Wenxi
e9c36400a7
feat(craft): enforce personal and task action policies ( #16179 )
...
## Description
Give each user and scheduled task its own action settings.
Workspace-disabled actions always remain blocked. Admins can require
workspace settings or let users choose their own settings.
Scheduled tasks now show app and MCP cards. Apps start disabled. When
creating a task, enabling an app copies the user's current settings.
Existing tasks keep their saved choices when apps are enabled again;
missing choices require approval. Later requests use the task's saved
settings and current workspace restrictions.
One migration replaces app-wide task pre-approvals with per-action
settings. Existing tasks receive auto-approval only for known actions in
apps they already pre-approved. Apps remain enabled even if they have no
known actions. New actions require approval. The migration remains with
the code that reads the new tables.
Action recognition identifies the request. One policy resolver then
applies workspace restrictions, task membership, personal or task
settings, and session grants. Failed recognition or policy lookup blocks
the request. A completed scheduled session cannot use personal settings
for later requests.
The next PR adds app settings editors. This PR includes the task editor
because its payload changes with the task API.
## How Has This Been Tested?
The complete stack passed 71 local Kind scenario checks, covering
browser editing, persistence, access restrictions, real proxy requests,
and scheduled execution. Checks include a real 180-second approval
timeout, live policy changes, and completed-task request rejection.
This PR’s intermediate tree passed 1,053 backend unit tests, 148
database tests, five route-contract tests, and 39 frontend tests. Python
and TypeScript checks and changed-file pre-commit checks passed.
No migration was applied to the user's database during this
verification.
## Additional Options
- [ ] [Optional] Please cherry-pick this PR to the latest release
version.
- [x] [Optional] Override Linear Check
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added per-action approval settings for connected apps and MCP tools,
with workspace, personal, and scheduled-task controls.
* Scheduled tasks can enable apps and configure individual actions when
creating or editing tasks; settings are also visible on task details.
New tasks start with apps disabled.
* Policy editors support searching, bulk changes, and resetting editable
choices.
* **Security & Permissions**
* Workspace restrictions remain binding, and task settings are checked
during active runs.
* Actions requiring approval still prompt users when app credentials are
unavailable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-10-19 18:44:13 +00:00
Wenxi
5baaf19b0d
refactor(craft): align action policy names ( #16184 )
2026-10-19 17:48:55 +00:00
Wenxi
362137d3eb
refactor(backend): inline redundant forwarding helpers ( #16155 )
2026-10-16 18:33:10 +00:00
Evan Lohn and Claude Opus 5.5
85854d6707
feat(search): show the cc_pair_ids backfill progress on Index Settings ( #15943 )
...
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-13 04:55:22 +00:00
Wenxi
6955635f73
fix(craft): OpenCode cold startup and local development resource budgets ( #15769 )
2026-10-09 21:01:40 +00:00
Wenxi
939aa526f8
fix(craft): remove kindnet CPU throttling in local clusters ( #15724 )
2026-10-08 21:09:35 +00:00
Wenxi
de3f09c7fd
refactor(craft): organize sandbox proxy modules and models ( #15561 )
2026-10-08 19:13:49 +00:00
Wenxi
b266a22e31
fix(craft): allow 90 seconds for OpenCode session initialization ( #15715 )
2026-10-08 18:17:20 +00:00
Wenxi
89c29f10ae
refactor(craft): rename sandbox daemon contract module to models ( #15687 )
2026-10-07 23:38:59 +00:00
Wenxi
7512729af3
fix(dev): recover stale Telepresence agents during k8s launch ( #15651 )
2026-10-06 22:58:00 +00:00
Wenxi and Claude Opus 5.5
26185be857
fix(chat): scope stop requests to one stream ( #15497 )
...
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com >
2026-10-05 17:54:28 +00:00
Yuhong Sun and Claude Opus 5.5
8ced9bc01f
chore: remove Vespa and consolidate the document index interface ( #15336 )
...
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-01 19:22:34 +00:00
Yuhong Sun and greptile-apps[bot]
8b28de2356
docs: refresh README and Simplified Chinese translation ( #15005 )
...
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-09-22 22:28:39 +00:00
Evan Lohn and Cursor
5f2aed65ab
feat: let the chat widget forward end-user JWTs ( #14968 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-09-22 19:39:12 +00:00
roshan
f2cc303f5c
revert: remove experimental search receipts from internal search responses ( #14849 ) ( #14938 )
2026-09-21 18:45:49 +00:00
roshan
d7cc16686a
feat(chat): add experimental search receipts to internal search responses ( #14849 )
2026-09-17 16:58:20 +00:00
Wenxi
dd22ca103c
chore(dev): improve local kind development and add Zed launcher ( #14683 )
2026-09-14 19:23:15 +00:00
Evan Lohn and Cursor
6dce67e26f
feat: expose system LLM usage in reports ( #14454 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-09-11 17:45:04 +00:00
Wenxi and Claude Opus 5
5bf03a2c0f
fix(craft-dev): unbreak fresh local kind setup ( #14562 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-09-08 21:00:14 +00:00
SubashMohan and Claude Opus 5
dfbff58af4
feat(audit): emit audit events for group permission and membership changes ( #14238 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-25 15:44:59 +00:00
Wenxi
439a6086ac
chore: bump sandbox opencode to 1.18.19 (message-ID rollover fix) ( #14130 )
2026-08-20 21:24:26 +00:00
SubashMohan and Claude Opus 4.7
be8cfa6144
feat(permissions):new group based permission system ( #10172 )
...
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-08-17 16:32:51 +00:00
Wenxi
d98a5d855d
feat(scheduled-tasks): support MCP pre-approvals ( #13884 )
2026-08-12 19:08:05 +00:00
roshan
b89f63e511
feat(usage): add PDF review pack to exports ( #13872 )
2026-08-12 16:30:39 +00:00
roshan
f807785611
feat(craft): lazy webapp provisioning on setup and restore ( #13712 )
2026-08-07 18:42:13 +00:00
roshan
b427760c3d
feat(craft): add webapp bootstrap script generator and tool assets ( #13711 )
2026-08-05 00:51:01 +00:00
Wenxi
3da2048fb9
chore(craft): upgrade OpenCode to 1.18.13 ( #13741 )
2026-08-04 22:25:53 +00:00
SubashMohan and Claude Opus 5
b345a930ed
feat(mobile): agent timeline composition + parallel tabs ( #13695 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-04 05:06:50 +00:00
SubashMohan and Claude Opus 5
45b92975cc
feat(mobile): reasoning renderer + full-text reader for the agent timeline ( #13694 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-08-04 04:51:43 +00:00
Jamison Lahman and Claude Opus 5
73616a28de
chore(install): make install.sh a bootstrap for onyx-cli deploy ( #13615 )
...
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-07-30 21:36:08 +00:00
Danelegend and Claude Opus 5
bb5bbc2b40
feat(craft): pre-pull the sandbox image for docker-compose deployments ( #13592 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-07-30 18:30:27 +00:00
SubashMohan and Claude Opus 4.8
f123a4415c
feat(mobile): agentic timeline grouping engine + packet contracts ( #13092 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-30 06:09:59 +00:00
SubashMohan and Claude Opus 4.8
ad09138cbc
feat(mobile): input-bar controls spec + tool-options foundation ( #13091 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-30 05:48:27 +00:00
Danelegend and Claude Opus 5
4ea5da046c
fix(craft): drop the prepuller PriorityClass ( #13562 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-07-29 17:34:48 +00:00
Danelegend and Claude Opus 5
9e055af760
feat(craft): pre-pull the sandbox image onto the sandbox node pool ( #13490 )
...
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com >
2026-07-29 06:46:18 +00:00
Nikolas Garza
1816f15cf8
refactor(opal): rename action-link-* tokens to action-selection-* ( #13529 )
2026-07-28 23:58:41 +00:00
Wenxi
461dbb8c5d
test(craft): move unit tests to discovered paths and prune trivial tests ( #13523 )
2026-07-28 22:57:41 +00:00
Jamison Lahman and Claude Opus 5
efc5695ad0
chore(deps-dev): bump ruff to 0.16.0 ( #13479 )
...
Co-authored-by: Claude Opus 5 <noreply@anthropic.com >
2026-07-27 20:49:05 +00:00
roshan and Claude Fable 5
2164093ae3
refactor: consolidate API routing on ONYX_SERVER_URL ( #13375 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-23 23:13:18 +00:00
148565b74a
feat(metrics): MCP server/client metrics + DB-snapshot connector state gauges [mirror of #12904 for edits] ( #13086 )
...
Co-authored-by: Sergei Ivliev <siriusfrk@gmail.com >
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-17 21:38:23 +00:00
SubashMohan and Claude Opus 4.8
ce299b5d1b
feat(mobile): chat citations + cited sources ( #13025 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-16 08:24:17 +00:00
SubashMohan and Claude Opus 4.8
bc0e90b1aa
feat(mobile): per-message file attachments in the chat composer ( #12804 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-09 15:33:46 +00:00
SubashMohan and Claude Opus 4.8
7e4ad4ff74
feat(mobile): project file management — upload, indexing, link/unlink ( #12691 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-07 05:20:34 +00:00
SubashMohan and Claude Opus 4.8
7a35a3a293
refactor(mobile): unify chat + project into one persistent ChatSurface ( #12687 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-06 16:40:21 +00:00
SubashMohan and Claude Opus 4.8
700c0c44be
feat(mobile): projects — list, select, chat-within ( #12648 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-06 03:33:31 +00:00
SubashMohan and Claude Opus 4.8
4edea31558
feat(mobile): agent selection — gallery, sidebar rail, avatars ( #12647 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-03 05:24:08 +00:00
roshan and Claude Opus 4.8
1e7975e57c
feat(craft): default ENABLE_BROWSER on to match the sandbox image ( #12659 )
...
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-02 19:59:00 +00:00
SubashMohan and Claude Opus 4.8
c183828acb
feat(mobile): resume in-flight chat runs + auto-name new sessions ( #12585 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-02 02:40:14 +00:00
roshan and Claude Opus 4.8
6b10c2c91c
feat(craft): context-window usage ring + compaction marker ( #12613 )
...
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-02 00:22:46 +00:00
Wenxi
f08c2b43d8
docs: remove stale skills planning docs ( #12638 )
2026-07-01 23:29:36 +00:00
Wenxi