f0b327cf68
fix(media): gate markdown image extraction by channel ( #72718 )
...
Closes #72642
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-04-27 11:27:35 +01:00
6b6dcafcee
fix(webchat): support non-image file attachments
2026-04-26 10:58:24 -07:00
5404bbbb71
Avoid duplicate generated media attachments
...
Generated media can be produced in intermediate tool results before the assistant chooses which assets to share in its final reply. This change keeps those intermediate files from being appended a second time when the final reply already names the assets to deliver, and tightens the media directive parsing around unsafe or ambiguous URLs.
2026-04-25 17:56:29 -07:00
e2fd3dcee9
fix(google): emit opus voice-note tts
2026-04-25 21:33:33 +01:00
75fcb8c56d
perf: lazy-load heavy test imports
2026-04-25 19:23:51 +01:00
c070509b7f
fix(security): bound archive and MIME parser work ( #71561 )
...
* fix(security): bound archive and MIME parser work
* fix(security): harden zip preflight accounting
* fix(plugins): keep update channel sync on bundled path helpers
* fix(lint): avoid boolean literal comparisons
* fix(lint): keep agent spawn assertion immutable
* test(auto-reply): relax slow model directive regression timeout
2026-04-25 06:22:56 -07:00
3507efa4ec
fix(media): preserve oversized video generation delivery
2026-04-25 12:41:43 +01:00
e174d96cc0
refactor(media): move sharp image ops into media runtime ( #71519 )
...
* refactor(media): move sharp image ops into plugin
* fix(media): pass image pixel budget to sharp plugin
* refactor(media): reuse media understanding sharp runtime
* test(build): allow staged runtime core graphs
2026-04-25 04:31:10 -07:00
01bf61fcfd
fix(media): remove express from media host ( #71436 )
...
* fix(media): remove express from media host
* fix(media): harden media host responses
* fix(msteams): stage express runtime dependency
* fix(browser): align profile facade exports
* fix(msteams): keep setup entry narrow
* fix(types): satisfy extension setup gates
* fix(msteams): use generic setup config type
2026-04-25 01:39:42 -07:00
537a8e25ed
fix(signal): classify filename-only voice notes
2026-04-25 06:45:54 +01:00
e3cba98f39
refactor(pdf): move document extraction to plugin
...
* refactor(pdf): move document extraction to plugin
* fix(deps): sync document extract lockfile
* fix(pdf): harden document extraction plugin
2026-04-24 17:15:05 -07:00
4e9c83d4d8
fix(media): centralize inbound media reference resolution
2026-04-25 00:57:07 +01:00
60d892d700
fix(reply): parse markdown image replies as media
...
* fix(reply): parse markdown image replies as media
* fix(reply): preserve inline markdown image captions
* fix(reply): harden markdown image parsing
2026-04-23 19:34:30 -07:00
1daa552d5f
refactor(qr): share PNG data URL helpers ( #70784 )
2026-04-23 15:41:45 -07:00
ea25d7ed5b
fix(qr): replace qrcode-terminal with qrcode-tui
...
Replace legacy qrcode-terminal usage with shared qrcode-tui media helpers, bound QR PNG rendering options, and raise bundled plugin host floors for the new SDK runtime surface.
2026-04-23 13:06:14 -07:00
6639b21ade
test(media): harden media store URI validation
2026-04-22 21:05:41 +01:00
e5b67b7ebd
fix(media): load inbound media store URIs
2026-04-22 20:32:05 +01:00
4d6756d45d
refactor: generalize voice audio compatibility
2026-04-22 06:58:45 +01:00
21e04350ab
test: generalize media fetch token fixtures
2026-04-22 06:45:09 +01:00
a65eb1b864
fix(zalo): add SSRF guard on outbound photo URLs [AI-assisted] ( #69593 )
...
* fix: address issue
* fix: address review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address build failures
* fix: address PR review feedback
* fix: address review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address PR review feedback
* fix: address review feedback
* fix: address build feedback
2026-04-21 19:20:26 +05:30
fcc86f043b
fix(media): preserve outbound attachment filenames
2026-04-21 14:19:27 +05:30
f350bb4dfc
fix(media): parse lowercase media directives
2026-04-21 14:19:27 +05:30
a732b916f4
test: use synthetic media channel fixtures
2026-04-20 23:59:39 +01:00
9c9ca5f431
test(extensions): move channel contracts to owners
2026-04-20 20:55:39 +01:00
f8bb35ead0
test: share media server harness
2026-04-20 19:18:27 +01:00
91f1f881bb
refactor: share channel media limit lookup
2026-04-20 13:41:39 +01:00
1f71137d1e
perf: narrow PDF extractor type surface
2026-04-19 01:26:13 +01:00
6e18f0e59e
test: share web media document loader
2026-04-19 00:43:32 +01:00
a5ea6d3cf4
test: share media fetch response mock
2026-04-19 00:35:43 +01:00
0195da6b0e
refactor: cache optional runtime imports
2026-04-18 20:45:26 +01:00
cc919db83b
chore(lint): enable async endpoint handler rule
2026-04-18 19:27:43 +01:00
8747351383
Media: keep inbound roots on media contracts
2026-04-17 14:56:47 -04:00
f334ca2b50
Auto-reply: fast-path sandbox media root resolution
2026-04-17 14:05:49 -04:00
4f00b76925
fix(context-window): Tighten context limits and bound memory excerpts ( #67277 )
...
* Tighten context limits and bound memory excerpts
* Align startup context defaults in config docs
* Align qmd memory_get bounds with shared limits
* Preserve qmd partial memory reads
* Fix shared memory read type import
* Add changelog entry for context bounds
2026-04-15 13:06:02 -05:00
d2a219ea44
fix(media): allow host-local CSV and Markdown uploads via Slack ( #67047 )
...
Merged via squash.
Prepared head SHA: 5ce11d0bac1853105+Unayung@users.noreply.github.com >
Co-authored-by: frankekn <712880+frankekn@users.noreply.github.com >
Reviewed-by: @frankekn
2026-04-15 20:38:17 +08:00
d21f07a39e
fix: allow workspace-rooted absolute media paths in auto-reply ( #66689 )
...
Merged via squash.
Prepared head SHA: 48206b5627140015627+joelnishanth@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-04-14 17:04:31 -04:00
450c3a8ed2
fix(security): include Matrix avatar params in sandbox media normalization + preserve mxc:// URLs + log gmail watcher stop failures [AI-assisted] ( #64701 )
...
Merged via squash.
Prepared head SHA: 54de3f019b108438815+slepybear@users.noreply.github.com >
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com >
Reviewed-by: @gumadeiras
2026-04-14 12:22:29 -04:00
e58d50b7a8
fix(telegram): trust explicit proxy DNS for media downloads ( #66461 )
2026-04-14 10:42:33 +01:00
a743b30b8b
fix: honor configured store limits ( #66240 ) (thanks @neeravmakwana)
...
* fix(media): honor configured store limits
* fix(media): report effective source limits
* refactor(media): distill configured limit wiring
---------
Co-authored-by: Ayaan Zaidi <hi@obviy.us >
2026-04-14 11:53:20 +05:30
e14efafa68
fix(qr): lazy load terminal runtime modules
2026-04-13 15:07:50 +01:00
cc5c691f00
feat(ui): render assistant directives and add embed tag ( #64104 )
...
* Add embed rendering for Control UI assistant output
* Add changelog entry for embed rendering
* Harden canvas path resolution and stage isolation
* Secure assistant media route and preserve UI avatar override
* Fix chat media and history regressions
* Harden embed iframe URL handling
* Fix embed follow-up review regressions
* Restore offloaded chat attachment persistence
* Harden hook and media routing
* Fix embed review follow-ups
* feat(ui): add configurable embed sandbox mode
* fix(gateway): harden assistant media and auth rotation
* fix(gateway): restore websocket pairing handshake flows
* fix(gateway): restore ws hello policy details
* Restore dropped control UI shell wiring
* Fix control UI reconnect cleanup regressions
* fix(gateway): restore media root and auth getter compatibility
* feat(ui): rename public canvas tag to embed
* fix(ui): address remaining media and gateway review issues
* fix(ui): address remaining embed and attachment review findings
* fix(ui): restore stop control and tool card inputs
* fix(ui): address history and attachment review findings
* fix(ui): restore prompt contribution wiring
* fix(ui): address latest history and directive reviews
* fix(ui): forward password auth for assistant media
* fix(ui): suppress silent transcript tokens with media
* feat(ui): add granular embed sandbox modes
* fix(ui): preserve relative media directives in history
* docs(ui): document embed sandbox modes
* fix(gateway): restrict canvas history hoisting to tool entries
* fix(gateway): tighten embed follow-up review fixes
* fix(ci): repair merged branch type drift
* fix(prompt): restore stable runtime prompt rendering
* fix(ui): harden local attachment preview checks
* fix(prompt): restore channel-aware approval guidance
* fix(gateway): enforce auth rotation and media cleanup
* feat(ui): gate external embed urls behind config
* fix(ci): repair rebased branch drift
* fix(ci): resolve remaining branch check failures
2026-04-11 07:32:53 -05:00
5605c89cb3
test: mock channel plugin lookup in media read policy
2026-04-11 07:20:06 +01:00
95bc417944
fix(cycles): split residual shared type seams
2026-04-11 02:46:40 +01:00
55578a5c40
fix: stabilize Codex runtime truthfulness ( #64439 ) (thanks @100yenadmin)
2026-04-11 01:19:32 +01:00
d85b2a0e81
refactor: simplify core conversions
2026-04-11 01:17:51 +01:00
b8cb0b4473
refactor: simplify image metadata dimensions
2026-04-10 23:38:44 +01:00
c949af9fab
fix(media): honor sender policy for host media reads ( #64459 )
...
* fix(media): honor sender policy for host media reads
* fix(media): clarify host read group policy gating
* fix(media): forward sender identity for outbound reads
* fix(media): propagate non-id sender fields through outbound session for e164/username/name policy matching
* fix(media): preserve requester provider for host read policy
* fix(media): forward full sender identity through followup and core send paths
* fix(media): forward requester session/account context through core send fallback
* fix(media): preserve account policy fallback for requester-scoped host reads
* chore(changelog): add outbound media sender-policy entry
* fix(media): align test call shape with production — omit messageProvider when sessionKey is set
Addresses P2 review: production call sites pass messageProvider: undefined
when sessionKey is present; tests should mirror that so regressions in
the precedence order are caught.
---------
Co-authored-by: Devin Robison <drobison@nvidia.com >
2026-04-10 13:07:56 -06:00
3174c6919d
refactor: dedupe gateway memory trimmed readers
2026-04-08 01:36:39 +01:00
ae4f8da94f
refactor: dedupe media and discord lowercase helpers
2026-04-07 13:44:41 +01:00
74ea9de6f2
refactor: dedupe reply lowercase helpers
2026-04-07 10:37:39 +01:00
Bartok