⬆️(deps): Bump fast-uri from 3.1.2 to 3.1.5 in /apps/mewbo_console - #199
Open
dependabot[bot] wants to merge 7 commits into
Open
⬆️(deps): Bump fast-uri from 3.1.2 to 3.1.5 in /apps/mewbo_console#199dependabot[bot] wants to merge 7 commits into
dependabot[bot] wants to merge 7 commits into
Conversation
…tract entity multiplex, structured outputs endpoint, and 7 new MCP tools (#71) ## New features ### Agentic Wiki — Q&A engine rebuilt - **Probe fan-out architecture**: a coordinating `wiki-qa` agent fans out parallel `wiki-qa-probe` leaf agents guided by ANN entry-point intuition, replacing the prior flat capped page-reader. - **Cited-sources viewer**: inline `[path:line-range]` chips rendered as `SourceCard` components, lazily fetching file excerpts from a new `GET /v1/wiki/projects/<slug>/source` endpoint. Chip and card identity share a `CitationRef.domId` for scroll-linking. - **QA→memory flywheel**: `QaMemoryDepositor` runs off the latency path and auto-deposits durable Q&A findings as memory notes via the same `InsightIngestor` used by the enrichment pipeline. - **DeepWiki-parity verbosity**: brevity floor is a prompt-only constraint; `QaFinalizer` never truncates and probes are un-capped. ### Knowledge Graph — Three-layer entity multiplex - **Abstract entity layer**: `ResolutionLadder` unifies AST symbols, graph entities, and memory notes into one multiplex. Entity IDs are deterministic; GraphRAG post-AST enrichment runs at index time. - **`KnowledgeGraphView`**: assembles AST + entity + memory layers with cross-layer anchor reconciliation via `resolve_many`. Labels are now surfaced and union-merged across all merge paths. - **Entity resolution for search**: `ScgAnchorResolver` implements the wiki's `StructureProvider` protocol, making SCG capability and entity-type nodes first-class participants in the same `ResolutionLadder` as wiki entities. - **Credential persistence**: per-slug credentials stored plaintext-behind-seam, redacted in all API surfaces; restart refreshes capabilities using the slug-keyed credential. ### Structured Outputs — new endpoint - `POST /v1/structured` starts an agentic session constrained to a caller-supplied JSON Schema. `EmitStructuredResponseTool` validates the payload inline and terminates the loop. - Async run lifecycle with `GET /v1/structured/{run_id}` polling. `/v1/structured/fast` streams partial tokens. - Workspace grounding: pass `workspace` and the session searches connected sources before writing a single output token. - The async `structured_output` event is now persisted correctly on both the sync and async code paths. ### MCP server — 7 new tools (19 total) Seven tools added, bringing the server to a 19-tool surface: | Tool | What it does | |---|---| | `get_wiki_answer` | Async wiki Q&A with run-id re-fetch | | `list_projects` | Workspace discovery entry point | | `list_search_workspaces` | Saved search workspace listing | | `search` | Cited agentic search | | `get_search_run` | Search run re-fetch | | `structured_query` | Schema-constrained agentic session | | `get_structured_run` | Structured run re-fetch | ### Console and API - **Session provenance**: sessions classified by origin (wiki job/QA, agentic search, channel, user) from tags and the first context event; `SessionOriginBadge` and per-origin filters in the console session list. - **Wiki "Copy badge"**: static CDN SVG + per-repo link to `Project.landingPageId`; one-click README affordance from the wiki landing page. --- ## Stability and resilience ### Agentic Wiki — Indexing - `WikiFinalizeTool` now overrides `should_terminate_run()`, eliminating the post-finalize LLM turn and teardown wedge window. - `WikiIndexingSessionEndHook` marks any non-terminal job `interrupted` on session end; `JobRecovery` re-drives it through a checkpoint-aware `WikiResume`. - Parser-download 504s during `wiki_build_graph` resolved with retry, pinned `tree-sitter-language-pack` version, and Docker XDG pre-warm. - Reindex after a retired model no longer silently re-selects it; the stored submission's model is verified against the live proxy before replay. - Model-fallback auto-heal with cap-2 sticky escalation; rescue model is the last fallback-ladder entry. ### MCP server — Contract hardening Five invariants, each at one seam: envelope-only error surface (`_enveloped` + HTML-drop), `bounded_poll` + `get_*_run` companion pattern, smallest-payload projections, schema-equals-behaviour, and `list_projects` as the discovery entry point. --- ## Documentation New pages: Structured Outputs, Policies, Monitors — each with a `flowchart LR` mermaid diagram. Updated: Agentic Wiki, Agentic Search (full SCG technical depth including entity resolution and shared multiplex), MCP Server (19 tools), Architecture, Session Runtime, home page. Fixed six broken `configuration.md` anchor links. --------- Co-authored-by: mewbo-ai[bot] <268600793+mewbo-ai[bot]@users.noreply.github.com> Reviewed-on: https://git.hurricane.home/bearlike/Assistant/pulls/71
…pickup, shareable runs + stability fixes ## New features **Agentic Search now works end-to-end.** The SCG engine and API glue existed, but the product was unreachable. The `scg` config section is now a real typed switch instead of a silently dropped key. The orchestrated runner returns real answers, delivers the search playbook, cancels cleanly, and settles dead workers as failed instead of stranding runs. The source catalog comes from your configured MCP servers, not fixtures. Mapped sources actually route: every capability gets a recipe, and `scg_route` emits executable `allowed_tool_ids` so probes are granted real connector tools, not graph addresses. Verified live against a real connector: a cited, grounded answer. The console grew the missing surface: a Sources dialog with live mapping progress, a tier picker, workspace search, run history, and safe snippet rendering. **Search tiers pick the brain.** New `scg.traversal.tier_models` maps fast/auto/deep to models (defaults: gpt-5.4-nano, sonnet-4-6, gpt-5.5). The tier was already the run's one knob for decomposition and fan-out budget; it now picks the model too, and probes inherit it, so one knob moves the whole run. `/v1/structured` and `/v1/structured/fast` also accept an optional per-request `model` override, so external consumers can pin small models on structured runs. **Workspaces are graph-first knowledge surfaces.** A workspace is now a name, purpose instructions, and MCP servers picked from the system catalog, persisted with secrets redacted. Saving auto-maps newly enabled sources, re-maps when a source's tool list drifts, and re-indexes when the purpose prose changes; the purpose textarea is the graph's codified intent. Routing is memory-aware: connector-corpus insights bias recipe ranking and ride along as capped memory hints. Agents can walk the graph themselves with `scg_observe`, typed hop by typed hop. Structured runs bound to a mapped workspace go graph-first: route, fan out path probes, terminate at a schema-validated emit, with pathway and probe provenance on the run. Run events stream live as they happen, so the console shows real reasoning instead of a frozen spinner. `/v1/structured/fast` and `/v1/draft/stream` mint full sessions with write-behind persistence; draft TTFT pays nothing. Every workspace gets a three-layer graph view in the console, schema plus memory plus entities. Mapping warms the memory layer at index time from tool descriptions and workspace prose, and deposit prompts teach notes to encode use-case paths so future agents traverse instead of re-exploring. Ordinary chat sessions get the SCG tools too, whole-graph scoped: route, observe, deposit. **Assign or mention the bot on an issue or PR and an agent picks it up.** A branch-aware Mewbo session starts, with a fetched, fast-forwarded worktree for PR head branches. A second mention steers the active run instead of erroring. When the session ends, the final answer is posted back to the thread as a bot comment. One workflow runs on both GitHub and Gitea Actions, with auth via revocable KeyStore-minted keys. Verified live on Gitea: assignment, mention, PR worktree continuity, and the reply leg. **Every search run is a link.** `/search?ws=<id>&run=<id>` is now the single source of truth for the view. Submit and replay push the URL, Back returns to the prior view, and a shared link renders identically on any browser. Opening a link performs GETs only, never a POST. Past-query chips replay stored runs instead of re-executing them. **Search console, finished.** A shared composer kit gives the search and tasks composers one focus bloom. Autocomplete opens only on real gestures, never on page load. The landing page earns its space: a workspace health band shows mapped-source coverage, graph size, and memory notes, with a clean first-run empty state. Dead controls were wired or deleted. Demo seeding retired behind an env default. **Traces you can filter.** TraceProvenance folds each session's durable signals into Langfuse tags: origin, product, session type, surface, project, repo, branch, workspace, model. Every client surface stamps itself through the `X-Mewbo-Surface` header: cli, console, mcp, home-assistant, channels, vcs-pickup. Wiki-index vs wiki-qa vs search-run vs structured vs chat is now one filter click, and search runs audit as one coherent session from route to emit. **Human-grade REST API reference.** The docs site's /rest-api/ page is now a full-page native Scalar app under the brand header, via a new `app.html` template and optional `header_tabs` tab rail in the mkdocs-shadcn-mewbo theme v1.3.0. All ~71 REST operations got rewritten OpenAPI metadata at the source: imperative summaries, consumer-grade descriptions, documented path and query params, 30 request-body models, and response status annotations. The spec exporter re-tags operations by path into resource families (Sessions, Projects & Worktrees, API Keys, Configuration, Workspaces & Runs, Source Graph, Structured Outputs, Fast Structured, Draft Streaming, Automation) with sidebar groups, a rewritten quickstart intro, and RST-literal sanitation. CI regenerates the committed spec best-effort on every docs build, so the reference cannot drift from the code. ## Stability & fixes - Realtime sessions are visible. The recorder creates the session record before any event write, tags are unique per session instead of colliding on one shared doc, and the synthesizer and streamer attach the Langfuse callback, so fast and draft calls finally export traces with cost and latency. - Runtime-granted capabilities reach the root agent's session tools, not just sub-agents. Continue-recovery no longer deletes a crash-interrupted turn; it anchors on the last recovery marker, so the user message and tool traces survive. - Connector insight deposits anchor on capability nodes again; the resolver had hard-coded entity ids, leaving every connector note orphaned. Pre-existing orphans re-anchor on the next map. - Long workspace purpose statements truncate instead of 500ing the save, and enrich plumbing can never fail the save that carried the prose. - Small-model discipline in the probe playbooks, from live nano and flash-lite runs: the graph is the map, connector tools are the territory; never declare NO DATA from graph reads alone; never emit while a probe is still running. - Console: the live run view can no longer wedge on "Starting search" when the opener frame drops; result cards are idempotent by result id at both the store and render seams; duplicate-key rendering is impossible. ## Docs & infrastructure - Docs gap-closure sweep: every feature page checked against source. Search, structured outputs, web API, session runtime, CLI, Docker and production deployment, getting started, LSP, and LLM setup all corrected; phantom extras and dead flags removed; a new Branches & Worktrees capability page added. - Repo restructure: the Home Assistant component moved into apps/ with its editable install genuinely wired and its default port fixed to 5125; the aider provenance snapshot moved next to the live adapted copy; the root workspace stub package deleted in favor of metadata-only wheel selection. - Agent CLAUDE.md tree refreshed across the touched subsystems with the durable invariants and seams. Reviewed-on: https://git.hurricane.home/bearlike/Assistant/pulls/90 Co-authored-by: mewbo-ai[bot] <268600793+mewbo-ai[bot]@users.noreply.github.com>
…faster engine ## New features **Agentic Search is now a real product surface.** Search runs render structured result cards. Each card carries a colour-coded status badge, a byte size, and per-result confidence drawn from the open `meta` dict. A trace instrument panel sits beside the results. It shows honest lanes and run stats: setup versus search time, the model, and step and token counts, plus a dedicated coordinator trace lane. Cards are de-duplicated by result id, and follow-up actions are wired through. The composer is unified into one shell with a single scope pill. Tier, model, and sources collapse into that one control. The landing page now loads fast by caching capability-graph node reads and rendering a light graph summary. Run and graph chunks lazy-load, and the composer dropdowns stay responsive. Related Questions resolve in a parallel call, with per-tool result counts and a denser layout. (apps/mewbo_console, apps/mewbo_api, packages/mewbo_graph) **One knob, one model, per run.** Each agentic search run takes a per-run model override. An all-models picker lives in the search bar. The tier and model pills are coupled. The budget pill names its model preset, and the model pill names the tier, so changing one keeps the other honest. (apps/mewbo_api, apps/mewbo_console) **Live token streaming for true time-to-first-token.** The tool-use loop streams real model token deltas as they arrive. The CLI and console render those deltas live, so first-token latency reflects the model, not a buffer. A run-accepted event fires instantly, and the tool registry is reused across turns to cut per-run overhead. The CLI can also stream its logs to a file with `--log-file` and `--overwrite`, keeping the terminal UI clean. (packages/mewbo_core, apps/mewbo_cli, apps/mewbo_console) **A central prompt registry.** Engine prompts now live in one schema-validated, injectable store. Overrides layer by scenario and by model prefix. Per-model prompt and edit-tool variants ship from the same registry. Cross-model behaviour converges from one place instead of scattered literals. (packages/mewbo_core, packages/mewbo_tools) **A sturdier, faster agent engine.** Parallel fan-out is now a single call. One batch of tasks delegates a whole wave of sub-agents reliably. Transiently-failed sub-agents auto-retry and re-delegate within a bounded budget. MCP initialization is non-blocking, so a slow or dead server never stalls startup or the loop. Deferred tool-schema loading is on by default, so large tool surfaces no longer weigh down every turn. Agent pickups run in an isolated worktree cut from HEAD, so a delegated task never disturbs the working branch. (packages/mewbo_core, packages/mewbo_tools, apps/mewbo_api) **Inline context expansion.** Type `@<ref>` to pull a file or symbol straight into the prompt, scoped to the git index. The console and CLI both offer `@` and `/` autocomplete. (packages/mewbo_tools, apps/mewbo_api, apps/mewbo_console, apps/mewbo_cli) **A persistent task sidebar on session detail.** The session view grows a left sidebar that lists the session's tasks next to the conversation. (apps/mewbo_console) **Structured outputs simplified.** The separate fast endpoint folds into `/v1/structured` as a `mode: "synthesis"` switch. One endpoint now serves both the agentic and synthesis paths. (apps/mewbo_api, packages/mewbo_core) ## Stability and fixes - Search answers render honestly. Synthesis markdown renders correctly. Confidence and evidence come from data-bearing probes, not echoed fixtures. Wiki Q&A citations resolve to real pages, with entity-hash provenance behind the source links. (apps/mewbo_api, packages/mewbo_graph) - The console build is far lighter. Build time drops from roughly 85s to 11.5s, and peak memory from 4.3GB to 1.7GB, by moving to Vite 8 with Rolldown. (apps/mewbo_console) - MCP pool logs name the real cause. A wrapped concurrency exception group is unwrapped, so the underlying error surfaces instead of the wrapper. (packages/mewbo_tools) - The Web IDE readiness probe target is now configurable. A deployment with a different topology can point the probe at the right address. (apps/mewbo_api, packages/mewbo_core) ## Docs and infrastructure - The REST API reference reaches full coverage. Every operation is documented in the native Scalar reference. Code-reference badges link prose back to source. Badge artwork is bound to theme tokens for one consistent colour and shape language, and the local badge fork is dropped in favour of the theme-native version. - Docs screenshots are refreshed across Search and Wiki. New shots cover the indexing wizard, the capability graph, the badge affordance, and Settings. A panel screenshot was added to the MCP server page. - Mermaid syntax was repaired in the session-tools registry diagram, and the docs theme was bumped to its latest release. Co-authored-by: mewbo-ai[bot] <268600793+mewbo-ai[bot]@users.noreply.github.com>
…s + gpt-oss-120b search default Expose Agentic Search to Mewbo's own task-spawned engine agents (not just the external MCP), and default every search tier's "Auto" model to GPT OSS 120B. - New `agentic_search` SessionTool (mewbo_graph.plugins.scg.search): async by handle — `query` starts a real scg-search run and returns a run_id + status:"processing" immediately; `run_id` fetches the cited answer + `computed_at`; an identical recent query is idempotently reused. Owns no orchestration (no-parallel-loop invariant) — drives through a new down-only `mewbo_graph.scg.search_launcher.SearchLauncher` seam (mirrors MapPhaseSink). - App registers `RunStoreSearchLauncher` (reuses SearchRun.start + run store) in init_agentic_search; degrades to a structured "unavailable" error when unwired. - `search` is GET-classified → default-allowed → surfaces to any task agent the `scg` capability grants (#84). Direct graph tools (scg_route/observe/memory/ results) already self-available. - MCP `search`/`get_search_run` now surface `computed_at` on the fetch paths. - `ScgTierModelsConfig` fast/auto/deep all default to `openai/gpt-oss-120b` (schema regenerated); the tier is now a budget knob only. Tests: test_search_tool.py + test_search_launcher_impl.py (tool + app backend: start/fetch/idempotent-reuse/workspace-resolution). ruff + mypy clean. Co-authored-by: Mewbo <268600793+mewbo-ai[bot]@users.noreply.github.com> (cherry picked from commit 15494ddd75cfa68d0bdb28c9333e334bdb0bfb10)
…ode graph, and device tools ## New features ### 📱 Mewbo Aura — a native Android assistant client A Kotlin + Jetpack Compose client over the existing session REST/SSE API, taken from v1 through v5: - **Assistant overlay, text and voice.** Invoke-from-anywhere overlay with app handoff. The voice-first flow auto-listens on trigger, streams the first reply in-overlay as a card, and hands off to the app from the second turn. Live composer dictation and chunked speak-along voice replies. - **Chat surface.** Streaming markdown transcript with folded tool-call cards, attachment tiles above the user query, a project-scoped MCP catalog with a server-grouped tool picker, a date-grouped Recents rail, and long-press session actions (rename + archive). - **Design language.** Aurora shader family rebuilt against real-device captures with a solid-rest contract, drawer navigation, measured dark parity, and a compact turn-aware transcript rhythm. - **Device tools.** Time, battery, alarm, timer, and wake, plus SMS read/send and alarm management gated solely by the OS runtime-permission flow. - **Distribution flavors.** `public` (platform trust only, the flavor CI ships) and `enterprise` (bakes a deployment-supplied private root CA for LAN/enterprise backends; cert seeded at build time, never committed). *(apps/mewbo_aura, packages/mewbo_core, apps/mewbo_api, apps/mewbo_console)* ### 🖥️ A full-Textual terminal UI The old four-stack terminal UI collapses into one Textual `MewboApp`, eliminating the Live-vs-Textual render race. It brings an event-driven streaming transcript over the `AgentTranscriptHub`, a selectable agent-fleet drill-in beside a faceted sidebar, plan approval as a bordered card with a selectable modal (no slash commands), a live plan/todo progress dock, an activity spinner with footer token throughput, and dedicated transcript cards for orchestration tools. CLI local-first adds opt-in remote session sync and product tools surfaced through the Mewbo MCP. *(apps/mewbo_cli, packages/mewbo_core)* ### 🕸️ Multi-language code graph and the 3D Code Galaxy CodeGraph schema v2 lands: closed structural kinds plus open subkinds and namespaced attributes, validated on both the full index and refresh deltas. Kotlin and Java join the AST graph. The wiki gains a shared 3D Code Galaxy view, faithful scip-python symbol resolution, a zero-LLM graph-only developer mode, branch selection in the onboarding wizard, and idempotent Q&A answer URLs with bounded, ranked cited sources. Graph rendering unifies on one 3D engine; Cytoscape is removed. *(packages/mewbo_graph, apps/mewbo_api, apps/mewbo_console)* ### 📎 Rich attachments and client device tools Attachments persist on the user event and render as cards above the user query across the console, Aura, and MCP session history, with the image payload carried on the context event for vision. Client-declared device tools ride a session-tool bridge with a dispatch round-trip and an SSE executor; a product-tool catalog derives request-scoped capabilities; and a shared tool-scope classifier surfaces tool scope in the console picker, the CLI `/mcp` command, and the composer. *(packages/mewbo_core, apps/mewbo_api, apps/mewbo_console, apps/mewbo_aura, apps/mewbo_mcp)* ### 🤖 Bot-authored PRs on issue pickup The vcs-pickup issue prompt bakes a `Closes #<n>` keyword so a merged pickup PR closes its originating issue, and the tea CLI ships in the API runtime so the bot can author those PRs directly. *(apps/mewbo_api, docker)* ## Stability and fixes - **Aura:** device-tool execution decouples from the shared SSE flow with restartable streams and honest background/stale/detach handling; errors surface as failed steps through a shared envelope and duplicate tool ids are rejected; ViewModel state stops collecting past the Activity lifecycle; `CancellationException` rethrows before any degrade; Keystore encrypt/decrypt pins off the caller's dispatcher; an unreadable attachment fails loud instead of dropping silently; streaming markdown de-flickers via render-state retention plus a reparse throttle. - **Engine and CLI:** the shell tool runs non-interactively with a pager-safe env and process-group reap; the watchdog names the in-flight tool and skips root self-stall injection; TaskQueue accepts internal tool ids so a clean completion leaves no error residue; the context gauge reads the live per-call context rather than cumulative session tokens; transcript-hub sink calls defer outside the state lock. - **Wiki:** Q&A goes greedy graph-first with a self-approving QA surface and file/graph citations, forcing the answer through `wiki_emit_block` instead of a discarded terminal reply; config resolves by walking up to the project root; tree-sitter grammars load on demand. *(apps/mewbo_aura, packages/mewbo_core, packages/mewbo_tools, packages/mewbo_graph, apps/mewbo_api, apps/mewbo_cli)* ## Docs and infrastructure - Docs restructure into per-client tabs (Terminal, Web, Android, API) with section-scoped sidebars and a shortlisted footer; raw-HTML media paths fixed on section subpages; the Aura enterprise flavor gets an asset reorg and visual examples. - Repository hygiene: docs, comments, and config templates now use deployment-neutral placeholders (example hostnames, env-driven paths, a generic enterprise-CA resource name) and product-neutral wording in design-lineage comments; the console dev server reads allowed hosts exclusively from `VITE_ALLOWED_HOSTS`. - CI: the Aura release workflow builds the public flavor only. *(.github/workflows, docs, apps/mewbo_aura, apps/mewbo_console)* Co-authored-by: Mewbo AI <268600793+mewbo-ai[bot]@users.noreply.github.com>
…em, and a full-Textual CLI ## New features ### 🧩 Mewbo Apps — LLM-generated, self-maintaining apps as a first-class sub-product An agent generates a Streamlit app from a prompt, and the platform keeps it alive. Pipelines are the execution engine: materialized code, declared with their own schedules at submit time so the platform arms them rather than an agent having to. They are also endpoints, with invoke and list surfaces and write-scoped tokens, plus a `ctx.llm` step, a read-through source cache, and reachable write-back. A submit-time verifier gates the builder's done-claim against ground truth, `get_app` gives the agent a read surface over what it generated, and a silent data regression triggers an auto-repair run with the repair surfaces named. The renderer is iframed so an embedded app cannot reach the host router. Sessions an app starts are a first-class origin with their own icon vocabulary. *(apps/mewbo_api, apps/mewbo_console, apps/mewbo_aura, packages/mewbo_core)* ### 🔐 An optional identity kernel — IAM, RBAC, and external IdPs A new `mewbo_iam` library adds principals, authenticators, roles, teams, grants and an audit trail, with the network and crypto provider legs behind extras so the base install stays lean. It layers over the API server without becoming mandatory: unconfigured deployments behave exactly as before. *(packages/mewbo_iam, apps/mewbo_api, apps/mewbo_console)* ### 🎨 One console design system The console converged on a single visual language. Navigation is one left rail and nothing else — the old top bar and task sidebar are gone, and Settings and the wiki page tree render their contents in the rail's scoped zone rather than each spending width on a nav column of their own. One rail vocabulary module backs every rail-like surface. Typography resolves to a single scale enforced by a guard test, with hierarchy carried by weight and colour instead of a second typeface. Settings collapsed from four pages into facet panes over one registry and one card primitive, and the dark theme is a value-port of the documentation site's palette so both properties read as one product. The chat surface adopts a vendored assistant-ui kit, and all four product composers share one chrome family. *(apps/mewbo_console)* ### 📱 Mewbo Aura — the Android client through v5 The native client gained a voice-first assist overlay that auto-listens, streams the first reply in place and hands off to the app from the second turn. Device tools cover time, battery, alarm, timer, wake, and SMS read/send, gated solely by the OS runtime-permission flow. Streamlit widgets render in a WebView over the bundled widget host, with full-screen viewing. The aurora shader family was rebuilt against real-device captures with a solid-rest contract and reduced-motion honored throughout. Long-press gives retry, branch, fork and copy, plus session rename and archive, and a completed background run raises a notification. Two distribution flavors ship: public, and an enterprise flavor that bakes a deployment-supplied private root CA at build time. *(apps/mewbo_aura, apps/mewbo_api, packages/mewbo_core)* ### 🖥️ A full-Textual terminal UI The old four-stack terminal collapsed into one Textual application, eliminating the render race between the two drawing systems. It brings an event-driven streaming transcript, a selectable agent-fleet drill-in beside a faceted sidebar, plan approval as a bordered card with a real modal rather than slash commands, a live plan and todo dock, a throughput meter, and dedicated transcript cards for orchestration tools. The CLI is local-first, with opt-in remote session sync. *(apps/mewbo_cli, packages/mewbo_core)* ### 🛡️ Delegation governance in the engine Sub-agent delegation became contractual. Each spawn carries a typed contract enforced at the existing seams, with capability and workspace containment tiers, a typed step budget with stall knobs, graduated budget exhaustion, and hash-chained attestation provenance across a delegation chain. Completion is verifier-gated: a ground-truth check runs before an agent's done-claim is accepted, and a write-progress signal observes rather than nudges. *(packages/mewbo_core)* ### ⏰ Reverse invocation — sessions the platform starts A trigger domain with five data-owned kinds, each owning its own scheduling and matching rules, backed by JSON and Mongo stores and driven by a watcher and fire pipeline behind a REST surface and a console management page. Sessions also gained the permanent termination state the API had always promised, enforced across every mutation path. *(packages/mewbo_core, apps/mewbo_api, apps/mewbo_console)* ### 🕸️ Graph, wiki, and Agentic Search CodeGraph schema v2 lands with validated subkinds and namespaced attributes; Kotlin and Java join the AST graph. The wiki gains a 3D Code Galaxy view on one rendering engine, faithful scip-python symbol resolution, a zero-LLM graph-only developer mode, branch selection during onboarding, editable project settings after onboarding, and greedy graph-first retrieval with file and graph citations. Agentic Search surfaces its work through a coordinator trace lane, structured result cards, honest run stats, and deterministic shareable run URLs, with search tiers selecting their own model. A product-wide git credential registry resolves credentials through one chain. *(packages/mewbo_graph, apps/mewbo_api, apps/mewbo_console, apps/mewbo_mcp)* ### 💬 Ask-user questions, and operator-authored system instructions A native ask-user-question tool blocks until answered across the console, Aura and the CLI, superseded correctly by steer, interrupt and cancel. Operators can author system instructions injected per client surface, rendered in a sandbox with the candidate values for every template variable surfaced in the editor. *(packages/mewbo_core, apps/mewbo_api, apps/mewbo_console, apps/mewbo_aura, apps/mewbo_cli)* ## Stability, performance, and security - **Transcript integrity.** Retrying or continuing a run no longer loses already-rendered turns, every sub-agent start is guaranteed exactly one terminal, live run status reaches the client through the existing poll, and six independent transcript linearizers collapsed into one canonical assembler with a two-sided parity gate. - **Run failures are classified and bounded at emission**, so a collapsed failure card replaces the raw error dumps that used to reach the reader. - **Secrets cannot reach a log sink.** A single redactor installs as the global patcher every interface already routes through, scrubbing message and bound context before any sink formats them, with variable-annotated tracebacks turned off so a secret-bearing local cannot leak through that path. - **A static-analysis pass was triaged against live code**: the dev runner no longer ships with the debugger on, two vulnerable dependencies were bumped, and every safe-by-design shell and templating site now states its trust model at the call site so the next scan does not re-open the question. - **True time-to-first-token**: real LLM token deltas stream from the tool-use loop to both the console and the CLI, with an instant run-accepted event and deferred tool-schema loading on by default. - **Faster, leaner builds**: the console build dropped from 85s to 11.5s with peak memory from 4.3GB to 1.7GB, and the repository moved to a standard uv workspace flow with images built from the lockfile. - Widget-host hardening, a terminated-session kill switch across every mutation path, and a sweep that removed internal hostnames and personal paths from the tree. ## Documentation and developer experience A generated Scalar REST reference with full endpoint coverage, documentation restructured into per-client tabs, theme-native code-reference badges, and a containerized demo stack with deterministic seeders that re-renders the entire screenshot surface as code rather than by hand. Forge CLIs moved into a runtime toolbox behind one shared entrypoint, and issue pickup runs in an isolated worktree and replies on the ticket as the bot. The console's lint gate passes clean. It had been reporting 663 problems and could never succeed, 653 of them from the vendored Pyodide runtime that lives in Vite's verbatim-copy directory — a file nobody authored, in no diff, and impossible to fix — which buried the ten real findings in `src/` and had turned the standing advice into "lint your own files and ignore the total". That directory is ignored now, the real findings are fixed rather than suppressed, and the one rule deliberately turned off states its reason in the file it applies to. Every component now reports one version, 0.0.13 — the identity kernel, the Home Assistant integration and the Android client had each drifted onto a line of their own, with Aura keeping a monotonic Android version code so installed clients still upgrade. The documentation screenshots are re-rendered from the seeded stack against the current console, and reviewing those images surfaced a Mermaid defect no test could: a flowchart branch label was drawn on Mermaid's own light chip, unreadable on a dark diagram, because that colour is derived from its palette rather than the background we override. Co-authored-by: Mewbo AI <268600793+mewbo-ai[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
mewbo-docs-discovery | 111102a | Aug 02 2026, 03:00 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps fast-uri from 3.1.2 to 3.1.5.
Release notes
Sourced from fast-uri's releases.
Commits
5e179cbBumped v3.1.52cad02dMerge commit from fork6aeece6Bumped v3.1.42d50fbafix: reject literal backslash in URI authority0549fe3Bumped v3.1.32a6d357Merge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.