AuraBoot
Start free
English简体中文

AuraBoot v0.x

Generated from the commit history of the product repository, AuraBootTeam/auraboot.

There is no stable semver contract before 1.0 — treat 0.x as a moving target, and pin to a commit if you need reproducibility.

Read "Breaking changes" before you upgrade. It carries every feat!: commit and everything with a BREAKING CHANGE trailer.

Unreleased (0.x line)

2026-05-14 – 2026-07-13 · 1188 commits

Features

  • d66c66c4e faq — give the loop an entry point, and provenance for the reviewer (M2) (#1207)
  • 12ff2c9a8 meta — carry route context through workbench navigation (#1206)
  • ce6cb2829 rag — understand charts — vision ingestion for images, per-model vision gate (#1205)
  • 3b583409d rag — wire the DashScope embedding provider and report which retrieval path ran (#1203)
  • a423ec45c faq — conversation → FAQ loop (S3 M1) + S0 conversation pid (#1202)
  • c539ab95f rag — add a web page to a knowledge base by URL, behind SSRF validation (#1201)
  • baeaadcea rag — ingest PPTX/XLSX, parse through StorageProvider, reconcile stranded documents (#1199)
  • 33ebe1eda web — prefill fields in inline reference creation (#1198)
  • cb89e49b2 showcase — polish all-fields form + localize CascadeSelect placeholders (#1195)
  • e9540f50c web — add typed JSON form editor (#1190)
  • 315e65473 iot — render semantic evidence items
  • e2f26ead8 rule-center — seed automation consumer binding (#1185)
  • 880b76131 rbac — self-contained nightly/release runner for the platform-baseline golden (#1182)
  • 45fcf2b7f permission — evaluate Rule Center ABAC guards
  • 44e146d59 platform,web — dynamic-model soft delete + form save-disable/[object Object] fix + command loading overlay (#1176)
  • d4de3a0ea review-drawer — close fully instead of minimizing to a floating pill (#1164)
  • 51daae7c6 decisionops — wire Strategy Studio decision tables (#1169)
  • 8f267f015 decisionops — add runtime action catalog (#1166)
  • 638eaec37 decisionops — add fact catalog API (#1165)
  • 2116a88f6 decisionops — add reusable condition fragments (#1163)
  • e87d8aea7 rule-center — seed DRT decisions for workflow demo (#1161)
  • cf8d01b82 decisionops — connect strategy studio to runtime APIs (#1160)
  • 76f5a918e rule-center — surface strategy studio workbench
  • ca0a74f82 rbac — L1 implicit tenant_member baseline (fixes render-blocked business roles) (#1138)
  • 5e99740ca rbac — unify reference display-name at read layer (C1) + system-management capabilities (R5b) (#1104)
  • bbc148ee9 permission — organize v2 permission editor by menu sections (menu-view) (#1103)
  • e94a6ccfd permission — show menus each capability unlocks in v2 page (R6) (#1097)
  • 0f3654e5f org — capability-ize organization/role/permission/member management (R5) (#1096)
  • 89f060d11 web — support panel feedback for prompt uploads
  • f1539e877 org — move team CRUD to DSL (#1087)
  • 53ff77cc3 settings — move system preferences to DSL form
  • 9caae3a31 settings — rewrite account security policy as DSL
  • 3de6806c0 web — rewrite enterprise info as DSL page
  • a954b585c web — make reference selects searchable and creatable
  • 59d1e699c auth — close account organization password flows
  • 61048aa3a harden rule center BPM SLA entry flows
  • a11637c35 web-admin — support status pill table cells (#1071)
  • f62f955a3 cover quote bom customer project flow (#1069)
  • 7c715d622 harden RBAC data scope runtime
  • 07e030d4d harden rbac data scope runtime

…and 294 more — see the full diff on GitHub.

Fixes

  • 5fa51eefe quickstart — the documented onboarding could never have worked (#1208)
  • 317ccd295 web — support workbench action navigation (#1200)
  • b30e97fab org — drop redundant convention CRUD commands on team page buttons (#1197)
  • 6957eaef9 seed — make OSS showcase seed sequence green (CRM model rename + dual-id helper) (#1193)
  • ffe12c6df web — back off BOM price polling data sources
  • 72b807835 web — add json editor i18n resources (#1191)
  • b0c546761 rbac — revalidate sessions after permission changes (#1188)
  • b0394cf62 web — filter table row actions by permission
  • d0dbf0c03 workbench — preserve nested evidence context
  • 7ce9c21cc test — stabilize platform ut and integration suite
  • 44a030d42 meta — derive batchInsert columns from union of all rows (#1177)
  • 392190505 rbac — align BootstrapRepairService required roles with the retired operator/viewer model (#1175)
  • b59db3b39 decisionops — keep BPM usage refs per designer node
  • 854360b06 rule-center — harden s1 runtime routes (#1159)
  • cd2ed4549 workbench — reset candidate selection after filtering (#1158)
  • b75f2149a e2e — quoteops gate pattern actually runs the per-role suites (#1156)
  • 300f7764a e2e — invalid-BOM-upload golden asserts the real panel feedback (not a stale banner) (#1155)
  • f21a73ce9 rbac — permission cache eviction — publish change events, evict AFTER_COMMIT, never cache empty sets (#1154)
  • 51ed0ed0c rbac — disable anonymous A2A discovery (REG-3) + tenant_admin-only assignment (REG-5/6) (#1147)
  • 03df13fdd e2e — green the born-red Auth Regression gate (system_overview aggregate 400) (#1144)
  • 86e1e6f15 security — make quota reserve hard-limit atomic (close over-reserve TOCTOU) (#1151)
  • 6d6920ece security — DoS hardening — ReDoS time-bound + decompression-bomb limits (#1150)
  • edfcf7a70 security — close cross-tenant object-read via file-create key claim + export IDOR (#1148)
  • 46c93584e test — mock AuthContext in LlmProvidersPage i18n test (gated by #1084) (#1149)
  • b74c19f0a e2e — focused-menu permission matrix targets the current owner role model (#1146)
  • 91a1c88c8 rbac — track-1 tenant-scope + platform_admin guards (REG-2 / REG-7 / findDefaultRole) + ITs (#1133)
  • bb02c77b5 rbac — SELF data scope supports varchar/ULID owner columns (#1143)
  • 3c021fc02 security — secure-by-default profile — Docker safe fallback + test-profile warner (#1141)
  • c8c8f18bd security — validate email click-tracking redirect target (open redirect / header injection) (#1140)
  • 86bd62c89 security — enforce object-level authorization (IM membership, Role tenant, Notification owner) (#1139)
  • 1c3f0b05b security — fail closed on weak/missing BPM-signature & field-encryption keys (non-dev) (#1137)
  • a4f742a5c security — don't leak WeChat appSecret in connection-test error message (#1136)
  • 4242fece6 security — neutralize CSV formula injection in dynamic-data export (#1135)
  • 642fdfc1c security — green the controller-authz fail-open gate (behavior controllers) (#1134)
  • c63bd674e security — enforce SELECT-only guard on dashboard type:sql widgets (#1131)
  • 6c0046cbe security — close SpEL sandbox escape in BPM node-hook scripts (RCE) (#1130)
  • cbb158a42 authz — gate remaining tenant-level mutation endpoints (audit 2026-06-28) (#1109)
  • 9d9427e85 ci — green the auth-regression gate (start redis + don't crash on absent PCBA plugin) (#1110)
  • 9ea109ad2 e2e — pass targetRecordPid to bom:regenerate_export (numnan deploy returned 400 without it) (#1124)
  • 342b5627e e2e — non-null SAMPLE_BOM in readFileSync — fix web-admin typecheck (broke release build) (#1123)

…and 220 more — see the full diff on GitHub.

Performance

  • 24a3bb1fb platform — scope metadata and permission reads (#1192)

Plus 405 test, refactor and tooling commits, not listed here.

v0.1.0-beta.3

2026-05-10 – 2026-05-18 · 193 commits

Features

  • f8f3b7c16 plugin — expose ai provider accessor
  • dc3ae2c4f mobile — add showcase mobile UX profile import support
  • f76de520f showcase — add mobile ux profile config
  • 9d33965d4 im — support mobile AI member management
  • ca12a8d5d im — include agent names in handoff events
  • 076378666 im — add mobile AI group backend contracts
  • 4c5d569e4 pipeline — import dev pipeline packets
  • 173852c08 pipeline — expose dev pipeline import endpoint
  • d598b4151 pipeline — import dev pipeline packets
  • b4a9888bc ai — close PCBA quality agent runtime (#176)
  • 9a048c523 ai — close PCBA quality agent runtime
  • ab3b3c0db meta — preserve SoD entity pid aliases
  • d369cdac3 permission — add record share pid aliases
  • 804fa95c2 marketplace — add paid install workflow

Fixes

  • 2e3f1e5a8 initialize agent runtime gate plugins
  • 00bd6aaa3 split bootstrap from plugin import
  • ad9a02020 expose marketplace upgrade checks
  • 12017548f seed oss docker marketplace catalog
  • 1a288e18c avoid wget in ga frontend healthcheck
  • 907ad4cc7 use absolute web-admin path in isolated stack
  • 54266788a use runtime backend image for enterprise reset
  • 540d6a9f1 harden docker dependency install registry
  • b5ba7b692 stabilize docker pnpm bootstrap behind proxy
  • b90465ae8 stabilize oss docker bootstrap auth refresh
  • 64e1059e2 require tenant context for plugin import
  • 4de1242ee stabilize plugin import validation contracts
  • f5c9a2873 harden isolated reset plugin import
  • 0843a8104 harden GA docker reset bootstrap
  • a105f322e meta — stabilize page schema mapper queries
  • 6e08af169 forms — render localized button labels
  • 722dae68f plugins — namespace priority fields for clean imports
  • d5d5124f5 meta — serialize structured json values
  • ab823bf8a preserve plugin pid on command import
  • a635f046b restore CI gate scripts after branch merge
  • 51d6b2282 remove stale merge markers from aurabot api test
  • 795e34577 ai — require tools for evidence-first openai agents
  • 14c745c6c ai — validate llm cloud config secrets
  • 60dfadfa7 ui — render default saved view types
  • f17e299a5 pipeline — serialize import json fields
  • 4f79fa5b5 resolve CodeQL security findings (#177)
  • 0f25f5eeb pipeline — wire importer service constructor
  • bbe87933a resolve CodeQL security findings
  • ce518f89c security — annotate stateless API CodeQL suppressions
  • 771ad4695 security — use CodeQL suppression ids
  • 1bc796e20 security — document CodeQL-safe stateless API paths
  • 072efd2f5 security — document CodeQL-safe stateless API paths
  • 9b84d34a5 agent — harden replay result contracts and isolated gate (#165)
  • 1a3d85fcc mobile — hide audit fields from search hits
  • 08b67ecd7 mobile — add oss mobile search endpoint
  • f445f72da im — route mobile group chat sends to agents
  • 409866b59 mobile — hide audit fields from search hits
  • f5394cc06 mobile — add oss mobile search endpoint
  • c72942eb0 agent — harden replay result contracts and isolated gate
  • 82d2bd624 im — route mobile group chat sends to agents

…and 3 more — see the full diff on GitHub.

Plus 67 test, refactor and tooling commits, not listed here.

v0.1.0-beta.2

2026-05-11 – 2026-05-11 · 34 commits

Features

  • 550d77e1e agent — unify runtime execution and replay audit

Fixes

  • 11fa79b16 isolate PF4J plugin directory in Docker quickstart
  • 21527c431 ci — align isolated env contracts
  • 07ec2c21e bootstrap — align startup and e2e contracts
  • fd5fc4324 dashboard — stabilize OSS CRM seed dashboard

Plus 16 test, refactor and tooling commits, not listed here.

v0.1.0-beta.1

2026-03-26 – 2026-05-11 · 1611 commits

⚠️ Breaking changes

Read this before you upgrade.

  • a01e205e1 PR template + brand assets capture spec
  • e8d3ec39e conv-turn — DC.4-OSS retire SSE transport, unify on ImMessageBroadcaster WS
  • d4328a49e conv-turn — D.3-chokepoint design v2 — lock 5 decisions + Q-DC.4 correction
  • 8eb0000d6 usp — audit admin list+stats access alongside forget (GDPR paper trail)
  • f5c2cb080 usp — extract UserSoulProfileStatus enum + migrate DB values to lowercase
  • a9e3b9580 remove legacy ApprovalChainExecutor + ab_approval_task
  • ef8a79a82 bpm — remove legacy ApprovalChainExecutor + ab_approval_task

Features

  • 042b3ff22 platform — 7 generic dashboard extensions (i18n, sanitizer, widget props) (#87)
  • 9fd286440 demo — DemoModeGuard + container image build pipeline
  • 229e81b95 platform — Phase 3 Op6+Op8 — BuiltinPluginImportService 2-profile + script §7.5 trim (#105)
  • 6f476eef0 platform — bootstrap admin endpoint + 9-invariant contract (Phase 2.4) (#104)
  • 07417c5cd platform — unify startup runners into BootstrapStartupRunner (Phase 2.3 of bootstrap-unified) (#103)
  • 01f354ed4 platform — extract BootstrapRepairService (Phase 2.2 of bootstrap-unified) (#102)
  • 04a953946 platform — add IT scaffolding (Phase 2.1 of bootstrap-unified plan) (#100)
  • 30a2b7585 agent — add GET /api/agent/tools/registry, remove no-op /tools/sync (#111)
  • 236a90a43 cli — add --dir and --non-interactive flags to aura plugin init (#107)
  • d757279c4 tests — env-scripts-testing v3 — Phase 1 + 1.5 + 3-partial (#99)
  • 39562358b agent — stub LlmProvider for E2E without real API key (#98)
  • f284802a4 connector-sdk — protocol-agnostic SDK + JDBC reference connector (#97)
  • 5094399dc aurabot-skill — SPI surface scaffold (Step 1 of C-2 plan)
  • 4e9fdaba6 aurabot — mount V3 shell in root.tsx — global provider + toggle + panel
  • 0285d93f4 aurabot — scaffold V3 shell — provider/panel/toggle + 9 envelopes + SPI client
  • 1eaec7154 smart-kanban — swap PointerSensor → MouseSensor when AURA_E2E_MODE flag is set
  • 4582d8000 smart-view — thread pageKey to kanban + preserve dashboard widget shorthand
  • 6000f3685 view — expose groupByDictCode and terminalStages on kanban ViewConfig
  • 3fc694551 smart-table-chart — consume widget config columns + i18n labels
  • b35697046 smart-kanban — derive columns from dict enum for full stage visibility
  • d02d3f3a7 meta-cmd — add default_value autoSet strategy that yields to payload
  • 04ab38750 auth — JwtAuthenticationFilter populates MetaContext role ids (M-090 CFG-001)
  • 005318fd1 rbac — RoleMapper.findPrioritiesByIds batch lookup (M-090 CFG-001)
  • 7f87db1f0 meta-context — getCurrentRoleIds + 5-arg setContext overload (M-090 CFG-001)
  • 2da84325c mobile-config — subject_type+subject_id scope columns + CHECK + index (M-090 CFG-001)
  • eec155ce7 crm-starter — add lightweight CRM overview dashboard
  • 1e8df2d14 crm-starter — add Pipeline Board + Lead Board kanban saved views
  • 1274b141f mobile-log — composite index on (category, client_timestamp DESC) (M-090 OPS-002)
  • b682a8681 ui/meta — fieldConfigSchemas with schema-driven definition
  • 3d41f57d5 shared/designer — handle 'dict-select' PropertyType in PropertyFieldRenderer
  • b05826f8b shared/designer — handle 'array' PropertyType in PropertyFieldRenderer
  • 4eb7237d5 shared/designer — ArrayItemEditor for the new 'array' PropertyType
  • aa77da1d1 shared/designer — extend PropertySchema with array, dict-select, and TLabel group
  • 20985527f smart-kanban — visual treatment for won/lost terminal cards
  • 42645928f perm-validator — add --oss=<path> and --enterprise=<path> flags
  • 9d4234d9b smart-kanban — add currency/avatar/progress/date-relative card field renderers
  • 2aea3d79d p1demo — ai-fill-banner DSL block + DslFormFillContext (P1' Stage C)
  • 60eec08f1 smart-kanban — inject dict color/terminal into column header
  • 8e6cb6ce0 perm — rename Java constants + bootstrap registrations + strict-mode CI (Phase 2/3/6)
  • 62ecf8a47 p1demo — wd_leave_request AI fill + safety check + annotation read (P1' Stage B)

…and 356 more — see the full diff on GitHub.

Fixes

  • 359d8ae63 web-admin — widen workspace admin pages
  • f59a336c7 meta — canonicalize page DSL contracts
  • aa15704e6 entitlement — add core probe API
  • b767c627a avoid i18n cache hydration mismatch
  • 038525b69 harden bootstrap auth and page layout
  • df6e75e51 quickstart — correct smoke endpoints — /api/menu and /api/permissions roots return 500/403 (#138)
  • 057c2db2d bff — hand non-API routes to react-router SSR — replace placeholder SPA fallback
  • 8c3a8bc4c deps — pin react-router family back to 7.5.0 — 7.15 drops unstable_createContext
  • 708d84546 plugin — builtin import — reorder core profile + register meta.changelog.read
  • cfa1cac2d tests — dedupe BASE_URL in member-* specs — unblock smoke collection
  • e9333a428 deps — bump react-router suite to 7.15.0 lockstep + migrate unstable_* APIs
  • 4d5e17747 deps — regenerate pnpm-lock.yaml — sync with 6 dependabot package.json bumps
  • 486477a6d docker — set SESSION_SECRET in compose frontend service — unblock BFF startup
  • 7739d2c70 docker — platform Dockerfile JDK 25 → 21 — match toolchain + Gradle 8.13
  • 7b61b9461 docs — pass-7 follow-through — credentials + actual profile usage
  • 7cb115b2d launch — review-pass 7 — README terminology + sync rule order + 1.0 honesty
  • 837ab7bf7 cla — trivial-fix exemption — drop char-count threshold
  • 438999e02 ci — codeql manual build for platform/ + gitee mirror plain --force
  • 65f9031b9 launch — review-pass 4 — DemoModeGuard real paths + CodeQL + SECURITY honesty
  • 6f174b997 oss-e2e — unblock OSS docker E2E baseline — 240→<35 fail across 24 commits (#114)
  • 1fa0541a7 launch — review-pass 3 — NOTICE accuracy + prereq alignment + issue-template URLs
  • 0718de0a6 launch — review-pass 2 — self-audit follow-through
  • 1b467c5de launch — review-pass 1 — license terminology, factual accuracy, broken gates
  • 3811007ff web — map HttpMessageNotReadableException to HTTP 400 instead of 500 (#110)
  • 8aff4e5a2 aurabot — correctly hold back partial <think> open tag in OpenAI stream filter (#108)
  • 3f2148424 e2e — showcase + marketplace cluster — tab ARIA + seed transitions (~29 specs) (#109)
  • a15b90865 meta — tag auto-created stub pages so plugin import overwrites them (#106)
  • 195f3f709 e2e — saved-view + finance cluster — unblock ~50 specs (#101)
  • f5afe1601 e2e — mcp-cursor-demo spec — install missing SDK dep + ESM __dirname compat (#96)
  • 8cbdbd5be saved-view+dsl-registry — add data-testid sidebar + register ai-fill-banner block
  • 951695aa1 aurabot-skill — controller + chat executor use ObjectProvider for redis stores (4/4)
  • 2751af07d aurabot-skill — SkillRequestValidator uses ObjectProvider for stores (3/4)
  • f415eaf0c aurabot-skill — make SkillIdempotencyStore conditional on redis (2/4)
  • ec531dc98 aurabot-skill — make PreviewTokenStore conditional on redis (1/4)
  • beb819ffb test — re-add redis config (file got reverted)
  • 44eb4d9bf p1 — replace error: '&lt;Chinese&gt;' with English in user-facing responses (#93)
  • 54e952c49 p0 — batch fixes from 2026-05-08 deep review (#89)
  • 11bb371b5 p1 — low-risk cleanup batch from 2026-05-08 deep review (#90)
  • 01646b9be p1 — validator scans rolePermissionBindings + plugin roles.json (#91)
  • d2e3b3f6f acp — register default-bootstrap.json to bind tenant_admin to ACP perms (F-1 P1)

…and 334 more — see the full diff on GitHub.

Performance

  • 9d37b64ad notification — @Async NotificationRouter event handlers
  • 91c993620 agent — pgvector-indexed cluster shortlist + dedup batch + dim validation + content normalisation (PR-74)
  • ff8ecc517 D5 — add PostgreSQL tuning config for development
  • 150ee05c7 B7 — add keyset (cursor-based) pagination for dynamic list API
  • 4a366bd22 phase3 — cache warmup, HikariCP tuning, async audit log
  • 586e3653d n+1 — batch-load BindingRules and add Caffeine caches for command metadata
  • c17b770b9 db — add composite indexes for ab_binding_rule and ab_role
  • cad367cc7 merge phase2a - HTTP compression
  • 60a348fa0 backend — enable HTTP response compression for JSON/HTML/CSS/JS

Plus 534 test, refactor and tooling commits, not listed here.