mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-28 05:12:33 +00:00
Mega MindandGitHub
c3718d9e4f
* feat: add mnemonic recovery flow and encryption key management - Introduced a new Mnemonic page for users to generate or import their recovery phrase. - Updated routing to redirect users to the Mnemonic page after onboarding. - Enhanced state management to store and retrieve AES encryption keys derived from the mnemonic. - Added utility functions for generating and validating BIP39 mnemonic phrases. - Updated selectors and reducers to handle encryption key state in the auth slice. - Included new dependencies for cryptographic operations. * feat: integrate Web3 wallet functionality and enhance state management - Added WalletInfoSection component to display connected wallet address, network, and balance. - Updated auth slice to manage primary wallet address derived from mnemonic. - Enhanced SkillManager to pass wallet address as load parameters for wallet skill. - Introduced utility function to derive EVM wallet address from mnemonic. - Updated dependencies for cryptographic operations related to wallet functionality. * fix: improve error handling and network selection in WalletInfoSection - Enhanced the parsing of network data to ensure robustness against undefined values. - Updated network selection logic to prioritize valid entries and provide a fallback. - Improved error logging for better debugging of wallet information loading issues. - Adjusted balance retrieval to handle cases where chain_id may be missing. * feat: add socket event contract for Tauri integration - Documented the socket event contract for communication between the backend and frontend in Tauri mode. - Introduced constants for `REQUEST_ENCRYPTION_KEY` and `ENCRYPTION_KEY_EVENT` to facilitate encryption key management. - Updated `setupTauriSocketListeners` to handle the encryption key request and response flow. * Refactor wallet information fetching and connection status handling - Updated `WalletInfoSection` to improve loading state management and error handling during wallet info retrieval. - Introduced a retry mechanism for fetching wallet information with a maximum of 5 attempts. - Enhanced connection status logic in `SkillsGrid` to treat missing authentication status as connected. - Added a new method in `SkillManager` to set the wallet address and notify the wallet skill accordingly. * feat: add integration token fetching and decryption functionality - Introduced `fetchIntegrationTokens` API call to retrieve encrypted OAuth tokens for integrations. - Implemented decryption logic for integration tokens using a provided key. - Enhanced deep link handling to support fetching and storing integration tokens upon successful OAuth login. - Added utility functions for hex and base64 conversions to facilitate token decryption. - Updated `authApi.ts` and `desktopDeepLinkListener.ts` to integrate new functionality. * refactor: move integration token encryption/decryption logic to a new utility file - Extracted encryption and decryption functions for integration tokens into `integrationTokensCrypto.ts`. - Removed redundant functions from `desktopDeepLinkListener.ts` to streamline the code. - Updated deep link handling to store only the encrypted tokens instead of decrypted ones. - Improved type definitions for integration tokens and their payloads. * feat: enhance Gmail skill integration and state management - Updated `SkillManager` to accept an optional access token for Gmail during OAuth completion. - Introduced `gmailSlice` to manage Gmail user profile and emails in the Redux store. - Implemented synchronization of Gmail skill state with the Redux store to keep user data updated. - Refactored `SkillProvider` to handle Gmail state changes and fetch initial state from the backend. - Adjusted deep link handling to pass decrypted access tokens for Gmail integration. - Modified API endpoint for onboarding completion to remove the Telegram prefix. * feat: implement Gmail metadata synchronization to backend - Added a new utility function `syncGmailMetadataToBackend` to emit Gmail profile and email summaries to the backend via the `integration:metadata-sync` socket event. - Updated `SkillProvider` to call the new synchronization function, ensuring Gmail skill state is sent to the backend when updated. * refactor: update Tauri socket event handling and improve Mnemonic component typing - Revised the Tauri socket event contract to clarify that encryption key handling is managed via the API instead of the socket. - Removed outdated socket event constants related to encryption key requests from `tauriSocket.ts`. - Enhanced type definitions in the `Mnemonic` component by specifying the event type for keyboard events. * fix: update Gmail provider constant and adjust metadata synchronization logic - Changed the constant for the Google provider from 'google' to 'gmail' for clarity. - Commented out the email metadata synchronization logic in `syncGmailMetadataToBackend` to prevent potential issues with undefined email states. * feat: implement Gmail metadata synchronization service - Added a new file `metadataSync.ts` to handle the synchronization of Gmail profile and email summaries to the backend via the `integration:metadata-sync` socket event. - Updated import paths in `SkillProvider` to reflect the new location of the Gmail metadata synchronization function. - Enhanced type definitions for Gmail profile and email summaries to ensure proper data structure during synchronization. * refactor: clean up code formatting and improve readability across multiple components - Standardized import statements and formatting in various files, including `WalletInfoSection`, `AgentChatPanel`, and `SkillsPanel`. - Enhanced readability by adjusting line breaks and spacing in JSX elements and function definitions. - Improved consistency in the use of arrow functions and destructuring across components. - Updated type definitions and ensured proper alignment of code for better maintainability. * feat: enhance error handling in WalletInfoSection and improve user feedback - Added error reporting functionality in `WalletInfoSection` to capture and enqueue errors when wallet info fails to load. - Updated `Mnemonic` component to handle user state more robustly, ensuring encryption key is only set if the user is loaded. - Refactored `TauriCommandsPanel` to improve string comparisons for loading states by converting to lowercase. - Adjusted deep link handling in `desktopDeepLinkListener` to use trimmed hex values for encryption key conversion. * fix: improve balance parsing and error handling in WalletInfoSection - Updated balance parsing logic in `WalletInfoSection` to ensure that non-finite values default to zero. - Enhanced error handling in `desktopDeepLinkListener` by adding error reporting for invalid encryption keys and conversion failures, improving user feedback and debugging capabilities. * Merge remote-tracking branch 'upstream/develop' into feat/final-flow-check * chore: update submodule URL for skills repository to use HTTPS * chore: update skills submodule to latest commit and enhance SkillsGrid component - Updated the skills submodule to the latest commit for improved functionality. - Refactored `SkillsGrid` to better handle skill setup logic, ensuring accurate representation of skills with setup requirements. - Cleaned up code formatting and improved readability in various components, including `SkillActionButton` and `desktopDeepLinkListener`. * feat: implement Notion metadata synchronization and user profile management - Added a new service `metadataSync.ts` to handle synchronization of Notion user metadata to the backend via the `integration:metadata-sync` socket event. - Introduced a new Redux slice `notionSlice.ts` for managing the Notion user profile state. - Updated `SkillProvider` to fetch and sync Notion user profile upon connection, ensuring seamless integration with the backend. - Enhanced the store configuration to include the new Notion reducer. * refactor: remove unnecessary console warnings in SkillProvider - Eliminated console warnings related to Notion user retrieval errors and auto-loading skills, streamlining the logging process for better clarity and reducing noise in the console output. - Improved code readability by cleaning up commented-out warning messages that were no longer needed.
2.6 KiB
2.6 KiB
Security Policy
Supported Versions
We provide security updates for the following versions of AlphaHuman:
| Version | Supported |
|---|---|
| Latest | ✅ |
| Previous minor | ✅ |
| Older | ❌ |
We recommend always running the latest release. AlphaHuman is in early beta; older versions may not receive patches.
Reporting a Vulnerability
We take security seriously. If you believe you have found a security vulnerability, please report it responsibly.
How to Report
- Do not open a public GitHub issue for security vulnerabilities.
- Email the maintainers with a clear description of the issue, steps to reproduce, and impact. You can reach us via the contact details listed in the AlphaHuman organization or repository.
- Include as much detail as possible (platform, version, configuration) so we can reproduce and triage quickly.
What to Expect
- We will acknowledge your report as soon as possible (typically within 5 business days).
- We will keep you updated on our assessment and any fix or mitigation.
- We will credit you in our security advisories and release notes (unless you prefer to remain anonymous).
Scope
We are especially interested in:
- Authentication or authorization bypass
- Data exfiltration or exposure (credentials, messages, user data)
- Remote code execution (frontend, Tauri/Rust backend, or skills runtime)
- Issues in dependency chain (npm, Cargo) that affect our build or runtime
- Platform-specific issues (macOS, Windows, Linux, Android, iOS) that compromise user data or device security
Out-of-scope for this process: general bugs, feature requests, and issues in third-party services we integrate with (e.g., Telegram, Notion) unless they are specific to how AlphaHuman uses them.
Safe Harbor
We support safe harbor for security researchers who report in good faith. We will not pursue legal action or involve law enforcement against you for discovering or reporting vulnerabilities in accordance with this policy.
Security Practices
- Credentials: Desktop uses OS-level credential storage (e.g., macOS Keychain, Windows Credential Manager). We do not store secrets in plain text.
- Data: Message content is processed on request and not retained for training or long-term storage.
- Skills: Skills run in a sandboxed environment with defined boundaries; we review skill behavior and dependencies where possible.
Thank you for helping keep AlphaHuman and its users safe.