* fix(docker): create /app/data owned by the runtime user before dropping privileges
* docs(deployment): note one-time ownership repair for pre-existing data volumes
---------
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
When ACCESS_CODE is set, verification tokens (timestamp.HMAC) never expired
because neither verifier checked the timestamp, and POST /api/access-code/verify
had no attempt throttling.
- Enforce a 7-day token lifetime in a shared, Edge-safe module used by both the
Node verifier and the middleware Web-Crypto verifier, and reject non-canonical
signatures in both.
- Rate-limit verification only when the client identity is trusted
(TRUST_PROXY_HEADERS=true): a per-client sliding window (10 failures / 60s)
whose attempt is reserved atomically at check time, returning 429 with
Retry-After. Without a trusted proxy the app cannot attribute requests to a
client, so no shared throttle is applied — a long random ACCESS_CODE is the
protection, and a warning is logged when it is short.
- Store bounded, copied identity keys so a large forwarding header cannot retain
memory.
- Document the behavior in .env.example, README, and configuration docs.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
GHSA-p293-qw3h-jr36 (CVE-2026-75604, critical): unauthenticated RCE on Windows-hosted Next.js servers. Root was on 16.2.11 and packages/docs on 16.2.6 (affected: >=16.0 <16.3.3). Both lockfiles regenerated. eslint-config-next lint plugins left as-is (not the affected runtime package).
Co-authored-by: Aniruddha Adak <aniruddhaadak80@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
Why:
- The root Node 20.9 contract predates direct runtime dependencies whose declared minimums now reach Node 22.19.
- README, contributor, localized docs, and the OpenMAIC extension skill repeated the stale supported-version claim.
What:
- Raise the root Node minimum to 22.19 and align every operator, contributor, locale, and skill prerequisite.
- Add a check that compares the root minimum with installed direct production dependency engine minimums.
- Run the new contract check in CI after the frozen dependency install.
Risk:
- This changes the declared minimum only; no upper bound is added and Node 24 compatibility remains a separate concern.
- The localized docs build was validated with the independent #1306 boundary fix from PR #1307, which is not included here.
Tests:
- RED on the base: engine check reported pi-agent-core, pi-ai, svg-pathdata, and undici floors
- GREEN: root minimum 22.19 satisfies 35 engine-constrained direct dependencies
- Node 20 lockfile-only install reports the root unsupported-engine warning
- Node 22 frozen install and postinstall
- Docs build with PR #1307 boundary: 34 pages and all locale postexport checks; docs types:check
- Root Prettier, ESLint, TypeScript, i18n, package-version, and internal-dependency gates
- Root pnpm test: 7137 passed, 81 skipped
Live Docs:
- GitHub issue #1304 tracks the Node contract; #1306 / PR #1307 tracks the separate docs-build prerequisite.
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
Why:
- The docs Turbopack project walked up to the repository root and compiled the product middleware.
- The v1.0 middleware's product-only feature-flag alias made every current docs build fail before static export.
What:
- Resolve the absolute packages/docs directory from the Next config URL.
- Set that directory as the standalone docs app's Turbopack root.
Risk:
- The setting affects only the docs Turbopack project; root product middleware and aliases are unchanged.
- Webpack-specific behavior is unchanged because the docs workflow builds with Turbopack.
Tests:
- packages/docs pnpm build: 34 static pages and all locale postexport checks passed
- packages/docs pnpm types:check
- Root Prettier, ESLint, TypeScript, and i18n gates
- Root pnpm test: 7137 passed, 81 skipped
Live Docs:
- GitHub issue #1306 tracks the regression and build evidence.
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
* feat(ai): add Grok 4.6 to the model registry
The Grok picker still topped out at 4.5, so the new flagship ID was not selectable with its documented xhigh reasoning effort.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(docs): stop the docs Next app from loading app instrumentation
Next 16 discovers the repo-root instrumentation.ts from packages/docs, then fails because that file imports app persistence modules. Give the standalone docs app a no-op register() so the Grok catalog docs can build.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Refresh the Chinese documentation against current functionality, synchronize all localized guides, document deployment and configuration behavior, and align the PPTX import feature flag implementation.
* feat: support GPT-5.6 model family
* test: cover GPT-5.6 SDK validation
* fix: canonicalize GPT-5.6 Sol alias
* fix: complete GPT-5.6 alias lookups
---------
Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
* docs: add Fumadocs documentation site (packages/docs)
Static-exportable Fumadocs site for the OpenMAIC docs, served under /docs.
- 6 locales (en default + zh-CN/zh-TW/ja/ru/ar) with Arabic RTL
- English unprefixed (/docs/getting-started) to preserve legacy URLs;
other locales at /docs/<lang>/<slug>
- Orama static search compatible with `output: 'export'`
- Brand theming via CSS variables; "Live Demo" link back to open.maic.chat
Kept fully isolated from the main app so it does not affect its build or CI:
- excluded from the pnpm workspace (own lockfile, build and deploy)
- ignored in .prettierignore (own toolchain, like the other packages)
- excluded from the root tsconfig so the main app build does not type-check it
ESLint already ignores packages/**.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: add standalone docs build check
Validate that packages/docs still builds (next build + static export) on
PRs that touch it. Runs only on packages/docs changes; no secrets, no deploy.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* docs: address CR — CJK search, single-source locale config
- Fix Chinese/Japanese search: zh-CN/zh-TW use the mandarin tokenizer and ja
the japanese tokenizer (@orama/tokenizers) on both the build-time index and
the client query; the english whitespace tokenizer indexed CJK as one token.
- Add lib/locales.mjs as the single source for the locale list, default locale,
per-locale search tokenizer, RTL set, labels, and the /docs basePath; consume
it from i18n, the search index/dialog, next.config, and the postexport script
(was duplicated and drift-prone).
- Drop dead gitConfig.branch; fix the stale README route table; document the
English-nested-page limitation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
