5574 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
github-actions[bot]	bb76d73a8b	Update internal dependencies to their current main	2026-10-25 06:43:55 +00:00
fabro-releases[bot]	1906d7c9ea	Bump version to 0.396.0-nightly.0	2026-10-24 09:34:28 +00:00
github-actions[bot]	a70e7d6a90	Update internal dependencies to their current main	2026-10-24 06:45:45 +00:00
Scott Werner	586fafa9f5	Merge pull request #1072 from fabro-sh/codex/bun-security-update ... security: update Bun to 1.4.4 for compromised CA distrust	2026-10-23 20:27:09 -04:00
Scott Werner	0910630fd3	test: isolate installer session caches between cases	2026-10-23 18:39:36 -04:00
Scott Werner	c01352b0e4	security: update Bun to 1.4.4 for compromised CA distrust	2026-10-23 18:37:20 -04:00
Scott Werner	6f1e0fd0d1	Merge pull request #1071 from fabro-sh/codex/installer-settings ... Stop generating ignored run settings during browser installation	2026-10-23 17:38:33 -04:00
Scott Werner	cd9b0be393	Remove unnecessary installer warning regression test	2026-10-23 17:20:56 -04:00
Scott Werner	6ba50e0807	Keep installer tests focused on behavioral contracts	2026-10-23 16:32:19 -04:00
Scott Werner	e047a9adff	Stop generating ignored run settings during browser installation	2026-10-23 16:10:25 -04:00
Scott Werner	c2d3735c3e	Merge pull request #1069 from fabro-sh/codex/toml-catalog-serialization ... Serialize generated provider overlays with the TOML library	2026-10-23 15:14:27 -04:00
Scott Werner	b1b1306211	Declare text support in the dotted-provider regression fixture	2026-10-23 14:43:13 -04:00
Scott Werner	2d859496e2	Serialize generated provider overlays with the TOML library	2026-10-23 14:38:46 -04:00
Scott Werner	f79e21872e	Merge pull request #1067 from fabro-sh/codex/retain-review-history-links ... Preserve human gate review links in Q&A history	2026-10-23 14:22:45 -04:00
Scott Werner	ffe389b5d2	Preserve human gate review links in Q&A history	2026-10-23 13:33:45 -04:00
Scott Werner	56bed5c900	Merge pull request #1064 from fabro-sh/codex/remove-run-prepare ... Remove run preparation settings in favor of explicit commands	2026-10-23 13:18:16 -04:00
Scott Werner	dee7dd1ddf	Drop duplicate former-prefix hook scenario	2026-10-23 12:49:30 -04:00
Scott Werner	d9bedadfb0	Remove redundant setup graph projection test	2026-10-23 12:39:40 -04:00
Scott Werner	ab3b078154	Trim redundant preparation removal coverage	2026-10-23 11:55:10 -04:00
Scott Werner	a98d5be8ff	Expect the settings source path in parser errors	2026-10-23 10:34:40 -04:00
Scott Werner	d374ef0ec1	Integrate Petri preparation removal and update admission checks	2026-10-23 10:30:54 -04:00
Scott Werner	0b38121930	Merge remote-tracking branch 'origin/main' into codex/remove-run-prepare	2026-10-23 10:07:20 -04:00
fabro-releases[bot]	c412cb079b	Bump version to 0.395.0-nightly.0	2026-10-23 09:39:10 +00:00
Scott Werner	9d9cbe9f41	Merge pull request #1065 from fabro-sh/codex/skipped-stage-display ... Distinguish skipped stages in CLI progress	2026-10-22 15:52:38 -04:00
Scott Werner	4a5c89e5ba	Distinguish skipped stages in CLI progress	2026-10-22 15:18:52 -04:00
Scott Werner	b452f498f5	Remove run preparation settings in favor of explicit commands	2026-10-22 15:01:03 -04:00
Scott Werner	2e525b9e1e	Merge pull request #1062 from fabro-sh/bot/internal-deps ... Update internal dependencies	2026-10-22 14:37:56 -04:00
github-actions[bot]	d377e92820	Update internal dependencies to their current main	2026-10-22 06:49:46 +00:00
fabro-releases[bot]	e28675a1df	Bump version to 0.393.0-nightly.1	2026-10-21 17:38:34 +00:00
Scott Werner	96dde72bc2	Merge pull request #1058 from fabro-sh/eng/patch-emudhra-tls ... security: patch eMudhra certificate trust dependencies	2026-10-21 13:04:51 -04:00
Scott Werner	b02b6f0e55	Merge pull request #1059 from fabro-sh/codex/bump-claude-aliases ... Bump lithos-llm for consistent Claude alias routing	2026-10-21 12:38:14 -04:00
Scott Werner	fdb69e7e04	Bump lithos-llm to fix Claude alias provider selection	2026-10-21 12:04:17 -04:00
Bryan Helmkamp	50b52fbddc	security: patch eMudhra certificate trust dependencies	2026-10-21 07:55:35 -07:00
Scott Werner	be48840dbb	Merge pull request #1049 from fabro-sh/bot/internal-deps ... Update internal dependencies	2026-10-21 10:49:03 -04:00
fabro-releases[bot]	a8c1a74f59	Bump version to 0.393.0-nightly.0	2026-10-21 09:41:31 +00:00
github-actions[bot]	7a28fda4eb	Update internal dependencies to their current main	2026-10-21 06:50:49 +00:00
Scott Werner	d45464eb9b	Merge pull request #1055 from fabro-sh/fix/no-bare-selector-passthrough ... Reject bare provider names and unknown unpinned model selectors	2026-10-20 15:56:27 -04:00
Scott Werner	9df720aa24	Merge pull request #1057 from fabro-sh/codex/hook-documentation ... Fix hook documentation configuration examples	2026-10-20 15:44:59 -04:00
Scott Werner	dc12a9d2b5	Keep hook documentation fix documentation-only	2026-10-20 15:23:21 -04:00
Scott Werner	5cdf3abd77	Merge pull request #1056 from fabro-sh/redact/recognize-ulids ... Exempt ULIDs from entropy-based secret redaction	2026-10-20 15:20:30 -04:00
Scott Werner	0e670e9234	Exempt ULIDs from entropy-based secret redaction ... Fabro's run, session, turn, message and pair IDs are ULIDs. A ULID occasionally has enough distinct characters to cross the secret scanner's 4.5-bit entropy threshold, and the stream redaction then rewrites the Web UI link to `/runs/REDACTED` and the run branch to `fabro/run/REDACTED`. Two nightly releases in the last week failed on `attach_replays_completed_detached_run` this way, and each fix so far protected one field at a time. Teach the entropy scanner the format instead: a token that is exactly 26 uppercase Crockford base32 characters and decodes to a timestamp between 2020 and 2100 is an identifier, not a secret, and is left alone wherever it appears. Trailing `-ULID`, `_ULID` and `=ULID` segments are stripped before measuring, so `20261020-<id>` and `<secret>-<id>` are handled, and the secret in the latter is still found. The gitleaks credential patterns run on every token as before. This mirrors detect-secrets' built-in UUID filter. A secret would have to take exactly this shape and land in the date window to be missed, which is about one in a hundred of the already rare tokens encoded as 26 uppercase base32 characters. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-20 14:51:14 -04:00
Scott Werner	d1144615bf	Fix hook documentation configuration examples	2026-10-20 14:35:21 -04:00
Scott Werner	8f01f9f41d	Merge pull request #1054 from fabro-sh/codex/stage-occurrence-links ... Fix navigation to repeated stage occurrences	2026-10-20 13:28:03 -04:00
Scott Werner	14584bbc32	Reject bare provider names and unknown unpinned selectors ... Fabro's shared resolver passed any unknown bare selector through verbatim to the highest-priority ready provider. A provider name in the model field, such as `gemini`, is not a catalog model, so it took that path and reached Anthropic with wire model `gemini`. The same path turned any typo into a request on whichever provider happened to win priority. An unqualified unknown selector is now an error. Passthrough of an uncatalogued model id still works, but only with a provider pin, which is also how the operator docs already described it. A bare provider name gets a dedicated error that names the provider and says to pin it and omit the model to use its default. The completions endpoint returns that error as a 400 before any provider call; the models lookup returns it as a 404. Session creation keeps its own provider-name message and no longer passes unknown unpinned names through either. The OpenAPI description of `CreateCompletionRequest.model` no longer advertises a provider id as a selector, and the TypeScript client is regenerated from it. Closes #950 by rejecting the input rather than resolving it: a provider name in the model position is ambiguous with model aliases, and no comparable library resolves it to a provider default. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-20 13:16:51 -04:00
Scott Werner	636fff0599	Fix navigation to repeated stage occurrences	2026-10-20 13:02:46 -04:00
fabro-releases[bot]	59342f7e99	Bump version to 0.392.0-nightly.0	2026-10-20 09:36:24 +00:00
github-actions[bot]	f41dbc331f	Update internal dependencies to their current main	2026-10-20 06:49:03 +00:00
Scott Werner	7a876b5444	Merge pull request #1044 from fabro-sh/codex/restore-run-retry ... Restore Retry for terminal runs in the web UI	2026-10-19 17:26:53 -04:00
Scott Werner	65f096b00a	Restore Retry for terminal runs in the web UI	2026-10-19 13:28:44 -04:00
Scott Werner	149b240e8d	Merge pull request #1043 from fabro-sh/bot/internal-deps ... Update internal dependencies	2026-10-19 12:50:08 -04:00