merge scenarios to staging

.github/workflows/owner-approval-review-signal.yml

@@ -0,0 +1,15 @@
+name: Owner Approval Review Signal
+
+on:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+
+permissions: {}
+
+jobs:
+  signal:
+    name: Signal trusted owner approval refresh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Record review event
+        run: echo "A trusted workflow will re-evaluate the staging owner-approval status."

.github/workflows/owner-approval-review.yml

@@ -0,0 +1,73 @@
+name: Owner Approval Review Evaluator
+
+on:
+  workflow_run:
+    workflows: [Owner Approval Review Signal]
+    types: [completed]
+
+concurrency:
+  group: owner-approval-review-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  evaluate:
+    name: Re-evaluate staging owner approval
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+      statuses: write
+    steps:
+      - name: Resolve pull request
+        id: pull-request
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            let pullRequests = context.payload.workflow_run.pull_requests || [];
+            if (pullRequests.length === 0) {
+              const response = await github.request(
+                'GET /repos/{owner}/{repo}/commits/{commit_sha}/pulls',
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  commit_sha: context.payload.workflow_run.head_sha,
+                },
+              );
+              pullRequests = response.data;
+            }
+
+            const pullNumbers = [...new Set(pullRequests.map((pullRequest) => pullRequest.number))];
+            if (pullNumbers.length === 0) {
+              core.notice('The review signal is not associated with a pull request.');
+              return;
+            }
+            if (pullNumbers.length !== 1) {
+              core.setFailed('The review signal is associated with more than one pull request.');
+              return;
+            }
+
+            core.setOutput('number', String(pullNumbers[0]));
+
+      - name: Checkout trusted default branch
+        if: steps.pull-request.outputs.number != ''
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        if: steps.pull-request.outputs.number != ''
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+
+      - name: Publish owner approval status
+        if: steps.pull-request.outputs.number != ''
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MEMBERS_TOKEN_CONFIGURED: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN != '' }}
+          PASTA_DEVS_MEMBERS_TOKEN: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN }}
+          PR_NUMBER: ${{ steps.pull-request.outputs.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: node scripts/evaluate-owner-approval.mjs

.github/workflows/pull-request-checks.yml

@@ -36,6 +36,12 @@ jobs:
       - name: Run project checks
         run: pnpm check
 
+      - name: Validate pull request gate topology
+        run: node scripts/validate-pr-triage.mjs
+
+      - name: Test owner approval evaluator
+        run: node scripts/test-owner-approval.mjs
+
       - name: Check version drift
         run: pnpm version:check
 

.github/workflows/pull-request-triage.yml

@@ -4,8 +4,6 @@ on:
   pull_request_target:
     types: [opened, reopened, edited, synchronize, ready_for_review]
     branches: [staging, main]
-  pull_request_review:
-    types: [submitted, dismissed]
 
 concurrency:
   group: pull-request-triage-${{ github.event.pull_request.number }}
@@ -14,9 +12,6 @@ concurrency:
 jobs:
   branch-policy:
     name: Branch policy check
-    if: >-
-      github.event_name == 'pull_request_target' &&
-      (github.event.action != 'edited' || contains(toJSON(github.event.changes), '"base"'))
     runs-on: ubuntu-latest
     permissions: {}
     steps:
@@ -49,107 +44,34 @@ jobs:
           echo "::error::Contributions must target staging. Main accepts only SpicyMarinara's same-repository staging promotion or hotfix/* PR."
           exit 1
 
-  external-contributor-approval:
-    name: "${{ github.event.pull_request.base.ref == 'staging' && ((github.event_name == 'pull_request_target' && (github.event.action != 'edited' || contains(toJSON(github.event.changes), '\"base\"'))) || (github.event_name == 'pull_request_review' && github.event.review.user.login == 'SpicyMarinara' && (github.event.action == 'dismissed' || github.event.review.state == 'approved' || github.event.review.state == 'changes_requested' || github.event.review.state == 'commented'))) && 'Owner approval for outside contributors' || 'Ignore unrelated triage event' }}"
+  owner-approval:
+    name: Evaluate staging owner approval
+    if: github.event.pull_request.base.ref == 'staging'
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: read
-    env:
-      APPROVAL_EVENT_RELEVANT: "${{ github.event.pull_request.base.ref == 'staging' && ((github.event_name == 'pull_request_target' && (github.event.action != 'edited' || contains(toJSON(github.event.changes), '\"base\"'))) || (github.event_name == 'pull_request_review' && github.event.review.user.login == 'SpicyMarinara' && (github.event.action == 'dismissed' || github.event.review.state == 'approved' || github.event.review.state == 'changes_requested' || github.event.review.state == 'commented'))) }}"
+      statuses: write
     steps:
-      - name: Ignore unrelated triage event
-        if: env.APPROVAL_EVENT_RELEVANT != 'true'
-        run: exit 0
-
-      - name: Classify pull request author
-        if: env.APPROVAL_EVENT_RELEVANT == 'true'
-        id: internal-author
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        env:
-          MEMBERS_TOKEN_CONFIGURED: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN != '' }}
+      - name: Checkout trusted base revision
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          # Fine-grained PAT or GitHub App token with Pasta-Devs "Members: read".
-          github-token: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN || github.token }}
-          script: |
-            const organization = context.repo.owner;
-            const ownerLogin = 'SpicyMarinara';
-            const authorLogin = context.payload.pull_request.user.login;
-
-            if (authorLogin.toLowerCase() === ownerLogin.toLowerCase()) {
-              core.notice(`${authorLogin} is the repository owner; owner approval is not required.`);
-              core.setOutput('internal', 'true');
-              return;
-            }
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
 
-            if (process.env.MEMBERS_TOKEN_CONFIGURED !== 'true') {
-              core.setFailed('PASTA_DEVS_MEMBERS_TOKEN is required to verify Pasta-Devs organization membership.');
-              return;
-            }
-
-            async function getOrganizationMembership(username) {
-              return github.request('GET /orgs/{org}/memberships/{username}', {
-                org: organization,
-                username,
-              });
-            }
-
-            let organizationMembership;
-            try {
-              ({ data: organizationMembership } = await getOrganizationMembership(authorLogin));
-            } catch (error) {
-              if (error.status === 404) {
-                core.notice(`${authorLogin} is not a ${organization} organization member; owner approval is required.`);
-                core.setOutput('internal', 'false');
-                return;
-              }
-              core.setFailed(`Could not verify ${authorLogin}'s ${organization} membership (${error.status ?? 'unknown status'}).`);
-              return;
-            }
-
-            if (organizationMembership.state !== 'active') {
-              core.notice(`${authorLogin}'s ${organization} membership is not active; owner approval is required.`);
-              core.setOutput('internal', 'false');
-              return;
-            }
-
-            if (organizationMembership.role === 'admin' || organizationMembership.role === 'member') {
-              core.notice(`${authorLogin} is an active ${organization} ${organizationMembership.role}; owner approval is not required.`);
-              core.setOutput('internal', 'true');
-              return;
-            }
-
-            core.notice(`${authorLogin} does not have a trusted ${organization} organization role; owner approval is required.`);
-            core.setOutput('internal', 'false');
-
-      - name: Require owner approval for outside staging contributions
-        if: env.APPROVAL_EVENT_RELEVANT == 'true' && steps.internal-author.outputs.internal != 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          script: |
-            const pullNumber = context.payload.pull_request.number;
-            const { data: pr } = await github.rest.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: pullNumber,
-            });
-
-            const reviews = await github.paginate(github.rest.pulls.listReviews, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: pullNumber,
-              per_page: 100,
-            });
-            const ownerReviews = reviews
-              .filter((review) => review.user?.login?.toLowerCase() === 'spicymarinara')
-              .sort((left, right) => left.id - right.id);
-            const latestOwnerReview = ownerReviews.at(-1);
-
-            if (latestOwnerReview?.state === 'APPROVED' && latestOwnerReview.commit_id === pr.head?.sha) {
-              core.notice('Outside contribution approved by SpicyMarinara.');
-              return;
-            }
+          node-version: 24
 
-            core.setFailed('Outside and first-time contributions to staging require an approving review from SpicyMarinara.');
+      - name: Publish owner approval status
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          MEMBERS_TOKEN_CONFIGURED: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN != '' }}
+          PASTA_DEVS_MEMBERS_TOKEN: ${{ secrets.PASTA_DEVS_MEMBERS_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: node scripts/evaluate-owner-approval.mjs
 
   label:
     name: Auto-label
@@ -214,16 +136,22 @@ jobs:
   template-check:
     name: Pull Request template check
     runs-on: ubuntu-latest
-    if: >-
-      github.event_name == 'pull_request_target' &&
-      github.event.pull_request.author_association != 'MEMBER' &&
-      github.event.pull_request.author_association != 'OWNER' &&
-      github.event.pull_request.author_association != 'COLLABORATOR'
     permissions:
       contents: read
       pull-requests: read
     steps:
+      - name: Exempt trusted contributor
+        if: >-
+          github.event.pull_request.author_association == 'MEMBER' ||
+          github.event.pull_request.author_association == 'OWNER' ||
+          github.event.pull_request.author_association == 'COLLABORATOR'
+        run: echo "Trusted contributor; pull request template validation is not required."
+
       - name: Check Pull Request body against template
+        if: >-
+          github.event.pull_request.author_association != 'MEMBER' &&
+          github.event.pull_request.author_association != 'OWNER' &&
+          github.event.pull_request.author_association != 'COLLABORATOR'
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
         run: |

CHANGELOG.md

@@ -4,6 +4,41 @@ This file is the release-notes source of truth for Marinara Engine. Reuse these
 
 ## [Unreleased]
 
+### Added
+
+- Added portable character-gallery image references: `card://self/gallery/<filename>` in a greeting or message resolves to whichever character is speaking, so gallery images embedded in a card keep working after export and import (character ids are regenerated on import, which broke id-based links). The character gallery gains a **Copy image reference** button that produces the portable form, editor field previews resolve it for the edited character, group-chat replies resolve `self` per speaker segment, and the native-export importer now preserves gallery filenames (sanitized, collision-safe) instead of renaming every image, which is the fix that makes the references survive the round trip. Documented in the Character Galleries and Sending & Streaming guides.
+- Added the **Hindi** documentation language pack, covering all 124 in-app guides (developer docs included) in natural Hindi, with English UI control names preserved for following instructions against the interface and Hindi sidebar category labels in the docs viewer. Select it under **Settings → General → Documentation Language** via **Download & Replace** (#4471).
+- Taught the docs viewer to render right-to-left documentation, ahead of the planned Arabic pack: each guide follows its served language's reading direction (untranslated English fallbacks stay left-to-right), code spans and fences keep their left-to-right order inside RTL prose, and lists/tables/panels use direction-aware styling. Three deliberate refinements are visible today: search highlights lose their slight inset so they can no longer sever cursive letter joining, sidebars whose category headers use non-Latin scripts (Japanese, Korean, Chinese, Hindi) drop the small-caps letter-spacing that misfit them, and the "Last updated" dates now follow the app's language instead of the browser's. Everything else renders identically for existing packs (#4489).
+
+### Fixed
+
+- Preserved full JannyAI definition fields by falling back to recovered page data when the original PNG is blocked, and stopped incomplete search metadata from masquerading as a complete character import (#4497).
+- Matched PocketTTS's official `localhost:8000` multipart `/tts` API and built-in voice catalog while retaining automatic compatibility with existing OpenAI-style PocketTTS wrapper URLs (#4499).
+- Let custom post-processing agents evaluate activation keywords against the completed assistant response, so Scan Depth 1 now sees the message the agent is meant to process (#4498).
+- Refined Roleplay Chat Summary controls with a centered Backfill action, a Chat Summary/Combine prompt switcher, and one Edit path that keeps the active prompt visible above template editing (#4501).
+- Sorted the **Settings → General → Language** dropdown by language code with English pinned first, matching the Documentation Language selector. The previous native-label sort used a different collation per entry, which scrambled the order across scripts (#4471).
+- Sent Noodle image instructions to the timeline model, and stopped the default Noodle Post Image template from appending them to the image-generation prompt, so directions like "mention build, clothing, pose, lighting" now shape the generated image description instead of reaching ComfyUI as literal prompt text. Custom templates that still reference `{{userInstructions}}` continue to append it verbatim. Raw style tokens belong in an image style profile, which applies to every Noodle image.
+- Stripped label text and language-model framing from the character personality and image-habit blocks in the Noodle image prompt, so the image model receives the descriptive values instead of sentences written for an LLM.
+- Dropped the `Character appearance notes:` header from the shared illustrator appearance block, which every caller appends directly to an image prompt, so diffusion models stop receiving the label as drawable text.
+
+## [2.4.1]
+
+### Added
+
+- Added optional prompt-preset targeting to regex scripts and refreshed the existing character target picker so scoped regexes follow the selected preset or characters without clipped controls (#4446).
+
+### Changed
+
+- Advanced the stable release identity to v2.4.1 across the Engine, PWA manifest, Windows installer, Android bootstrap APK, update checks, Home page, and release references. Android uses `versionName` `2.4.1` with `versionCode` `42` so it updates over every previously published APK.
+
+### Fixed
+
+- Let Characters, Personas, Lorebooks, Agents, Presets, and Connections sidebar labels use the full desktop row width beneath hover actions, and made Conversation Call clip-length rows size to their panel instead of clipping labels beside fixed-width fields (#4449).
+- Removed accumulated duplicate built-in **Default** settings profiles during startup normalization while preserving one stable profile and active selection per chat mode (#4442).
+- Kept `/scene` chats and standalone conversions out of Conversation branch groups so original conversations remain visible in the Conversation sidebar (#4443).
+- Taught Professor Mari the supported custom `image_prompt` agent configuration, including marker activation and the image-generation capability, so she creates requested image agents instead of falsely refusing them (#4444).
+- Kept Google Gemini API keys in the `x-goog-api-key` header when fetching models instead of duplicating them in the URL, preventing compatible proxies from rejecting the query token with HTTP 401 (#4448).
+
 ## [2.4.0]
 
 ### Added