Skip to content

Commit 64db13d

Browse files
cursoragentmsukkari
cursoragent
and
msukkari
committed
Merge branch 'main' into cursor/development-environment-setup-5c91
Co-authored-by: Michael Sukkarieh <msukkari@users.noreply.github.com>
2 parents e440089 + 9e07fcd commit 64db13d

File tree

269 files changed

+9570
-6735
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

269 files changed

+9570
-6735
lines changed

‎.env.development‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,6 @@ CONFIG_PATH=${PWD}/config.json # Path to the sourcebot config file (if one exist
4040
# Redis
4141
REDIS_URL="redis://localhost:6379"
4242

43-
# Stripe
44-
# STRIPE_SECRET_KEY: z.string().optional(),
45-
# STRIPE_PRODUCT_ID: z.string().optional(),
46-
# STRIPE_WEBHOOK_SECRET: z.string().optional(),
47-
# STRIPE_ENABLE_TEST_CLOCKS=false
48-
4943
# Agents
5044

5145
# GITHUB_APP_ID=
@@ -75,4 +69,5 @@ SOURCEBOT_TELEMETRY_DISABLED=true # Disables telemetry collection
7569

7670
# CONFIG_MAX_REPOS_NO_TOKEN=
7771
NODE_ENV=development
78-
# SOURCEBOT_TENANCY_MODE=single
72+
73+
DEBUG_WRITE_CHAT_MESSAGES_TO_FILE=true

‎.github/workflows/license-audit.yml‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
name: License Audit
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
paths:
7+
- "yarn.lock"
8+
- "package.json"
9+
- "packages/*/package.json"
10+
- "scripts/fetchLicenses.mjs"
11+
- "scripts/summarizeLicenses.mjs"
12+
- "scripts/npmLicenseMap.json"
13+
- "scripts/licenseAuditPrompt.txt"
14+
- "scripts/runLicenseAudit.sh"
15+
workflow_dispatch:
16+
17+
jobs:
18+
license-audit:
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
pull-requests: write
23+
id-token: write
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@v4
27+
with:
28+
fetch-depth: 1
29+
30+
- name: Setup Node.js
31+
uses: actions/setup-node@v4
32+
with:
33+
node-version: "20"
34+
cache: "yarn"
35+
36+
- name: Install dependencies
37+
run: yarn install --frozen-lockfile
38+
39+
- name: Fetch licenses
40+
run: node scripts/fetchLicenses.mjs
41+
42+
- name: Summarize licenses
43+
run: node scripts/summarizeLicenses.mjs
44+
45+
- name: Read audit prompt
46+
id: read-prompt
47+
run: |
48+
{
49+
echo 'PROMPT<<PROMPT_EOF'
50+
cat scripts/licenseAuditPrompt.txt
51+
echo 'PROMPT_EOF'
52+
} >> "$GITHUB_OUTPUT"
53+
54+
- name: Audit licenses with Claude
55+
uses: anthropics/claude-code-action@v1
56+
with:
57+
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
58+
claude_args: '--allowedTools "Bash,Read,Write,Glob,Grep,WebFetch"'
59+
prompt: ${{ steps.read-prompt.outputs.PROMPT }}
60+
61+
- name: Validate audit result
62+
run: |
63+
if [ ! -f license-audit-result.json ]; then
64+
echo "::error::license-audit-result.json was not created by the audit step"
65+
exit 1
66+
fi
67+
68+
STATUS=$(node -e "const r = require('./license-audit-result.json'); console.log(r.status)")
69+
UNRESOLVED=$(node -e "const r = require('./license-audit-result.json'); console.log(r.summary.unresolvedCount)")
70+
STRONG=$(node -e "const r = require('./license-audit-result.json'); console.log(r.summary.strongCopyleftCount)")
71+
WEAK=$(node -e "const r = require('./license-audit-result.json'); console.log(r.summary.weakCopyleftCount)")
72+
RESOLVED=$(node -e "const r = require('./license-audit-result.json'); console.log(r.summary.resolvedCount)")
73+
74+
echo "## License Audit Result: $STATUS"
75+
echo ""
76+
echo "- Resolved: $RESOLVED"
77+
echo "- Unresolved: $UNRESOLVED"
78+
echo "- Strong copyleft: $STRONG"
79+
echo "- Weak copyleft: $WEAK"
80+
81+
if [ "$STATUS" = "FAIL" ]; then
82+
echo ""
83+
echo "::error::License audit failed. See details below:"
84+
node -e "const r = require('./license-audit-result.json'); r.failReasons.forEach(r => console.log(' - ' + r))"
85+
exit 1
86+
fi
87+
88+
- name: Comment on PR
89+
if: always() && github.event_name == 'pull_request'
90+
uses: actions/github-script@v7
91+
with:
92+
script: |
93+
const fs = require('fs');
94+
const resultPath = 'license-audit-result.json';
95+
96+
// Determine if we should comment
97+
let shouldComment = false;
98+
let body = '';
99+
100+
if (!fs.existsSync(resultPath)) {
101+
shouldComment = true;
102+
body = `## License Audit\n\n:x: Audit failed to produce results. Check the workflow logs for details.`;
103+
} else {
104+
const result = JSON.parse(fs.readFileSync(resultPath, 'utf-8'));
105+
const hasWeakCopyleft = result.summary.weakCopyleftCount > 0;
106+
const isFail = result.status === 'FAIL';
107+
108+
if (!isFail && !hasWeakCopyleft) {
109+
return;
110+
}
111+
112+
shouldComment = true;
113+
const icon = isFail ? ':x:' : ':warning:';
114+
115+
body = `## License Audit\n\n`;
116+
body += `${icon} **Status: ${result.status}**\n\n`;
117+
body += `| Metric | Count |\n|---|---|\n`;
118+
body += `| Total packages | ${result.summary.totalPackages} |\n`;
119+
body += `| Resolved (non-standard) | ${result.summary.resolvedCount} |\n`;
120+
body += `| Unresolved | ${result.summary.unresolvedCount} |\n`;
121+
body += `| Strong copyleft | ${result.summary.strongCopyleftCount} |\n`;
122+
body += `| Weak copyleft | ${result.summary.weakCopyleftCount} |\n`;
123+
124+
if (result.failReasons && result.failReasons.length > 0) {
125+
body += `\n### Fail Reasons\n\n`;
126+
for (const reason of result.failReasons) {
127+
body += `- ${reason}\n`;
128+
}
129+
}
130+
131+
if (result.unresolved && result.unresolved.length > 0) {
132+
body += `\n### Unresolved Packages\n\n`;
133+
body += `| Package | Version | License | Reason |\n|---|---|---|---|\n`;
134+
for (const pkg of result.unresolved) {
135+
body += `| ${pkg.name} | ${pkg.version} | \`${pkg.license}\` | ${pkg.reason} |\n`;
136+
}
137+
}
138+
139+
if (result.copyleft && result.copyleft.strong && result.copyleft.strong.length > 0) {
140+
body += `\n### Strong Copyleft Packages\n\n`;
141+
body += `| Package | Version | License |\n|---|---|---|\n`;
142+
for (const pkg of result.copyleft.strong) {
143+
body += `| ${pkg.name} | ${pkg.version} | \`${pkg.license}\` |\n`;
144+
}
145+
}
146+
147+
if (result.copyleft && result.copyleft.weak && result.copyleft.weak.length > 0) {
148+
body += `\n### Weak Copyleft Packages (informational)\n\n`;
149+
body += `| Package | Version | License |\n|---|---|---|\n`;
150+
for (const pkg of result.copyleft.weak) {
151+
body += `| ${pkg.name} | ${pkg.version} | \`${pkg.license}\` |\n`;
152+
}
153+
}
154+
155+
if (result.resolved && result.resolved.length > 0) {
156+
body += `\n<details><summary>Resolved Packages (${result.resolved.length})</summary>\n\n`;
157+
body += `| Package | Version | Original | Resolved | Source |\n|---|---|---|---|---|\n`;
158+
for (const pkg of result.resolved) {
159+
body += `| ${pkg.name} | ${pkg.version} | \`${pkg.originalLicense}\` | \`${pkg.resolvedLicense}\` | ${pkg.source} |\n`;
160+
}
161+
body += `\n</details>\n`;
162+
}
163+
}
164+
165+
if (!shouldComment) return;
166+
167+
const comments = await github.rest.issues.listComments({
168+
owner: context.repo.owner,
169+
repo: context.repo.repo,
170+
issue_number: context.issue.number,
171+
});
172+
const existing = comments.data.find(c => c.body.startsWith('## License Audit'));
173+
if (existing) {
174+
await github.rest.issues.updateComment({
175+
owner: context.repo.owner,
176+
repo: context.repo.repo,
177+
comment_id: existing.id,
178+
body,
179+
});
180+
} else {
181+
await github.rest.issues.createComment({
182+
owner: context.repo.owner,
183+
repo: context.repo.repo,
184+
issue_number: context.issue.number,
185+
body,
186+
});
187+
}
188+
189+
- name: Upload artifacts
190+
if: always()
191+
uses: actions/upload-artifact@v4
192+
with:
193+
name: license-audit
194+
path: |
195+
oss-licenses.json
196+
oss-license-summary.json
197+
license-audit-result.json

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,4 +163,7 @@ dist
163163
.sourcebot
164164
/bin
165165
/config.json
166-
.DS_Store
166+
.DS_Store
167+
oss-licenses.json
168+
oss-license-summary.json
169+
license-audit-result.json

‎AGENTS.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ Standard dev commands are documented in `CONTRIBUTING.md` and `package.json`. Ke
3333
- **Build deps only:** `yarn build:deps` (builds shared packages: schemas, db, shared, query-language)
3434
- **DB migrations:** `yarn dev:prisma:migrate:dev`
3535

36+
### Deprecated Packages
37+
38+
- **`packages/mcp`** - This standalone MCP package is deprecated. Do NOT modify it. MCP functionality is now handled by the web package at `packages/web/src/features/mcp/`.
39+
3640
### Non-obvious Caveats
3741

3842
- **Docker must be running** before `yarn dev`. Start it with `docker compose -f docker-compose-dev.yml up -d`. The backend will fail to connect to Redis/PostgreSQL otherwise.

‎CHANGELOG.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [4.16.5] - 2026-04-02
11+
12+
### Added
13+
- Added `GET /api/commit` endpoint for retrieving details about a single commit, including parent commit SHAs [#1077](https://github.com/sourcebot-dev/sourcebot/pull/1077)
14+
15+
### Changed
16+
- Replaced placeholder avatars with deterministic minidenticon-based avatars generated from email addresses [#1072](https://github.com/sourcebot-dev/sourcebot/pull/1072)
17+
- Changed `author_name` and `author_email` fields to `authorName` and `authorEmail` in `GET /api/commits` response [#1077](https://github.com/sourcebot-dev/sourcebot/pull/1077)
18+
- Changed `oldPath` and `newPath` in `GET /api/diff` response from `"/dev/null"` to `null` for added/deleted files [#1077](https://github.com/sourcebot-dev/sourcebot/pull/1077)
19+
- Bumped `simple-git` to `3.33.0`. [#1078](https://github.com/sourcebot-dev/sourcebot/pull/1078)
20+
21+
## [4.16.4] - 2026-04-01
22+
23+
### Added
24+
- Added `GET /api/diff` endpoint for retrieving structured diffs between two git refs [#1063](https://github.com/sourcebot-dev/sourcebot/pull/1063)
25+
26+
### Fixed
27+
- Fixed `GET /api/mcp` hanging with zero bytes by returning `405 Method Not Allowed` per the MCP Streamable HTTP spec [#1064](https://github.com/sourcebot-dev/sourcebot/pull/1064)
28+
- Fixed tokens with trailing newlines breaking git clone URLs by adding `.trim()` in `getTokenFromConfig()` [#1067](https://github.com/sourcebot-dev/sourcebot/pull/1067)
29+
30+
### Removed
31+
- Removed "general" settings page with options to change organization name and domain. [#1065](https://github.com/sourcebot-dev/sourcebot/pull/1065)
32+
33+
### Changed
34+
- Changed the analytics and license settings pages to only be viewable by organization owners. [#1065](https://github.com/sourcebot-dev/sourcebot/pull/1065)
35+
36+
## [4.16.3] - 2026-03-27
37+
38+
### Added
39+
- Added support for `.gitattributes` `linguist-language` overrides in the file viewer ([#1048](https://github.com/sourcebot-dev/sourcebot/pull/1048))
40+
- Added Basic language syntax highlighting in the file viewer ([#1054](https://github.com/sourcebot-dev/sourcebot/pull/1054))
41+
42+
### Fixed
43+
- Fixed Ask GitHub landing page chat box placement to be centered on the page instead of at the bottom. [#1046](https://github.com/sourcebot-dev/sourcebot/pull/1046)
44+
- Fixed issue where local git connections (`file://`) would fail when matching a file instead of a directory. [#1049](https://github.com/sourcebot-dev/sourcebot/pull/1049)
45+
- Fixed regex queries containing parentheses (e.g. `(test|render)<`) being incorrectly split into multiple search terms instead of treated as a single regex pattern. [#1050](https://github.com/sourcebot-dev/sourcebot/pull/1050)
46+
47+
## [4.16.2] - 2026-03-25
48+
49+
### Fixed
50+
- Fixed line numbers being selectable in Safari in the lightweight code highlighter. [#1037](https://github.com/sourcebot-dev/sourcebot/pull/1037)
51+
- Fixed GitLab sync deleting repos when the API returns a non-404 error (e.g. 500) during group/user/project fetch. [#1039](https://github.com/sourcebot-dev/sourcebot/pull/1039)
52+
- Fixed React hydration mismatch in `KeyboardShortcutHint` caused by platform detection running at module load time during SSR. [#1041](https://github.com/sourcebot-dev/sourcebot/pull/1041)
53+
- Fixed rendering performance for ask threads, especially when hovering or selecting citations. [#1042](https://github.com/sourcebot-dev/sourcebot/pull/1042)
54+
55+
### Added
56+
- Added optional copy button to the lightweight code highlighter (`isCopyButtonVisible` prop), shown on hover. [#1037](https://github.com/sourcebot-dev/sourcebot/pull/1037)
57+
58+
## [4.16.1] - 2026-03-24
59+
60+
### Fixed
61+
- Fixed scroll position when selecting chat references that point to lines further down in a file. [#1036](https://github.com/sourcebot-dev/sourcebot/pull/1036)
62+
63+
## [4.16.0] - 2026-03-24
64+
65+
### Changed
66+
- Changed language detection to resolve file extensions with multiple language resolutions (e.g., .md) to the most common resolution. [#1026](https://github.com/sourcebot-dev/sourcebot/pull/1026)
67+
- Changed the `webUrl` property of the `/api/repos` api to return a URL rather than just a path. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
68+
- Changed the ask search scope selector to allow submitting questions with no search scope selected. When no selection is made, the agent will be able to search over all repos the user has access to. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
69+
- Renamed the `search_code` tool to `grep` for ask and mcp. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
70+
- Improved auto-scroll behavior in the ask chat thread. [#1031](https://github.com/sourcebot-dev/sourcebot/pull/1031)
71+
72+
### Added
73+
- Added `glob`, `find_symbol_definitions`, and `find_symbol_references` tools to the ask agent and MCP server. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
74+
- Added `list_tree` tool to the ask agent. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
75+
- Added input & output token breakdown in ask details card. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
76+
- Added `path` parameter to the `/api/commits` api to allow filtering commits by paths. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
77+
- Search contexts now support topic-based filtering with new `includeTopics` and `excludeTopics` fields, enabling repository filtering by GitHub/GitLab topics with glob pattern support and case-insensitive matching.[#1028](https://github.com/sourcebot-dev/sourcebot/pull/1028)
78+
79+
### Fixed
80+
- Fixed issue where ask responses would sometimes appear in the details panel while generating. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
81+
- Fixed reference panel overflow issue in the ask UI. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
82+
- Fixed homepage scrolling issue in the ask UI. [#1014](https://github.com/sourcebot-dev/sourcebot/pull/1014)
83+
- Fixed UI freeze when the `grep` tool returns a large number of results with `groupByRepo=true`. [#1032](https://github.com/sourcebot-dev/sourcebot/pull/1032)
84+
- Fixed issue where the search scope selection persisted after a new thread is created. [#1033](https://github.com/sourcebot-dev/sourcebot/pull/1033)
85+
- Fixed inaccurate scroll position when selecting a chat reference in the ask UI. [#1035](https://github.com/sourcebot-dev/sourcebot/pull/1035)
86+
87+
## [4.15.11] - 2026-03-20
88+
89+
### Changed
90+
- Updated JumpCloud SSO documentation to clarify token endpoint authentication method requirement and AUTH_SECRET configuration. [#1022](https://github.com/sourcebot-dev/sourcebot/pull/1022)
91+
- The `ask_codebase` MCP tool is now hidden when no language model providers are configured. [#1018](https://github.com/sourcebot-dev/sourcebot/pull/1018)
92+
93+
## [4.15.10] - 2026-03-20
94+
95+
### Changed
96+
- Increased `SOURCEBOT_CHAT_MAX_STEP_COUNT` default from 20 to 100 to allow agents to perform more autonomous steps. [#1017](https://github.com/sourcebot-dev/sourcebot/pull/1017)
97+
- [EE] Fix error with Jumpcloud SSO state param [#1020](https://github.com/sourcebot-dev/sourcebot/pull/1020)
98+
99+
## [4.15.9] - 2026-03-17
100+
101+
### Added
102+
- Added read-only annotations to MCP tools for compatibility with Cursor Ask mode and other MCP clients that restrict tool usage based on behavior hints. [#1013](https://github.com/sourcebot-dev/sourcebot/pull/1013)
103+
104+
## [4.15.8] - 2026-03-17
105+
106+
### Added
107+
- Added support for connecting to Redis over TLS via `REDIS_TLS_ENABLED` and related environment variables. [#1011](https://github.com/sourcebot-dev/sourcebot/pull/1011)
108+
109+
### Changed
110+
- `filterByFilepaths` in the MCP `search_code` tool now accepts regular expressions matched against the full file path, instead of treating values as escaped literals. [#1008](https://github.com/sourcebot-dev/sourcebot/pull/1008)
111+
112+
### Fixed
113+
- Connection sync job failures now log the actual error reason instead of a generic message. [#1012](https://github.com/sourcebot-dev/sourcebot/pull/1012)
114+
115+
## [4.15.7] - 2026-03-16
116+
10117
### Added
11118
- Added AGENTS.md with Cursor Cloud development environment instructions. [#1001](https://github.com/sourcebot-dev/sourcebot/pull/1001)
119+
- Added support for configuring SMTP via individual environment variables (SMTP_HOST, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD) as an alternative to SMTP_CONNECTION_URL. [#1002](https://github.com/sourcebot-dev/sourcebot/pull/1002)
120+
- Added `DISABLE_API_KEY_CREATION_FOR_NON_OWNER_USERS` and `DISABLE_API_KEY_USAGE_FOR_NON_OWNER_USERS` environment variables to restrict API key creation and usage to organization owners. [#1007](https://github.com/sourcebot-dev/sourcebot/pull/1007)
121+
122+
### Changed
123+
- Deprecated `EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS` in favour of `DISABLE_API_KEY_CREATION_FOR_NON_OWNER_USERS`. The old variable will continue to work as a fallback. [#1007](https://github.com/sourcebot-dev/sourcebot/pull/1007)
124+
125+
### Modified
126+
- Made OSS license audit runnable locally [#1021](https://github.com/sourcebot-dev/sourcebot/pull/1021)
12127

13128
## [4.15.6] - 2026-03-13
14129

15130
### Added
16131
- Added generated OpenAPI documentation for the public search, repo, and file browsing API surface. [#996](https://github.com/sourcebot-dev/sourcebot/pull/996)
132+
- Added OSS license audit github action. [#1003](https://github.com/sourcebot-dev/sourcebot/pull/1003)
17133

18134
### Fixed
19135
- [EE] Fixed account-driven permission sync silently wiping all Bitbucket Server repository permissions when the OAuth token expires on instances with anonymous access enabled. [#998](https://github.com/sourcebot-dev/sourcebot/pull/998)

0 commit comments

Comments
 (0)