Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
663 commits
Select commit Hold shift + click to select a range
933aeb9
test(webapp): stub the agent proxy's environment lookup, not a Prisma…
kathiekiwi Aug 6, 2026
05b3472
Merge branch 'main' into feat/dashboard-agent-flows
kathiekiwi Aug 6, 2026
d73f3f5
chore: ignore the agent worktrees directory
kathiekiwi Aug 6, 2026
48d0d4a
fix(webapp): drop the img-src wildcard host for a validated origin al…
kathiekiwi Aug 6, 2026
cd112ba
test(webapp): assert the document img-src has no wildcard host
kathiekiwi Aug 6, 2026
5adba81
docs: document CSP_IMG_SRC_ALLOWLIST for self-hosted image hosts
kathiekiwi Aug 6, 2026
fb99526
feat(dashboard-agent): tell the eval judge a failure's kind without i…
kathiekiwi Aug 6, 2026
9daa8f9
docs(dashboard-agent): tell the judge the error category is derived, …
kathiekiwi Aug 6, 2026
09d1b55
fix(webapp): require the watch card's request id instead of falling b…
kathiekiwi Aug 6, 2026
22bf6d9
fix(webapp): cancel the watch a losing submit's winner does not name
kathiekiwi Aug 6, 2026
210863e
fix(webapp): separate a watch's last look from its last check in the …
kathiekiwi Aug 6, 2026
240799d
chore(dashboard-agent): drop the comments the code already says
kathiekiwi Aug 6, 2026
478b30c
chore(dashboard-agent): drop the test comments the assertions already…
kathiekiwi Aug 6, 2026
4e00b79
style(webapp): format the sweep's authorization helper
kathiekiwi Aug 6, 2026
d00b126
fix(webapp): bind a delegated token's environment claim on the projec…
kathiekiwi Aug 6, 2026
a7fc406
fix(webapp): keep a delegated token's claims on the authenticated ide…
kathiekiwi Aug 6, 2026
f700174
fix(webapp): ceiling an exchanged environment JWT by what the delegat…
kathiekiwi Aug 6, 2026
3336a47
test(webapp): give the container-backed user-actor scope tests their …
kathiekiwi Aug 6, 2026
7a645e5
chore(webapp): drop the comments the code already says
kathiekiwi Aug 6, 2026
79482de
chore(webapp): drop the comments the tests already say
kathiekiwi Aug 6, 2026
d646809
chore(rbac): keep the delegated-token invariant, drop the essay
kathiekiwi Aug 6, 2026
c4d3f58
fix(webapp): replay a watch submission's recorded email outcome inste…
kathiekiwi Aug 6, 2026
49e8fb5
fix(webapp): tell a watch's creator about their own email alerts, not…
kathiekiwi Aug 6, 2026
7b2f9c6
chore(dashboard-agent-db): drop the submission's external-notificatio…
kathiekiwi Aug 6, 2026
f7b8374
fix(webapp): put a turn's settled investigation card in the transcript
kathiekiwi Aug 6, 2026
26f93da
fix(webapp): have the stale-investigation sweep close the card it set…
kathiekiwi Aug 6, 2026
07b83da
docs: note the agent's closed investigations, watch email honesty and…
kathiekiwi Aug 6, 2026
60a9584
test(webapp): fail if a route sets an over-broad image CSP
kathiekiwi Aug 6, 2026
e62d8c6
style(webapp): format the route image CSP audit
kathiekiwi Aug 6, 2026
1759618
fix(webapp): keep the project-wide answer for an environment-agnostic…
kathiekiwi Aug 6, 2026
657f11d
docs(webapp): say which UAT flow the project-wide answer is preserved…
kathiekiwi Aug 6, 2026
29de34f
style(webapp): drop the imports the merge left unused
kathiekiwi Aug 6, 2026
5bf3612
fix(webapp): settle an investigation and its closing card in one write
kathiekiwi Aug 6, 2026
37c56aa
test(webapp): pin the settlement failure window and the open panel
kathiekiwi Aug 6, 2026
44b4e57
docs: say the investigation card closes while the panel is open
kathiekiwi Aug 6, 2026
49a1504
docs: cut the release note back to what a user notices
kathiekiwi Aug 6, 2026
2e23a09
fix(webapp): keep the other Anthropic options when the step breakpoin…
kathiekiwi Aug 6, 2026
f6f753c
fix(webapp): merge the transcript under the row lock instead of repla…
kathiekiwi Aug 6, 2026
afc0cfa
fix(webapp): close a consented watch investigation's card atomically
kathiekiwi Aug 6, 2026
d52c224
fix(dashboard-agent): merge the step breakpoint into the message's an…
kathiekiwi Aug 6, 2026
abaeebb
fix(webapp): make a repeated watch card close leave the revision alone
kathiekiwi Aug 6, 2026
c3f4ba8
refactor(webapp): drop the unused settleOpenInvestigations
kathiekiwi Aug 6, 2026
7ab35df
fix(webapp): merge the turn's cache breakpoint into the last message'…
kathiekiwi Aug 6, 2026
020dad2
refactor(webapp): store the dashboard agent's transcript one row per …
kathiekiwi Aug 6, 2026
81e8349
refactor(webapp): drop the dashboard agent's JSONB transcript column
kathiekiwi Aug 6, 2026
398a298
test(webapp): cover the batch position allocator with concurrent turns
kathiekiwi Aug 6, 2026
aad8498
fix(webapp): converge the watch transcript when a retried delivery fi…
kathiekiwi Aug 6, 2026
d8fda07
fix(webapp): stop an ordinary transcript write from rewriting a store…
kathiekiwi Aug 6, 2026
f159c69
test(webapp): guard against a raw-SQL reference to the dropped chats.…
kathiekiwi Aug 6, 2026
ceaa38d
fix(webapp): scope the watch transcript's appends to the caller's org…
kathiekiwi Aug 6, 2026
3d3c962
fix(webapp): keep a malformed message's own text out of the error, an…
kathiekiwi Aug 6, 2026
e3fcc20
refactor(dashboard-agent-db): collapse the agent's migrations into one
kathiekiwi Aug 6, 2026
f4337f7
style(dashboard-agent-db): format the generated migration snapshot
kathiekiwi Aug 6, 2026
bb036f9
feat(webapp): split Watch out of the dashboard agent's first PR
kathiekiwi Aug 6, 2026
9fad665
test(webapp): cover the dashboard agent's eval-policy gate, and requi…
kathiekiwi Aug 7, 2026
c37bdf8
test(webapp): pin the delegated token's scope ceiling on the RBAC fal…
kathiekiwi Aug 7, 2026
5edfd78
feat(webapp): name the dashboard agent Ask Trigger everywhere
kathiekiwi Aug 7, 2026
c88a448
refactor(webapp): rename the ask-ai button variant to ask-trigger
kathiekiwi Aug 7, 2026
0d3d216
feat(webapp): drop the agent button from the deploy blank states
kathiekiwi Aug 7, 2026
9c6f148
chore(webapp): keep Ask AI in the tree, deprecated and unmounted
kathiekiwi Aug 7, 2026
db9f9a2
Merge remote-tracking branch 'origin/main' into feat/dashboard-agent-…
kathiekiwi Aug 7, 2026
dfcee8b
fix(webapp): settle the API keys route after merging main
kathiekiwi Aug 7, 2026
49051f5
fix(dashboard-agent-db): stop rewriting the published migration history
kathiekiwi Aug 7, 2026
798fdf9
refactor(webapp): split the dashboard agent's UI out of the first PR
kathiekiwi Aug 7, 2026
c025bbf
fix(dashboard-agent): keep the finished answer in the transcript, not…
kathiekiwi Aug 7, 2026
2ff7ec0
fix(dashboard-agent): name a head-started chat instead of leaving it …
kathiekiwi Aug 7, 2026
711b79e
fix(dashboard-agent): apply the token's cap as a second ceiling, and …
kathiekiwi Aug 7, 2026
c236601
feat(webapp): let an environment JWT read a queue, as it already read…
kathiekiwi Aug 7, 2026
8adf2b2
Merge remote-tracking branch 'origin/main' into feat/dashboard-agent-…
kathiekiwi Aug 7, 2026
df2227e
fix(webapp): resolve a test's route paths from the test, not the repo…
kathiekiwi Aug 7, 2026
bd357fc
revert(webapp): put the JWT exchange back to how main had it
kathiekiwi Aug 7, 2026
f891584
fix(webapp): stub what the env JWT act-claim test's route actually calls
kathiekiwi Aug 7, 2026
cb0bcc9
fix(webapp): refuse an environment-scoped token on a route that names…
kathiekiwi Aug 7, 2026
0f2814e
fix(dashboard-agent): escape model-supplied ids in tool request paths
kathiekiwi Aug 7, 2026
33a3f6b
fix(dashboard-agent): require both halves of the support endpoint config
kathiekiwi Aug 7, 2026
983055a
fix(dashboard-agent): keep a withheld object's key names from the eva…
kathiekiwi Aug 7, 2026
5126bae
fix(webapp): gate a run's commit metadata on reading deployments
kathiekiwi Aug 7, 2026
2d23dde
fix(webapp): keep the retired chats.messages column, and allow Google…
kathiekiwi Aug 8, 2026
05505d5
fix(webapp): carry a queue's depth forward across empty buckets
kathiekiwi Aug 8, 2026
1ee6704
fix(webapp): describe how far a report metric fell
kathiekiwi Aug 8, 2026
0db1cf0
fix(webapp): say why a report's numbers can't be trusted
kathiekiwi Aug 8, 2026
d0be659
test(webapp): assert the queue depth trend fills its bucket grid
kathiekiwi Aug 8, 2026
4c42230
fix(webapp): stop treating a ClickHouse unknown identifier as a rollo…
kathiekiwi Aug 8, 2026
aa55227
fix(cli): say that a capless mint-token is read-only
kathiekiwi Aug 8, 2026
f598f96
fix(webapp): refuse a dashboard agent turn whose token mint failed
kathiekiwi Aug 8, 2026
b38c518
fix(webapp): stop a failed agent chat start leaving an empty chat behind
kathiekiwi Aug 8, 2026
de4cdad
fix(webapp): list the preview branch an agent token is scoped to
kathiekiwi Aug 8, 2026
e2704ea
fix(webapp): keep identityOnly off action routes in the type
kathiekiwi Aug 8, 2026
f6afda3
docs(dashboard-agent): say what the queue path encoding is for
kathiekiwi Aug 8, 2026
14d70be
docs(webapp): say that the agent is off until a flag turns it on
kathiekiwi Aug 8, 2026
c3f0d62
fix(webapp): undo a new agent chat only when its start never got anyw…
kathiekiwi Aug 8, 2026
314a1d7
perf(webapp): skip the global feature-flag query when a per-org overr…
kathiekiwi Aug 8, 2026
a4ba027
fix(webapp): refuse a delegated token at the entrance of the PAT-only…
kathiekiwi Aug 8, 2026
d0f06d5
fix(webapp,dashboard-agent): address a branch environment by name and…
kathiekiwi Aug 8, 2026
a660349
fix(webapp): make each report caveat discount only the input it names
kathiekiwi Aug 8, 2026
3355b68
fix(webapp): stop an unmeasured queue depth from silencing a measured…
kathiekiwi Aug 8, 2026
566de27
docs: say that the agent works on branches
kathiekiwi Aug 8, 2026
ad2698b
feat(webapp): render the cards the flows already emit
kathiekiwi Aug 8, 2026
643ea39
fix(dashboard-agent): read the report's untrustworthy reason under it…
kathiekiwi Aug 8, 2026
ed0a7b3
fix(dashboard-agent): stop a retrieved run's own error counting as a …
kathiekiwi Aug 8, 2026
0cae301
fix(dashboard-agent): pin the investigation cards the transcript actu…
kathiekiwi Aug 8, 2026
8fc6f20
style(dashboard-agent): format the two eval test files
kathiekiwi Aug 8, 2026
c3b7c10
refactor(dashboard-agent): move the watch data layer into the Watch PR
kathiekiwi Aug 8, 2026
36691f1
chore: mark drizzle and test snapshots as generated
kathiekiwi Aug 8, 2026
7e272cc
chore(webapp): drop the unused waiting-run diagnosis
kathiekiwi Aug 8, 2026
d40e9fe
chore: mark the lockfile as generated too
kathiekiwi Aug 9, 2026
2aacd26
fix(webapp,dashboard-agent): keep investigation cards, and stop a bro…
kathiekiwi Aug 9, 2026
8fd5369
revert(webapp): move the queue JWT read to the PR that uses it
kathiekiwi Aug 9, 2026
0fd886c
perf(webapp): stop the agent transcript re-rendering on every streame…
kathiekiwi Aug 9, 2026
9805c0a
fix(webapp): deny an unknown report key instead of authorizing it aga…
kathiekiwi Aug 9, 2026
20c8f9e
fix(webapp): stop an unreadable eval override reading as consent to j…
kathiekiwi Aug 9, 2026
449e9f3
feat(webapp): the dashboard agent's UI
kathiekiwi Aug 7, 2026
44cf389
style(webapp): use the agent's own logo in the Help & Feedback entry
kathiekiwi Aug 7, 2026
1d094a8
fix(webapp): drop Keep digging once the turn has already kept digging
kathiekiwi Aug 7, 2026
ebd1b76
feat(webapp): give Cmd-I and the CLI's help link back to Ask AI
kathiekiwi Aug 8, 2026
6120967
test(webapp): give the untrustworthy report fixture the reason field …
kathiekiwi Aug 8, 2026
a447e86
fix(webapp): give each copyable task snippet its own SDK import
kathiekiwi Aug 8, 2026
9acbcbf
fix(webapp): drop a run diagnosis action that has nowhere to go
kathiekiwi Aug 8, 2026
4db8ab3
fix(webapp): stop Cmd-J opening Chrome's downloads
kathiekiwi Aug 8, 2026
e73112d
fix(webapp): keep an empty chat open instead of showing a new one
kathiekiwi Aug 8, 2026
4e27872
docs: say where the docs went now the header button is gone
kathiekiwi Aug 8, 2026
8c682da
perf(webapp): keep report blocks out of the investigation winner pass
kathiekiwi Aug 8, 2026
db578e0
fix(webapp): give icon-only tooltip buttons an accessible name
kathiekiwi Aug 8, 2026
4472339
fix(webapp): stop a zero-limit queue reading as at capacity
kathiekiwi Aug 8, 2026
466ed7d
fix(webapp): stop the agent's retry duplicating the failed message
kathiekiwi Aug 8, 2026
2c7575f
docs(webapp): say who Cmd-I actually opens the agent for
kathiekiwi Aug 8, 2026
e8c43e4
fix(webapp): time the report sparkline's bars from the report, not th…
kathiekiwi Aug 8, 2026
a09d8a8
fix(webapp): key a repeated view block by its own position
kathiekiwi Aug 8, 2026
e27e80e
fix(webapp): send a deep-linked question once
kathiekiwi Aug 8, 2026
084d45f
fix(webapp): stop the URI resolver working after the panel closes
kathiekiwi Aug 8, 2026
022388c
fix(webapp): announce the composer's counter and name the history button
kathiekiwi Aug 8, 2026
5e8b6e1
fix(webapp): keep the hero's heading reachable when it outgrows the p…
kathiekiwi Aug 8, 2026
8d2e2c9
fix(webapp): pin the AI-help redirect to the dashboard's own origin
kathiekiwi Aug 8, 2026
fd11d3a
fix(webapp): read the agent's page label from the left of the path
kathiekiwi Aug 8, 2026
aaed07b
fix(webapp): step the composer's live region instead of reading every…
kathiekiwi Aug 8, 2026
b282c79
fix(webapp): key an investigation's action rows by position, not by kind
kathiekiwi Aug 8, 2026
886e802
fix(webapp): treat a transcript re-read that isn't a list as a failed…
kathiekiwi Aug 8, 2026
f64c1d1
fix(webapp): stop the Ask AI host remounting the dashboard, and four …
kathiekiwi Aug 9, 2026
43a9199
fix(webapp): stop the CLI's AI help link dead-ending without an AI su…
kathiekiwi Aug 9, 2026
d87ca1d
perf(webapp): restore the stripped-message cache the UI rewrite dropped
kathiekiwi Aug 9, 2026
57f0762
test(webapp): use a static import in the sweep card test
kathiekiwi Aug 9, 2026
61a3288
fix(webapp): scope the org-creation RBAC check to user-actor tokens
kathiekiwi Aug 9, 2026
8fbbcf0
test(webapp): pin 404-before-403 ordering for capped user-actor tokens
kathiekiwi Aug 9, 2026
0787f0c
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
637a2bb
test(webapp): pin that an ordinary PAT still passes the PAT-only helper
kathiekiwi Aug 9, 2026
c78eaca
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
82b93db
fix(webapp): compute answered for view blocks in the base message ren…
kathiekiwi Aug 9, 2026
a72b797
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
d304c1a
test(webapp): assert the org route never consults a plain PAT ability
kathiekiwi Aug 9, 2026
8f017ec
test(webapp): pin that the disabled org route never consults the toke…
kathiekiwi Aug 9, 2026
49f42de
fix(webapp): allow the org-avatar favicon endpoint in the img-src policy
kathiekiwi Aug 9, 2026
a6782c0
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
edb48d5
fix(webapp): close the queued-reload race and the backslash route escape
kathiekiwi Aug 9, 2026
3984b5c
fix(webapp): report card keeps its series and links, and the metric g…
kathiekiwi Aug 9, 2026
dbb4d34
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
e4ab0a5
test(webapp): the report block adapter keeps series and links
kathiekiwi Aug 9, 2026
08871bf
fix(webapp): fit the report metric row at the default panel width
kathiekiwi Aug 9, 2026
acf5a14
fix(webapp): a dead stream with a dangling tool call self-heals from …
kathiekiwi Aug 9, 2026
bf82cce
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
df64bec
fix(sdk): chat streams reconnect when the body ends mid-turn
kathiekiwi Aug 9, 2026
dd789e2
fix(sdk): re-earn the reconnect budget on any record and honor abort …
kathiekiwi Aug 9, 2026
4378c69
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
2f3b2ec
fix(webapp): the last-chat key stays org-true and a foreign chat heal…
kathiekiwi Aug 9, 2026
a264213
fix(webapp): lift the finding line text 2px
kathiekiwi Aug 9, 2026
0d2760e
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
be99614
fix(webapp): the finding text lifts alone, the label stays with the icon
kathiekiwi Aug 9, 2026
87f1d11
fix(webapp): drop the headline icon 4px
kathiekiwi Aug 9, 2026
cd08d08
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
df020b1
fix(webapp): finding text sits 2px up, not 4
kathiekiwi Aug 9, 2026
d6e1b4e
fix(webapp): a self-evident finding keeps its line and drops the echo…
kathiekiwi Aug 9, 2026
6fcf1cf
fix(webapp): only the warning headline icon sits lower
kathiekiwi Aug 9, 2026
c40b25d
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 9, 2026
709065a
fix(webapp): a delta arrow without a magnitude renders nothing
kathiekiwi Aug 10, 2026
b603cfb
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 10, 2026
730ded1
test(webapp): a collapse to zero renders no arrow
kathiekiwi Aug 10, 2026
8e675a1
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 10, 2026
94f786c
fix(webapp): chat code blocks render at 12px
kathiekiwi Aug 10, 2026
d1840a2
fix(webapp): revive the code block styling streamdown 2.5 renamed away
kathiekiwi Aug 10, 2026
7789d1f
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 10, 2026
b73599b
fix(webapp): action rows render at the end of the turn
kathiekiwi Aug 10, 2026
01ef8fd
fix(webapp): navigation filters speak the run page's language
kathiekiwi Aug 10, 2026
4d9af86
fix(dashboard-agent): navigate_to teaches the run-status vocabulary a…
kathiekiwi Aug 10, 2026
489869e
Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into…
kathiekiwi Aug 10, 2026
69c7b02
test(webapp): report parity matches the de-duplicated untrustworthy l…
kathiekiwi Aug 10, 2026
a6ae419
merge: origin/main into dashboard-agent base (resolve report-health)
kathiekiwi Aug 10, 2026
f93f8d6
fix(webapp): detect tables inside a JOIN…ON subquery for query-scope …
kathiekiwi Aug 10, 2026
fb4f0b3
fix(webapp): stop the agent body cap matching a task named dashboard-…
kathiekiwi Aug 10, 2026
bb077d4
fix(dashboard-agent): time out stalled agent HTTP calls
kathiekiwi Aug 10, 2026
28c28e6
fix(webapp): cap report cache TTL to the liveness fresh window
kathiekiwi Aug 10, 2026
aef86b3
fix(webapp): reword the healthy-execution report line to not imply fa…
kathiekiwi Aug 10, 2026
64eaf2f
fix(webapp): return 400 for ai-help with a missing query param
kathiekiwi Aug 10, 2026
35ab0c5
fix(webapp): ceiling a capless user-actor token to read-only on env-J…
kathiekiwi Aug 10, 2026
6cb0631
fix(webapp): clamp an env-JWT's lifetime to the delegated token's expiry
kathiekiwi Aug 10, 2026
e367280
fix(webapp): gate the agent maintenance cron on the agent being confi…
kathiekiwi Aug 10, 2026
3f1eec6
docs(errors-api-e2e): mint the e2e token with an explicit write cap
kathiekiwi Aug 10, 2026
502e1bd
fix(webapp): block remote images in model-authored markdown
kathiekiwi Aug 10, 2026
65c60df
fix(webapp): reject CSP-delimiter characters in the img-src allowlist
kathiekiwi Aug 10, 2026
237f01a
test(webapp): assert report cache TTL stays within the liveness fresh…
kathiekiwi Aug 10, 2026
ca2bacd
merge: base-misc review fixes (M2, M10a, H8, H13, M10r, ai-help, swee…
kathiekiwi Aug 10, 2026
b962949
test(webapp): assert StreamdownRenderer drops remote image src end-to…
kathiekiwi Aug 10, 2026
94c3a47
merge: CSP review fixes (B2 block remote model images, B4 reject CSP …
kathiekiwi Aug 10, 2026
99bbc07
merge: propagate review fixes from feat/dashboard-agent-flows
kathiekiwi Aug 10, 2026
39ba709
fix(dashboard-agent): fence and cap untrusted free-text in tool results
kathiekiwi Aug 10, 2026
5a83bcb
fix(dashboard-agent): tell the agent fenced tool text is data, not in…
kathiekiwi Aug 10, 2026
bf6872d
fix(dashboard-agent): neutralize fence delimiters in payload and fenc…
kathiekiwi Aug 10, 2026
2e58b36
fix(webapp,cli): cap user-actor token lifetime at 7 days
kathiekiwi Aug 10, 2026
1acb6b8
fix(webapp): bind user-actor tokens to their source PAT
kathiekiwi Aug 10, 2026
c18a073
fix(webapp): give the agent's env JWT a stable rate-limit key
kathiekiwi Aug 10, 2026
1e97712
test(webapp): cover the jwt-actor rate-limit branch, not just the helper
kathiekiwi Aug 10, 2026
a97ada5
fix(webapp): recheck the source PAT against the token's own claim, no…
kathiekiwi Aug 10, 2026
b14c8f3
merge: B3 prompt-injection boundary on tool results
kathiekiwi Aug 10, 2026
d6f67d4
merge: H3 PAT-bound token revocation + 7d ceiling, H9 stable rate-lim…
kathiekiwi Aug 10, 2026
876ed56
feat(webapp,dashboard-agent-db): retain and purge deleted agent chats
kathiekiwi Aug 10, 2026
8506877
merge: propagate wave-2 review fixes from feat/dashboard-agent-flows
kathiekiwi Aug 10, 2026
18379a4
fix(webapp): don't let a failed agent-purge enqueue break org deletion
kathiekiwi Aug 10, 2026
41fdffe
merge: org-delete agent-purge enqueue is best-effort
kathiekiwi Aug 10, 2026
2bcd7eb
merge: propagate org-purge best-effort from feat/dashboard-agent-flows
kathiekiwi Aug 10, 2026
70c1092
fix(webapp): keep the stored chat pointer when opening a chat fails t…
kathiekiwi Aug 10, 2026
3977c2d
fix(dashboard-agent): finalize the turn's own message ids from newUIM…
kathiekiwi Aug 10, 2026
bd5f8fd
fix(dashboard-agent-db): scope softDeleteChat by organizationId
kathiekiwi Aug 10, 2026
2932b88
merge: newUIMessages finalize + softDeleteChat org-scope review-comme…
kathiekiwi Aug 10, 2026
83b7f07
merge: openChat chat-pointer transient 5xx review-comment fixes
kathiekiwi Aug 10, 2026
c0a93b0
merge: propagate review-comment fixes from feat/dashboard-agent-flows
kathiekiwi Aug 10, 2026
5b6e4d0
fix(webapp): replace a stale running step when a settled transcript i…
kathiekiwi Aug 11, 2026
917c75b
merge: replace stale running step on settled transcript re-read
kathiekiwi Aug 11, 2026
40a610b
chore(server-changes): consolidate the dashboard-agent notes into one
kathiekiwi Aug 11, 2026
a1dc88a
merge: consolidate dashboard-agent server-changes 11 to 1
kathiekiwi Aug 11, 2026
12e04c2
merge: propagate server-changes consolidation from feat/dashboard-age…
kathiekiwi Aug 11, 2026
1424441
chore: consolidate this PR's changesets into one
kathiekiwi Aug 11, 2026
fe30aa4
docs(server-changes): restore dropped user-facing dashboard agent points
kathiekiwi Aug 11, 2026
f7dfc90
fix(webapp): stop the project-wide user-actor route 500-ing for claim…
kathiekiwi Aug 11, 2026
32ea4b0
test(webapp): add the recheck export to stale user-actor auth mocks
kathiekiwi Aug 11, 2026
4736a93
merge: add recheck/assertSourcePatActive exports to stale auth test m…
kathiekiwi Aug 11, 2026
db414b7
merge: consolidate PR changesets and restore dropped note points
kathiekiwi Aug 11, 2026
bdf1126
merge: propagate changeset consolidation and note restoration from fe…
kathiekiwi Aug 11, 2026
2aeb32f
refactor(webapp): move dashboard-agent render UI to the UI PR
kathiekiwi Aug 11, 2026
635cab2
chore: mark generated drizzle meta as generated
kathiekiwi Aug 11, 2026
f7a7753
merge: propagate base UI relocation + drizzle attribution
kathiekiwi Aug 11, 2026
24c87c3
test(webapp): assert FROM-less SELECT is valid in the tsql linter
kathiekiwi Aug 11, 2026
4962f7a
test(webapp): update the stale missing-FROM tsql linter case
kathiekiwi Aug 11, 2026
8f8fb98
merge: propagate the tsql linter test fix from feat/dashboard-agent-f…
kathiekiwi Aug 11, 2026
b2f1d82
test(webapp): move card/winner tests to the UI PR with their render code
kathiekiwi Aug 11, 2026
6a64769
merge: propagate card-test relocation
kathiekiwi Aug 11, 2026
54ab14f
chore: merge main into feat/dashboard-agent-flows
kathiekiwi Aug 11, 2026
eca32d2
chore: merge feat/dashboard-agent-flows (main sync)
kathiekiwi Aug 11, 2026
1e7f861
fix(webapp): clear the history-list thinking marker when the streamin…
kathiekiwi Aug 11, 2026
dec52bd
chore: merge main into feat/dashboard-agent-ui (post-squash of #4418)
kathiekiwi Aug 11, 2026
eb4f824
fix(webapp): harden model-facing sanitizers, claims resolution and so…
kathiekiwi Aug 11, 2026
a964b09
fix(webapp): keep the draft on Escape and finish polling a died-mid-t…
kathiekiwi Aug 11, 2026
843d02b
fix(webapp): let a second Escape close the panel while keeping the fi…
kathiekiwi Aug 11, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .changeset/chat-stream-mid-turn-reconnect.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@
"trigger.dev": patch
---

Chat in the browser now reconnects when the connection drops mid-turn, instead of leaving the reply stuck as if it were still generating. Reports can be fetched as structured data with the `json` format, and the shortest report period is now one minute (`30m`, `1h`, `7d`). The `mint-token` command's help is clearer too: a token minted without `--cap` is read-only, and `--ttl` shows the correct maximum lifetime of 7 days.
Chat in the browser now reconnects when the connection drops mid-turn, instead of leaving the reply stuck as if it were still generating. Reports can be fetched as structured data with the `json` format, and the shortest report period is now one minute (`1m`, `30m`, `1h`, `7d`). The `mint-token` command's help is clearer too: a token minted without `--cap` is read-only, and `--ttl` shows the correct maximum lifetime of 7 days.
13 changes: 13 additions & 0 deletions .claude/agents/code-reviewer.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
---
name: code-reviewer
description: Adversarially verifies one landed packet against its requirement; read-only.
model: opus
---

You are an adversarial code reviewer for one landed packet. READ-ONLY: never modify code, never commit, never push, never post to GitHub.

- Try to refute that the change answers its stated requirement; look for the failure scenario, not confirmation.
- Check the diff for unrelated drift, dead code, broken semantics of neighbors, and whether tests prove the actual invariant (would the test fail if the fix were subtly wrong?).
- Check the change landed in the correct PR/branch of the stack.
- Distinguish fact from inference; cite exact file:line evidence.
- Return: verdict (approve / needs-changes) with evidence per concern, and the exact minimal correction when needs-changes.
16 changes: 16 additions & 0 deletions .claude/agents/code-writer.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
name: code-writer
description: Implements exactly one work packet — minimal diff, targeted checks, own-paths-only commits.
model: opus
---

You are a code writer. Implement exactly the one work packet in your prompt.

- Minimal diff; match surrounding style and idiom.
- Prefer no comment at all; comment only a non-obvious constraint, max 2 short lines. All texts (comments, commit messages) short, clear, simple.
- Verify the packet's own diagnosis against the code before applying; if it is wrong, STOP without committing and report why.
- Run only the targeted checks for your packet: the relevant vitest files, `pnpm run typecheck --filter <pkg>` when the change warrants it. Never full suites unless asked.
- `pnpm run format` on touched files before committing.
- Stage and commit ONLY your packet's files. Conventional commit message. NO Claude attribution, no Co-Authored-By.
- Push only if the packet explicitly says to.
- Return: what changed, evidence (test output), commit SHA, and anything contradicting the diagnosis.
12 changes: 12 additions & 0 deletions .claude/agents/software-architect.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
name: software-architect
description: Resolves contested design questions against the specs; decision + rationale, never code.
model: opus
---

You are a software architect. Resolve exactly the contested design question in your prompt against the given specs/contracts. READ-ONLY.

- Ground the decision in the actual code and the project's design contracts (GUIDEBOOK, Linear specs) — not in generic best practice.
- Weigh stack boundaries: which PR owns the change, what merges independently.
- Prefer the smallest decision that unblocks the packet; flag speculative architecture rather than endorsing it.
- Return: the decision, its rationale, rejected alternatives (one line each), and exactly what the dependent packet should do.
78 changes: 31 additions & 47 deletions apps/webapp/app/components/AskAI.tsx
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
/**
* @deprecated Superseded by the dashboard agent (`components/dashboard-agent`). Nothing mounts
* this any more — every Ask AI entry point now opens Ask Trigger. Kept until the agent has
* shipped, then removed along with `@kapaai/react-sdk` and `KAPA_AI_WEBSITE_ID`.
* Mostly superseded by the dashboard agent (`components/dashboard-agent`), which owns every
* entry point except two: ⌘I and the CLI's `?aiHelp=` link still open Ask AI. `AskAIRoot` is
* mounted by the `_app` layout for those; the `AskAI` button below is mounted nowhere.
*/

import {
Expand All @@ -17,13 +17,17 @@ import { useSearchParams } from "@remix-run/react";
import DOMPurify from "dompurify";
import { motion } from "framer-motion";
import { marked } from "marked";
import { type ReactNode, useCallback, useEffect, useRef, useState } from "react";
import { useTypedRouteLoaderData } from "remix-typedjson";
import { useCallback, useEffect, useRef, useState } from "react";
import { AISparkleIcon } from "~/assets/icons/AISparkleIcon";
import { SparkleListIcon } from "~/assets/icons/SparkleListIcon";
import { useFeatures } from "~/hooks/useFeatures";
import { useAskAiAvailability } from "~/hooks/useAskAiAvailability";
import { useShortcutKeys } from "~/hooks/useShortcutKeys";
import { type loader } from "~/root";
import {
ASK_AI_DEEP_LINK_PARAM,
ASK_AI_SHORTCUT,
askAiCanOpen,
} from "./dashboard-agent/ask-ai-channels";
import { useAskAiHost } from "./dashboard-agent/askAiOpenRequest";
import { Button } from "./primitives/Buttons";
import { Callout } from "./primitives/Callout";
import { Dialog, DialogContent, DialogHeader, DialogTitle } from "./primitives/Dialog";
Expand All @@ -40,11 +44,6 @@ import {
} from "./primitives/Tooltip";
import { ClientOnly } from "remix-utils/client-only";

function useKapaWebsiteId() {
const routeMatch = useTypedRouteLoaderData<typeof loader>("root");
return routeMatch?.kapa.websiteId;
}

/** Open/close state for the Ask AI dialog, including the `?aiHelp=` deep-link handling. */
function useAskAIState() {
const [isOpen, setIsOpen] = useState(false);
Expand All @@ -67,14 +66,14 @@ function useAskAIState() {

// Handle URL param functionality
useEffect(() => {
const aiHelp = searchParams.get("aiHelp");
const aiHelp = searchParams.get(ASK_AI_DEEP_LINK_PARAM);
if (aiHelp) {
// Delay to avoid hCaptcha bot detection
window.setTimeout(() => openAskAI(aiHelp), 1000);

// Clone instead of mutating in place
const next = new URLSearchParams(searchParams);
next.delete("aiHelp");
next.delete(ASK_AI_DEEP_LINK_PARAM);
setSearchParams(next);
}
}, [searchParams, openAskAI]);
Expand All @@ -83,45 +82,30 @@ function useAskAIState() {
}

/**
* Hosts Ask AI (Kapa provider, ⌘I shortcut, dialog) for a menu that renders its own trigger. Wrap
* it around the popover, not inside, so the dialog and shortcut survive the popover closing.
* `children` receives the open function, or undefined when Ask AI is unavailable (self-hosted, no
* Kapa website id, or SSR).
*
* @deprecated See the note at the top of this file.
* Hosts Ask AI (Kapa provider, ⌘I shortcut, dialog). It renders no page content and wraps
* nothing: entry points reach it through `requestAskAi`, so the Kapa provider mounting after
* hydration can never remount the app around it.
*/
export function AskAIRoot({
children,
}: {
children: (openAskAI: (() => void) | undefined) => ReactNode;
}) {
const { isManagedCloud } = useFeatures();
const websiteId = useKapaWebsiteId();
export function AskAIRoot() {
const availability = useAskAiAvailability();

if (!isManagedCloud || !websiteId) {
return <>{children(undefined)}</>;
if (!askAiCanOpen(availability)) {
return null;
}

return (
<ClientOnly fallback={<>{children(undefined)}</>}>
{() => <AskAIRootProvider websiteId={websiteId}>{children}</AskAIRootProvider>}
</ClientOnly>
);
const websiteId = availability.kapaWebsiteId!;

return <ClientOnly>{() => <AskAIRootProvider websiteId={websiteId} />}</ClientOnly>;
}

function AskAIRootProvider({
websiteId,
children,
}: {
websiteId: string;
children: (openAskAI: () => void) => ReactNode;
}) {
function AskAIRootProvider({ websiteId }: { websiteId: string }) {
const { isOpen, setIsOpen, initialQuery, openAskAI, closeAskAI } = useAskAIState();

useShortcutKeys({
shortcut: { modifiers: ["mod"], key: "i", enabledOnInputElements: true },
shortcut: ASK_AI_SHORTCUT,
action: () => openAskAI(),
});
useAskAiHost(openAskAI);

return (
<KapaProvider
Expand All @@ -134,7 +118,6 @@ function AskAIRootProvider({
}}
botProtectionMechanism="hcaptcha"
>
{children(() => openAskAI())}
<AskAIDialog
initialQuery={initialQuery}
isOpen={isOpen}
Expand All @@ -145,15 +128,16 @@ function AskAIRootProvider({
);
}

/** @deprecated See the note at the top of this file. */
/** @deprecated Mounted nowhere: the sidebar's AI entry point is the dashboard agent. */
export function AskAI({ isCollapsed = false }: { isCollapsed?: boolean }) {
const { isManagedCloud } = useFeatures();
const websiteId = useKapaWebsiteId();
const availability = useAskAiAvailability();

if (!isManagedCloud || !websiteId) {
if (!askAiCanOpen(availability)) {
return null;
}

const websiteId = availability.kapaWebsiteId!;

return (
<ClientOnly
fallback={
Expand Down
105 changes: 58 additions & 47 deletions apps/webapp/app/components/BlankStatePanels.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ import {
v3NewProjectAlertPath,
v3NewSchedulePath,
} from "~/utils/pathBuilder";
import { AskAI } from "./AskAI";
import { AskAgentButton } from "./dashboard-agent/AskAgentButton";
import { CodeBlock } from "./code/CodeBlock";
import { useDevPresence } from "./DevPresence";
import { InlineCode } from "./code/InlineCode";
Expand Down Expand Up @@ -65,6 +65,55 @@ import {
import { StepContentContainer } from "./StepContentContainer";
import { V4Badge } from "./V4Badge";

/**
* What the agent is asked when it's opened from a deployment setup panel. The panel is the docs
* answer; the agent is for the part the docs can't answer — this project, this environment.
*/
const ASK_AGENT_DEPLOY_PROMPT =
"I'm trying to deploy my tasks to this environment. Walk me through it and tell me if anything about this project or environment is going to get in the way.";

/** The docs links the deployment panels offer to anyone without the agent. */
function DeployDocsLinks() {
return (
<>
<SimpleTooltip
asChild
tabbable
button={
// Span wrapper: LinkButton drops the pointer-event props Radix injects via asChild, so
// the tooltip trigger has to be a plain element (same pattern as FavoritePageButton).
<span className="flex">
<LinkButton
variant="small-menu-item"
LeadingIcon={BookOpenIcon}
leadingIconClassName="text-blue-500"
to={docsPath("deployment/overview")}
aria-label="Deploy docs"
/>
</span>
}
content="Deploy docs"
/>
<SimpleTooltip
asChild
tabbable
button={
<span className="flex">
<LinkButton
variant="small-menu-item"
LeadingIcon={QuestionMarkCircleIcon}
leadingIconClassName="text-blue-500"
to={docsPath("troubleshooting#deployment")}
aria-label="Troubleshooting docs"
/>
</span>
}
content="Troubleshooting docs"
/>
</>
);
}

export function HasNoTasksDev({ initializedAt }: { initializedAt: Date | string | null }) {
const { isConnected } = useDevPresence();
const initialized = !!initializedAt;
Expand Down Expand Up @@ -330,29 +379,10 @@ export function DeploymentsNoneDev() {
<Header1>Deploy your tasks</Header1>
</div>
<div className="flex items-center">
<SimpleTooltip
button={
<LinkButton
variant="small-menu-item"
LeadingIcon={BookOpenIcon}
leadingIconClassName="text-blue-500"
to={docsPath("deployment/overview")}
/>
}
content="Deploy docs"
/>
<SimpleTooltip
button={
<LinkButton
variant="small-menu-item"
LeadingIcon={QuestionMarkCircleIcon}
leadingIconClassName="text-blue-500"
to={docsPath("troubleshooting#deployment")}
/>
}
content="Troubleshooting docs"
/>
<AskAI />
{/* One entry point instead of two: the docs links were a guess at which page you
needed, and the agent can look at this project and answer for it. Someone with no
agent still gets the links. */}
<AskAgentButton prompt={ASK_AGENT_DEPLOY_PROMPT} fallback={<DeployDocsLinks />} />
</div>
</div>
<StepNumber stepNumber="→" title="Switch to a deployed environment" />
Expand Down Expand Up @@ -718,29 +748,10 @@ function DeploymentOnboardingSteps() {
</Header1>
</div>
<div className="flex items-center">
<SimpleTooltip
button={
<LinkButton
variant="small-menu-item"
LeadingIcon={BookOpenIcon}
leadingIconClassName="text-blue-500"
to={docsPath("deployment/overview")}
/>
}
content="Deploy docs"
/>
<SimpleTooltip
button={
<LinkButton
variant="small-menu-item"
LeadingIcon={QuestionMarkCircleIcon}
leadingIconClassName="text-blue-500"
to={docsPath("troubleshooting#deployment")}
/>
}
content="Troubleshooting docs"
/>
<AskAI />
{/* One entry point instead of two: the docs links were a guess at which page you
needed, and the agent can look at this project and answer for it. Someone with no
agent still gets the links. */}
<AskAgentButton prompt={ASK_AGENT_DEPLOY_PROMPT} fallback={<DeployDocsLinks />} />
</div>
</div>
<ClientTabs defaultValue="github">
Expand Down
Loading
Loading