Bohan Jiang bdae0d2a03 fix(attachments): serve proxy-mode downloads with a scoped capability URL (MUL-5292) (#6092) ...

Desktop users on self-hosted deployments saw a save dialog but never got a
file. Electron's native download is a browser-level request: it carries
neither the desktop client's Authorization header nor a session cookie, so
GET /api/attachments/{id}/download answered 401.

The authenticated GET /api/attachments/{id} already exists to hand native
loaders a URL they can fetch without our credentials, and it already does so
in two of three modes -- a CloudFront-signed URL, or an S3 presigned URL.
Proxy mode (local disk, private object host) had no equivalent and kept
returning the auth-gated API path, which is the whole of the bug: one
unfinished branch of an otherwise correct design.

Finish that branch. In proxy mode the already-authenticated metadata endpoint
now mints a capability -- an HMAC-SHA256 signature over (version, attachment
id, expiry) with a key domain-separated from the JWT secret, valid for 60
seconds and scoped to exactly one attachment -- and a separate public route
redeems it. Membership is checked when the capability is minted, never at
redemption; the signature is the proof that check happened.

Nothing moves out of middleware.Auth: the existing authenticated download
route is untouched, so clients that predate this keep working and there is no
second copy of the header/cookie/PAT/task-token resolution. The capability
route always proxy-streams, so it emits no cross-origin redirect and the
signed query cannot leak to a CDN in a Referer.

The capability is site-relative and minted only by GetAttachmentByID. Both
matter: an absolute URL would be picked up by the inline-media re-sign path
and pinned into an <img> far longer than the TTL, and a capability in a list
response would expire before anything used it.

Verification: go test ./internal/handler/ ./cmd/server/ and the
@multica/views editor tests pass; gofmt, go vet, tsc --noEmit clean.

Co-authored-by: Bohan-J <bohan@devv.ai>
Co-authored-by: multica-agent <github@multica.ai>

2026-07-29 15:20:13 +08:00

..

activity_test.go

refactor(timeline): drop server-side comment + timeline pagination (#2322)

2026-05-09 16:11:58 +08:00

activity.go

MUL-3328: add retry button for failed agent comments (#4217)

2026-06-17 15:18:44 +02:00

actor_guards_test.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

actor_guards.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

admission_security_mul4525_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

admission_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

admission.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

agent_access_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_access.go

fix(dashboard): stop leaking private agents from the per-agent rollups (MUL-5409) (#6051)

2026-07-29 13:08:48 +08:00

agent_avatar.go

feat(agents): assign emoji avatars by default (#5764)

2026-07-22 16:38:50 +08:00

agent_builder_test.go

MUL-5163 fix(agents): rebind the Agent Builder carrier when the runtime is switched (#5780)

2026-07-23 10:56:53 +08:00

agent_builder.go

MUL-5163 fix(agents): rebind the Agent Builder carrier when the runtime is switched (#5780)

2026-07-23 10:56:53 +08:00

agent_composio_allowlist_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_concurrency_test.go

MUL-5396: validate agent concurrency limits (#6034)

2026-07-29 12:47:14 +08:00

agent_env_permission_test.go

fix(agents): allow agent owners to manage their own agent's env (MUL-5438) (#6080)

2026-07-29 14:01:09 +08:00

agent_env.go

fix(agents): allow agent owners to manage their own agent's env (MUL-5438) (#6080)

2026-07-29 14:01:09 +08:00

agent_permission_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_permission.go

fix(agents): thread permission_mode/invocation_targets through the template create path (MUL-4010) (#4897)

2026-07-03 17:56:02 +08:00

agent_runtime_config_mask_test.go

feat(openclaw): support connecting to existing OpenClaw gateway (#3260) [MUL-3158] (#3664)

2026-06-13 15:33:28 +08:00

agent_runtime_skills_broadcast_test.go

feat(agents): add per-agent runtime skill controls (#5686)

2026-07-22 15:38:38 +08:00

agent_runtime_skills.go

feat(agents): add per-agent runtime skill controls (#5686)

2026-07-22 15:38:38 +08:00

agent_template_permission_test.go

fix(agents): thread permission_mode/invocation_targets through the template create path (MUL-4010) (#4897)

2026-07-03 17:56:02 +08:00

agent_template.go

MUL-5396: validate agent concurrency limits (#6034)

2026-07-29 12:47:14 +08:00

agent_test.go

perf(agents): index-backed latest-terminal lookup in task snapshot (MUL-5436) (#6085)

2026-07-29 14:28:44 +08:00

agent_thinking_test.go

MUL-5185: add Codex Fast mode (#5821)

2026-07-23 15:40:18 +08:00

agent_validation.go

MUL-5396: validate agent concurrency limits (#6034)

2026-07-29 12:47:14 +08:00

agent_work_dir_test.go

MUL-2771: feat(transcript): server-derived relative work_dir chip (#3428)

2026-05-28 15:53:16 +08:00

agent.go

perf(agents): index-backed latest-terminal lookup in task snapshot (MUL-5436) (#6085)

2026-07-29 14:28:44 +08:00

attachment_capability_test.go

fix(attachments): serve proxy-mode downloads with a scoped capability URL (MUL-5292) (#6092)

2026-07-29 15:20:13 +08:00

attachment_capability.go

fix(attachments): serve proxy-mode downloads with a scoped capability URL (MUL-5292) (#6092)

2026-07-29 15:20:13 +08:00

attribution_response_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

auth_signup_test.go

…

auth.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

autopilot_attribution_transfer_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

autopilot_cron_preview_test.go

feat(autopilots): redesign the autopilot schedule editor (#5457)

2026-07-17 16:44:31 +08:00

autopilot_cron_preview.go

feat(autopilots): redesign the autopilot schedule editor (#5457)

2026-07-17 16:44:31 +08:00

autopilot_list_test.go

fix: archive autopilots on delete (#5042)

2026-07-07 20:49:42 +08:00

autopilot_mention_authority_test.go

fix(comment): restore autopilot @mention delegation authority (MUL-4857) (#5512)

2026-07-16 15:23:56 +08:00

autopilot_permissions_test.go

feat(autopilot): View/Write permission layer + member access delegation (MUL-3807) (#4695)

2026-06-30 12:29:11 +08:00

autopilot_private_leader_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

autopilot_subscriber_test.go

fix: archive autopilots on delete (#5042)

2026-07-07 20:49:42 +08:00

autopilot_webhook_handler_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

autopilot_webhook_iprl_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

autopilot_webhook_test.go

MUL-2703: feat(autopilots): webhook event filters per trigger (MUL-2334 follow-up) (#3231)

2026-05-27 15:47:36 +08:00

autopilot_webhook.go

MUL-4744: restore Autopilot webhook response contract (#5397)

2026-07-14 18:29:05 +08:00

autopilot.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

cancel_task_by_user_test.go

fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)

2026-07-15 00:52:27 +08:00

chat_attachment_reply_test.go

fix(daemon): gate codex session pointer writes on rollout presence (MUL-5305) (#5960)

2026-07-27 13:12:06 +08:00

chat_draft_restore_race_test.go

fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)

2026-07-15 00:52:27 +08:00

chat_draft_restore_test.go

fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)

2026-07-15 00:52:27 +08:00

chat_history_test.go

feat(slack): two-command channel reads — chat history (overview) + chat thread [id] (MUL-3871) (#4762)

2026-07-01 12:46:47 +08:00

chat_history.go

feat(slack): two-command channel reads — chat history (overview) + chat thread [id] (MUL-3871) (#4762)

2026-07-01 12:46:47 +08:00

chat_input_ownership_test.go

fix(lark): ingest inbound images and videos as chat attachments (MUL-4934) (#5580)

2026-07-27 15:44:39 +08:00

chat_pending_tasks_test.go

perf(chat): fix pending-task index mismatch + cut aggregate request storm (MUL-4159) (#5018)

2026-07-07 13:20:30 +08:00

chat_pinned_agent.go

feat(chat): Chat V2 — first-class IM-style Chat tab (MUL-4171) (#5076)

2026-07-08 21:58:16 +08:00

chat_project_context_test.go

MUL-5150: add project context to Chat (#5765)

2026-07-24 11:30:27 +08:00

chat_test.go

fix(chat): reland archived-session unread + mount-race auto-read (MUL-4360) (#5333)

2026-07-14 09:37:02 +08:00

chat_title_test.go

feat(chat): LLM-generated chat session titles with silent fallback (MUL-4295) (#5141)

2026-07-09 13:49:07 +08:00

chat_title.go

feat(chat): LLM-generated chat session titles with silent fallback (MUL-4295) (#5141)

2026-07-09 13:49:07 +08:00

chat.go

MUL-5150: add project context to Chat (#5765)

2026-07-24 11:30:27 +08:00

client_usage_test.go

[MUL-5125] Add daily Desktop/Web usage and runtime reporting (#5763)

2026-07-22 16:52:34 +08:00

client_usage.go

[MUL-5125] Add daily Desktop/Web usage and runtime reporting (#5763)

2026-07-22 16:52:34 +08:00

cloud_billing_test.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

cloud_billing.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

cloud_runtime_test.go

feat(auth): support mcn_ Cloud Node PATs verified via Fleet (#3349)

2026-05-27 14:52:03 +08:00

cloud_runtime.go

feat(auth): support mcn_ Cloud Node PATs verified via Fleet (#3349)

2026-05-27 14:52:03 +08:00

comment_content_sanitize_test.go

fix(comment): sanitize NUL/invalid bytes in comment content and trigger preview (#5391)

2026-07-14 19:56:17 +08:00

comment_decision_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

comment_duplicate_enqueue_race_test.go

fix(handler,service): return 409/coalesced instead of 500 on duplicate-key violations (MUL-5285) (#5958)

2026-07-27 14:26:23 +08:00

comment_fold_test.go

feat(comments): resolve-aware fold for agent comment reads (MUL-3555) (#4463)

2026-06-24 09:52:18 +08:00

comment_list_test.go

fix(comments): preserve direct parent on replies (#3579)

2026-06-01 08:28:15 +08:00

comment_merge_failclosed_test.go

fix(handler,service): return 409/coalesced instead of 500 on duplicate-key violations (MUL-5285) (#5958)

2026-07-27 14:26:23 +08:00

comment_reconcile_test.go

fix(comment): restore autopilot @mention delegation authority (MUL-4857) (#5512)

2026-07-16 15:23:56 +08:00

comment_reply_authz_handler_test.go

fix(comments): clarify 409 for top-level comment from a comment-triggered task (MUL-4417) (#5292)

2026-07-12 14:23:30 +08:00

comment_reply_authz_test.go

fix(MUL-4348): authorize + chronologically order per-thread coalesced replies (#5211)

2026-07-10 16:15:10 +08:00

comment_resolve_test.go

fix(comments): enforce single resolution per thread (#3984)

2026-06-10 14:20:39 +08:00

comment_touch_issue_test.go

feat(issues): bump issue updated_at when a comment is added (MUL-5009) (#5667)

2026-07-20 15:38:31 +08:00

comment_trigger_outcomes_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

comment_trigger_preview_test.go

fix(comment): @all no longer swallows an explicit @agent mention (MUL-5411) (#6048)

2026-07-29 13:15:10 +08:00

comment.go

fix(comment): @all no longer swallows an explicit @agent mention (MUL-5411) (#6048)

2026-07-29 13:15:10 +08:00

config_test.go

feat(vcs): make self-hosted Git providers self-host-only (MUL-3772, MUL-5138) (#5888)

2026-07-24 16:39:22 +08:00

config.go

feat(vcs): make self-hosted Git providers self-host-only (MUL-3772, MUL-5138) (#5888)

2026-07-24 16:39:22 +08:00

contact_sales_test.go

feat(landing): add Contact Sales page and inquiry endpoint (MUL-2493) (#2988)

2026-05-22 13:22:36 +08:00

contact_sales.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

daemon_batch_claim_finalize_test.go

Machine-level batch task claim endpoint (MUL-4257) (#5193)

2026-07-14 11:53:42 +08:00

daemon_batch_claim_test.go

Machine-level batch task claim endpoint (MUL-4257) (#5193)

2026-07-14 11:53:42 +08:00

daemon_chat_prompt_test.go

fix(lark): ingest inbound images and videos as chat attachments (MUL-4934) (#5580)

2026-07-27 15:44:39 +08:00

daemon_claim_channel_type_test.go

fix(agent): stop agents shipping local-path links, make Desktop 404 recoverable (MUL-4899) (#5557)

2026-07-17 13:40:23 +08:00

daemon_claim_continuity_gap_test.go

fix(daemon): gate codex session pointer writes on rollout presence (MUL-5305) (#5960)

2026-07-27 13:12:06 +08:00

daemon_comment_delivery_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

daemon_comment_workspace_scope_test.go

fix: scope claim-time comment fetch to workspace + guard --attachment paths (MUL-4252) (#5190)

2026-07-10 13:43:45 +08:00

daemon_rpc_test.go

Machine-level batch task claim endpoint (MUL-4257) (#5193)

2026-07-14 11:53:42 +08:00

daemon_rpc.go

Machine-level batch task claim endpoint (MUL-4257) (#5193)

2026-07-14 11:53:42 +08:00

daemon_test.go

feat(gc): batch issue reconciliation (#5534)

2026-07-17 12:33:36 +08:00

daemon_workspace.go

MUL-4480: make daemon workspace sync event-driven (#5354)

2026-07-14 11:56:30 +08:00

daemon_ws.go

MUL-4480: make daemon workspace sync event-driven (#5354)

2026-07-14 11:56:30 +08:00

daemon.go

fix(agents): allow agent owners to manage their own agent's env (MUL-5438) (#6080)

2026-07-29 14:01:09 +08:00

dashboard_agent_visibility_test.go

fix(dashboard): stop leaking private agents from the per-agent rollups (MUL-5409) (#6051)

2026-07-29 13:08:48 +08:00

dashboard_test.go

feat(usage): error/failure charts on the Usage page (MUL-5352) (#5991)

2026-07-27 18:40:48 +08:00

dashboard.go

fix(dashboard): stop leaking private agents from the per-agent rollups (MUL-5409) (#6051)

2026-07-29 13:08:48 +08:00

featureflag_test.go

fix(agents): always enable AI creation (MUL-4998) (#5660)

2026-07-20 12:46:39 +08:00

feedback_test.go

…

feedback.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

file_test.go

fix(lark): ingest inbound images and videos as chat attachments (MUL-4934) (#5580)

2026-07-27 15:44:39 +08:00

file.go

fix(attachments): serve proxy-mode downloads with a scoped capability URL (MUL-5292) (#6092)

2026-07-29 15:20:13 +08:00

github_test.go

MUL-5088: import repositories from GitHub App (#5896)

2026-07-28 16:19:35 +08:00

github.go

MUL-5088: import repositories from GitHub App (#5896)

2026-07-28 16:19:35 +08:00

handler_test.go

[MUL-5125] Add daily Desktop/Web usage and runtime reporting (#5763)

2026-07-22 16:52:34 +08:00

handler_writejson_test.go

feat(api): emit Content-Length header on JSON responses (#5021)

2026-07-07 14:43:19 +08:00

handler.go

fix(lark): ingest inbound images and videos as chat attachments (MUL-4934) (#5580)

2026-07-27 15:44:39 +08:00

heartbeat_scheduler_test.go

perf(heartbeat): batch runtime last_seen_at writes (#2213)

2026-05-07 15:50:27 +08:00

heartbeat_scheduler.go

perf(heartbeat): batch runtime last_seen_at writes (#2213)

2026-05-07 15:50:27 +08:00

heartbeat_test.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

inbox.go

feat(inbox): archived notifications sub-view (MUL-3736) (#5518)

2026-07-16 14:58:42 +08:00

integrations_composio_test.go

fix: guide SSH installs to token login (#5318)

2026-07-13 16:42:46 +08:00

integrations_composio.go

MUL-4009: hide not-configured Composio toolkits at Service layer (#4880)

2026-07-03 16:10:19 +08:00

invitation_test.go

fix(server): allow re-inviting after invitation expires (#2059)

2026-05-04 21:24:56 +08:00

invitation.go

MUL-4480: make daemon workspace sync event-driven (#5354)

2026-07-14 11:56:30 +08:00

issue_agent_create_e2e_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

issue_agent_create_origin_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

issue_assignee_types_test.go

MUL-3903: Extract shared issue surfaces (#4774)

2026-07-02 14:11:10 +08:00

issue_batch_test.go

fix(issues): batch status applies directly; coalesce staged parent notifications (MUL-4155) (#5151)

2026-07-10 09:11:29 +08:00

issue_cancel_status_no_cancel_test.go

fix(server): don't cancel active tasks when issue status → cancelled (#5328)

2026-07-13 16:15:58 +08:00

issue_child_done_stage_test.go

fix(squads): align parent issue status with agent-managed model (MUL-5156) (#5758)

2026-07-22 20:33:15 +08:00

issue_child_done_test.go

fix(daemon): gate codex session pointer writes on rollout presence (MUL-5305) (#5960)

2026-07-27 13:12:06 +08:00

issue_child_done.go

fix(squads): align parent issue status with agent-managed model (MUL-5156) (#5758)

2026-07-22 20:33:15 +08:00

issue_children_for_parents_test.go

feat(issues): richer sub-issue rows in issue detail (MUL-5098) (#5721)

2026-07-22 22:43:34 +08:00

issue_create_labels_test.go

fix(issues): attach labels in the create transaction (MUL-4832) (#5510)

2026-07-16 13:31:06 +08:00

issue_create_position_test.go

fix(issues): place new issues at top of column in manual sort mode

2026-05-28 14:20:20 +08:00

issue_grouped_test.go

fix: return stage from issue list APIs

2026-07-13 13:08:04 +08:00

issue_involves_test.go

feat(my-issues): cover squad assignees via involves_user_id (MUL-2397) (#2829)

2026-05-19 10:37:38 +08:00

issue_limit_validation_test.go

fix(issues): validate and clamp limit/offset in ListIssues (MUL-2847) (#3585)

2026-06-02 17:17:41 +08:00

issue_metadata_test.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_metadata.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_move_test.go

MUL-5202: unify Issue Query across List, Board, and Swimlane (#5820)

2026-07-23 15:58:25 +08:00

issue_move.go

MUL-5202: unify Issue Query across List, Board, and Swimlane (#5820)

2026-07-23 15:58:25 +08:00

issue_reaction.go

…

issue_reassign_no_cancel_test.go

fix(server): do not cancel issue tasks on assignee change (MUL-4113, #4963) (#4975)

2026-07-06 19:11:47 +08:00

issue_scheduled_test.go

fix: return stage from issue list APIs

2026-07-13 13:08:04 +08:00

issue_sort_test.go

MUL-4797: add configurable issue table view (#5454)

2026-07-17 19:21:27 +08:00

issue_table_facets.go

MUL-5198: Restore server-backed issue table grouping (MUL-5100) (#5817)

2026-07-23 12:03:27 +08:00

issue_table_filters_test.go

MUL-4797: add configurable issue table view (#5454)

2026-07-17 19:21:27 +08:00

issue_table_group.go

MUL-5202: unify Issue Query across List, Board, and Swimlane (#5820)

2026-07-23 15:58:25 +08:00

issue_table_query_test.go

fix(issues): filter working agents by active task issues (#5839)

2026-07-23 17:54:52 +08:00

issue_table_query.go

fix(issues): filter working agents by active task issues (#5839)

2026-07-23 17:54:52 +08:00

issue_table_rows.go

MUL-5202: unify Issue Query across List, Board, and Swimlane (#5820)

2026-07-23 15:58:25 +08:00

issue_trigger_preview_test.go

MUL-3416: Issue pre-trigger preview + Handoff Note (#4383)

2026-06-23 13:17:13 +08:00

issue_trigger.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

issue_validation_test.go

fix: validate issue status and priority (#4156)

2026-06-16 12:26:44 +08:00

issue.go

feat(issues): richer sub-issue rows in issue detail (MUL-5098) (#5721)

2026-07-22 22:43:34 +08:00

label_test.go

fix(release): harden v0.3.44 migrations (#5345)

2026-07-13 18:13:44 +08:00

label.go

fix(release): harden v0.3.44 migrations (#5345)

2026-07-13 18:13:44 +08:00

lark_test.go

feat(lark): let an agent's owner bind/manage its Lark bot (MUL-4213) (#5079)

2026-07-08 16:19:41 +08:00

lark.go

feat(lark): let an agent's owner bind/manage its Lark bot (MUL-4213) (#5079)

2026-07-08 16:19:41 +08:00

mcp_overlay_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

mcp_overlay.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

mention_self_trigger_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

notification_preference_test.go

MUL-4798: make Inbox notification preference updates atomic (#5451)

2026-07-15 17:52:10 +08:00

notification_preference.go

MUL-4798: make Inbox notification preference updates atomic (#5451)

2026-07-15 17:52:10 +08:00

onboarding_shim.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

onboarding_test.go

feat(onboarding): merge About-you step, collect source after agents deliver value (#5786)

2026-07-23 01:57:44 +08:00

onboarding.go

feat(onboarding): merge About-you step, collect source after agents deliver value (#5786)

2026-07-23 01:57:44 +08:00

parse_since_param_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

personal_access_token_test.go

MUL-2744: feat(auth): auto-renew daemon PAT in-place within 7-day window (#3360)

2026-05-27 22:22:26 +08:00

personal_access_token.go

MUL-2744: feat(auth): auto-renew daemon PAT in-place within 7-day window (#3360)

2026-05-27 22:22:26 +08:00

pin.go

…

project_dates_test.go

feat(project): add start_date and due_date fields (MUL-4388) (#5313)

2026-07-13 13:22:02 +08:00

project_resource_test.go

Revert "feat(daemon): worktree_pool mode for local_directory (MUL-3483) (#4986)" (#5037)

2026-07-07 17:35:33 +08:00

project_resource.go

Revert "feat(daemon): worktree_pool mode for local_directory (MUL-3483) (#4986)" (#5037)

2026-07-07 17:35:33 +08:00

project_validation_test.go

MUL-3438: fix(projects): require admin for project deletion (#4327)

2026-06-21 23:54:58 +08:00

project.go

MUL-5150: add project context to Chat (#5765)

2026-07-24 11:30:27 +08:00

property_test.go

MUL-4820: support custom property icons (#5468)

2026-07-15 22:37:57 +08:00

property.go

MUL-4820: support custom property icons (#5468)

2026-07-15 22:37:57 +08:00

quick_create_parent_test.go

feat: improve create issue field controls (#5532)

2026-07-17 11:11:52 +08:00

reaction.go

…

reserved_slugs.json

feat(web): add use-cases content pipeline with welcome page (MUL-2349) (#2795)

2026-05-25 10:05:17 +08:00

resource_label_cascade_test.go

fix(labels): sweep resource-label junctions on bulk deletes (MUL-4479) (#5348)

2026-07-13 20:07:24 +08:00

rollup_guard_test.go

test(rollup): serialise shared-singleton rollup tests across packages (MUL-3980) (#4854)

2026-07-02 18:31:45 +08:00

runtime_archive_squad_cleanup_test.go

MUL-2489 fix(runtime): delete archived squads before runtime teardown (#2955)

2026-06-08 13:08:38 +08:00

runtime_cascade_test.go

MUL-4158: allow deleting orphaned profile runtimes

2026-07-07 12:01:14 +08:00

runtime_custom_name_test.go

feat(runtimes): custom runtime names + searchable machine-grouped picker (MUL-4217) (#5070)

2026-07-08 16:00:17 +08:00

runtime_liveness_store_test.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

runtime_liveness_store.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

runtime_local_skills_overwrite_test.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

runtime_local_skills_redis_store_test.go

feat: redesign agent Skills and MCP capabilities (#5277)

2026-07-12 02:53:17 +08:00

runtime_local_skills_redis_store.go

feat: redesign agent Skills and MCP capabilities (#5277)

2026-07-12 02:53:17 +08:00

runtime_local_skills_test.go

feat(agents): add per-agent runtime skill controls (#5686)

2026-07-22 15:38:38 +08:00

runtime_local_skills.go

feat(agents): add per-agent runtime skill controls (#5686)

2026-07-22 15:38:38 +08:00

runtime_models_redis_store_test.go

…

runtime_models_redis_store.go

fix(handler): keep runtime pending redis keys in one slot

2026-07-02 14:38:05 +08:00

runtime_models_test.go

…

runtime_models.go

MUL-5185: add Codex Fast mode (#5821)

2026-07-23 15:40:18 +08:00

runtime_profile_handler_test.go

fix(channels): auto-reclaim orphaned IM-bot installations + accurate rebind conflict copy (#4810) MUL-3937 (#5103)

2026-07-09 15:07:11 +08:00

runtime_profile.go

fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)

2026-07-15 00:52:27 +08:00

runtime_redis_keys_test.go

fix(handler): keep runtime pending redis keys in one slot

2026-07-02 14:38:05 +08:00

runtime_test.go

fix(usage): disambiguate model pricing by provider (MUL-3346)

2026-06-18 11:10:06 +08:00

runtime_update_authorization_test.go

MUL-4861: align runtime CLI update permissions (#5514)

2026-07-16 13:54:01 +08:00

runtime_update_redis_store_test.go

MUL-4861: align runtime CLI update permissions (#5514)

2026-07-16 13:54:01 +08:00

runtime_update_redis_store.go

MUL-4861: align runtime CLI update permissions (#5514)

2026-07-16 13:54:01 +08:00

runtime_update_test.go

MUL-4861: align runtime CLI update permissions (#5514)

2026-07-16 13:54:01 +08:00

runtime_update.go

MUL-4861: align runtime CLI update permissions (#5514)

2026-07-16 13:54:01 +08:00

runtime_visibility_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

runtime.go

feat(usage): error/failure charts on the Usage page (MUL-5352) (#5991)

2026-07-27 18:40:48 +08:00

search_test.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

search_timeout_test.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

search.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

skill_create.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

skill_import_archive_test.go

feat(skills): import skills from a .skill/.zip archive (#4735)

2026-06-30 14:46:46 +08:00

skill_import_archive.go

feat(skills): import skills from a .skill/.zip archive (#4735)

2026-06-30 14:46:46 +08:00

skill_import_duplicate_test.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

skill_list_test.go

feat(agents): add per-agent runtime skill controls (#5686)

2026-07-22 15:38:38 +08:00

skill_search_test.go

feat: add skill search CLI (#3601)

2026-06-01 15:19:42 +08:00

skill_test.go

fix(skills): tree-first skill import to stop 504 on large repos (MUL-5136) (#5753)

2026-07-22 14:38:31 +08:00

skill.go

fix(skills): tree-first skill import to stop 504 on large repos (MUL-5136) (#5753)

2026-07-22 14:38:31 +08:00

slack_test.go

feat(slack): bring-your-own-app install + per-installation Socket Mode (MUL-3666) (#4566)

2026-06-29 14:09:34 +08:00

slack.go

fix(channels): auto-reclaim orphaned IM-bot installations + accurate rebind conflict copy (#4810) MUL-3937 (#5103)

2026-07-09 15:07:11 +08:00

squad_assign_trigger_test.go

feat: implement Squad feature MVP (#2505)

2026-05-13 18:46:20 +08:00

squad_briefing_claim_test.go

fix(squad): inject leader briefing by task flag, not issue assignee (MUL-3730) (#4606)

2026-06-26 16:01:33 +08:00

squad_briefing_test.go

fix(squads): align parent issue status with agent-managed model (MUL-5156) (#5758)

2026-07-22 20:33:15 +08:00

squad_briefing.go

fix(squads): align parent issue status with agent-managed model (MUL-5156) (#5758)

2026-07-22 20:33:15 +08:00

squad_comment_trigger_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

squad_creator_scope_test.go

feat(squad): allow members to create and manage their own squads (MUL-4223) (#5071)

2026-07-08 14:51:54 +08:00

squad_id_enqueue_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

squad_member_status_test.go

fix(agents): surface archived status for retired agents (#3608)

2026-06-02 13:03:15 +08:00

squad_no_action_test.go

fix(squad): suppress no-action leader comments (#2583)

2026-05-14 14:07:26 +08:00

squad_parent_status_contract_test.go

fix(squads): align parent issue status with agent-managed model (MUL-5156) (#5758)

2026-07-22 20:33:15 +08:00

squad_private_leader_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

squad_worker_comment_wakes_leader_test.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

squad.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

subscriber_test.go

feat(agents): gate private-agent surfaces with allowed_principals predicate (#2359)

2026-05-11 12:39:45 +08:00

subscriber.go

…

task_lifecycle.go

feat(attribution): Human Attribution Phase 1 (MUL-4302) (#5150)

2026-07-15 03:09:56 +08:00

task_terminal_wakeup_test.go

fix(daemon): wake queued tasks after predecessor exits (#5379)

2026-07-14 13:16:50 +08:00

trigger_test.go

fix(comment): restore autopilot @mention delegation authority (MUL-4857) (#5512)

2026-07-16 15:23:56 +08:00

user_language_test.go

i18n: add japanese locale (MUL-2893) (#3538)

2026-06-02 14:29:29 +08:00

user_timezone_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

vcs_test.go

feat(vcs): make self-hosted Git providers self-host-only (MUL-3772, MUL-5138) (#5888)

2026-07-24 16:39:22 +08:00

vcs_webhook_test.go

feat(vcs): make self-hosted Git providers self-host-only (MUL-3772, MUL-5138) (#5888)

2026-07-24 16:39:22 +08:00

vcs_webhook.go

MUL-5265: GitHub API-snapshot PR cards — CI status + mergeability (#5889)

2026-07-24 18:30:20 +08:00

vcs.go

feat(vcs): make self-hosted Git providers self-host-only (MUL-3772, MUL-5138) (#5888)

2026-07-24 16:39:22 +08:00

webhook_delivery_test.go

MUL-4744: restore Autopilot webhook response contract (#5397)

2026-07-14 18:29:05 +08:00

webhook_delivery_worker.go

MUL-4744: restore Autopilot webhook response contract (#5397)

2026-07-14 18:29:05 +08:00

webhook_delivery.go

MUL-4502: make autopilot webhook admission durable (#5386)

2026-07-14 16:20:33 +08:00

webhook_rate_limiter_test.go

MUL-4502: make autopilot webhook admission durable (#5386)

2026-07-14 16:20:33 +08:00

webhook_rate_limiter.go

MUL-4502: make autopilot webhook admission durable (#5386)

2026-07-14 16:20:33 +08:00

workspace_reserved_slugs.go

refactor(reserved-slugs): single JSON source for backend + frontend (#2148)

2026-05-08 19:14:12 +08:00

workspace_revoke.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

workspace_test.go

MUL-5265: GitHub API-snapshot PR cards — CI status + mergeability (#5889)

2026-07-24 18:30:20 +08:00

workspace.go

fix(chat): defer cancellation-time finalization until the task transcript is stable (#5246)

2026-07-15 00:52:27 +08:00