Merge upstream/main into fork — v1.4.0 resync (352 commits)

.gitattributes

@@ -4,3 +4,11 @@
 # assets, and collapse it in review UIs. Drift is still caught by the content-based
 # `git diff --quiet -- internal/api/dashboardspa/dist` gate in the Makefile.
 internal/api/dashboardspa/dist/** -diff linguist-generated
+
+# The typed Go API client under internal/api/genclient/client_gen.go is emitted by
+# oapi-codegen (its header says "DO NOT EDIT") from the OpenAPI spec. Treat it as
+# generated output like the SPA bundle above: skip textual diffing and the
+# whitespace lint on the machine-generated source, and do not attribute its shape
+# to authored complexity. Drift is still caught by content-based build/regeneration
+# gates, since a blob-hash change is detected even with -diff.
+internal/api/genclient/client_gen.go -diff linguist-generated

.githooks/pre-commit

@@ -4,8 +4,9 @@ set -euo pipefail
 staged_go_files=$(git diff --cached --name-only --diff-filter=ACM -- '*.go' || true)
 staged_web_src=$(git diff --cached --name-only --diff-filter=ACM -- 'internal/api/dashboardspa/web/shared/src/' 'internal/api/dashboardspa/web/frontend/src/' 'internal/api/dashboardspa/web/frontend/index.html' 'internal/api/dashboardspa/web/frontend/public/' 'internal/api/dashboardspa/web/package.json' 'internal/api/dashboardspa/web/shared/package.json' 'internal/api/dashboardspa/web/frontend/package.json' 'internal/api/dashboardspa/web/frontend/vite.config.ts' 'internal/api/dashboardspa/web/frontend/tsconfig.json' 'internal/api/dashboardspa/web/shared/tsconfig.json' || true)
 staged_docs=$(git diff --cached --name-only --diff-filter=ACM -- '*.md' 'docs/**' 'engdocs/**' 'plans/**' 'specs/**' 'AGENTS.md' 'CONTRIBUTING.md' 'README.md' 'TESTING.md' || true)
+staged_spec=$(git diff --cached --name-only --diff-filter=ACM -- 'internal/api/openapi.json' || true)
 
-if [ -z "$staged_go_files" ] && [ -z "$staged_web_src" ] && [ -z "$staged_docs" ]; then
+if [ -z "$staged_go_files" ] && [ -z "$staged_web_src" ] && [ -z "$staged_docs" ] && [ -z "$staged_spec" ]; then
   exit 0
 fi
 
@@ -44,12 +45,24 @@ if [ -n "$staged_docs" ]; then
   make check-docs
 fi
 
-# Dashboard SPA rebuild: whenever the spec changes OR the SPA source
-# changes, regenerate the TS types, typecheck, and rebuild the compiled
-# bundle. Guarded on `npm` availability so contributors without Node
-# tooling aren't blocked; CI enforces the full regeneration.
+# Dashboard SPA rebuild: when internal/api/openapi.json changes, regenerate
+# the generated TS API client from the new spec and stage it. When the spec
+# OR the SPA source changes, typecheck and rebuild the compiled bundle.
+# Guarded on `npm` availability so contributors without Node tooling aren't
+# blocked; CI enforces the full regeneration via make dashboard-ci.
 if command -v npm >/dev/null 2>&1; then
+  # Re-read the index rather than reusing the pre-hook snapshot: the Go
+  # block above runs `go run ./cmd/genspec` and stages the regenerated
+  # internal/api/openapi.json, so a Go-only commit that moves the API
+  # surface only shows up here (#4627, #4607).
   spec_changed=$(git diff --cached --name-only --diff-filter=ACM -- 'internal/api/openapi.json' || true)
+  if [ -n "$spec_changed" ]; then
+    # Regenerate BEFORE typecheck/build below: a client that no longer
+    # matches the new spec must fail typecheck immediately instead of
+    # silently building/committing a stale client (#4627, #4607).
+    (cd internal/api/dashboardspa/web && npm ci --silent && npm run generate:client)
+    git add internal/api/dashboardspa/web/shared/src/generated/gc-supervisor-client
+  fi
   if [ -n "$spec_changed" ] || [ -n "$staged_web_src" ]; then
     # Typecheck BEFORE build: vite's build transpiles TS to JS and
     # silently ignores type errors. The Makefile target also runs the

.githooks/pre-push

@@ -14,11 +14,13 @@ set -euo pipefail
 zero="0000000000000000000000000000000000000000"
 
 go_changed=0
+any_non_deletion=0
 while read -r _local_ref local_sha _remote_ref remote_sha; do
-  # Branch deletion — nothing to test.
+  # Branch deletion — nothing to test, nothing to guard.
   if [ "$local_sha" = "$zero" ]; then
     continue
   fi
+  any_non_deletion=1
   # New remote branch: no cheap base to diff against — run the suite.
   if [ "$remote_sha" = "$zero" ]; then
     go_changed=1
@@ -29,6 +31,21 @@ while read -r _local_ref local_sha _remote_ref remote_sha; do
   fi
 done
 
+# Bead ownership/staleness guard (ga-fip9ps.1): re-checks bd claim state
+# immediately before this push leaves the machine, once per invocation
+# (not per ref) regardless of whether Go sources changed. A mayor ruling
+# (reassign/close/hold/reroute) that landed after this push was queued
+# must not be allowed to clobber a branch another agent has since taken
+# over. Bypass: `git push --no-verify`.
+if [ "$any_non_deletion" -eq 1 ]; then
+  repo_root="$(git rev-parse --show-toplevel)"
+  # shellcheck source=../scripts/push-ownership-guard.sh disable=SC1091
+  . "$repo_root/scripts/push-ownership-guard.sh"
+  if ! assert_bead_still_claimed; then
+    exit 1
+  fi
+fi
+
 if [ "$go_changed" -eq 0 ]; then
   exit 0
 fi

.github/requirements/mcp-agent-mail.in

@@ -2,11 +2,17 @@
 # publishes current wheel/sdist assets.
 mcp-agent-mail @ https://github.com/Dicklesworthstone/mcp_agent_mail/archive/32783f6848bd63c425c4b5004cee3350016635fb.tar.gz
 
-# Security floor: GitPython 3.1.49 has GHSA-mv93-w799-cj2w (HIGH).
-# Pinning floor at 3.1.50 to ensure the resolver picks the patched version
-# even if mcp-agent-mail's transitive constraint allows older. Drop this
-# line once mcp-agent-mail upstream pins GitPython>=3.1.50 itself.
-gitpython>=3.1.50
+# Security floor: GitPython < 3.1.52 has multiple HIGH-severity command
+# injection and path traversal advisories reported by the image gate.
+# Pinning the floor ensures the resolver picks the patched version even if
+# mcp-agent-mail's transitive constraint allows older. Drop this line once
+# mcp-agent-mail upstream pins GitPython>=3.1.52 itself.
+gitpython>=3.1.52
+
+# Security floor: Pillow < 12.3.0 has multiple HIGH-severity image parsing
+# vulnerabilities reported by the image gate. Drop this line once transitive
+# constraints carry the patched version themselves.
+pillow>=12.3.0
 
 # Security floor: urllib3 < 2.7.0 has GHSA-mf9v-mfxr-j63j (HIGH,
 # decompression-bomb safeguards bypassed in parts of the streaming API)
@@ -31,6 +37,15 @@ litellm>=1.84.0
 # authlib's transitive constraint carries the patched version itself.
 joserfc>=1.6.8
 
+# Security floor: CVE-2026-52869 + CVE-2026-52870 (HIGH, fixed 1.27.2 — HTTP
+# transports serve session requests without verifying the authenticated
+# session, and experimental task handlers are reachable by any client) and
+# CVE-2026-59950 (HIGH, fixed 1.28.1 — WebSocket transport lacks Host/Origin
+# validation) in the mcp Python SDK < 1.28.1. mcp arrives transitively via
+# fastmcp-slim (mcp<2.0,>=1.24.0); floor at 1.28.1 to clear all three. Drop
+# once fastmcp-slim's transitive constraint carries the patched version itself.
+mcp>=1.28.1
+
 # Authlib and FastMCP security floors live in
 # .github/requirements/mcp-agent-mail.overrides.txt because mcp-agent-mail
 # v0.3.2 still caps Authlib below the fixed release.