Skip to content

Email-ready release: restore reviews, honest health, reconnect and Email UI fixes - #424

Open
Maneek21 wants to merge 119 commits into
masterfrom
release/email-ready-20261104
Open

Maneek21 wants to merge 119 commits into
masterfrom
release/email-ready-20261104

Conversation

@Maneek21

@Maneek21 Maneek21 commented Nov 4, 2026

Copy link
Copy Markdown
Owner

Summary

This brings the Email follow-up work from Nov 2–4 into master, for the Email-ready release. It has three parts:

  1. Nov 2 integration (int/deft-20261102): restore-access review with an honest 403 next_step contract, record-mirror nominations, resumable background leases, the file transfer queue (8 MiB uploads, four slots per owner), Anthropic SDK 1.x, the react-grid-layout v2 migration, the Experience Worker source cap raised to 112 KiB, and reader and compose polish.
  2. Database restore (fix/db-restore-20261104): post-.131 migrations now apply on fresh installs and upgrades, the reviewed catalogs are pinned to the real digests, restore access goes through stored single-use reviews, and the non-unique restore-review foreign key is dropped.
  3. Health, reconnect and Email UI (fix/ui-host-20261104):
    • Background health is attached to the account catalog and scoped to the connection owner.
    • Apps can show connection_action buttons that start the Host's reconnect flow directly.
    • Fixes from six UI review rounds: compose width, reader subject wrapping on phones, wide tables, the folder overflow menu, RTL, rule editor rows, contrast, focus return and the Reply hint.
    • The experience icon set now uses Lucide geometry with a 1.5 stroke, and idle toolbar icons are muted.

The four dependabot bumps (#418, #419, #421, #422) are already included here; those PRs can be closed after this merges.

Kit

This changes the public Kit contracts in packages/app-kit (experience-account, experience-core, experience-menu). Once this is merged, release Kit 0.1.0-alpha.43 so Email can bump its pin (see the Email PR).

Release order

  1. Merge and deploy the Host.
  2. Release Kit alpha.43.
  3. Bump the Kit pin in Email and release it (the Email PR).
  4. Smoke-test on demo.deft.ing with a real Gmail account.

Testing

  • Web typecheck passes and the app boundary check reports 0 errors.
  • Experience, app-connection and restore-access-review suites: 643 pass and 1 fails. The failure (experience-record-form-disabled-mounted) is a timing test that also fails on the base branch.
  • New guard tests for the icon table and icon styling: 4 of 4 pass.
  • Database: 23 of 23 API restore tests pass on a freshly pushed full schema (121 versions).
  • Production build checked in a browser against a local fixture stack at 1440px and 390px, in light and dark: one accepted send per click, Compose survives polling, axe contrast violations 0, Compose opens in 0.83 s and Inbox in 1.84 s.
  • This exact tree was built and tested before this branch was cut; git diff between them is empty.

Known gaps (not blocking)

  • The sender on a sent message, the 34px Refresh jump and the 44×44 Retry target are covered by unit tests only.
  • Agent permission rows have no one-line explanation yet.
  • On phones a long subject makes the sticky reader toolbar about 150px tall.
  • A menu row whose action has no Kit icon name shows no icon.

🤖 Generated with Claude Code

dependabot Bot and others added 30 commits October 28, 2026 12:24
…update

Bumps the npm_and_yarn group with 1 update in the /examples/apps/email directory: [nodemailer](https://github.com/nodemailer/nodemailer).
Bumps the npm_and_yarn group with 1 update in the /examples/apps/email/fixtures/sdk9-consumer directory: [nodemailer](https://github.com/nodemailer/nodemailer).


Updates `nodemailer` from 10.0.10 to 10.1.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.10...v10.1.4)

Updates `nodemailer` from 10.0.10 to 10.1.4
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.10...v10.1.4)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.1.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: nodemailer
  dependency-version: 10.1.4
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) from 0.128.0 to 1.3.0.
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.128.0...sdk-v1.3.0)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [react-grid-layout](https://github.com/STRML/react-grid-layout) and [@types/react-grid-layout](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-grid-layout). These dependencies needed to be updated together.

Updates `react-grid-layout` from 1.5.4 to 2.3.0
- [Release notes](https://github.com/STRML/react-grid-layout/releases)
- [Changelog](https://github.com/react-grid-layout/react-grid-layout/blob/master/CHANGELOG.md)
- [Commits](react-grid-layout/react-grid-layout@1.5.4...2.3.0)

Updates `@types/react-grid-layout` from 1.3.6 to 2.1.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-grid-layout)

---
updated-dependencies:
- dependency-name: "@types/react-grid-layout"
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: react-grid-layout
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…8 updates

Bumps the patch-and-minor group with 38 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.1` | `2.1.5` |
| [dotenv](https://github.com/motdotla/dotenv) | `18.0.4` | `18.0.9` |
| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | `0.45.3` | `0.45.4` |
| [hono](https://github.com/honojs/hono) | `4.13.11` | `4.13.14` |
| [node-ical](https://github.com/jens-maus/node-ical) | `0.27.2` | `0.27.3` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.23.0` | `8.23.1` |
| [read-excel-file](https://gitlab.com/catamphetamine/read-excel-file) | `9.3.10` | `9.3.12` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.3` | `26.6.5` |
| [@tiptap/core](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/core) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-code-block-lowlight](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-code-block-lowlight) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-details](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-details) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-document](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-document) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-highlight](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-highlight) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-image](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-image) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-paragraph](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-paragraph) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-placeholder](https://github.com/ueberdosis/tiptap/tree/HEAD/packages-deprecated/extension-placeholder) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-cell](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-cell) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-header](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-header) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-table-row](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-table-row) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-task-item](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-item) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-task-list](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-task-list) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-text](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-text) | `3.31.3` | `3.32.0` |
| [@tiptap/extension-underline](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-underline) | `3.31.3` | `3.32.0` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `3.31.3` | `3.32.0` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `3.31.3` | `3.32.0` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `3.31.3` | `3.32.0` |
| [@tiptap/suggestion](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/suggestion) | `3.31.3` | `3.32.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.48.0` | `1.61.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.28` | `8.5.31` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@types/d3-zoom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/d3-zoom) | `3.0.8` | `3.0.9` |
| [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.13.0` |
| [@neondatabase/serverless](https://github.com/neondatabase/serverless) | `1.1.0` | `1.2.0` |
| [@modelcontextprotocol/client](https://github.com/modelcontextprotocol/typescript-sdk) | `2.3.0` | `2.4.0` |



Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@hono/node-server` from 2.1.1 to 2.1.5
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.1...v2.1.5)

Updates `dotenv` from 18.0.4 to 18.0.9
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v18.0.4...v18.0.9)

Updates `drizzle-orm` from 0.45.3 to 0.45.4
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](drizzle-team/drizzle-orm@0.45.3...0.45.4)

Updates `hono` from 4.13.11 to 4.13.14
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.11...v4.13.14)

Updates `node-ical` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/jens-maus/node-ical/releases)
- [Commits](jens-maus/node-ical@0.27.2...0.27.3)

Updates `pg` from 8.23.0 to 8.23.1
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.1/packages/pg)

Updates `read-excel-file` from 9.3.10 to 9.3.12
- [Changelog](https://gitlab.com/catamphetamine/read-excel-file/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/catamphetamine/read-excel-file/compare/v9.3.10...v9.3.12)

Updates `@types/node` from 26.6.3 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@tiptap/core` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/core)

Updates `@tiptap/extension-code-block-lowlight` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-code-block-lowlight/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-code-block-lowlight)

Updates `@tiptap/extension-details` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-details/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-details)

Updates `@tiptap/extension-document` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-document/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-document)

Updates `@tiptap/extension-highlight` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-highlight/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-highlight)

Updates `@tiptap/extension-image` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-image/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-image)

Updates `@tiptap/extension-link` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-link/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-link)

Updates `@tiptap/extension-paragraph` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-paragraph/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-paragraph)

Updates `@tiptap/extension-placeholder` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages-deprecated/extension-placeholder/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages-deprecated/extension-placeholder)

Updates `@tiptap/extension-table` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-table/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table)

Updates `@tiptap/extension-table-cell` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-cell)

Updates `@tiptap/extension-table-header` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-header)

Updates `@tiptap/extension-table-row` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-table-row)

Updates `@tiptap/extension-task-item` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-task-item)

Updates `@tiptap/extension-task-list` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-task-list)

Updates `@tiptap/extension-text` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-text/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-text)

Updates `@tiptap/extension-underline` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/extension-underline/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/extension-underline)

Updates `@tiptap/pm` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/pm/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/pm)

Updates `@tiptap/react` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/react/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/react)

Updates `@tiptap/starter-kit` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/starter-kit/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/starter-kit)

Updates `@tiptap/suggestion` from 3.31.3 to 3.32.0
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/v3.32.0/packages/suggestion/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/v3.32.0/packages/suggestion)

Updates `lucide-react` from 1.48.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `postcss` from 8.5.28 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.28...8.5.31)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/d3-zoom` from 3.0.8 to 3.0.9
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/d3-zoom)

Updates `eslint` from 10.11.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.11.0...v10.13.0)

Updates `@neondatabase/serverless` from 1.1.0 to 1.2.0
- [Changelog](https://github.com/neondatabase/serverless/blob/main/CHANGELOG.md)
- [Commits](neondatabase/serverless@v1.1.0...v1.2.0)

Updates `@modelcontextprotocol/client` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/@modelcontextprotocol/client@2.3.0...@modelcontextprotocol/client@2.4.0)

---
updated-dependencies:
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: dotenv
  dependency-version: 18.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: drizzle-orm
  dependency-version: 0.45.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: node-ical
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: pg
  dependency-version: 8.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: read-excel-file
  dependency-version: 9.3.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/core"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-code-block-lowlight"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-details"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-document"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-highlight"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-image"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-paragraph"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-placeholder"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-cell"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-header"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-table-row"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-task-item"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-task-list"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-text"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/extension-underline"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/pm"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/react"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@tiptap/suggestion"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: "@types/d3-zoom"
  dependency-version: 3.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@neondatabase/serverless"
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: "@modelcontextprotocol/client"
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Top-level channel mentions replace conversation history with the room pack, so durable module results from approved actions were dropped for public and private channels (threads and group DMs already worked). Carry bounded result sources out of the pack and re-check Module authority through the existing approvedResultHistory path before any identifier reaches the model.

Adds a handler-level DB test proving the authorized record id survives the room-pack path for public and private channels and disappears when module access is revoked.
…e Done summary

Dashboard day buckets were computed from the server's local calendar day, so a viewer whose timezone differed from the server saw tasks in the wrong due-today / overdue / due-this-week buckets. Resolve the viewer timezone (?tz= validated, then users.timezone, then org tz, then UTC) and compute boundaries with getDayBoundaries; the web dashboard now sends the browser/profile tz.

The approval-confirmation flow appends a Done summary to the proposal message while also posting the same summary as a separate confirmation message, so approving the last card rendered the Done text twice. Strip the stale approval prompt from the proposal without repeating the outcome; the confirmation message remains the single canonical summary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nned

CI installs examples/apps/email with --frozen-lockfile, so the nodemailer
10.1.4 manifest bump left the lockfile stale and the install failed.

Regenerate examples/apps/email/pnpm-lock.yaml for nodemailer 10.1.4 and
restore the sealed sdk9 historical consumer package.json to 10.0.10. That
fixture is byte-for-byte evidence recorded in SEALED-HISTORICAL-CONSUMER.json
(sha256 b0545b1...), not a supported consumer, so it must not drift.
formatDeftyApprovalReply returned null for module_record_update/create/etc,
so two CRM actions in one Defty message fell back to a generic summary that
triggered the 'could not create a valid approval card' clarification. Add
module-aware rendering so each proposal family gets a readable combined card
while keeping all permission/tenant/grounding checks intact.

- formatModuleActionChange helper for create/update/archive/task-link
- truncateChangeValue to avoid double punctuation and long values
- Tests: normalize/validate/render two CRM actions; mocked compiler draft

Refs W1-crm
react-grid-layout 2.x replaces the flat v1 props with composable configs and
redefines Layout as a readonly LayoutItem[]. Without migration the read-only
dashboard would have silently become draggable and resizable because v2 enables
both by default.

- Type layout items as LayoutItem[] and layout arrays as Layout.
- Map edit mode onto dragConfig/resizeConfig (helper is unit-tested).
- Keep vertical compaction explicit with verticalCompactor.
- Drop @types/react-grid-layout: 2.1.0 is a deprecated empty stub and its
  presence masked the component props from the type checker.
…urvive

The first attempt only fixed the approval summary renderer, which never
empties the action list. The real drop is that module writes reaching the
runner path carry the model's raw input with no stable idempotency_key, and
validateRegisteredProposalAction rejects every module write without one. The
compiler already derives a deterministic key via buildActionGraph; give the
runner path the same contract by backfilling a stable key before validation.

Also soften buildWriteIntentClarification so a still-empty proposal list asks
the user to retry or split changes instead of blaming the request.

Refs W1-crm2
…fallback copy

The runner path backfill (2222329) is correct, but its fallback copy told
users to "ask for each change separately", which is now wrong: two CRM writes
in one message persist as two approval cards. Restore the neutral original
message and sharpen the docstring/inline comment to name the true drop point
(the runner passing raw module input that fails the required idempotency_key
check in validateRegisteredProposalAction). Add a focused unit test for
ensureModuleWriteIdempotencyKeys (distinct stable keys, never overwrite an
existing key, non-module actions untouched).

Refs W1-crm2
…pping attachment chips

Compose opening (audit #3): drop the 'Checking browser recovery…' notice
flash while the recovery scope and opening proof run, render a structured
compose skeleton (aria-busy, four .skeleton rows) alongside the opening
status, and gate the Browser draft recovery banner so an in-flight check
never flashes above the form. Unconfirmed candidates, submissions and
genuinely failed checks still surface with their actions.

Mobile and a11y (audit #7, #9): hide the desktop width toggle below the
sm breakpoint and reserve its gutter only from sm up, left-align the
identity pill against the optional-field toggles above a ghost divider,
close the identity popover on Escape and outside pointerdown, and unify
the Review primary button on the primary-container token.

Attachment chips (audit #5): compose file rows wrap below sm with a
140px minimum filename block, and original-attachment rows style their
Include/Omit/Check status actions as Deft pills via parent selectors
while keeping the exact button markup.

Tests: mounted skeleton without recovery jargon, recovery banner gating
(candidate/submission/failure still surface), Escape and outside-click
identity dismissal, responsive chip classes, and the sm-breakpoint
surface. Repairs the stale recipient-presentation VM fixture (real
recordForm* helpers and structured-address parser) whose whole-file
computed-import digest is refreshed in the app-boundary allowlist; the
loader expression and every pinned component line are unchanged.
Use Obsidian design tokens across the shared experience renderer, wrap reader headings to two lines on phones, and show a shimmer skeleton while a document loads. Ring-frame HTML documents without shifting authored widths. Auto-open listed attachments as responsive chips, announce status/progress text, label icon buttons, and submit search on Enter.
SDK 1.0 added a system variant to MessageParam whose array content is
text-only. normalizeAgentToolHistory spread the filtered block array back
over the union, so tsc rejected the system arm and the API typecheck
failed after the bump. Tool-ordering repair only applies to
user/assistant turns, so pass system messages through unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…icy toggle defaults

Adds the app-neutral prepare_record_mirror inner operation to the Kit
schema (effect in review mode, requires action_key and a required
record_id pin), accepts it in the integration-tool inner/callback
fences, and classifies it as a write effect for installed-tool
discovery. Renders agent runtime-action policies as a single toggle
list and defaults a fresh Defty delegation to read-only.
…se 2)

Add a single app-neutral restore-access review (context/review/activate) that
re-issues every prior grant of a reconnected account at its original lifetime,
never widened, in one transaction with soft-transitioned old rows and audit
lineage. Enum-typed details.next_step (restore_access|reconnect|review_consent)
is emitted on lapsed/reauth 403s and parsed/rendered by the web layer instead
of the bare 'Outcome uncertain' dead-end.

Implements design-p2-host.md §2-§5 incl. same-account gate, subset activation,
lapsed-vs-broken defaults, audit link, and the app-neutral grant-kind registry.
…efaults

- AppRecordMirrorService.nominate lets a Defty/personal-MCP caller nominate
  a saved record for a declared record-mirror policy; it validates the agent
  principal and owner/tenant isolation and lands a pending agent_actions card,
  issuing no receipt until the human approves through the unchanged
  review()/confirm() authority.
- seedExperienceAgentPolicyDefaults seeds require_approval for nominated
  runtime actions (deny stays implicit), never overwriting a prior choice.
- seedDefaultDeftyIntegrationGrant seeds a read-only Defty delegation during
  the restore-access review; draft/send stay explicit opt-ins.
…urrent integration session

- C1: memoise the parsed deployment registry per HTTP request via an
  AsyncLocalStorage scope (still lstat-validated on every lookup so a
  replaced/removed/oversized file revokes on the very next call); hoist the
  per-entry transport digest into a constructor map.
- C3: select the single highest-revision current integration session and deny
  on tie/stale-fallthrough instead of re-running full authority per candidate.
- 2.5: DEFT_APP_DATA_TIMING=authority emits a content-free app_data_timing
  event for every authority operation and adds the new phase names.
- Add no-DB unit tests for registry-scope memoisation and revocation parity,
  plus framework-free authority-latency / statement-count harness scripts.
…y policy over on restore

Phase 3 (Host): make the app-integration-knowledge retry loop terminal when an
account grant ends, expose capture health to the app, and carry the capture
policy over to the reconnected account inside the restore-access review.

- Add retired_at/retired_reason/last_error to app_integration_capture_policies
  (migration 0.3.0-preview.132) and retire a policy on APP_ACCESS_DENIED with a
  system notification instead of retrying 5x/min forever.
- Widen capture settings() with a health object and add a POST
  /api/app-integrations/knowledge/health probe that reports grant_ended without
  a hard 403.
- Enumerate capture_policy grants in the restore review and re-enable the
  retired policy in place on activate (fresh revision + scheduled job).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reply/New compose opening issued 6 target resolves and 4 runtime invocations
before the form appeared. The opening reads (locator reserve, seed hydration,
record read) now share one in-flight target nomination for at most 5 s, and
resolveSeed's before/after-reserve phases revalidate that nomination locally
instead of buying two more Host admissions. load() also passes its target to
the seed metadata invoke and returns openingRecovery so the form never needs
the fallback recovery-scope resolve.

The cached value is a nomination, not an authority decision: every dispatch
still goes to the Host route and the Runtime still verifies current authority,
the confirm phase keeps the existing fresh proof before any save, and the
window is cleared by every mutating port and by check()/current() failures.
Recovery scope and snapshot remain fresh by design.

Reply open: 1 resolve and 2 parallel invocations (was 6/4). New compose with
a signature default: 1 resolve and 3 invocations. Synthetic-latency harness:
1932-1946 ms (< 2200 ms).
…er issued

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ness out of the repo

The highest-revision shortcut compared revision counters across different
connection sessions. Revisions are per session and restart at 0, so after a
reconnect a superseded session could win and current access would be denied.
The perf harness used computed imports the app boundary check rejects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the Accounts/Access/Approvals split with one Account Card that surfaces connection health, private access, inline agent-request permissions and background jobs. Un-bury connection diagnostics, summarize record-store consent, and keep long account labels wrapping at phone width.
…stead of instant 503

Raise the data-plane binary IO budget (files 4/owner 8 global, images
6/owner 12 global) and replace the instant 503 on overflow with a bounded
FIFO wait (2 s) that drains on release. Re-entrancy and the slot-held-until-
unwind guarantee are unchanged.
…ized content-length with 413

Match the advertised 8 MiB body and a 30 s transfer window, widen upload
slots to 4/owner and 16 global, and answer 413 APP_ACTION_INVALID before
reading any body byte when the declared content-length exceeds the limit.
Maneek21 and others added 30 commits November 4, 2026 16:56
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ch minimatch

- Re-review FP-004, FP-012..014 and FP-027: three frame sinks moved 43 lines
  unchanged; pinned sources changed only for connection actions, the 112 KiB
  worker bound and record-mirror nomination. Notes record the reasoning.
- List the four new tests that set DEFT_APP_RUN_KEYRINGS (and the one runtime
  startup consumer) in the email-preview API isolation partition.
- Override minimatch >=7 <11.0.1 to ^11.0.1 for GHSA-g3hv-75wg-m249 (eslint
  tooling only); pnpm audit reports no known vulnerabilities.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
preview.132-134 (capture retirement, grace resume, restore-access reviews)
take the seeded test ledger from 118 to 121. Keep the 118-120 counts as
rejected stale ledgers and move the unreviewed-future case to 122.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the full schema app_integration_capture_policies enforces org, owner and
(org, installation) foreign keys; the fixtures only created a stub table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The registry refuses group/other-readable files on POSIX; the fixture used the
default 0644, so every scoped lookup failed on Linux CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… extended

app_runtime_session_resume_allowed returned NULL for any session whose
renewal_lifetime is NULL (every finite session). In the guard, NOT NULL stays
NULL, so the whole deny condition was NULL and PL/pgSQL skipped the exception:
an expired finite session's expires_at could be pushed forward. Return a
strict boolean with COALESCE(..., false).

The persistent-consent test now exercises the real app_runtime_sessions table
(the temp-table copy cannot satisfy the typed function), scopes every update
to its own tenant inside its rolled-back transaction, and asserts that an
expired finite session cannot be extended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The observation consent guard only admits a new row as proposed. Restore
inserted it directly as active, so Restore access failed for any account with
an observation consent. Insert proposed, then activate, as record_consent does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Seed real org, owner, installation, resource and runtime binding rows; insert
synthetic later-state sessions and consents through a replica-role fixture
helper so every application call still runs with triggers on; follow the
successor session that action-consent activation publishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
app-integration-health deleted every capture policy and claim, and the retire
test deleted every policy, notification, attention item and capture job, while
other files share the CI database concurrently. A wipe mid-run removed the live
test's policy, so its delivery check was denied. Drop the global deletes, give
each test its own job id, and scope the pending-job count to the test org.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI sets a dummy ANTHROPIC_API_KEY, so the expected 'no AI provider' pause never
happened and the run continued into capture with a stub gateway. The test now
removes provider keys before importing the app modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant