Repository navigation
Sync iaser-ai/ansari develop (c3f32fc1) into MachineWisdomAI develop - #16
Merged
Merged
Conversation
…e as apps/whatsapp
…uff, test signature rejection
…through apps/auth and call apps/api with their JWT
…ed on expiry, serialized per user
…ng thread id, document lock scope
…ream, add WA_MAINTENANCE_MODE, remove the per-user lock
…uest_id only, Sentry for thread/auth failures, PORT, Dockerfile uv pin
…Es, deployment notes, staging smoke test
…root Dockerfile paths, plan outcome
…ns against a real apps/api; record real-service run
…erify token; keep tests independent of local MOCK_AUTH_TOKEN
…ID in .env.example
Defines the requirements, native module constraints (expo-apple-authentication and @react-native-google-signin/google-signin), Better Auth ID token verification contract, and two-token protocol parity for issue iaser-ai#324.
…n-in Updates spec 324 to adopt react-native-nitro-google-signin powered by Nitro Modules (Android Credential Manager & native iOS SDK) in place of @react-native-google-signin/google-signin.
…open items and PR notes in the plan
…ment 2); 0001 regenerated as 0001_api_key; better-auth model test; phone_number accepted and ignored
…ENT, gemini skipped)
…8 and owner amendment 2
…MENT), PR body Sentry wording corrected
… coverage, U2 scan positive control and pinned sign-up behaviour, doc nits, optional shapes)
…s the Dockerfile
Railway refuses --mount=type=cache without an id tied to its own service id
('flag --mount=type=cache,target=/root/.cache/uv is missing an id argument').
Copy pyproject.toml and uv.lock before the dependency sync instead of
bind-mounting them; Docker's layer cache still skips the sync when only src/
changes.
…-railway fix(whatsapp): Dockerfile builds on Railway (no BuildKit cache mounts)
…merge precondition met
…hatsApp token exchange (spec 329) Service API keys through @better-auth/api-key, issued only by apps/auth/scripts/service-keys.ts, and POST /api/whatsapp/session, which exchanges a whatsapp:mint key and a BSUID for the standard 15-minute JWT, only ever for a WhatsApp user. No phone number is stored (owner amendment 2). Migration 0001_api_key was applied to staging before this merge; production gets the whole auth journal at its cutover.
wa_ becomes ansari_wa_ and amcp_ becomes ansari_mcp_, so every Ansari key names its issuer as well as its service (as sk-ant-, ghp_ do), and the secret-scanning patterns are less likely to collide with other issuers' tokens. A test now requires every prefix to be ansari_<service>_, unique, and not the start of another.
…the old scanning pattern until they are revoked
feat(auth): namespace service key prefixes as ansari_<service>_
Regenerated with `uv lock --upgrade` under uv 0.9.13, the line that wrote the lock and that the Dockerfile and CI pin; `revision = 3` is unchanged. Every range in pyproject.toml is open, so no manifest change is needed. The one alert that mattered for the deployed image is certifi: the locked 2025.1.31 bundle still trusted the emSign root whose intermediate keys were compromised, and certifi is the trust store for every httpx call the service makes to Meta, apps/auth and apps/api. It is now 2026.10.23. Also moved: anyio 4.9.0 -> 4.15.1, urllib3 2.5.0 -> 2.8.0, starlette 0.46.2 -> 1.7.0 (fastapi 0.115.12 -> 0.162.0), python-multipart 0.0.20 -> 0.0.32, requests, idna, python-dotenv, pytest, pygments, sentry-sdk, pydantic, uvicorn. Not moved: dnspython 2.8.0. Its patched 2.9.x requires Python >= 3.11 and the project declares >= 3.10, so a universal lock cannot take it. It is dev-only (email-validator via fastapi[standard]) and not in the image.
certifi is not a direct dependency (it arrives through httpx and requests), so after the lock refresh nothing in the manifest forbade a future resolve from going back below the emSign fix. `[tool.uv] constraint-dependencies` floors it without making it a direct dependency; uv.lock records the constraint in its [manifest] block and the resolved set is unchanged. Negative test: with the floor raised above the pinned version, `uv lock --check` exits 1; restored, it exits 0.
chore(whatsapp): refresh uv.lock to clear the open Dependabot alerts
Brings upstream's 260 commits in. pnpm-lock.yaml was the only conflict: it starts from upstream's lockfile and is regenerated with pnpm install --lockfile-only, so the only changes against upstream are apps/mcp's dependency tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
yia-mw-agent
approved these changes
Nov 5, 2026
yia-mw-agent
left a comment
yia-mw-agent
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the full merge-base-to-head diff (base develop 853aee9, head 510c9a9). No material defects.
Helmet-Review-Request: #16 (comment)
What I checked:
- The merge result matches iaser-ai/ansari develop c3f32fc everywhere except apps/mcp, pnpm-lock.yaml and pnpm-workspace.yaml. Outside those paths, no file differs from upstream.
- apps/mcp is byte-identical to the fork's base develop, so the merge does not alter the MCP work.
- pnpm-workspace.yaml: the only addition against upstream is the dompurify and @hono/node-server overrides. Only apps/mcp declares hono, @hono/node-server or dompurify, so the overrides cannot reach the api, auth or frontend apps.
- pnpm-lock.yaml against upstream changes only the MCP dependency tree (@saga-a2ui/* 1.0.x, @modelcontextprotocol/* 2.4.0, hono 4.13.16, @hono/node-server 2.1.5, dompurify 3.4.17). The PR description's account of this is accurate.
- Run locally at the exact head:
pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp...passes; apps/mcp lint, typecheck and tests pass (146 of 146);pnpm check:release --target productionpasses (registry verification of the five @saga-a2ui packages). - CI on this head passes: MCP application, api, auth, frontend, gitleaks, whatsapp. I did not rerun the 78 browser checks or the api, auth and frontend suites locally; CI covers them.
Non-blocking: none.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings upstream iaser-ai/ansari
develop(c3f32fc, 260 commits) into this fork'sdevelop. After the merge, a PR from here to upstream contains only the Ansari MCP work.Conflict
pnpm-lock.yamlwas the only conflict. It starts from upstream's lockfile and is regenerated withpnpm install --lockfile-only. Compared with upstream, it changes onlyapps/mcp's dependency tree:@saga-a2ui/*1.0.x;@modelcontextprotocol/*2.4.0;hono4.13.16,@hono/node-server2.1.5 anddompurify3.4.17.Verification
pnpm install --frozen-lockfile --strict-peer-dependencies --filter ansari-mcp...succeeds.pnpm mcp verifypasses: lint, typecheck, 146 tests and 78 browser checks.bash apps/mcp/scripts/verify-container.shpasses.pnpm check:release --target productionpasses.🤖 Generated with Claude Code