admin/openfang
1
0
Fork 0
mirror of https://github.com/RightNow-AI/openfang.git synced 2026-07-30 23:05:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
528 Commits 8 Branches 100 Tags
f05ba5e42f7a4df5528158be6cf6685bb48bb2df
Commit Graph
117 Commits
Author SHA1 Message Date
jaberjaber23 88ad029999 bump v0.6.6 2026-05-12 15:27:09 +03:00
jaberjaber23 6f8463fc91 bump v0.6.5 2026-05-12 15:05:53 +03:00
dependabot[bot]andGitHub 24aca4e31d build(deps): bump open from 5.3.3 to 5.3.4 
Bumps [open](https://github.com/Byron/open-rs) from 5.3.3 to 5.3.4.
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](https://github.com/Byron/open-rs/compare/v5.3.3...v5.3.4)

---
updated-dependencies:
- dependency-name: open
  dependency-version: 5.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-01 10:50:27 +00:00
jaberjaber23 3cce1eb3fb bump v0.6.4 2026-05-01 13:48:18 +03:00
jaberjaber23 948117d5de bump v0.6.3 2026-05-01 13:12:25 +03:00
jaberjaber23 15ed29c667 bump v0.6.2 2026-04-29 20:39:59 +03:00
Jaber JaberandGitHub fe34a37e6f Merge pull request #1112 from RightNow-AI/dependabot/cargo/lettre-0.11.21 
build(deps): bump lettre from 0.11.20 to 0.11.21
 2026-04-29 16:10:44 +03:00
Jaber JaberandGitHub 4b63eb18cc Merge pull request #1111 from RightNow-AI/dependabot/cargo/libc-0.2.185 
build(deps): bump libc from 0.2.183 to 0.2.185
 2026-04-29 16:10:31 +03:00
Jaber JaberandGitHub fe21d4b4df Merge pull request #1110 from RightNow-AI/dependabot/cargo/rustls-0.23.39 
build(deps): bump rustls from 0.23.37 to 0.23.39
 2026-04-29 16:10:19 +03:00
Jaber JaberandGitHub f52bc53e47 Merge pull request #1109 from RightNow-AI/dependabot/cargo/uuid-1.23.1 
build(deps): bump uuid from 1.23.0 to 1.23.1
 2026-04-29 16:10:05 +03:00
jaberjaber23 aabf83b351 bump v0.6.1 2026-04-29 15:30:46 +03:00
dependabot[bot]andGitHub 40bd7e2c11 build(deps): bump lettre from 0.11.20 to 0.11.21 
Bumps [lettre](https://github.com/lettre/lettre) from 0.11.20 to 0.11.21.
- [Release notes](https://github.com/lettre/lettre/releases)
- [Changelog](https://github.com/lettre/lettre/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lettre/lettre/compare/v0.11.20...v0.11.21)

---
updated-dependencies:
- dependency-name: lettre
  dependency-version: 0.11.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 08:24:47 +00:00
dependabot[bot]andGitHub a7197d7b97 build(deps): bump libc from 0.2.183 to 0.2.185 
Bumps [libc](https://github.com/rust-lang/libc) from 0.2.183 to 0.2.185.
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.185/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/libc/compare/0.2.183...0.2.185)

---
updated-dependencies:
- dependency-name: libc
  dependency-version: 0.2.185
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 08:24:21 +00:00
dependabot[bot]andGitHub bc26d5e8c3 build(deps): bump rustls from 0.23.37 to 0.23.39 
Bumps [rustls](https://github.com/rustls/rustls) from 0.23.37 to 0.23.39.
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rustls/rustls/compare/v/0.23.37...v/0.23.39)

---
updated-dependencies:
- dependency-name: rustls
  dependency-version: 0.23.39
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 08:23:42 +00:00
dependabot[bot]andGitHub 84d90ad342 build(deps): bump uuid from 1.23.0 to 1.23.1 
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.23.0 to 1.23.1.
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.0...v1.23.1)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 08:23:16 +00:00
jaberjaber23 e6bab993ae bump v0.6.0 2026-04-19 22:57:55 +03:00
jaberjaber23 5a1f372612 command registry 2026-04-19 17:08:11 +03:00
Matteo De Agazio 528a7b9ff7 fix(deps): upgrade wasmtime 41->43 and rumqttc 0.24->0.25 to resolve CVEs (RUSTSEC-2026-0049, 0085-0096) 2026-04-11 23:50:55 +02:00
jaberjaber23 6851bbab09 bump v0.5.9 2026-04-10 21:19:33 +03:00
Jaber JaberandGitHub e322afbebd Merge pull request #956 from RightNow-AI/dependabot/cargo/cron-0.16.0 
chore(deps): bump cron from 0.15.0 to 0.16.0
 2026-04-10 19:59:26 +03:00
jaberjaber23 a4c6c038a0 bump v0.5.8 2026-04-10 19:57:59 +03:00
dependabot[bot]andGitHub 6f86f7a857 build(deps): bump cron from 0.15.0 to 0.16.0 
Bumps [cron](https://github.com/zslayton/cron) from 0.15.0 to 0.16.0.
- [Release notes](https://github.com/zslayton/cron/releases)
- [Commits](https://github.com/zslayton/cron/commits)

---
updated-dependencies:
- dependency-name: cron
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-10 16:17:45 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		c47e15c1ce chore(deps): bump prost 0.13 -> 0.14 
Bumps [prost](https://github.com/tokio-rs/prost) from 0.13.5 to 0.14.3.
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/prost/compare/v0.13.5...v0.14.3)

---
updated-dependencies:
- dependency-name: prost
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 19:16:03 +03:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		185ebc429f chore(deps): bump lettre 0.11.19 -> 0.11.20 
Bumps [lettre](https://github.com/lettre/lettre) from 0.11.19 to 0.11.20.
- [Release notes](https://github.com/lettre/lettre/releases)
- [Changelog](https://github.com/lettre/lettre/blob/master/CHANGELOG.md)
- [Commits](https://github.com/lettre/lettre/compare/v0.11.19...v0.11.20)

---
updated-dependencies:
- dependency-name: lettre
  dependency-version: 0.11.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-10 19:15:56 +03:00
Brandon FreemanandMatteo De Agazio e1790b5380 fix: add explicit crypto provider 2026-04-09 17:10:21 +02:00
jaberjaber23 a26f762635 v0.5.7: multi-instance hands + 8 critical fixes 
## Headline feature
- Multi-instance Hands via optional instance_name (customer ask + #878).
  Web UI, CLI (--name / -n), API, kernel, registry all threaded. Two
  clip-youtube + clip-tiktok instances now coexist. Backward compatible
  when instance_name is omitted.

## Critical bug fixes
- #919 [SECURITY] rm bypass closed. process_start tool now validates against
  exec_policy allowlist and rejects shell metacharacters in both command
  and args. Added 5 regression tests.
- #1013 session_repair phase ordering — dedup now runs BEFORE synthetic
  result insertion, fixing Moonshot's non-unique tool_call_id format
  (function_name:index). Added regression test.
- #1003 global [[fallback_providers]] now actually used at runtime.
  resolve_driver wraps primary in FallbackDriver with global fallback
  chain. Network errors escalate to fallback instead of infinite retry.
- #937 Discord gateway heartbeat. Spawns interval task, tracks sequence,
  handles ACKs, detects zombie connections, force-closes on missing ACK.
  Credits @hello-world-bfree (PR #938) for the diagnosis.
- #935 System prompt leak in Web UI. get_agent_session now filters
  Role::System by default (?include_system=true for debug). Defense in
  depth client-side filter too.
- #984 Custom hands persistence. install_from_path copies to
  ~/.openfang/hands/. Kernel loads them on startup.
- #884 Workspace version bump 0.5.5 -> 0.5.7. Binaries now correctly
  report --version as 0.5.7 instead of stale 0.5.5.

## Cleanup
- rmcp 1.3 builder API adopted (credits @jefflower PR #986) for
  StreamableHttpClientTransportConfig. Drops unused Arc import.

## Stats
- 22 files changed, all workspace tests passing (1800+)
- Live-tested with daemon: v0.5.7 reported, multi-instance hands
  verified end-to-end, Groq round-trip PONG confirmed
 2026-04-08 22:59:56 +03:00
Jaber JaberandGitHub a78299ed3d Merge pull request #753 from RamXX/fix/dashboard-password-argon2 
Replace SHA256 password hashing with Argon2id for dashboard auth
 2026-03-31 02:22:02 +03:00
jaberjaber23 618e83714c fix: version bump to 0.5.5, SSRF allowlist, Ollama context, embedding detection 
- Bump workspace version and Tauri config to 0.5.5 (fixes users stuck on 0.5.1)
- Add ssrf_allowed_hosts config for self-hosted K8s environments (Jerry Jaz)
- Raise Ollama discovered model defaults to 128K context / 16K output (Cureator)
- Expand embedding auto-detection: OpenAI, Groq, Mistral, Together, Fireworks, Cohere, then local providers (Thunder Guardian)

All tests passing. 9 files changed, 272 insertions.
 2026-03-30 21:30:48 +03:00
RamXX 8ba84ada9d Replace SHA256 password hashing with Argon2id for dashboard auth 
Dashboard passwords were hashed with plain SHA256 (no salt), vulnerable
to rainbow tables and GPU brute force. Switch to Argon2id with random
per-hash salts. Breaking change: existing SHA256 hashes in config.toml
must be regenerated with `openfang auth hash-password`.
 2026-03-27 13:03:52 -07:00
Jaber JaberandGitHub f98bc330d4 Merge pull request #859 from RightNow-AI/dependabot/cargo/governor-0.10.4 
build(deps): bump governor from 0.8.1 to 0.10.4
 2026-03-27 22:04:59 +03:00
Jaber JaberandGitHub 86694dd926 Merge pull request #862 from RightNow-AI/dependabot/cargo/toml-0.9.12spec-1.1.0 
Bump toml from 0.8.2 to 0.9.12+spec-1.1.0
 2026-03-27 22:04:55 +03:00
dependabot[bot]andGitHub f8da17719e Bump governor from 0.8.1 to 0.10.4 
Bumps [governor](https://github.com/boinkor-net/governor) from 0.8.1 to 0.10.4.
- [Release notes](https://github.com/boinkor-net/governor/releases)
- [Changelog](https://github.com/boinkor-net/governor/blob/master/release.toml)
- [Commits](https://github.com/boinkor-net/governor/compare/v0.8.1...v0.10.4)

---
updated-dependencies:
- dependency-name: governor
  dependency-version: 0.10.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 19:02:27 +00:00
Sky Moore 9e2853a5f8 fix: resolve CI failures after rebase on upstream/main 
- Add missing budget_config field to AppState in all 3 test files
- Fix redundant closures and unwrap_or_else in openfang-memory semantic.rs
- Fix needless_borrow in openfang-api routes.rs (toml::from_str)
- Update parse_researcher_hand test to match new max_iterations = 25
- Update tar to 0.4.45 to fix RUSTSEC-2026-0067 and RUSTSEC-2026-0068
- Apply cargo fmt fixes in ws.rs and feishu.rs
 2026-03-27 18:40:33 +00:00
Sky Moore e53e238e81 fix: cargo fmt and update rustls-webpki to 0.103.10 (RUSTSEC-2026-0049) 2026-03-27 16:47:35 +00:00
Sky Moore 991aea85ee feat: use rmcp for mcp protocol instead of hand rolled 
Replace the custom JSON-RPC + stdio/SSE transport layer with the rmcp
SDK (crate 'rmcp').  This gives us spec-compliant Streamable-HTTP
transport, automatic Mcp-Session-Id tracking, SSE stream parsing, and
content-type negotiation out of the box while deleting ~300 lines of
hand-rolled plumbing.

Key changes:
- Add rmcp dependency with transport feature
- Replace McpTransportHandle enum with rmcp RunningService
- Replace manual JSON-RPC send_request/send_notification with rmcp client calls
- Add custom HTTP headers support for authenticated remote MCP servers
- Simplify tool discovery and invocation through rmcp's typed API
 2026-03-27 16:47:32 +00:00
Jaber JaberandGitHub b6cb4cc2d9 Merge pull request #657 from xinuxZ/feat/feishu-websocket-receive-mode 
feat(feishu): add WebSocket receive mode with protobuf framing
 2026-03-27 16:44:31 +03:00
Jaber JaberandGitHub 282ad3a960 Merge pull request #832 from felix307253927/pr-main-324 
Fixes unicode filename upload via multipart/form-data.
 2026-03-27 04:52:50 +03:00
Jaber JaberandGitHub 6ae8dd4cfd Merge pull request #860 from RightNow-AI/dependabot/cargo/clap_complete-4.6.0 
Minor version bump. CI passes.
 2026-03-27 04:50:13 +03:00
Jaber JaberandGitHub 25a66df41b Merge pull request #861 from RightNow-AI/dependabot/cargo/openssl-0.10.76 
Security patch. Reviewed and approved.
 2026-03-27 04:50:10 +03:00
dependabot[bot]andGitHub 5212730773 Bump toml from 0.8.2 to 0.9.12+spec-1.1.0 
Bumps [toml](https://github.com/toml-rs/toml) from 0.8.2 to 0.9.12+spec-1.1.0.
- [Commits](https://github.com/toml-rs/toml/compare/toml-v0.8.2...toml-v0.9.12)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 0.9.12+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 01:10:12 +00:00
jaberjaber23andClaude Opus 4.6 9b7496947b fix: resolve 7 more bugs (#825, #828, #856, #770, #774, #851/#808, #785) 
- #825: Doctor now surfaces blocked workspace skills count in injection scan
- #828: Skill install detects Git URLs (https://, git@) and clones before install
- #856: Custom model names preserved — user-defined models take priority over builtins
- #770: Dashboard WS streaming now triggers Alpine.js reactivity via splice()
- #774: tool_use.input always normalized to JSON object (fixes Anthropic API errors)
- #851/#808: Global skills loaded for all agents; workspace skills properly override globals
- #785: Gemini streaming SSE parser handles \r\n line endings (fixes empty response loop)

All 2,186 tests passing. Live tested with daemon.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-27 04:04:17 +03:00
dependabot[bot]andGitHub 895e94ccac Bump openssl from 0.10.75 to 0.10.76 
Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.75 to 0.10.76.
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.75...openssl-v0.10.76)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 08:19:40 +00:00
dependabot[bot]andGitHub da9d8a84f1 Bump clap_complete from 4.5.66 to 4.6.0 
Bumps [clap_complete](https://github.com/clap-rs/clap) from 4.5.66 to 4.6.0.
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.66...clap_complete-v4.6.0)

---
updated-dependencies:
- dependency-name: clap_complete
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 08:19:25 +00:00
jaberjaber23 604e4ea7e3 fix: resolve 6 open bugs (#834, #805, #820, #848, #826, #836) 
- #834: Remove 3 decommissioned Groq models (gemma2-9b-it, llama-3.2-1b/3b-preview)
- #805: Ollama streaming parser now checks both reasoning_content and reasoning fields
- #820: Browser Hand checks python3 before python, fix optional dep logic
- #848: Hand continuous interval changed from 60s to 3600s to prevent credit waste
- #826: Doctor command no longer reports all_ok when provider key is rejected
- #836: WebSocket tool events now include tool call ID for concurrent call correlation

All 825+ tests passing. Verified live with daemon.
 2026-03-26 03:33:07 +03:00
Felix da12f47369 fix: Fix the error when uploading files with Unicode characters in filenames 2026-03-24 19:33:12 +08:00
Jaber JaberandGitHub 41ffb8537a Merge pull request #742 from RightNow-AI/dependabot/cargo/zip-4.6.1 
Bump zip from 2.4.2 to 4.6.1
 2026-03-20 03:13:22 +03:00
dependabot[bot]andGitHub 9a683ec511 Bump roxmltree from 0.20.0 to 0.21.1 
Bumps [roxmltree](https://github.com/RazrFalcon/roxmltree) from 0.20.0 to 0.21.1.
- [Changelog](https://github.com/RazrFalcon/roxmltree/blob/master/CHANGELOG.md)
- [Commits](https://github.com/RazrFalcon/roxmltree/compare/v0.20.0...v0.21.1)

---
updated-dependencies:
- dependency-name: roxmltree
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-19 08:18:28 +00:00
dependabot[bot]andGitHub eaa89defd1 Bump zip from 2.4.2 to 4.6.1 
Bumps [zip](https://github.com/zip-rs/zip2) from 2.4.2 to 4.6.1.
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zip-rs/zip2/compare/v2.4.2...v4.6.1)

---
updated-dependencies:
- dependency-name: zip
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-19 08:17:54 +00:00
jaberjaber23 2d02ba22fb lockfile sync 2026-03-19 01:03:35 +03:00
jaberjaber23 3688d86ef8 bug fixes 2026-03-18 05:49:42 +03:00