Commit Graph

262 Commits

Author SHA1 Message Date
d56131d8b4 fix(ai): completely remove thinkingConfig from Gemini payload to prevent 400 errors 2026-05-19 16:16:52 -07:00
0dcde757f5 fix(runner): correct Gemini SDK payload property thinkingBudgetTokens to thinkingBudget 2026-05-19 16:16:08 -07:00
f2dcd5597d fix(ai): correct Gemini SDK payload property thinkingBudgetTokens to thinkingBudget 2026-05-19 16:15:59 -07:00
ba2cbd531d docs: outline UX refactor from Tasks to Features for Plan tab 2026-05-19 16:13:25 -07:00
18355e1421 fix(ui): group plan tasks by User Story or Phase to support Spec Kit format 2026-05-19 15:56:13 -07:00
e12882d13b fix(ai): revert thinkingBudget to thinkingBudgetTokens 2026-05-19 15:49:15 -07:00
7c45fdc5cc fix(ai): bump roundSinceText cutoff to 30 to prevent panic loops 2026-05-19 15:26:15 -07:00
63b64d5fc2 feat(ui): implement explicit chat modes for collaborate, delegate, and vibe coding 2026-05-19 15:18:30 -07:00
096ebc278a fix(api): delete legacy atlas and advisor agent endpoints 2026-05-19 15:09:59 -07:00
5573f1e6fa fix(ai): restore thinking animations for gemini streams 2026-05-19 14:53:24 -07:00
d7d4b2d2fe fix(ai): bump loop-breaker limits from 16 to 30 to permit long autonomous workflows 2026-05-19 14:51:45 -07:00
2e5ca29c40 fix(runner): bump max tool rounds to 30 to support long deployments 2026-05-19 14:51:11 -07:00
8071ac9049 fix(runner): remove leftover syntax errors 2026-05-19 14:34:42 -07:00
2f86a4262e fix(runner): resolve TypeScript compilation errors 2026-05-19 14:14:34 -07:00
67fa4a2ccc feat(runner): migrate vibn-agent-runner to use frontend MCP proxy tools and updated headless prompt 2026-05-19 14:06:12 -07:00
bbcd4ad55e fix(ai): implement Phase 2 and 3 prompt recommendations from review 2026-05-19 13:47:18 -07:00
618f7796b2 feat(ai): optimize tool loops, fix deployments, and integrate new onboarding flow 2026-05-19 12:52:47 -07:00
331312b648 fix(ui): adopt SWR for useAnatomy to deduplicate requests across components and fix API flooding 2026-05-17 20:18:19 -07:00
6b8862ef2b feat(api): comprehensive QA hardening — security gates, chat improvements, beta scaffolds
Closes checklist items F-01..F-06, D-01..D-28, S-01..S-10, C-01..C-07,
B-01..B-07, R-01..R-02, O-03.

Security (28 deletions + 10 auth gates):
- Delete 28 unauthenticated debug/cursor/firebase/test routes
- Gate ai/chat, ai/conversation, context/summarize, work-completed with withTenantProject/withAuth
- Add HMAC-SHA256 signature verification to webhooks/coolify
- Switch all admin secret comparisons to timingSafeStringEq

Foundations (lib/server/*):
- api-handler.ts: withAuth, withTenantProject, withWorkspace, withAdminSecret, withRateLimit
- logger.ts: structured request-scoped logging with turnId
- audit-log.ts: writeAuditLog helper + audit_log table
- rate-limit.ts: Postgres sliding window rate limiter
- coolify-webhook.ts: verifyCoolifySignature
- timing-safe.ts: timingSafeStringEq

Chat hardening (chat/route.ts):
- MAX_TOOL_ROUNDS 15 → 8 (C-01)
- Loop detection: hard-break at 3 identical fingerprints (was 5) (C-02)
- Add 6-consecutive-tool-call hard-break (C-02)
- Mode: respond first, act second prompt block (C-03)
- SSE heartbeat every 25s via setInterval (C-04)
- Per-tool 45s timeout via Promise.race (C-05)
- turnId per-turn UUID for log correlation (C-06)
- Recovery fires when roundsSinceText >= 4 (C-07)
- SSE plan event on plan_task_add/edit (B-05)

Beta features:
- invites table + GET/POST /api/invites (P4.8)
- invites/[token] validate + redeem (P4.8)
- fs_project_dev_servers table + lib/server/dev-server-state.ts (P6.B1)
- fs_project_secrets table + CRUD routes (P6.D2)
- lib/integrations/brief-extract.ts (P3.7)

Documentation:
- app/api/ROUTES.md: full route map with auth + tenant
2026-05-17 19:17:22 -07:00
955aeed6ce fix(ai): hardcode all default LLM references to gemini-3.1-pro-preview across monorepo 2026-05-16 15:00:17 -07:00
814815af82 fix(deploy): install openssl in base docker image to fix prisma client initialization error during build phase 2026-05-16 14:05:48 -07:00
000d2d171e fix(deploy): use explicit ssh:// scheme and port 222 for gitea clone urls in coolify 2026-05-16 13:54:17 -07:00
120f045a55 fix(ai): upgrade deploy mechanism to use explicit ssh deploy keys rather than http basic auth to solve gitea cloning bugs 2026-05-16 13:30:14 -07:00
9b5702a81c fix(ai): actually throw probe error out of probeDevServerReadiness so AI captures the failure synchronously 2026-05-16 13:16:17 -07:00
1545145292 fix(ai): implement two-stage loop detection to warn before hard-stopping (Fix 11) 2026-05-16 12:59:16 -07:00
f2c29857b5 fix(ai): relax fs_edit line number enforcement to allow safe oldString replacements 2026-05-16 12:54:15 -07:00
2057a61ea2 fix(ai): correct syntax for executing bash scripts inside the dev container 2026-05-16 12:49:50 -07:00
70ea8f849b feat(ai): inject full directory tree into context to eliminate manual fs_list probing 2026-05-16 12:40:31 -07:00
ca8a915fe2 fix(ai): sync auto-commit with streamed result to surface commit SHA to UI (Fix 10) 2026-05-16 12:26:54 -07:00
89c9b01669 fix(ai): add hard-rule prompt clause forbidding unverified mutation claims (Fix 8) 2026-05-16 12:25:26 -07:00
24a7689d69 fix(ai): force recovery summary when final tools fail (Fix 6) 2026-05-16 12:25:00 -07:00
36c9dd47fb fix(ai): implement fixes 4, 5, and 7 to broaden loop detection, tighten silent stretches, and lower tool round caps 2026-05-16 12:24:09 -07:00
9f59b584e5 fix(ai): feed verified tool history back into model context to prevent hallucination compounding (Fix 3) 2026-05-16 12:22:58 -07:00
f0d7548fe1 feat(ai): persist raw tool execution results in postgres to enable fine-tuning dataset extraction 2026-05-16 11:59:46 -07:00
dfd799f046 feat(ui): add JSON export functionality to session viewer for AI fine-tuning 2026-05-16 11:32:40 -07:00
a4480f9217 fix(agent): ensure is_force_https_enabled is applied to docker compose apps when setting custom domains 2026-05-16 11:29:31 -07:00
67ee2b49d7 feat(ui): build session viewer to read raw AI transcripts and tool calls 2026-05-16 11:10:05 -07:00
c7e720bdc9 fix(agent): increase dev server readiness probe timeout to 300s to accommodate slow Next.js cold boots and prevent premature AI loop restarts 2026-05-15 16:59:10 -07:00
b92939ab86 fix(ai): update system prompt to enforce line-number usage for fs_edit to prevent 404 block mismatches 2026-05-15 16:38:17 -07:00
8cb7a9450b feat(ui): add manual reload button to preview device toggles 2026-05-15 16:31:31 -07:00
feebeccd8e fix(ai): ensure dev container is running before attempting to generate codebase summary 2026-05-15 16:22:43 -07:00
485ed73572 feat(ai): inject dynamic codebase summary into system prompt to eliminate blind structure searches 2026-05-15 16:16:45 -07:00
d464ccd19d feat(ui): hardcode visual preview tab to primary frontend port 3000 2026-05-15 16:03:06 -07:00
4adf7a7659 feat(ui): remove design tab from primary navigation 2026-05-15 15:49:01 -07:00
dc82ccc47a feat(ui): move preview device toggles into the global nav rail 2026-05-15 15:42:49 -07:00
a4354a5294 feat(ai): implement adaptive 5-dimensional QA rubric for multi-surface evaluation 2026-05-15 14:35:27 -07:00
f3b957ace2 feat(ui): add showcase toggle and runtime renderer to design explorer 2026-05-15 14:09:27 -07:00
b4821b3eba fix(ui): handle fallback UI for design systems without visual previews 2026-05-15 14:00:01 -07:00
f9d74205fb feat(ui): implement split-pane live preview for design systems 2026-05-15 13:56:12 -07:00
895fd8a961 feat(ai): replace hardcoded design kits with dynamic open-design templates and registries 2026-05-15 13:49:16 -07:00