Conversation
The April 2026 security update bumped swagger-ui 4.15.5 -> ^5.32.2 without migrating df-api-docs.component.ts to the v5 calling convention. v5 introduced breaking changes in bundle layout and internal call paths, causing every service's API docs to throw "TypeError: o is not a function" from inside the swagger-ui bundle. Pinning back to 4.15.5 restores the working UI as a stopgap. The patched DOMPurify XSS / Handlebars JS injection CVEs return — low practical risk for the admin UI (specs come from trusted backends), but a proper v5 migration is still owed. Rebuilt dist/ artifacts included.
The API Builder nav entries and breadcrumbs rendered raw transloco keys (nav.api-builder.nav, nav.api-connections.api-types.api-builder.*, and the missing api-types.header). Add the strings to en.json (source + runtime dist copy). Translations are runtime-loaded JSON, so no JS rebuild is required.
Major rework of the API Builder admin UI (df-api-builder.component.ts):
UX:
- Replace the cramped 2-column workbench with a Swagger-style master-detail:
API settings card (title, /api/v2/{base_path}, status, Save/Docs/Delete) +
a method-colored endpoint accordion. Click a row to edit inline; Add Endpoint
opens a new draft. Collapsed by default.
- Surface Endpoint Name/URL as primary fields; preserve user-entered identity
(don't overwrite path/label/description once edited).
- Autocomplete source-API/table pickers; hide non-data service types from the
source list; focus-to-show-full-list with deferred blur restore.
Behavior fixes:
- Preview/Test now execute (send dry_run:false + snake_case path_params); the
Test runner response is shown verbatim.
- Re-introspect the source when loading a saved endpoint so Fields/Relationships
render with saved selections (safe now that the CD-hang is fixed via trackBy).
- "Save the API first" hint when no API is saved yet.
Field/relationship renaming (output aliases):
- Per-field/relationship rename inputs -> flat alias map on the execution-plan
step; backend applies a key-remap on fetched rows.
camelCase interceptor safety (shared utilities):
- case.ts: treat execution_plan/response_mapping VALUES as verbatim blobs (their
inner keys are real field names + user aliases) — transform the envelope key
only, both directions. Same pattern as the existing requestBody exclusion.
- case.interceptor.ts: skip response transform for /api_builder/test so the
preview shows the real output keys the deployed endpoint returns.
- Add regression tests; existing case tests still pass.
Includes rebuilt dist/.
…ship builder) Workspace/relationship panel on the custom-API editor: pick backing services for the API and author cross-service relationships, with a live preview and per-type help text. Endpoint source picker is scoped to the API's workspace and refreshes live when it changes. camelCase interceptor support for API Builder fields (case.ts). Rebuilt production dist.
…ervice_request + transform recipe)
Self-contained adf-agents component (mirrors adf-alerts): agent CRUD with role + key TTL and revoke, approve/deny pending access requests, and an activity view (last-active + recent agent alerts). Top-level 'agents' route + nav label. Includes rebuilt dist. Claude-Session: https://claude.ai/code/session_01TAqkbJ6Wpa9CX2sydcFeZu
…eguard The global caseInterceptor converts /api responses to camelCase; the component read snake_case so every field was undefined (toggle stuck off, blank cells, edits not persisting). Rewrote to camelCase (alerts log stays snake — /_internal is not under /api). Toggle now reverts to server truth on error. Rebuilt dist. Claude-Session: https://claude.ai/code/session_01TAqkbJ6Wpa9CX2sydcFeZu
Drive the AI chat and AI Connections UIs off theme tokens instead of hardcoded white text, so they are legible in light mode. Dark mode is unchanged: the dark token values reproduce the original whites. - AI chat: theme tokens for messages, tool-result cards, session list, and the chat shell; show the tool CALL (name + arguments), not just the result; move "Act as role" beside New chat; tighten height so the input stays in view. - AI chat config: MCP servers + data services as selectable pickers. - AI Connections config: theme tokens for allowed-roles, model-picker, and test-connection; fix df-role-scope wildcard callout. - Hide API Builder / Alerts / Agents from the left nav (routes intact). - Drop em-dashes from shipped picker and test-connection copy.
Snapshot of in-progress work found uncommitted in the tree: a new API Builder preview component (+ specs), large reworks to the workspace and main builder components, and small tweaks to Agents, event-script details, welcome page, and the script editor. Committed to clean the tree ahead of the UI-hardening branch; not reviewed.
…solved toward main's --df-ai-* pattern; dist kept ours, rebuilt next)
…d once on body - styles.scss: --df-* token set, light on :root, dark under .dark-theme, dark values reproduce the pre-token hardcoded whites - DfThemeService now stamps .dark-theme on <body> (single source of truth); color-scheme: dark for native controls - component migration to tokens follows in stream1 sweep commits
…pane (fixed ~48px overflow on every screen)
… 100% (System was the holdout at 52px; scoped ::ng-deep override did not pierce the child component, shared trim does)
…ble add->send+response->export)
…vious API's tables) serviceName was read once from a route snapshot in ngOnInit, but Angular reuses the component across /api-docs/:name changes, so navigating between services left the token pickers (tables, fields, procs, funcs) and the api-key loader introspecting the previously-loaded service. Fix: rerun the resolver on paramsChange and read serviceName + service id inside the reactive route.data subscription. Verified: pgsql->mysql->chargeback_db each shows its own tables.
…ivilege default key - formatForSupport: mask DSN host/user/password (and PDO 'user@host') in the copied raw body so a support paste no longer leaks DB connection internals that the on-screen headline already hides. - df-artifact-resolver: among keys that probe 200, rank read-only / narrowly-scoped keys ahead of broad write-capable ones for the default curl; stable sort keeps first-working as the tie-break.
# Conflicts: # dist/5052.a1f133e1145b1e21.js # dist/7764.061ac42c84fcbcd3.js # dist/8889.2575245cbb4c5093.js # dist/index.html # dist/runtime.7a232095ca68a82c.js # src/app/adf-services/df-service-details/df-service-details.component.html # src/app/shared/components/df-script-editor/df-script-editor.component.ts
Cody's scheduler run-as UI (api-key + role fields, clear-run-as-on-app-clear), snapshot-banner date fix (lastRefreshedAt), and api-types breadcrumb fix.
…nfirmed kill switch The registry rows now show every field the spec calls for: owner (owner_id resolved via the already-loaded user lookup), last_active_at as a relative label (memoized per data load, refreshed by the 20s poll), and the existing key-status/is_active badge. Killing an agent (toggle off) now goes through DfConfirmDialogComponent, same pattern as df-manage-table; cancel puts the toggle back without a request. Reactivating stays unconfirmed.
…mmit hook fallout)
Lifted from feat/http-service-curl-import (Cody): curl-parser + spec and the import dialog land as-is; the df-service-details entry point and the df-array-field writeValue fix are re-applied onto the overhauled components rather than merging the branch (16/24 files collided with the UI overhaul). Includes dist rebuild.
The cURL parser passed through whatever scheme the pasted command carried. file://, gopher://, and dict:// became the rws base_url with no warning, an SSRF and local-file-read entry point when the service is later invoked server-side. This is admin-authenticated and has full parity with the manual base_url field, so it is LOW, but the import warned on captured credentials and multipart while staying silent on a dangerous scheme. Close that gap: emit a scheme warning for anything other than http/https. Schemeless and relative base URLs and host:port stay valid; no false positives. The server-side scheme guard in df-rws is a separate item, noted in the close-out. curl-parser jest 25/25.
The df-schema-contracts backend shipped in 7.7 but its admin UI never merged off feature branches (same orphan pattern as curl-import). Lifted the adf-schema-contracts module from schema-contracts-on-7.6 (the newer branch that carries the Phase 6 runtime-enforcement selector): the manage-contracts tab plus the OpenAPI, snapshot-history, and table-diff dialogs, the service, and types. Re-wired the four entry points (route, ROUTES enum, URLS const, i18n) against the 7.7 overhaul rather than merging the stale branch. Verified: npm run build clean; the /admin-settings/schema-contracts tab renders live on :8081, hits /api/v2/system/schema_contract, no JS errors, i18n wired. Includes dist rebuild + an e2e render test.
…refix Clicking Schema Contracts also highlighted Schema: isActive() used router.url.startsWith(nav.path), so /admin-settings/schema-contracts matched the sibling /admin-settings/schema by bare string prefix. Any two nav paths where one prefixes the other collided. Match on a segment boundary now: active when the url equals the path or starts with path + '/', with query/fragment stripped. Parent-highlight-on-child-route still works. Verified live: on /admin-settings/schema-contracts only Schema Contracts is active. e2e/schema-contracts.spec.ts now asserts it. Includes dist rebuild.
… fence An assistant reply may end with a fenced block whose language tag is 'suggestions' (1-4 short follow-up lines). df-chat-message now strips that trailing closed fence from the rendered segments and surfaces its lines as keyboard-accessible chips on the newest assistant message (gated by the parent while a reply is in flight); clicking a chip sends the text through the normal send flow. Mid-message or malformed fences still render as ordinary code. Ports the sysco demo's chat-suggestions console addon natively (~10x smaller than the addon's XHR/DOM shim). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New 'Task cost estimator' panel beside the rate calculator: describe a task, route it to a registered agent via POST /api/v2/agents/route (falls back to a manual ai_chat service picker when routing is unavailable), calibrate per-call token averages from the meter's own 90d history (app-level, then service-level, >=5 requests), and project a low/high cost range via the observed 3-6 calls-per-task tool loop priced through the shared estimateCost. Optional budget gives an advisory verdict (never a hard block), and 'Run for real' executes the task on the target chat service, snapshots the meter before/after, and classifies actual spend against the pre-run range. Pure math lives in utils/task-estimate.ts with unit coverage wired into CI. Ports the sysco demo's what-if console addon natively. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tion-chips AI Chat: follow-up suggestion chips from a trailing suggestions fence
…stimator AI Usage: task-based what-if cost estimator (estimate → budget verdict → run & compare)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.