Adds the self-built operations UI served from the app origin under the
reserved /admin slug: overview, users (with disable/enable and token
revocation), workspaces, audit log, and platform admin management. The
shell gates on /api/admin/me, sends signed-out visitors to /login, and
hides writes a viewer cannot perform; the server enforces the same roles.
Core gains an admin API client with zod-validated responses, query
options and mutation hooks; views add the pages and copy in all five
locales.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FrVjAFWeckYV69HS51xUhy
Adds the backend for the operations console: platform_admin roles
(super_admin / operator / viewer), an admin_audit_log table, and
user.disabled_at so disabling an account is a stored state instead of a
hard-coded denylist. The in-process disabled set is now refreshed from the
database every 30 seconds, and the old emergency denylist entries are
migrated into it.
/api/admin exposes overview counts, user and workspace listings with
detail, disable/enable, token revocation, the audit log, and platform
role management. Every write requires a reason and is recorded with the
actor, IP and user agent. PLATFORM_ADMIN_EMAILS bootstraps the first
super_admin.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FrVjAFWeckYV69HS51xUhy
Resolve a workspace idempotency key before catalog and admission so a
replay does not depend on the catalog. Adopt a skill only when its
content digest matches and it has no files; any other name hit is
content_mismatch and is not inserted. Keep crash bookkeeping off the
public step while still storing it with the operation.
Co-authored-by: klinsmaya <[email protected]>
Commit, read, and reconcile share the install ledger. The watcher leases
due operations. A missing catalog policy pin writes no row, and workspace
delete removes the new tables.
Co-authored-by: klinsmaya <[email protected]>
The ledger commits a correlation id while a step is armed, then inserts
with that id. An ambiguous write stays unknown and that pass only looks
the id up. A ready install keeps a refused task step and does not insert
a task.
Co-authored-by: klinsmaya <[email protected]>
Two comments described rules the types do not enforce. ParseListingID is not the only way to build a ListingID, and decodeVersion returns more than ErrInvalidListing.
Co-authored-by: klinsmaya <[email protected]>
The sketch's router test plan named task-token rejection. A member who gets
200 with a session gets 403 from RequireHumanActor with a task token bound
to them, on browse, detail, and preflight.
Co-authored-by: klinsmaya <[email protected]>
Adds the market_v1-gated Market browse, listing, and install-check pages in
@multica/views/market, wired into web routes, desktop routes, the sidebar,
search, tab subjects, and link handling. The install check renders the
preflight report with its runtime and model choices kept in the URL; a ready
report says the workspace can accept the listing and offers no install.
Co-authored-by: klinsmaya <[email protected]>
Add Market types, zod schemas, client methods, and query options keyed
by workspace. A ready preflight parses only when every check is
satisfied and the source is live; anything else falls back to
unreadable. Generate the block-reason list from the server JSON with a
CI drift check, add the market_v1 flag key, reserve the market slug,
and bucket market routes in diagnostics.
Co-authored-by: klinsmaya <[email protected]>
Mount /api/market inside the workspace-member group behind market_v1 and
RequireHumanActor. Preflight takes version, runtime_id, and model only;
the member comes from the workspace middleware. Configure the catalog
with MULTICA_MARKET_CATALOG_URL and MULTICA_MARKET_CATALOG_TOKEN; an
empty URL serves the stub samples.
Co-authored-by: klinsmaya <[email protected]>
Add evaluatePreflight, a pure check of whether a member could install one
listing version here. It judges the model runtime, MCP tools, Composio
connections, and skills with the predicates the existing routes use, so
preflight cannot promise what those routes refuse. Facts load through a
marketReader of Get and List methods inside a READ ONLY transaction. A
stub listing is never ready.
Share the rules instead of copying them. ListAgentRuntimes reads
runtimesVisibleTo, BuildTaskOverlay reads composio.MountableToolkits, and
canManageAgent decides with canManageAgentEnv, so a NULL agent owner no
longer matches anyone.
Block reasons live in market_block_reasons.json, and a test pins the Go
consts to it.
Co-authored-by: klinsmaya <[email protected]>
Add the marketcatalog client. It reads listings and pinned versions from the
NocoBase /market/v1 resources, or serves a stub sample catalog when no catalog
URL is set. One decoder parses both, so a sample cannot hold anything the live
parser rejects. A malformed manifest is ErrInvalidListing and never becomes a
listing. Unknown requirement kinds are kept as unsupported needs.
Co-authored-by: klinsmaya <[email protected]>
Add the M01 lookup table for agents, tasks, credentials, squads, and events at 18fa9f728. The table marks unique task creation and a market callback feed as missing.
Co-authored-by: klinsmaya <[email protected]>
- issueworkflow.Brief is the only renderer: the claim carries it into every
run's per-turn prompt; the editor preview and timeline show the same text.
- Workflow handoffs stop writing the brief into handoff_note, so a person's
note no longer drops the brief and the handoff framing fits again.
- Agents that are not the issue's assignee get an observer brief without
the step's commands.
- Clearer rule override and narrower wakeup guidance; user text is
stripped of control characters.
- multica-platform skill documents project workflows.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): workspace workflows with step handoffs (MUL-7420)
A workflow is a named, workspace-level selection of statuses from the
shared status catalog, in board order, with an optional handoff on each
step. Projects opt in through project.workflow_id; a project without one
keeps the whole catalog (the implicit Default workflow), so existing
workspaces see no change.
- issue_workflow table + project.workflow_id, CRUD API under
/api/issue-workflows, POST /api/projects/{id}/workflow with a dry-run
status mapping plan. Only issues on statuses the target workflow does
not list are remapped, and remapping never hands issues off.
- Issue writes keep the status inside the project's workflow. Entering a
step with a handler through a status change assigns the issue to that
handler and starts its run with the step's brief as the handoff note;
an explicit assignee in the same write wins. Creating an issue starts
at the workflow's starting step.
- Task claims carry the issue's project workflow, and the brief renders
a Project Workflow section so agents move along this project's
statuses instead of the built-in ones.
- Statuses a workflow lists cannot be archived.
- Adoption is gated by the project_workflows_v1 flag; existing
workflows keep working and projects can always switch back to Default.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): workflow settings, project picker and workflow-aware boards (MUL-7420)
- Settings → Workflows (behind project_workflows_v1): the Default
workflow plus named workflows, each shown as its step chain with
handlers and the projects using it; an editor to pick statuses from the
library, order them, mark the starting step, and set each step's
handoff, instructions and next/back statuses.
- Project Workflow property: switching dry-runs first and asks where
issues on unlisted statuses go; nothing else moves and nothing is
handed off.
- A project board's columns are its workflow's steps, and each column
head names who entering it hands the issue to.
- Status pickers offer only the issue's workflow steps and say who each
hands off to; boards refuse drops onto statuses the dragged card's
workflow does not list.
- New issues in a workflow project start on its starting step, with a
hint naming who they will be handed to.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): name built-in steps once in the brief; roomier picker hints (MUL-7420)
Built-in statuses have no stored name, so the handoff brief printed
`todo` todo. Print the key alone when the name adds nothing.
The status picker widens for workflow projects and shows the handoff as
an arrow and name, so step names no longer truncate to one letter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): handoff previews and a single timeline entry per handoff (MUL-7420)
- GET /api/issues/{id}/workflow-handoff?status= says what moving an issue
would do: who it goes to, which runs of its current agent are still
active, and the brief the handler receives. Backs the confirmation.
- POST /api/issue-workflows/preview-brief renders a step's brief from an
unsaved workflow, for the editor's preview.
- Mapping plans list the statuses that stay, so the switch dialog can say
which issues are untouched.
- A handoff is recorded on the status_changed activity (workflow, handler,
whether a run started, the brief) instead of a separate assignee row.
- The brief now reads like the one shown in the design: the workflow, the
current step, its instructions, the statuses, and the commands to hand
off.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): rebuild the workflow UI to the reviewed design (MUL-7420)
The first cut used generic controls where the design had purpose-built
ones. This brings every surface up to the mockup:
- Settings → Workflows is one page: the workflows (step chain with
handler avatars, handoff count, projects using it; Default first) and,
below, the shared status library with each status's workflow usage.
- The workflow editor is a full page instead of a dialog: draggable step
cards summarising each handoff, and a panel for the selected step —
swap its status, pick the handler with a segmented control and a
searchable target, handoff instructions, next/back statuses, a preview
of the brief the handler receives, duplicate and delete.
- The project Workflow picker lists each workflow's statuses, handoffs and
projects, links to settings, and always confirms the switch with what
moves and what stays.
- Moving an issue into a handoff step (status picker, table, board drop)
asks first: who it goes from and to, a default-on option to stop the
previous agent's run, and the brief.
- Status pickers name the workflow and project, show each step's handler
with an avatar or that the assignee stays, and explain themselves.
- Boards: the handler chip in project column heads, hatched columns a
dragged card cannot enter with the reason, and a drop hint naming who
the card will go to.
- The timeline records a handoff under its status change, with the brief
the run received; the issue sidebar shows the workflow it follows.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): word a queued previous run as queued in the handoff confirm
The confirm dialog said the previous agent was "still running (for N
minutes)" even when its task had only been queued. Queued runs now read
as queued, and the checkbox cancels them instead of stopping them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): refuse a run's status change once the issue left its step
A run decides where the issue goes next from the step it was queued for.
When someone else moved the issue while the run worked, applying that
decision undid their move: in the live Grok run, a PM parked NW-1 as
blocked and the still-running agent moved it straight back to code
review.
Tasks now record the issue's status when they are queued
(agent_task_queue.workflow_step, written by the task INSERTs; automatic
retries keep their parent's step), and a run's own status changes move
it along. In a workflow project, an agent status change from a run whose
step no longer matches the issue is refused with 409
workflow_step_moved, naming where the issue is now and who moved it, so
the agent stops instead of retrying.
A handoff away from a squad now also stops the runs made on the squad's
behalf, and stopped runs record who stopped them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): keep every status entry point inside the issue's workflow
The issue context menu listed every catalog status and applied handoff
steps without the confirmation the status picker and board show, so a
right-click could pick a status the workflow refuses or start an agent
unasked. It now offers the workflow's steps and opens the handoff
confirmation through a shared modal.
One-click status actions no longer assume built-in statuses a workflow
may not list: "mark done" lands on the workflow's done step (hidden when
it has none), un-marking a duplicate returns to the workflow's start,
and "mark duplicate" is offered only when the workflow lists cancelled.
The batch toolbar offers a single project's workflow statuses when the
selection sits in one project.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): keep issue wakeups consistent with workflow steps
Three places where project workflows and issue wakeups met:
- A wakeup run is queued when it fires, so it took the issue's status at
that moment as its workflow step. A wakeup an agent registered then
bypassed the stale-step refusal: parked by a PM, the issue could be
moved on by the agent's "check CI, then hand to review" wakeup. It now
keeps the registering run's step; a member's wakeup still starts from
the issue's status.
- Retries carried handoff_note only for wakeup runs, so a retried
workflow handoff lost its brief. Rows with a workflow step keep it.
- Switching or editing a workflow remaps statuses in bulk without the
close rule, so an issue remapped into a done status kept its wakeups
and pending wakeup runs. The remap now ends them like any status write.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): don't also wake the agent a write hands the issue to
A workflow handoff or an assignment already starts the receiving agent's
run. If that agent also subscribed an event wakeup to the issue's status
or assignee, the same write queued a second run for one fact, and
workflows made such writes frequent.
The write now names the agent it hands the issue to in the
transaction-local multica.handed_to_agent (the new agent assignee, a
squad's leader, or a step's handler even when it already owned the
issue), and wakeup capture skips that agent's subscriptions for the
write's issue.* events. Other agents' wakeups, and task, comment and
reaction events, are captured as before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): tell agents not to watch workflow issues with wakeups
The handoff brief and the runtime's project workflow section now say
that each step's handler gets a run when the issue enters the step, so
wakeups on a workflow issue are for waiting on time or on something
outside it, not on its status, assignee or runs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): refresh project usage after project changes
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): MUL-7420 split columns from per-project handoffs
Workflows now only define a board's columns between a fixed head
(backlog, todo) and tail (blocked, done, cancelled). Handoffs move to
project.workflow_handoffs, so projects can share columns and still hand
off to different people. Default becomes a real, editable row that every
project without a named workflow follows. Adds project handoff, add-column
(project fork or shared) and project brief preview endpoints; same-agent
adjacent columns re-run the agent.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(core): MUL-7420 project handoffs and Default workflow client model
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(views): MUL-7420 column-header handoffs and project workflow menu
Board column headers set the project's handoff for that column; the
project toolbar gets a workflow menu (full flow, switch, templates) and an
add-column action. Views outside a project show Default's columns, with
other statuses reachable through a status filter. Adds the issue flow card,
create-project workflow choice, a columns-only workflow editor and a
lighter status picker.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(views): MUL-7420 wrap create-project workflow label in a menu group
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): MUL-7420 keep workflow structure in settings; no squad handoffs
Projects no longer add columns or create workflows: the add-column
endpoint is removed and creating a workflow is admin-only. Handoffs go
to one agent, a member or the project lead; squads route work themselves,
so a handoff to one is rejected, as is the issue-creator handler.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* refactor(core): MUL-7420 drop the project add-column client
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(views): MUL-7420 simpler handoff picker and workflow editor form
The handoff form is one searchable "Hand to" picker (no handoff, the
project lead, an agent or a member); the next status defaults to the next
column and next/back overrides sit under "More options". The workflow
editor gets labelled name and description fields and shows the fixed
statuses as one start and one end row. Templates move from the project
menu to Settings → Workflows → New, and the project board loses its
add-column action.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* refactor(server): MUL-7420 keep handoffs on the workflow, make backlog and blocked optional
Handoffs move back onto workflow steps: a workflow is the whole pipeline,
and a project only picks one. The project lead stays a relative handler, so
projects can still share a workflow. Handoff edits are admin-only, through
the workflow write or PUT /api/issue-workflows/{id}/handoffs/{status}; the
brief preview moves to the workflow too. Drops the unreleased
project.workflow_handoffs migration.
Todo, done and cancelled are required; backlog and blocked are optional and
keep their fixed places. Without blocked, the brief points agents at the
step's back status.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Co-authored-by: Cursor <[email protected]>
* feat(views): MUL-7420 edit handoffs on the workflow, optional backlog and blocked
The workflow editor sets each column's handoff in its side panel, and
Backlog and Blocked switch on and off. The board's column popover and the
flow panel edit the workflow's handoff, say how many projects it reaches,
and are read-only for non-admins. Drops the per-project handoff client
code.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): MUL-7420 keep platform rules on writes that hand off nobody
Migration 579 skips an issue.* event for the agent a write hands the issue
to. Its filter compared agent_id with the transaction's handed_to_agent
setting using IS DISTINCT FROM, which is false when both are NULL. Main's
platform rules (child_done) have no agent_id, so every issue.* event that
handed the issue to nobody was dropped for them: a parent leaving backlog
never woke its agent for sub-issues that closed meanwhile
(TestChildDoneHeldWhileParentInBacklog).
Rules without an agent are never the handoff target, so they always
capture. Extends TestHandoffDoesNotAlsoWakeTheHandler with a platform rule
on a handoff and on a plain status change; the latter fails on the old
filter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(views): MUL-7420 three-way handoff choice; quieter move confirm
The handoff form picks one of three directions, as in the mockup: no
handoff, hand to an agent (starts a run), or hand to a member, project lead
included (assignee only). What the step does, where it goes next and the
back status only reach an agent's brief, so they show and save for agent
handoffs alone.
The board's move confirmation keeps the agent's brief collapsed. Create
project shows the workflow picker even when Default is the only workflow,
with a note on where to make more. The hidden-columns panel says a board's
columns come from its workflow, with a link to manage workflows for admins.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(workflows): confirm handoff on project move, per-project handoff copy, two-pane editor (MUL-7420)
- A single issue moved into a workflow project from issue detail confirms
the handoff of the column it lands on; the write opts in with
enter_workflow_step. Batch, API and CLI moves stay administrative.
- The handoff preview takes project_id to preview such a move.
- Saving a shared workflow's handoff from a board can keep the change to
that project: the server copies the workflow for it and switches the
project in one transaction (copy_for_project_id).
- The column popover says which workflow it edits and who else uses it.
- The workflow editor is a step list with a detail panel for the
selected step.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* style: gofmt workflow tests
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(views): MUL-7420 show next/back always; edit workflow name and description in place
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* feat(views): MUL-7420 trim copy on the workflows settings page
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix: MUL-7420 keep pre-workflow behavior for workspaces that never adopt workflows
The run step guard now applies only to workflows that hand off, and the
standalone Statuses settings page keeps its original header.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(views): MUL-7420 use a solid placeholder tone on the workflow header
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(workflows): keep the runtime brief cache-stable; fix project board and batch status gaps (MUL-7420)
- Move the project workflow out of the runtime brief into the per-turn
prompt so CLAUDE.md stays byte-identical across steps and issues.
- An explicit status filter overrides the project workflow's columns; the
hidden-columns panel lists statuses outside the workflow.
- Batch status offers only statuses every selected workflow allows; a
partial batch rolls back, refetches and warns.
- setProjectWorkflow returns void instead of an unparsed body.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Co-authored-by: Lambda <[email protected]>
Co-authored-by: Cursor <[email protected]>
* MUL-8047: feat(onboarding): open the runtime guide issue directly instead of a welcome modal
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8047: chore(onboarding): drop dead option cards, copy, and completion animations
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8047: fix(onboarding): reopen the existing guide issue on duplicate
A reload, or a create whose response was lost, leaves the guide issue
from an earlier Skip in place while onboarding is still incomplete; the
retry then hits the server's active-duplicate guard and the step was
stuck toasting forever. Recover the existing issue from the validated
409 body and continue to completion.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8046: feat(issues): per-run cost bars and token detail in the run log
The sidebar's cumulative spend curve becomes one bar per run with spend,
token and agent-time totals, and each past run gains a second line with
agent, duration or failure reason, tokens and model. The Runs dialog
replaces the step curve with a bucketed bar chart (cost, tokens or agent
time, stacked by agent or token type), adds a cost split by agent and
model, model and token columns, and an expandable per-run breakdown.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8046: feat(issues): one bar per run in the Runs dialog chart
Time buckets spent most of the chart on hours where nothing ran and made
each bar roughly one run anyway. The dialog chart now draws one bar per
run like the sidebar strip: height is cost, tokens or agent time, colour
is the agent or token type, a tick marks failed and cancelled runs, and
day dividers replace the time axis. Drops the bucket, lane hit-testing
and time-tick helpers.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8046: fix(issues): split run bars by share so sub-dollar costs fill them
Segments used dollar amounts as flex-grow; factors summing below 1 fill only
that fraction of the free space, so bars and share bands under $1 drew short.
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* MUL-8046: feat(issues): keep the cumulative cost chart as a second Runs dialog view
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: Cursor <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Arabic/Hebrew/Persian comments and descriptions that mix in English
words, paths or numbers render left-aligned with scrambled word order,
because every block inherits the page's LTR direction.
Use `unicode-bidi: plaintext` so each paragraph, list item, heading and
blockquote resolves its base direction from its own first strong
character, and `text-align: start` so alignment follows it. Applied to
.rich-text-editor (prose.css) and .markdown-content (markdown.css).
LTR-only content resolves to LTR and is unchanged.
Co-authored-by: Claude Opus 5.5 <[email protected]>
* fix(inbox): restrict notifications to current workspace recipients
Removing a member or leaving a workspace deletes their subscriptions, but
several notification sources keep addressing the user by a retained ID:
reactions to their issues and comments, retained assignments, explicit
mentions, squad mentions through surviving squad-member rows, quick-create
outcomes and children_done for a retained parent assignee. CreateInboxItem
inserted those rows unconditionally and the inbox:new event was then sent to
the user's own connections, so a former member could keep receiving new
issue titles and comment content.
Guard the shared insert instead of each source: a member recipient must still
be a member of the item's workspace and an agent recipient must belong to it.
An ineligible recipient yields no row (pgx.ErrNoRows), which every caller now
treats as a quiet skip without publishing inbox:new or failing the underlying
operation. The check runs in the statement's snapshot and takes no row locks;
historical inbox rows are left untouched.
Existing delivery tests created recipients without membership rows; their
fixtures now add the membership the production path requires.
* test(inbox): assert children_done settles receipts when the recipient left
* refactor(inbox): centralize eligible notification writes
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: 千乘妍 (Xiaoyaner) <[email protected]>
Co-authored-by: Sol-Boy <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(scheduler): stop a dense-cron autopilot trigger going permanently silent
Root cause (#8939): autopilotPlansForScope enumerated (lastPlan, dbNow] under
a 24h replay cap. NextOccurrencesUTC keeps the FIRST 1024 activations of the
interval, so after a pause longer than 1024 occurrences of a dense cron
("* * * * *" after ~17h) the latest kept one is hours stale, fails the
5-minute lateness guard, and the hook returns nothing. Nothing is written to
sys_cron_executions, the anchor never moves, and next_run_at keeps looking
valid while the trigger stays silent for good. Any cron with more than 1024
activations per 24h is affected; */2 (720/day) is not.
Floor `after` at now - maxAutopilotScheduleLateness (inclusive) before
enumerating. This keeps the latest-only collapse, the lateness guard, the
retry path and the cold-start anchors, and makes the 1024 cap unreachable for
this caller; the 24h replayWindow is now redundant and removed.
This also recovers triggers an older build already left silent: the next tick
re-anchors inside the lateness window and the trigger fires again, so the
manual recovery from the report (change the cron, or delete and recreate the
trigger) is no longer needed. An anchor past dbNow (DB clock rollback) is
healed through the same floor instead of keeping (after, dbNow] empty forever.
Tests (jobs_autopilot_long_pause_test.go): dense-cron pauses of 18h and 3 days
fail before and pass after; the short-pause and */2 cases are controls; the
5-minute lateness bound is pinned on both sides; the automatic self-heal and
the future-anchor recovery are covered.
go test ./internal/scheduler/ and go vet ./internal/scheduler/ pass.
Signed-off-by: Battleplus <[email protected]>
* fix(scheduler): keep dense-cron recovery scoped to stale anchors
Co-authored-by: multica-agent <[email protected]>
---------
Signed-off-by: Battleplus <[email protected]>
Co-authored-by: Sol-Boy <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* fix(views): route plain attachment download links through the re-sign path (WK-11)
A plain markdown link to the API-host attachment endpoint
(MULTICA_PUBLIC_URL/api/attachments/<id>/download, persisted by
buildMarkdownURL in private-storage deployments) opened with a bare
navigation. The browser sent no credential there — web's session cookie is
host-locked to the API origin and SameSite=Strict, and Desktop/mobile carry a
bearer token no <a> can send — so the request returned 401
"missing authorization" and the user downloaded the error body, not the file.
File-card/image and the download button already route through
useDownloadAttachment, which refreshes authenticated metadata and navigates to
the credential-bearing URL the server mints per click (capability / presign /
CloudFront). Plain links missed that path. Intercept attachment download URLs
(UUID-guarded via attachmentIdFromDownloadURL) in RichLink and hand the
click to the same download hook, so all three attachment entry points behave
alike. Modified clicks still open natively; the raw URL remains the durable ref.
Add a routing test covering the UUID-link interception and the non-UUID
non-interception.
Fixes WK-11.
* fix(attachments): scope Markdown downloads to their deployment and workspace
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: Dev (multica) <agent@multica>
Co-authored-by: Yushen <[email protected]>
Co-authored-by: multica-agent <[email protected]>
* test: cover switching workspaces from the search palette
Failing tests for the palette's Workspaces group and for desktop resuming
a workspace's last active tab when a switcher pushes its Issues root.
* feat(search): switch workspaces from the search palette
Adds a Workspaces group to Mod+K. Rows match on name or slug, plus the
hidden keywords "switch" and "workspace". The current workspace is
excluded, and rows keep the sidebar switcher's order and unread dot.
* feat(desktop): resume a workspace's last tab when switching to it
A cross-workspace push to the target's Issues root, which both workspace
switchers send, now restores that workspace's last active tab. Deeper
paths still open exactly that path.
* test(desktop): cover cross-workspace replace resuming the last tab
* refactor(desktop): simplify workspace resume routing and its tests
* fix(wakeups): drain pending inputs and due checks in one dispatch pass
A dispatch pass visited a single batch of 100 rules ordered by updated_at.
With ~1,160 ready rules in production, a status-change hint waited about
a dozen 30s passes behind condition checks with nothing new, so
--until-status handoffs fired minutes late (MUL-7933, #9139).
Each pass now takes batches from two lanes until both drain or a limit
is hit: rules with pending inputs (at most 50 per batch, not filtered by
enabled) and due schedules/deadlines/condition checks (the rest of each
batch). Rules are visited at most once per pass; the pass stops after 15s
or 1,500 rules so the sequential scheduler keeps time for other jobs.
Global passes log lane counts, duration, stop reason and the oldest
pending input age (warn when cut short or older than 2 minutes).
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): keep due checks moving behind slow inputs; report held inputs apart
Review follow-up on #9202.
- A pass ran a whole batch's inputs before its due rules and checked only
the overall 15s budget, so a few inputs near the 2s dispatch cap could
starve schedules, deadlines and condition checks. Dispatches now
alternate between the lanes, and while due work remains the input lane
stops at half the pass budget; either lane uses the rest once the other
drains.
- The pass log counted every unprocessed receipt as backlog, but dispatch
keeps inputs pending on purpose while a run holds them (reserved by a
claim, the rule's own run claimed, or waiting to join a queued run). Those
are now logged as held_inputs, and only the oldest input the scheduler
could act on (oldest_ready_input_age_s) can raise the 2-minute warning.
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): count only inputs a run can still take as held
Review follow-up on #9202. The pass log's held count hid real backlog in
two cases, so a stalled wakeup could sit for minutes without a warning:
- An input whose task_id pointed at a run that ended (cancelled/failed)
before starting was counted as held, but takenReceipts releases it on
the next dispatch. Reserved now means the run has neither started nor
ended, as takenReceipts decides; an input of a run that started is
consumed on the next dispatch and also counts as backlog.
- A platform rule's input was held by any queued run on the issue. It is
now held only by a queued run of the issue's current target agent, run
as the person the platform rule's run would run as, reusing
resolveWakeTarget, childDoneRunAs and hasWaitingRun as dispatchSystem
does.
PendingWakeupInputs is replaced by ListPendingWakeupInputGroups (per-rule
groups, oldest first, bounded) plus pendingInputs in Go.
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): keep tick tests and passes stable under load
CI failed the tick tests with "timeout: context deadline exceeded": under
load the 100ms scan-order touch after each dispatch timed out, and the
pass reported that as an error. The touch only affects scan order (the
rule's outcome is already committed and an unfinished rule stays a
candidate), so a failed touch is now logged at debug, not returned.
The tests also depended on wall-clock speed. The drain tests now run with
a generous budget, since they pin which rules a pass reaches; the slow
input test checks dispatch order (at most two slow inputs before the last
due check) instead of what fits in 1.5s. Without the input budget it
still fails, with all ten inputs ahead of the last due check.
Co-authored-by: multica-agent <[email protected]>
* fix(wakeups): scan every pending input group; warn when the scan is incomplete
Review follow-up on #9202. The pending scan read only the oldest 1000
groups, so a ready input behind a page of held groups left
oldest_ready_input_age_s empty, and a scan that hit its 1s timeout was
dropped without a trace; either way a stalled wakeup did not warn.
- ListPendingWakeupInputGroups is keyset-paged on (oldest, wakeup_id,
reserved); pendingInputs reads pages until a short one.
- The scan gets 3s. On an error or timeout the pass logs
pending_scan=incomplete with the error, at warn level, together with
the partial counts; a finished scan logs pending_scan=complete.
- A pass with dispatch failures also logs at warn level.
- Platform-rule target checks are cached per issue.
Co-authored-by: multica-agent <[email protected]>
---------
Co-authored-by: multica-agent <[email protected]>
Jagan Fulare