chore(deps)(deps): bump undici from 7.25.0 to 7.28.0 in /server - #24
Open
dependabot[bot] wants to merge 233 commits into
Open
chore(deps)(deps): bump undici from 7.25.0 to 7.28.0 in /server#24dependabot[bot] wants to merge 233 commits into
dependabot[bot] wants to merge 233 commits into
Conversation
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.24.2 to 0.28.0. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.24.2...v0.28.0) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…esbuild-0.28.0 chore(deps)(deps-dev): bump esbuild from 0.24.2 to 0.28.0 in /server
Auto-built by .github/workflows/build.yml from src/.
- Add badges: License, Build status, CodeQL status, GitHub stars - Drop the duplicate architecture diagram (was two near-identical copies); keep the one that mentions CDP, and correct the storage label from "SQLite" to "file-based, <project>/.continuum/" - Update the Memory model section: the architecture moved to file-based storage in .continuum/ a few versions back; the README still claimed one-SQLite-file-per-project - Drop dead env vars (SUPER_TESTER_MEMORY_BACKEND, SUPER_TESTER_DB_PATH) and replace with the actual override (SUPER_TESTER_DATA_DIR) - Add Contributing + License footer linking to LICENSE, SECURITY.md, issues, discussions Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the v1 design for browser_upload_stage and browser_upload_file — two new browser MCP tools that bypass the native OS file picker via a strategy chain (direct setFileInputFiles → file-chooser intercept → drag-drop synthesis → paste synthesis) backed by content-addressed storage under .continuum/uploads/. Includes smart-wait, path allowlist, error taxonomy, and a five-fixture integration test plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
25-task TDD plan implementing the spec in docs/superpowers/specs/2026-05-19-browser-file-upload-design.md. Builds server-side uploads.js (stage, dedup, GC, undici URL fetch), extension/upload.js (4 strategies, smart wait, frame traversal), five fixture pages, and end-to-end integration runner. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds extension/upload.js as a statically-imported ES module (manifest already has "type": "module"). The module exposes handleUploadFile(params, clientId) which background.js calls from a new "upload_file" case in dispatch(). Helpers needed by upload.js (cdp, ensureAttached, getSession, targetTab) are mirrored onto globalThis from background.js to avoid a circular import. The strategy chain itself is stubbed in this commit — real strategies land in Tasks 14-17, smart wait in Task 18. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…earch) Adds resolveTargetNode + frame walking + auto-detect-from-anchor to upload.js. In this codebase `ref` is already a CSS selector (mochi snapshots emit selectors as the "ref" field), so target.ref routes through DOM.querySelector identically to target.selector — there is no separate ref->nodeId table to consult, and the plan's globalThis.refToNodeId hook is intentionally absent. autoDetectFromAnchor uses Runtime.callFunctionOn on the anchor's JS object to find a nearby <input type=file>: descendants first, then up to 5 following siblings, then ancestors' descendants up to 3 levels. If none match, the anchor itself is returned as a trigger element so the intercept strategy can click it later. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…/input events Replaces the runStrategy stub with a dispatch table (direct/intercept/drop/ paste) and implements strategyDirect: resolve target -> describe node -> verify it's <input type=file> -> DOM.setFileInputFiles -> dispatch change/input events via Runtime.callFunctionOn. Note: DOM.describeNode returns attributes as a flat [name, value, name, value, ...] array, not a map — iterating pairwise. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…rDialog + handleFileChooser Adds strategyIntercept and a transient CDP-event-listener fanout in background.js's chrome.debugger.onEvent handler. The fanout reads globalThis.__mochiCdpListeners — a Map upload.js populates per-call and cleans up in a finally block — so listeners never leak past their request. Intercept flow: enable Page.setInterceptFileChooserDialog -> register chooser-listener -> Input.dispatchMouseEvent at the trigger's center (real synthetic click required for the chooser to dispatch) -> on Page.fileChooserOpened call Page.handleFileChooser with our file paths -> wait up to 3s for the event -> always tear down the listener + disable intercept in finally. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds strategyDrop: requires fileBytes from the server (base64 + mime + name per file), then inside the page builds File objects from those bytes, stuffs them into a DataTransfer, dispatches dragenter -> dragover -> drop on the resolved target, and waits 500ms for a MutationObserver to observe at least one mutation as proof the page reacted. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds strategyPaste: like 'drop' but dispatches a ClipboardEvent('paste')
carrying a DataTransfer. The target is the resolved element when it's
content-editable or a text input; otherwise the call falls back to
document.activeElement (some chat composers swallow paste only on the
focused inner editor). Mutation observation as the success signal.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…istener)
Replaces the smartWait stub with a real implementation that polls three
parallel signals until one wins or the timeout expires:
1. network-2xx — a transient CDP listener watches Network.responseReceived
for 2xx responses whose URL matches an upload-ish pattern (configurable
via waitFor.networkPattern; default /upload|media|attach|photo/i).
2. preview-img — an in-page MutationObserver installed via Runtime.evaluate
watches for any element matching waitFor.previewSelector (default:
blob:/data: image+video sources).
3. successSelector — if provided, polled every 250ms via DOM.querySelector.
Returns { signal, durationMs, ... } on success, { signal: null, reason:
'timeout', evidence } on timeout. Cleans up the network listener entry and
the in-page observer in a finally block so neither leaks across waits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…n-depth) The scaffold in commit 354b7b9 already landed the basic .continuum/uploads/ substring check inside handleUploadFile. This commit completes Task 21 by hardening isPathAllowed against path-traversal: any '..' segment in the incoming path is rejected outright, even if the surrounding prefix would otherwise match. The server normalises paths before sending, so a '..' reaching the extension is suspicious enough to refuse. Documents the SUPER_TESTER_UPLOAD_ALLOW_PATHS extension point that lets the server widen the allowlist on a per-request basis without rebuilding the extension. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…on yet) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…jsonl Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ompact compaction counter (Task 17) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…eview-auto/flush/reset-id/purge); show===emit redact Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…/mochi:insights; register all three commands Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… bucketing, whitelist serializer) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… iid-drop + erasure Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add missing KEEP-path edge test for §13.4 iid-drop contract: assert that a recent event (ts within dedupWindowDays) retains its iid while a 30-day-old event in the same sweep has its iid stripped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add corrupt-line resilience test to _store.test.mjs, covering the deliberate try/catch fault-tolerance in readAllEvents and eraseIid against blank + truncated/corrupt JSONL lines (mirrors run-telemetry-log.mjs test #3 pattern). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fall back to current-day bucket (Date.now()) instead of epoch 0 when ts is absent or non-numeric in appendEvents. This prevents distillation records (which carry no ts field) from landing in 1970-01-01.jsonl where they would be immediately deleted by the first sweepRetention call. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ry + improvement backlog Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…/global token buckets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ped, all §13.8 views) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-limit), dashboard, summary, erasure, health Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wrap the http.createServer async handler body in a top-level try/catch so FS errors (ENOSPC, EACCES, ENOTDIR) from appendEvents, eraseIid, readAllEvents, aggregate, and renderDashboard are caught and returned as HTTP 500 responses instead of escaping as unhandled rejections that terminate the process. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…README; full node --test suite green Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…st in build.yml Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… (Task 31) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…e dashboard login Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…he production endpoint The hook subprocesses (session_end flush) can't have their fetch mocked, so with the real write-key baked in, the harness was POSTing session_close to the live ingest. emit now honors MOCHI_INGEST_URL; run-telemetry.sh points it at a dead local no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…cy critique + self-hosted dashboard Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…mochi-plugin # Conflicts: # .claude-plugin/plugin.json # CHANGELOG.md # server/package.json
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
DevZonayed
force-pushed
the
dependabot/npm_and_yarn/server/undici-7.28.0
branch
from
July 17, 2026 10:36
58c83dd to
194db5d
Compare
Contributor
Author
|
A newer version of undici exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
DevZonayed
force-pushed
the
dependabot/npm_and_yarn/server/undici-7.28.0
branch
3 times, most recently
from
August 8, 2026 04:59
8df1a52 to
f351f7e
Compare
DevZonayed
force-pushed
the
dependabot/npm_and_yarn/server/undici-7.28.0
branch
from
August 17, 2026 08:29
f351f7e to
cdc1bf6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps undici from 7.25.0 to 7.28.0.
Release notes
Sourced from undici's releases.
... (truncated)
Commits
f9eba0aBumped v7.28.0 (#5430)a027a4aBackport WebSocket maxPayloadSize fixes to v7.x (#5423)8cb10f9websocket: limit the number of fragments in a message04201f8fix: honor requestTls when proxy is SOCKS5fcd642ffix(socks5): preserve dispatch backpressure return value (#5166)bc98c97fix(socks5): use configured connector in Socks5ProxyAgent (#5168)9e1c743fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)376c8befix(socks5): enforce authenticated state before CONNECT (#5097)3805b8ffix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...85a2405fix(cache): trim qualified field namesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.