test_config.py: SecurityConfig.mode default changed from "warn" to "redact"
test_config_phase3.py: ServerConfig.host default changed from "0.0.0.0" to "127.0.0.1"
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- BoundaryGuard degrades gracefully when Rust scanners unavailable
- BoundaryGuard tests use lightweight mock scanners (no Rust needed)
- Server-dependent tests use pytest.importorskip for starlette/fastapi
- Fix import ordering in test files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add check_bind_safety() to auth_middleware — refuses to bind non-loopback
without API key. Add cors_origins parameter to create_app() so CORS uses
config values instead of hardcoded wildcard "*".
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Detailed plan covering network exposure, boundary guard, webhook
validation, file permissions, log sanitization, credential scoping,
CORS hardening, and security profiles. Each task has failing tests
first, then implementation, then verification.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Tailwind CSS v4.2 (@tailwindcss/oxide) requires Node >= 20 for native
bindings. Without this, `npm install` succeeds but `vite` fails at
runtime with a missing native binding error.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Roadmap: updated messaging status (iMessage/SMS + Slack working,
WhatsApp Baileys blocked, Meta Cloud API planned).
Testing plan: 12 query types across 3 platforms (Interact, Slack,
iMessage/SMS) with execution phases and success criteria.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Added SendBlue (iMessage/SMS) and Slack messaging setup with detailed
step-by-step instructions, App Manifest JSON, webhook registration,
and troubleshooting tables. Reorganized doc into two sections:
Messaging Channels (talk to agent) and Data Connectors (search data).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Removed WhatsApp (Baileys blocked by WhatsApp servers) and Twilio SMS
(SendBlue handles SMS as fallback automatically). Updated Slack setup
instructions with the App Manifest JSON for one-step configuration.
Three channels: iMessage + SMS (SendBlue), Slack (Socket Mode)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
CI installs `--extra dev` but not `--extra server`, so fastapi is
unavailable. All other server tests use pytest.importorskip("fastapi")
to skip gracefully — this file was missing the guard.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Tauri desktop app's resolve_bin("git") function checked incorrect
paths for Git on Windows (e.g. {ProgramFiles}\git\git.exe) and had no
PATH fallback, causing "git not found" even when Git is installed.
Fixes:
- Add correct Git for Windows paths: {ProgramFiles}\Git\cmd\git.exe,
{ProgramFiles(x86)}\Git\cmd\git.exe, {LOCALAPPDATA}\Programs\Git\cmd\
- Add Scoop package manager path: {home}\scoop\shims\git.exe
- Add PATH fallback using `where.exe` on Windows and `which` on Unix,
so any binary on PATH is found even if not at a hardcoded location
Closes#128
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Twilio webhook now:
1. Sends "Message received! Working on it now..." via Twilio API
2. Routes to DeepResearchAgent (via bridge or direct fallback)
3. Sends the research response back as SMS
4. Handles missing bridge gracefully
5. Formats response for SMS (strips markdown, 1500 char limit)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replaces the flaky inline bolt_app creation with a proper subprocess
daemon (slack_daemon.py). The daemon persists independently of the
HTTP request lifecycle, solving the Socket Mode connection dropping.
Features: thread replies, progress updates, message queue, Slack
formatting, PID file for lifecycle management.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
All bot replies (acknowledgment, progress updates, final response)
now use thread_ts to reply in the thread of the user's message.
Keeps the DM conversation clean — one thread per question.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Converts: ## Header → *Header* (bold), **bold** → *bold*,
*italic* → _italic_, ~~strike~~ → ~strike~, [text](url) → <url|text>.
Removes LaTeX and HTML. System prompt updated to use simple markdown
since it gets auto-converted per platform.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Ack message: "Message received! Working on it now..."
2. Queue awareness: if another message arrives while processing,
"Message received! Message X in queue, will respond ASAP"
3. Periodic reminders every 60s: "Still working! Will reply ASAP"
4. Response formatting: _format_for_sms() strips markdown headers,
bold/italic, code blocks, LaTeX, image syntax, collapses blanks
5. System prompt: instructs agent to use plain text, short paragraphs,
simple dashes — no markdown/LaTeX that breaks in iMessage/SMS
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1. Initial: "Message received! Working on it now..."
2. Every 60s while processing: "Still working! Will reply ASAP"
3. New message while busy: "Message received! Message X in queue of Y"
4. Responses stripped of markdown (headers, bold, code blocks) for
clean Slack display
5. System prompt updated to prefer plain text over complex markdown
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- test_deep_research_prompt.py (8 tests): date injection, time, day of week,
dynamic generation, response types, tool descriptions, /no_think, Jarvis name
- test_slack_messaging.py (7 tests): connect with/without tokens, error state,
disconnect, handler registration, send without token
- test_connector_health.py (44 tests): all 11 connectors instantiate, have
required methods, report not-connected without creds, have metadata.
Plus KnowledgeStore data presence checks.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The model now knows today's date and time. _build_system_prompt()
generates a fresh prompt with "Today is Saturday, March 28, 2026.
The current time is 02:28 PM." on every agent.run() call.
Fixes: model was hallucinating "January 29, 2025" for date queries.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replaces the rigid deep-research-only prompt with an adaptive one that
classifies queries into 4 types:
1. Casual/conversational — friendly reply, no tools
2. Quick data lookup — one tool call, short answer
3. Deep research — multi-hop, cited report
4. About self — describe capabilities
Tested: casual gets 0 tool calls (6s), quick lookup gets 1 SQL call (17s),
self-description gets 0 calls (17s). Deep research still works as before.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Register sendblue in channels/__init__.py so ChannelRegistry works
- Auto-restore SendBlue bindings on server startup from database,
re-creating ChannelBridge + DeepResearchAgent so webhooks survive
server restarts
- Add sendblue to CLI channel_cmd.py (_get_channel, help text) and
SystemBuilder._resolve_channel() for config.toml support
- Health check endpoint GET /v1/channels/sendblue/health returns
channel_connected, bridge_wired, ready status
- Frontend: SendBlueWizard checks health on mount, shows
"Disconnected" badge with "Reconnect" button when bridge is dead
- Docs: CLI usage, server restart behavior, ngrok re-registration,
troubleshooting table, health check endpoint
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
App Token (xapp-) is required for Socket Mode DMs, not optional.
Removed xoxe- from CLI prompt since session tokens don't work.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When a text arrives via SendBlue:
1. Immediately sends "Message received! Researching your data now..."
2. If the agent takes >45s, sends "Still working — complex query..."
3. Then sends the full research response
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Covers both data connector (read messages) and messaging channel (DM the agent).
Includes the full App Manifest JSON, required scopes table, and all the gotchas
we discovered (Request URL, reinstall requirement, App Token vs Bot Token, etc.).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
