Merge 17 open PRs (with conflict resolution + dep alignment)#32

Closed

adm01-debug wants to merge 155 commits into

mainfrom

claude/resolve-pr-conflicts-BcZ8Q

Commits on Apr 26, 2026

:arrow_up: ci: Bump actions/setup-node from 4 to 6
dependabot[bot]
authored
:arrow_up: ci: Bump actions/checkout from 4 to 6
dependabot[bot]
authored
fix(evolution): suprime LOGOUT_INSTANCE falso após stream:error 515 (#2498)
claude
committed
feat(evolution-health): auto-restart em 'deaf session' (Baileys#2491)
claude
committed
feat(evolution): set-settings envia sessionPhoneVersion (anti-ban #2437/#2497)
claude
committed
feat(ui): syncFullHistory admin-only com aviso de risco (#2437)
claude
committed
fix(evolution): archive-chat curto-circuita 503 ARCHIVE_CHAT_UPSTREAM_DOWN
claude
committed
feat(evolution): adiciona STATUS_INSTANCE/LOGOUT_INSTANCE/NEW_JWT_TOKEN/MESSAGING_HISTORY_SET
claude
committed
fix(evolution-health): AbortSignal.timeout em todos os fetch upstream
claude
committed
feat(evolution): handler NEW_JWT_TOKEN como sinal de saúde Baileys 7
claude
committed
test(evolution-webhook): atualiza contrato 27→29 (status.instance + messaging.history.set)
claude
committed
fix(tests): destrava CI — vitest agora roda 240/240 verde
claude
committed
fix(lint): destrava ESLint nos arquivos tocados no PR
claude
committed
chore(mcp): registra servidores MCP do Portainer e Evolution
claude
committed
fix(evolution): aplica feedback do CodeRabbit no PR #23
claude
committed
fix(test): vitest fallback de SUPABASE env trata string vazia também
claude
committed
fix(e2e): test #3 do dlq-idempotency usa authTest, não test
claude
committed
fix(test): vitest CI usa singleFork + retry para mitigar flakiness
claude
committed
docs(baileys): production hardening audit + gaps + applied mitigations
claude
committed

Commits on Apr 27, 2026

docs(reference): add canonical Baileys + Evolution API reference (1835 lines)
claude
committed
feat(webhook): body size guard, replay protection, idempotency cleanup cron
claude
committed
fix(webhook): redact JID + drop raw content from message handler error logs
claude
committed
feat(safe-send): per-JID throttle + humanized delay anti-ban primitives
claude
committed
feat(disconnect-reason): map Baileys codes to severity-tagged labels
claude
committed
docs(baileys): document webhook hardening + safe-send + disconnect-reason
claude
committed
feat(evolution-api): wire safe-send per-JID throttle + presence sim into pipeline
claude
committed
feat(db): version-control Baileys observability tables + admin RPCs
claude
committed
feat(admin): Baileys health dashboard - error patterns + WA version drift
claude
committed
feat(observability): Sentry forwarder + wire into webhook handler errors
claude
committed
docs(baileys): document pipeline integration + Sentry + Baileys health panel
claude
committed
fix(test): apply leakSafeOpts to maybeSimulatePresence tests
claude
committed
refactor(sentry): extract DSN parser to named function
claude
committed
ci(deno): pre-cache deps with retry loop to defeat registry flakes
claude
committed
revert(ci): remove pre-cache step (did not help, restore minimal config)
claude
committed
ci(deno): split test command per directory for diagnostic visibility
claude
committed
fix(evolution-api): unbreak send-media/send-audio source-extraction tests
claude
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Changes

lovable-dev[bot]
and
adm01-debug
committed
Preservou state do player no replay

lovable-dev[bot]
and
adm01-debug
committed
fix(security): restrict CORS origins for proxy observability endpoints
adm01-debug
committed
fix(security): remove wildcard cors from proxy observability functions
adm01-debug
committed
Merge PR #8: ci: Bump actions/setup-node from 4 to 6
Claude Code
committed
Merge PR #9: ci: Bump actions/checkout from 4 to 6
Claude Code
committed
:arrow_up: ci: bump actions/upload-artifact from 4 to 7

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: Bump the minor-and-patch group across 1 directory with 2 updates

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: bump react-day-picker from 8.10.1 to 9.14.0

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: Bump @types/react-dom from 18.3.7 to 19.2.3

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: bump zod from 3.25.76 to 4.3.6

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: bump vaul from 0.9.9 to 1.1.2

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: Bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: bump react-i18next from 16.6.6 to 17.0.2

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: Bump eslint from 9.39.4 to 10.2.1

dependabot[bot]
authored and
Claude Code
committed
:arrow_up: deps: bump @hello-pangea/dnd from 17.0.0 to 18.0.1

dependabot[bot]
authored and
Claude Code
committed
Merge PR #23: fix(evolution): 8 mitigações para Baileys 7 / Evolution v2.3.7
Claude Code
committed
Merge PR #26: Webhook hardening + anti-ban + disconnect-reason mapping
Claude Code
committed
Merge PR #28: Add configurable CORS handling to proxy-metrics and proxy-health functions
Claude Code
committed
Remove unused ALLOWED_ORIGINS in proxy-metrics (centralized via _shared/validation)
Claude Code
committed
Merge PR #29: Centralize CORS headers and response header builders for proxy endpoints
Claude Code
committed
Merge PR #30: Lovable sync 1777290333
Claude Code
committed
fix(deps): align peer deps for react-i18next 17 and revert @types/react-dom
Claude Code
committed
fix(lint): resolve eslint v10 / react-hooks v7 errors
Claude Code
committed
style(test): align validation header tests with repo conventions
adm01-debug
committed
fix(test): align MessageStatus.played test label with component (Reproduzido -> Reproduzida)
Claude Code
committed
fix(test): swallow finally chain rejection and skip 5xx in anon hardening
Claude Code
committed
chore(test): migrate vitest 4 poolOptions and centralize 5xx skip
Claude Code
committed
fix(test): defense-in-depth for partial Supabase degradation
Claude Code
committed
test(security): gate live anon-hardening behind RUN_LIVE_HARDENING_TESTS
Claude Code
committed
ci(test): surface vitest output as artifact + bail on first failure
Claude Code
committed
ci(test): also print vitest tail in the job log on failure
Claude Code
committed
ci(test): post vitest tail as PR comment on failure (read-only friendly)
Claude Code
committed
ci: grant pull-requests:write so the failure-comment step can post
Claude Code
committed
:arrow_up: ci: bump denoland/setup-deno from 1 to 2
dependabot[bot]
authored
:arrow_up: ci: bump actions/download-artifact from 4 to 8
dependabot[bot]
authored
Merge origin/main into umbrella PR; gate new RLS live test
Claude Code
committed
fix(lint): replace any-casts in rlsCriticalEndpoints test with structural types
Claude Code
committed
Merge PR #35: ci: bump actions/download-artifact from 4 to 8
Claude Code
committed
Merge PR #34: ci: bump denoland/setup-deno from 1 to 2
Claude Code
committed
Merge PR #33: Use shared CORS headers and deduplicate Access-Control-Allow-Headers
Claude Code
committed
fix: address Copilot + Codex review comments on #32
Claude Code
committed
test(scenarios): comprehensive day-to-day coverage of PR#32 implementation
claude
committed
fix: address CodeRabbit + Codex 2nd review wave (16 inline + 4 outside-diff)
Claude Code
committed
test(deno): update disconnect-reason scenarios for 405→403 + safe-send no-bypass
Claude Code
committed
fix(webhook): replay timestamp gate — accept legitimate Evolution retries
Claude Code
committed
fix: address Codex P2 round 3 (jwt event subscription + url inheritance)
Claude Code
committed
fix: address Codex P2 round 4 (per-jid env validation + status_updated_at)
Claude Code
committed
feat(db): S4 _swarm_guardian_events audit table + admin RPC
claude
committed
feat(sidecar): swarm-task-guardian — duplicate-task detection + auto-kill
claude
committed
test(guardian): 7 scenarios for orphan-identification decision logic
claude
committed
docs(baileys): swarm-task-guardian design + deployment + service hardening
claude
committed
fix: address CodeRabbit + Codex review wave 5
Claude Code
committed
fix: address PR #32 critical review threads (zod v4, day-picker, authz)
claude
committed
fix: critical refetch-wipe + ceiling-storm + ci.yml hardening
Claude Code
committed
fix(webhook): stream body cap (Content-Length is bypassable)
Claude Code
committed
fix: streaming body cap test alignment + S5 deaf-session restart lock
Claude Code
committed
feat(sentry): redact PII before forwarding to third-party SaaS
Claude Code
committed
perf(migration): composite index for rpc_wa_version_drift
Claude Code
committed
test(webhook): align HMAC contract test with the inline-verify refactor
Claude Code
committed
docs(baileys-ref): refresh 27→29 events + redact remaining PII
Claude Code
committed
fix(webhook): HMAC P1 + STRICT_MODE regression + safe-send caller budget
Claude Code
committed
test(webhook): align scenario/contract tests with new HMAC structure
Claude Code
committed
fix(health): correct dispatch_error_logs column names in strong-signal probe
Claude Code
committed
fix: CodeRabbit wave — 7 real bugs + 1 test hardening
Claude Code
committed
fix(evolution-api): preserve syncFullHistory + reject blank PER_JID env
Claude Code
committed
fix: chat-switch state reset + webhook delete error check (Codex P1+P2)
Claude Code
committed
fix(reconcile): include retrying in STATUS_RANK so it can't be downgraded
Claude Code
committed
fix(s5): persist acquired bucket end-to-end (Codex P2 race)
Claude Code
committed
chore(claude): disable MCP auto-enable in shared settings
claude
committed
fix: CodeRabbit wave — chat-switch race + 5 quality fixes
Claude Code
committed
feat(baileys): 10 hardening improvements (B1-B10) post analysis
claude
committed
fix: Codex P1+P2 — gate DLQ summary RPC + reject blank webhook env vars
Claude Code
committed
feat(baileys): zombie-state blindage Z1-Z6
claude
committed
feat(baileys): continuous-improvement wave (CT1-CT3, CT6)
claude
committed
fix: Codex P1+P2 — gate sidecar heartbeat RPC + allow dlq_enqueued audit
Claude Code
committed
feat(admin): expose B7/Z1/Z6 observability in Baileys Health page (CT5)
claude
committed
fix: Codex P1+P2 — surface PostgREST errors in probe + DLQ replay
Claude Code
committed
fix: Codex P1+P2x2 — probe alert dedup, z1 admin RLS, heartbeat error check
Claude Code
committed
fix: surface JSON parse failures + cap message length (audit follow-up)
claude
committed
fix: Codex P1+P2 — DLQ replay loop guard + don't double-count attempts
Claude Code
committed
fix: Codex P2x2 — gate presence budget by action + check audit RPC error
Claude Code
committed
fix: Codex P2x2 — blank-as-unset in parseMsEnv + scope probe dedup to exact instance
Claude Code
committed
fix: Codex P2x2 — blank Sentry sample rate + probe alert error check
Claude Code
committed

Commits on Apr 28, 2026