⬆️(deps): Bump fast-uri from 3.1.2 to 3.1.5 in /apps/mewbo_console - #199
Open
dependabot[bot] wants to merge 2 commits into
Open
⬆️(deps): Bump fast-uri from 3.1.2 to 3.1.5 in /apps/mewbo_console#199dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
dependabot
Bot
added
dependencies
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
mewbo-docs-discovery | 9d23883 | Aug 21 2026, 10:43 PM |
…for agentic apps, and a declared indexing plan
## Features
### packages/mewbo_speech
A new package for synthesis and transcription against an OpenAI-compatible gateway, with model
capability discovery so a surface can ask what a deployment can actually do rather than assume.
It is optional in both senses the layering rule requires: a PEP 621 extra, and an import guard at
every call site.
### packages/mewbo_core
- **A declared step plan and an observed progress ledger** (`contracts/progress.py`). Long jobs
previously reported progress as a register of ad hoc counters, so a value belonging to a phase
that had already ended was read as describing the current one. Work is now DECLARED as a plan of
steps and OBSERVED against it, which is what lets a reader tell "not started" from "finished
and reset" — two states a bare counter spells identically.
- Tool refusals carry a machine-readable code and close the gap that made a refusal
indistinguishable from an empty result. Generative UI ships as a first-party plugin suite with a
canonical identity for built-ins, and `SessionToolRegistry` gains a deny set, so an operator can
switch a built-in tool off without removing the plugin that provides it.
### packages/mewbo_graph
Per-project embedding models, and an indexing read failure that used to end a run early now
surfaces as a typed fact instead of silent truncation. Every indexing step opens a scope of its
own, so a log line that escapes its declared step is labelled as unattributed rather than
rendered anonymously — an invisible gap is how one survives a green suite.
### apps/mewbo_api
- **A live tier for Mewbo Apps** (`apps/pipeline_runner.py`, `pipeline_tracker.py`, `models.py`,
`plugin/submit_app.py`). An app declares a result contract; a post-response verifier checks what
it actually returned, and auto-repair reaches on-demand pipelines rather than only scheduled
ones. A code pipeline's `ctx` is scoped to the app's own staging directory.
- Speech routes (`speech/routes.py`) expose synthesis and transcription over the gateway, gated by
the same capability header every other client-side capability travels through.
- **Device control is a session** (`device_tools.py`): started, held, shown and ended, with the
binding durable across re-engagement instead of rebuilt per request.
- An operator-owned execution allowlist for pipelines, and a concurrency bound on live pipelines —
a long-lived request spends a process-wide budget, so the ceiling is stated rather than
discovered when the API stops answering.
### apps/mewbo_console
The declared plan renders as an outline that follows the run and collapses what is done; the
indexing screen is rebuilt as four bounded regions so a loading screen can no longer grow a
scrollbar and push its own Cancel control off-screen. Live and average tokens-per-second appear in
the trajectory and the turn footer. The model and fallback pickers become one tabbed panel.
### apps/mewbo_aura
**Aura is operable without a touchscreen.** Anyone driving the app by D-pad, remote or keyboard
could not reach most of it, and the cause was not missing focus targets: `clickable` is already
focusable in Compose and the accessibility tree held eight focusable nodes. Focus was TRAPPED. A
focused text field consumed all four arrow keys to move its caret, the composer took focus on the
first frame, and eight consecutive arrow presses moved focus not once. So the fix is a navigation
model rather than a stylesheet, and adding `Modifier.focusable` anywhere would have changed
nothing.
Four parts, all in `ui/common/`. `Modifier.dpadFocusEscape` lets Up/Down always leave a text
field while keeping in-text caret movement. `Modifier.auraFocusRing` gives a control a visible
focus state, and must precede the click modifier in the chain — `onFocusChanged` observes only
focus targets that follow it, so ringing from behind compiles, draws nothing and warns about
nothing. `focusProperties { down = FocusRequester.Cancel }` contains focus at the bottom edge,
where a move onto a node the IME then destroyed left the tree with no focused node in any
direction and no key events to recover with. `Modifier.imeOnConfirmOnly` stops the keyboard
covering the screen for someone merely traversing past a field, and is named for the behaviour
rather than the device. Settings rows now carry their own click and render the switch as a
display-only indicator, because a trailing `Switch` was focusable and still unreachable from all
four directions.
Television is where this becomes unavoidable rather than what it is for: with no touchscreen at
all, each of the above is a hard failure instead of an inconvenience. Android TV and Fire TV
admission, a permanent navigation rail in place of the modal drawer, remote speech and in-app
updating ride along, and the API floor drops to 30 — `RuntimeShader`, not haptics, was what stood
in the way.
## Fixes
- **`packages/mewbo_core`** — a reasoning model's bare-string answer is wrapped as a text block
before it reaches history, where a strict OpenAI-shaped backend rejected it on replay. Schema
upper bounds that break grammar-constrained backends are dropped, an activated skill is no longer
truncated in half, and a session stays on its own model. Every turn gets its own trace and every
tool call a span.
- **`packages/mewbo_graph`** — the progress ledger gets a denominator that cannot move, settles at
the end, and says when settling hid something; the ledger is read from whichever transport is
ahead.
- **`apps/mewbo_api`** — the Web IDE app-staging tier no longer drops sessions bound only by tag;
the external-cwd gate can see paths the server already owns; poisoned app workspace bindings are
repaired on resubmit; the code-server image is pulled before a container is created.
- **`apps/mewbo_console`** — a citation badge annotates its sentence instead of erasing it, and the
injected theme no longer collapses embedded-app sidebar spacing or leaves the auto-generated
multipage sidebar nav unthemed.
- **`apps/mewbo_aura`** — the stop-reading-aloud control gets its focus ring, the one focusable box
the sweep missed.
- **build and CI** — every package README resolves inside its own project so package metadata can
reach it; the Docker and Android release pipelines run on both forges; the docs upload timeout is
raised above the real transfer time, where the old cap cut the archive mid-stream and reported a
truncated build rather than a timeout.
## Removals
`public_endpoint` is dropped — a declaration nothing read.
Co-authored-by: Mewbo AI <268600793+mewbo-ai[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/apps/mewbo_console/fast-uri-3.1.5
branch
from
August 21, 2026 22:42
111102a to
9d23883
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps fast-uri from 3.1.2 to 3.1.5.
Release notes
Sourced from fast-uri's releases.
Commits
5e179cbBumped v3.1.52cad02dMerge commit from fork6aeece6Bumped v3.1.42d50fbafix: reject literal backslash in URI authority0549fe3Bumped v3.1.32a6d357Merge commit from fork