* feat(auth): allow JWT IP changes by configuration
* fix(auth): make JWT IP change setting concurrency-safe
* test(auth): move JWT IP change setting tests out of MCP test file
- Add State_GPU message to the proto with utilization and memory fields
- Add HostState.GPUs with conversion in both PB() and PB2State()
- Keep the existing gpu field populated so older agents keep working
Regenerated with protoc-gen-go v1.34.2 / protoc v5.29.3 to match the
existing files; nezha_grpc.pb.go is untouched since the service is
unchanged.
Closes#1217
* fix: prevent unbounded transfer history growth
* fix: preserve transfer history on alert load errors
* test: close transfer cleanup database
---------
Co-authored-by: naiba <hi@nai.ba>
* test: TDD regression tests for GHSA-jx78-55p5-rwv5 stream quota enforcement
* Apply remaining changes
* fix: update action SHA allowlist and test assertions to match dependabot bump
* fix: close GHSA-jx78-55p5-rwv5 incomplete fix of GHSA-qjpp-gffx-2wm9
Finding 1 (Moderate): nil-guard reporterServer in delayCheck and notifyCheck.
ServerShared has its own lock independent of serviceResponseDataStoreLock, so
m := ServerShared.GetList() taken inside the worker can return a nil entry for
the reporter if the server was concurrently deleted. Previously this caused an
unrecovered SIGSEGV in the worker goroutine (and in the gRPC layer with no
recovery interceptor), taking down the whole instance.
Finding 2 (Low): nil-guard ss.services[id] in ServiceSentinel.Delete().
A caller-supplied id that is absent from the registry caused
ss.services[id].CronJobID to panic, aborting the Delete loop and leaving every
subsequent valid id as a zombie service (DB row deleted, in-memory entry kept,
cron probe still running).
Regression tests added for both findings following the existing
servicesentinel_lifecycle_test.go patterns.
* Apply remaining changes
* chore: replace commit hashes with version tags in test.yml
* fix(server): serialize authoritative lifecycle changes
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* fix(service): bind reports to reporter lifecycle
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* fix(rpc): reject results from stale task streams
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
* fix(agentcompat): allow version-tagged actions
* fix(agentcompat): allow literal checkout refs
* refactor(agentcompat): remove SHA resolver policy
* test(agentcompat): remove resolver SHA fixtures
* test(agentcompat): remove mutable ref fixtures
* test(agentcompat): use tagged actions in secure fixtures
* test(agentcompat): update credential fixtures for tags
* test(agentcompat): update reusable action fixtures
* test(agentcompat): update artifact redaction fixtures
* test(agentcompat): finish artifact fixture tag migration
* test(agentcompat): update workflow validation fixtures
* test(agentcompat): update dependency workflow fixture
* ci(agentcompat): stop pinning cross-repository revisions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: naiba <hi@nai.ba>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
77-QiQi
naiba
github-actions[bot]
NikoCat233
Ryrenz
Weblate (bot)andace-consultoria
Chraandnaiba
Mubelotix
Kris
dependabot[bot]
