectionist to 5.10.0
update @assistant-ui/react to 0.15.0
update @assistant-ui/react-streamdown to 0.3.8
update radix-ui to 1.6.7
update react-router-dom to react-router@8.3.0 - react-router-dom is no longer a standalone package, it just reexports react-router
remove @radix-ui/react-slot: we import this from `radix-ui`
remove eslint-plugin-react: we imported it, but never actually used it!
2026-07-31 13:42:03 -04:00
ethernet
1f70e7ee7e update tornado to 6.5.7
tornado 6.5.5 has 7 known vulnerabilities:
GHSA-pw6j-qg29-8w7f
PYSEC-2026-3387
PYSEC-2026-3388
PYSEC-2026-3389

they're fixed in >= 6.5.7
2026-07-31 13:42:03 -04:00
ethernet
ea266a6061 fix(sec): update pynacl to 1.6.2
pynacl 1.5.0 has 1 known vulnerability:
PYSEC-2026-3002
it's fixed in >=1.6.2
2026-07-31 13:42:03 -04:00
ethernet
09da075505 fix(sec): update pygments to 2.20.0
pygments 2.19.2 has 1 known vulnerability:
PYSEC-2026-2987
it's fixed in >= 2.20.0
2026-07-31 13:42:03 -04:00
ethernet
f8d032588c fix(sec): update pytest to 9.1.1
pytest 9.0.2 has 1 known vulnerability:
GHSA-6w46-j5rx-g56g
it's fixed in >= 9.0.3
2026-07-31 13:42:03 -04:00
ethernet
eeab0a251d fix(sec): update pydantic-settings to 2.14.2
pydantic-settings 2.13.1 has 1 known vulnerability:
GHSA-4xgf-cpjx-pc3j

it's fixed in >= 2.14.2
2026-07-31 13:42:03 -04:00
ethernet
bb2539ea16 fix(sec): update pyasn1 to 0.6.4
pyasn1 0.6.3 has 5 known vulnerabilities:

GHSA-8ppf-4f7h-5ppj
GHSA-hm4w-wwcw-mr6r
PYSEC-2026-3455
PYSEC-2026-3456
PYSEC-2026-3457

they're fixed in >= 0.6.4
2026-07-31 13:42:03 -04:00
ethernet
abcd213504 fix(sec): update pillow to 12.3.0
pillow 12.2.0 has 26 known vulnerabilities:

GHSA-45hq-cxwh-f6vc
GHSA-4x4j-2g7c-83w6
GHSA-5x94-69rx-g8h2
GHSA-62p4-gmf7-7g93
GHSA-6r8x-57c9-28j4
GHSA-8v84-f9pq-wr9x
GHSA-9hw9-ch79-4vh6
GHSA-fj7v-r99m-22gq
GHSA-jjj6-mw9f-p565
GHSA-pg7v-jwj7-p798
GHSA-phj9-mv4w-65pm
GHSA-vjc4-5qp5-m44j
GHSA-xj96-63gp-2gmr
PYSEC-2026-2253
PYSEC-2026-2254
PYSEC-2026-2255
PYSEC-2026-2256
PYSEC-2026-2257
PYSEC-2026-3451
PYSEC-2026-3452
PYSEC-2026-3453
PYSEC-2026-3454
PYSEC-2026-3493
PYSEC-2026-3494
PYSEC-2026-3495
PYSEC-2026-3496

they're fixed in >= 12.3.0
2026-07-31 13:42:03 -04:00
ethernet
0945cc5b52 fix(sec): update msgpack to 1.2.1
msgpack 1.1.2 has 1 known vulnerability: GHSA-6v7p-g79w-8964

it's fixed in >= 1.2.1
2026-07-31 13:42:03 -04:00
ethernet
a7efeb0829 fix(sec): update mcp to 1.28.1
mcp 1.26.0 has 3 known vulnerabilities: PYSEC-2026-3481,
PYSEC-2026-3482, PYSEC-2026-3483

they're fixed in >= 1.28.1
2026-07-31 13:42:03 -04:00
ethernet
a3fdc189a4 fix(sec): update httplib2 to 0.32.0
httplib2 0.31.0 has a known vulnerability PYSEC-2026-3444

it's fixed in >= 0.32.0
2026-07-30 21:36:47 -04:00
ethernet
9bdfa9f36e fix(sec): update cbor2 to 6.1.3
cbor2 5.8.0 has a known vulnerability PYSEC-2026-2123

it's fixed in >= 5.9.0
2026-07-30 21:36:47 -04:00
ethernet
e9f64e83c1 fix(sec): update setuptools to 83 2026-07-30 21:36:47 -04:00
Teknium
cc4cab2f59 chore: release v0.19.1 (2026.7.30) 2026-07-30 16:45:08 -07:00
Teknium
c0689c3bcb test(tui): make _load_enabled_toolsets assertions tolerant of first-release back-filled toolsets
The two exact-list assertions in test_tui_gateway_server froze the toolset
list and broke the moment _RECENTLY_SHIPPED_TOOLSETS back-filled bfl onto a
saved platform list — the exact behavior the sibling change ships on purpose.
Assert the invariant instead: the expected base set is present, and anything
extra must be inside _RECENTLY_SHIPPED_TOOLSETS (vacuously exact again once
that set empties between releases).
2026-07-30 16:34:08 -07:00
rob-maron
97c6a183af auto populate flux3 in tools for nous portal users 2026-07-30 16:34:08 -07:00
Teknium
524ab53994 fix(telegram): apply media read_timeout to all upload send paths, not just video
send_video got the 60s read_timeout but send_voice/send_audio/send_photo/
send_document/send_media_group/send_animation upload through the same PTB
request path and hit the same server-side processing wait before the
response arrives. Same class, all sites: they all pass
_MEDIA_SEND_READ_TIMEOUT now. Also drops an unused test helper.
2026-07-30 15:20:09 -07:00
rob-maron
0a2859cf9a drop env var 2026-07-30 15:20:09 -07:00
rob-maron
88f6949097 more conservative 2026-07-30 15:20:09 -07:00
rob-maron
061b04ebb4 fix video delivery 2026-07-30 15:20:09 -07:00
rob-maron
5932ec4552 more conservative to 120s 2026-07-30 15:20:09 -07:00
rob-maron
dcd7a95704 higher telegram media limits 2026-07-30 15:20:09 -07:00
rob-maron
4c7cc62f9f flux3 messaging system fixes 2026-07-30 15:20:09 -07:00
hermes-seaeye[bot]
5d6aae02bf
fmt(js): npm run fix on merge (#75055)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-07-30 22:06:42 +00:00
brooklyn!
3a2b332985
Merge pull request #74938 from NousResearch/bb/rail-own-worktree
fix(desktop): a session's coding rail follows its own worktree
2026-07-30 16:54:37 -05:00
rob-maron
4a798f4bce
improve polling for FLUX3 video gen (#75010)
* wait between polls
2026-07-30 16:29:27 -04:00
Andrew Fiebert
c9de69c6d5 fix(desktop): keep queued prompts bound to their origin session
ChatView migrated tip-keyed composer queue/draft entries onto queueSessionKey
whenever the two ids differed. queueSessionKey is route-driven and can flip to
Session B a frame before the store selection leaves Session A, so migrate
re-homed A queue entries onto B and the idle ChatBar auto-drained them into
the wrong chat.

Gate migrate on same-conversation lineage only (tip to root). Also honor
lineage when background queue drain decides selected/busy, so a root queue key
is not treated as idle/offscreen while the compression tip is still working.
2026-07-30 15:08:31 -04:00
rob-maron
07447bd5db
nous portal video gen (#74963)
Some checks are pending
CI / Detect affected areas (push) Waiting to run
CI / Python tests (push) Blocked by required conditions
CI / Python lints (push) Blocked by required conditions
CI / JS & TS checks (push) Blocked by required conditions
CI / Desktop E2E (push) Blocked by required conditions
CI / Docs Site (push) Blocked by required conditions
CI / Deny unrelated histories (push) Blocked by required conditions
CI / Check contributors (push) Blocked by required conditions
CI / Check uv.lock (push) Blocked by required conditions
CI / Check no committed infographics (push) Blocked by required conditions
CI / package-lock.json diff (push) Blocked by required conditions
CI / Lint Docker scripts (push) Blocked by required conditions
CI / Build&Test Docker image (push) Blocked by required conditions
CI / Supply-chain scan (push) Blocked by required conditions
CI / Review label gate (push) Blocked by required conditions
CI / OSV scan (push) Waiting to run
CI / CI review comment (live) (push) Blocked by required conditions
CI / All required checks pass (push) Blocked by required conditions
CI / CI timing report (push) Blocked by required conditions
Deploy Site / deploy-vercel (push) Waiting to run
Deploy Site / deploy-docs (push) Waiting to run
Docker Build, Test, and Publish / build (amd64, type=gha,scope=docker-amd64, type=gha,mode=max,scope=docker-amd64, linux/amd64, ubuntu-latest) (push) Waiting to run
Docker Build, Test, and Publish / build (arm64, type=gha,scope=docker-arm64, type=gha,mode=max,scope=docker-arm64, linux/arm64, ubuntu-24.04-arm) (push) Waiting to run
Docker Build, Test, and Publish / publish (amd64, type=gha,scope=docker-amd64, type=gha,mode=max,scope=docker-amd64, linux/amd64, ubuntu-latest) (push) Blocked by required conditions
Docker Build, Test, and Publish / publish (arm64, type=gha,scope=docker-arm64, type=gha,mode=max,scope=docker-arm64, linux/arm64, ubuntu-24.04-arm) (push) Blocked by required conditions
Docker Build, Test, and Publish / merge (push) Blocked by required conditions
auto-fix lint issues & formatting / Generate eslint --fix patch (push) Waiting to run
auto-fix lint issues & formatting / Apply patch (push) Blocked by required conditions
2026-07-30 14:52:15 -04:00
Brooklyn Nicholson
8f4ab7ad2c fix(desktop): coding rail reads only its own worktree
The row fell back to the global $repoStatus whenever repoPath was blank,
painting the main pane's branch and ± onto a tile whose cwd hadn't
resolved yet. The fallback bought nothing — the primary computed is keyed
to $currentCwd, which is empty in exactly that case — and cost a rail
showing a tree the session was never in.
2026-07-30 12:27:23 -05:00
Brooklyn Nicholson
c48d9a9c6d fix(desktop): mark tile and branch runtimes as background
A tile and a branched session each live in their own worktree and render
from their own SessionView slice, so neither is the main pane's session.
Pass foreground: false at both call sites.
2026-07-30 12:27:23 -05:00
Brooklyn Nicholson
dd762d07bb fix(desktop): only the foreground session may write the composer atoms
applyRuntimeInfo unconditionally mirrored a runtime's cwd, branch, model
and usage into the global composer atoms. Every tile create and session
branch called it, so opening a session in another worktree re-pointed the
MAIN pane's coding rail at that tile's repo — and persisted it, so the
wrong workspace cwd survived a restart.

Collect the patch first, then mirror it once behind a `foreground` gate.
Background callers still get the full patch for their own session state;
they just stop publishing into state they don't own.
2026-07-30 12:27:16 -05:00
brooklyn!
8defb9fd60
Merge pull request #74833 from NousResearch/bb/status-stack-seam
fix(desktop): fuse the status stack to the composer again
2026-07-30 12:06:36 -05:00
Austin Pickett
1fd7548b49 test(desktop): query the profile row kebab by its own label
main now labels each panel row's kebab with the row's name
(menuLabel={profile.name}), so the hardcoded "Actions" default this test
relied on no longer exists. The name alone is ambiguous — the row-select
button carries it too — so match the menu trigger via `expanded`.

Neither side conflicts textually, so this only surfaced once main merged in.
2026-07-30 12:31:38 -04:00
Austin Pickett
95571de9d7 fix(desktop): fold delete dialog into shared, level up name field, test the view
Addresses review on #73013.

1. Manage Profiles used a hand-rolled delete Dialog next to the shared
   DeleteProfileDialog in the same folder. That copy missed the active-
   profile re-home fix (f764b0400): deleting the profile the gateway is
   on stranded it on a dead backend. Switch to the shared dialog, which
   owns the deleteProfile call and re-homes to default. Drops
   handleConfirmDelete, the deleting state, and the now-unused Dialog*
   imports.

2. The name field regressed to a plain Input during the create-dialog
   dedup, losing live slugging. Level both shared dialogs up to
   SanitizedInput sanitize={slug} so every entry point gets the behavior
   Manage Profiles had — the sanitize primitive means callers never
   validate-then-reject.

3. Nothing rendered ProfilesView, which is how the drift got in. Add a
   behavior test: create dialog exposes SOUL.md, deleting the active
   profile re-homes to default, deleting a non-active one does not.
2026-07-30 12:31:38 -04:00
Austin Pickett
4d9b7718d9 fix(desktop): use shared create-profile dialog on Manage Profiles page
The Manage Profiles page had its own local CreateProfileDialog/
RenameProfileDialog copies that predated the shared dialogs in
create-profile-dialog.tsx / rename-profile-dialog.tsx. The local
create copy lacked the SOUL.md textarea, so New Profile from the
sidebar rail and New Profile from Manage Profiles rendered different
modals.

Delete both local duplicates and reuse the shared self-contained
dialogs (they own the createProfile/renameProfile/updateProfileSoul
calls), so both entry points show the same modal including SOUL.md.
2026-07-30 12:31:38 -04:00
kshitij
14abd64b00 test: drop change-detector test, keep behavioral test
test_generated_script_contains_umask_else_branch asserted on shell
script text ('else', 'umask', '(0666 & ~0', 'chmod') rather than
behavior — a change-detector test per AGENTS.md. The behavioral
test (test_new_file_gets_umask_default_permissions) already
covers the actual behavior end-to-end via real subprocess.
2026-07-30 21:53:38 +05:30
webtecnica
fbfee8e405 fix(file_ops): apply umask-default permissions in _atomic_write for new files (#70856) 2026-07-30 21:53:38 +05:30
kshitij
9ceac1896e
Merge pull request #74902 from kshitijk4poor/chore/author-map-webtecnica-email
chore: add contato@webtecnica.com.br → webtecnica to AUTHOR_MAP
2026-07-30 21:47:06 +05:30
kshitij
ad12233f76 chore: add contato@webtecnica.com.br → webtecnica to AUTHOR_MAP
Required for PR #70888 salvage attribution audit.
webtecnica already has a noreply entry (75556242+webtecnica@users.noreply.github.com);
this adds their commit-email identity.
2026-07-30 20:52:19 +05:00