c83dcc2bc0
fix(security): harden network tool output at canonical owner boundaries ( #118984 )
...
* fix(security): bound external tool content at its canonical owner boundary
* fix(plugin-sdk): document supported security boundary and restore facade parity
2026-08-03 15:34:33 -07:00
3f37731175
docs(agents): surface hidden tool capabilities in model-facing descriptions ( #114516 )
2026-07-27 07:20:25 -04:00
990916c6ac
fix(firecrawl): reject malformed 2xx response envelopes ( #111210 )
...
* fix(firecrawl): reject malformed JSON envelopes
* test(firecrawl): use canonical plugin config fixture
Co-authored-by: Alix-007 <li.long15@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-19 20:41:48 -07:00
c7e7ac2728
refactor: remove expired plugin compatibility surfaces ( #111451 )
...
* docs(secrets): remove retired web credential paths
* refactor(web): remove retired provider compatibility paths
* refactor(providers): delete retired compatibility routes
* refactor(secrets): remove retired credential aliases
* refactor(plugin-sdk): delete retired compatibility surfaces
* docs(plugin-sdk): remove retired migration guidance
* chore(plugin-sdk): refresh rebased surface budgets
* chore(plugin-sdk): refresh API removal baseline
* refactor(compat): migrate retired internal callers
* chore(plugin-sdk): refresh current-main baselines
* test(config): migrate plugin-owned secret assertions
* test(gateway): narrow plugin secret refs
* fix(plugin-sdk): preserve private boundary type identity
* chore(compat): remove stale sweep references
* chore(lint): lower max-lines budget
* refactor(secrets): remove unused web helper
* build(plugin-sdk): drop removed compat entries
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): use Linux API baseline hash
* fix(plugin-sdk): preserve private bundled build entries
* fix(plugin-sdk): package private runtime facades
* fix(plugins): preserve external credential contracts
2026-07-19 11:04:48 -07:00
53b53f1977
improve(agents): exact web_fetch output contract with cleaned result shape ( #110223 )
...
* feat: add web fetch output contract
* fix(agents): keep web_fetch contract schema module-local
* docs: refresh docs map for the web_fetch result section
2026-07-18 03:28:29 +01:00
f81f9d8570
chore: enforce max-lines suppression ratchet ( #107315 )
...
* ci: enforce max-lines suppression ratchet
* chore: prune stale max-lines suppression
* fix: close max-lines ratchet enforcement gaps
* fix: harden max-lines ratchet checks
* fix(ci): satisfy max-lines ratchet checks
* style: format max-lines declarations
* fix(ci): match oxlint suppression grammar
* test: isolate max-lines git fixtures
* chore: prune resolved max-lines debt
* test: skip newline path fixture on Windows
* fix: harden max-lines suppression ratchet
* chore: refresh max-lines baseline
* fix: close max-lines ratchet bypasses
* fix: derive ratchet base from PR merge tree
* fix: support older Git in staged ratchet
* fix: align max-lines declarations and baseline
* chore: refresh max-lines baseline for current main
* fix: exclude generated wizard locales from max-lines
* chore: prune resolved max-lines debt
2026-07-14 09:27:02 -07:00
c8e94b202e
refactor(firecrawl): remove internal export seams ( #107485 )
2026-07-14 06:08:53 -07:00
8809848b19
feat(firecrawl): add keyless Firecrawl Search (Free) provider + richer firecrawl_search options ( #97078 )
...
* feat(firecrawl): add keyless Firecrawl Search (Free) provider + richer firecrawl_search options
Add an opt-in, keyless 'firecrawl-free' web_search provider (Firecrawl
Search (Free)) mirroring the Parallel plugin's parallel-free pattern:
requiresCredential false, no autoDetectOrder, never auto-selected. The
free path is credential-isolated — it never resolves or sends any
Firecrawl API key (no Authorization header), so opting out of credentials
cannot leak a configured/paid key — and its results and cache key carry a
distinct 'firecrawl-free' provider identity. The keyed 'firecrawl'
provider and core search auto-select behavior are unchanged, honoring the
maintainers' opt-in policy for keyless search.
Registered in index.ts, the web-search-provider barrel, the
web-search-contract-api metadata artifact (the onboarding/setup source),
manifest contracts, the official external plugin catalog snapshot, and
the doctor/contract registries.
Also extend the firecrawl_search tool to /v2/search parity:
includeDomains/excludeDomains (mutually exclusive), tbs, location,
country, and raise the result cap to 100.
* docs: regenerate docs_map for firecrawl heading rename
---------
Co-authored-by: developersdigest <jonathan@sideguide.dev >
2026-07-12 21:04:43 -07:00
81941f2d68
test: enable noUncheckedIndexedAccess for extension tests ( #105343 )
2026-07-12 12:48:22 +01:00
8034454568
fix(firecrawl): preserve Unicode in API errors ( #103487 )
...
* fix(firecrawl): preserve error detail Unicode
* test(firecrawl): cover Unicode error boundaries
* test(firecrawl): satisfy bundled lint
* test(firecrawl): streamline Unicode boundary coverage
* docs(changelog): credit Firecrawl Unicode fix
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-10 15:21:04 +01:00
9cf5079e56
refactor(plugins): localize provider internals ( #101425 )
2026-07-06 23:50:12 -07:00
2f6459093a
improve(web-fetch): speed up provider fallback loading ( #98559 )
...
* perf(web-fetch): add web fetch benchmark
* perf(web-fetch): cache provider fallback resolution
* perf(firecrawl): avoid duplicate scrape payload wrapping
* perf(web-readability): reuse void tag lookup
* fix(web-fetch): keep provider cache live
* fix(web-fetch): invalidate provider cache on registry swap
* perf(web-fetch): reduce html extraction overhead
* fix(web-fetch): bound provider discovery cache
* perf(web-fetch): avoid full plugin load on fallback
2026-07-04 12:47:10 -07:00
8c5f45fc36
refactor(shared): consolidate provider and utility lazy loaders ( #98749 )
...
* refactor(shared): consolidate provider lazy loaders
* refactor(shared): leave enforcement to follow-up
2026-07-02 21:16:26 -07:00
86b9b88f40
test(firecrawl): add unit tests for firecrawl client functions ( #97714 )
2026-06-29 07:58:40 -07:00
0a14444924
Bound successful provider response reads
2026-06-24 19:08:22 -05:00
beea31a6b5
feat(firecrawl): add keyless scrape support ( #94551 )
...
Merged under maintainer approval while exact-head CI was queue-bound.
Co-authored-by: Developers Digest <124798203+developersdigest@users.noreply.github.com >
Co-authored-by: Vincent Koc <vincentkoc@users.noreply.github.com >
2026-06-19 00:23:41 +08:00
4fa5092cdc
docs: document small extension sources
2026-06-04 21:02:07 -04:00
304e2c83c0
chore(lint): enable stricter oxlint rules
2026-05-31 18:59:02 +01:00
deb7bc6539
chore(lint): enable readability lint rules
2026-05-31 07:17:57 +01:00
f5e1fe9755
refactor: share firecrawl web search metadata
2026-05-29 07:41:27 +02:00
0d189102f5
fix: clamp web provider subsecond timeouts
2026-05-28 22:04:22 -04:00
27d1c08c51
fix: normalize web provider numeric params
2026-05-28 20:49:19 -04:00
3c907250b9
fix: validate firecrawl numeric options
2026-05-28 19:20:18 -04:00
11ef608685
fix: validate firecrawl numeric options
2026-05-28 18:18:33 -04:00
4f4d108639
chore(lint): remove underscore-dangle allow list ( #83542 )
...
* chore(lint): reduce underscore-dangle exceptions
* chore(lint): reduce more underscore exceptions
* chore(lint): remove underscore-dangle allow list
* fix(lint): repair underscore cleanup regressions
* test(lint): track version define suppression
2026-05-18 14:56:06 +01:00
fe680e47ce
fix(cli): scope web command secret refs
2026-05-17 10:42:57 +01:00
8659eabba7
fix(firecrawl): wrap malformed api json
2026-05-15 09:01:39 +08:00
827b0de0ce
refactor: reduce plugin sdk surface
2026-05-10 12:37:10 +01:00
eefb0ee6f8
test: tighten firecrawl tool assertions
2026-05-09 21:39:34 +01:00
d456dd1bd3
test: tighten command extension helper assertions
2026-05-08 20:50:06 +01:00
a1ea0b65de
test: tighten firecrawl fetch config assertion
2026-05-08 19:22:12 +01:00
f2c917d104
test: tighten firecrawl config assertion
2026-05-08 19:05:05 +01:00
450b541d77
test: clarify extension auth assertions
2026-05-08 13:02:44 +01:00
9ef37d1907
test: tighten assertions and harness coverage
2026-05-08 05:28:12 +01:00
6a4069dead
fix: share plugin runtime helpers
...
Consolidate shared plugin runtime MIME/schema helpers, preserve canonical runtime behavior, and guard QQBot STT fetches.
2026-05-08 00:28:43 +01:00
1ef85c7d4c
test: make suites safe without isolation ( #78834 )
...
* test: make suites safe without isolation
* fix: narrow auth profile credential types
* test: inject channel module loader factory locally
2026-05-07 08:43:29 +01:00
189ab9f5d1
fix(firecrawl): block unsafe scrape targets
2026-05-02 07:24:40 +01:00
1771160d2c
fix(web-search): restrict private network guard
2026-05-02 06:39:48 +01:00
b66459e3c2
fix(web-search): support self-hosted Firecrawl
2026-05-02 06:34:31 +01:00
38e162dc71
refactor: trim slack test helper exports
2026-05-01 20:26:34 +01:00
c1f31f3870
refactor: trim provider helper exports
2026-05-01 16:25:10 +01:00
f34b41f198
refactor: split plugin sdk test helpers
2026-04-28 01:14:19 +01:00
74e62c32c3
test: route extension tests through sdk subpaths
2026-04-27 21:58:48 +01:00
4336a7f3a9
refactor(plugin-sdk): narrow config runtime imports
2026-04-27 14:58:32 +01:00
ef7ad8229a
fix(voicewake): drop stale sdk collateral
2026-04-26 06:19:35 +01:00
afe1abc297
feat(voicewake): refresh trigger routing on main
2026-04-26 06:19:35 +01:00
b2472d6560
build: migrate schema deps to typebox
2026-04-23 04:59:42 +01:00
7ca649413a
refactor: share env secret ref allowlist check
2026-04-20 23:42:11 +01:00
a7e029fde9
refactor: cache provider tool runtimes
2026-04-18 19:05:00 +01:00
2482e70fb8
test: narrow web search contract runtime loads
...
Honor targeted includes in the contracts Vitest lane and compare bundled
web-search fast-path artifacts against plugin-owned runtime artifacts instead
of loading whole plugin entries. Split Google and Firecrawl runtime-only work
behind lazy seams so provider registration stays metadata-light.
Also keep Perplexity contract metadata aligned by sharing its runtime transport
resolution with the contract artifact.
2026-04-17 17:26:46 -04:00
Peter Steinberger