chore(deps): bump actions/download-artifact from 4 to 8 by dependabot[bot] · Pull Request #13 · jgoy-labs/server-nexe

dependabot · 2026-03-15T14:52:23Z

Bumps actions/download-artifact from 4 to 8.

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Don't attempt to un-zip non-zipped downloads by @danwkennedy in actions/download-artifact#460

Add a setting to specify what to do on hash mismatch and default it to error by @danwkennedy in actions/download-artifact#461

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Update GHES guidance to include reference to Node 20 version by @patrikpolyak in actions/download-artifact#440

Download Artifact Node24 support by @salmanmkc in actions/download-artifact#415

fix: update @actions/artifact to fix Node.js 24 punycode deprecation by @salmanmkc in actions/download-artifact#451

prepare release v7.0.0 for Node.js 24 support by @salmanmkc in actions/download-artifact#452

New Contributors

@patrikpolyak made their first contribution in actions/download-artifact#440

@salmanmkc made their first contribution in actions/download-artifact#415

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits

3e5f45b Add regression tests for CJK characters (#471)
e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
f258da9 Add change docs
ccc058e Fix linting issues
bd7976b Add a setting to specify what to do on hash mismatch and default it to error
ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
15999bf Add note about package bumps
974686e Bump the version to v8 and add release notes
fbe48b1 Update test names to make it clearer what they do
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Documentació corregida i actualitzada: - API.md: Endpoints correctes amb /v1/, dual-key auth, X-API-Key headers - SECURITY.md: Configuració real (server.toml), paths correctes, MAX_SCAN_LENGTH - RAG.md: Sistema híbrid embeddings (nomic-embed-text 768d), 3 col·leccions, chunking en caràcters - USAGE.md: CLI real (memory recall/store/stats/cleanup, knowledge ingest), autenticació obligatòria - README.md: Stack correcte (Click+Rich), compatibilitat OpenAI parcial, SECURITY.md afegit Canvis principals documentació: - Models embeddings: Ollama nomic-embed-text (768 dims) + fallbacks documentats - Col·leccions Qdrant: nexe_chat_memory, nexe_documentation, user_knowledge - Thresholds diferenciats: 0.4 (docs), 0.35 (knowledge), 0.3 (memory) - Chunking: 1500/200 chars (text general), 800/100 (RAG endpoint) - Autenticació X-API-Key obligatòria a tots els endpoints /v1/* - CLI real: store|recall|stats|cleanup (no search/list/delete) - Paths correctes: storage/qdrant/, /v1/memory/*, /api/info Codi NEXE 0.8 complet afegit: - Core: FastAPI server, CLI, endpoints, loaders - Plugins: MLX, llama.cpp, Ollama, security, web UI - Memory: RAG system, embeddings, Qdrant integration - Personality: i18n, module management, configuration Eliminats: - PRODUCTION_PLAN.md - REVIEW_SUPERCONSULTOR_2026-01-31.md Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…cepts - memory/rag/routers/endpoints.py: ALLOWED_UPLOAD_EXTENSIONS whitelist, filename sanitization (Path.name) to prevent path traversal, generic 500 error messages (no internal details exposed) - core/endpoints/root.py: /health/ready returns only {status, timestamp} to avoid exposing internal module list without auth - plugins/web_ui_module/session_manager.py: implement cleanup_inactive() with timedelta TTL to prevent session memory leak - memory/memory/engines/persistence.py: QDRANT_API_KEY env var support for authenticated Qdrant deployments - core/endpoints/chat.py: log JSONDecodeError in Ollama stream, handle asyncio.CancelledError on client disconnect - plugins/web_ui_module/memory_helper.py: replace bare except with except Exception + debug logging - .env.example: document all env vars including QDRANT_API_KEY - .dockerignore: exclude .env, storage/, venv/, .git/ from Docker image - .github/workflows/ci.yml: pip-audit CVE scan + unit tests - core/endpoints/tests/test_security.py: 14 security regression tests Assisted by AI

- fastapi 0.109.0 → 0.128.8 (starlette 0.49.1+, tanca GHSA-2c2j + GHSA-7f5h) - uvicorn 0.27.0.post1 → 0.34.3 - pydantic 2.6.0 → 2.10.6 - python-multipart 0.0.6 → 0.0.22 (tanca GHSA-wp53-j4wj-2cfg) - httpx 0.26.0 → 0.27.2 - qdrant-client 1.12.0 → 1.13.3 - structlog 24.1.0 → 25.5.0 - tenacity 8.2.3 → 9.1.2 - python-dotenv 1.0.1 → 1.2.1 - huggingface_hub 0.20.3 → 0.36.2 - sentence-transformers 2.3.1 → 2.7.0 - pypdf 4.0.1 → 6.7.1 (tanca 7 CVEs GHSA-*) - numpy 1.26.4 mantingut (numpy 2.x breaking changes) - rich/typer mantinguts (cadena de compatibilitat) Verificat: pip-audit 0 vulnerabilitats, 14/14 tests passen Assisted by AI

… endpoints M-7: personality/i18n/i18n_manager.py i modular_i18n.py usaven 8 línies de codi duplicat per cercar server.toml. Ara deleguen a core.config.find_config_path (funció centralitzada ja existent). M-8: personality/i18n/__init__.py: _global_i18n = None s'inicialitzava lazy sense lock. Afegit threading.Lock + double-checked locking per evitar race condition en entorns async/multi-thread. T-3: memory/rag/tests/test_endpoints.py: 14 tests unitaris nous pels endpoints RAG (upload, search, add_document, whitelist extensions). Cobreixen: validació extensions, path traversal, errors 500 genèrics, resultats correctes, metadades invàlides, fitxers massa grans. Total tests: 28/28 passen. Assisted by AI

…p.state - factory_state.py: eliminar 4 crides register_service() (codi mort) - lifespan.py: sincronitzar app.state.config amb server_state.config en reload - memory/module.py: substituir get_service() per get_i18n() i get_server_state() - web_ui/manifest.py: substituir get_service("module_manager") per get_server_state() - container.py: marcar com a DEPRECATED (mantingut per tests, eliminar en v0.9) Resultat: font única per a cada objecte; desync config eliminat. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

N-1: server.toml → production, debug=false, reload=false N-2: system.py → PID i kill commands eliminats de respostes HTTP N-3: memory/api/v1.py → str(e) → error genèric + exc_info=True N-4: manifest.py → path traversal /ui/static/ bloquejat (resolve+startswith) N-5: session cleanup asyncio periòdic (cada hora, TTL 24h) N-6: system health → versió llegida de config (no hardcoded "0.7.1") N-7+N-8: manifest.py → import duplicat + _initialized eliminats Tests: +35 (test_security_n_series.py), total 49 passed Docs: SECURITY.md secció N-series afegida Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- security_logger/logger.py: hostname nexe-server → server-nexe - RUNTIME_CONTRACT.md: nexe.core.server_nexe → core.app (mòdul real) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- manifest.toml (×8): server.nexe/ → server-nexe/ (comentaris i paths) - nexe script: path hardcodat /NatSytem/server-nexe → /NatSytem/Nexe/server-nexe Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- cli/output.py: banner title server.nexe → server-nexe - security/manifest.py: comentari server.nexe root → server-nexe root Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- setup.sh: comprovació Python >=3.10 amb missatge clar (brew install python@3.11) (python-multipart==0.0.22 i altres deps requereixen Python 3.10+) - install_nexe.py: logo tagline traduït a català Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- 14 strings hardcoded ara passen per t() (ca/es/en) - Afegides 37 claus noves a les 3 traduccions: - Pantalla selecció de models (mida, model, motor) - Descàrrega Ollama/GGUF/MLX (progress steps) - Metal fallback (opcions, missatges d'error) - rec_label ara usa t('size_small/medium/large') - "Motors:" ara usa t('engines_label') Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Prova python3.11/3.12/3.10, paths Homebrew (/opt/homebrew), i /usr/local/bin abans de caure a python3 del sistema. Usa PYTHON_BIN per llançar install_nexe.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ZIP de GitHub no preserva permisos d'execució. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- MODEL_CATALOG: lang i description ara dicts {ca/es/en} per a 7 models - Afegides claus disk_label i fits_tight a les 3 traduccions - Display: usa model['lang'][LANG], model['description'][LANG] - "💾 Disc:" → t('disk_label') (Disc/Disco/Disk) - "Pot anar just" → t('fits_tight') Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

install_nexe.py: - Strings embeddings download/validation ara usen t() - Passa NEXE_LANG com a env var al subprocess d'ingesta - Afegides claus: embeddings_*, processing_knowledge_*, knowledge_indexed_ok core/ingest/ingest_knowledge.py: - Afegit _I18N dict + _t() que llegeix NEXE_LANG - Tots els missatges ara multilingüe (ca/es/en) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- knowledge/: 9 documents amb capçalera # === METADATA RAG === (id, abstract, tags, chunk_size, priority). README.md mogut de l'arrel a knowledge/ i ara és ingestable (id: nexe-overview, P1). - Exclusió README.md eliminada dels 4 punts d'ingestió (lifespan, cli, ingest_knowledge, install_nexe). - header_parser.py: fix _extract_header — blank lines seguides de comentaris de secció (# ===) ja no trenquen el parsing. - OpenAPI: summary= afegit als 33 endpoints; tags= a routers sense etiquetar (system, modules); descripció global enriquida a factory_app.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Docs moguts a knowledge/ca/ (estructura multi-idioma). El glob **/*.md ja era recursiu, cap canvi de codi a ingestió. - knowledge/en/ pot afegir-se quan calgui. - chat.py: cerca user_knowledge filtra per lang=NEXE_LANG (default 'ca') via filter_metadata — usa FieldCondition Qdrant existent. Cada idioma de servidor retorna només docs en el seu idioma. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- chat.py: llegeix idioma de req.app.state.i18n.current_language en runtime (p.ex. "ca-ES" → "ca"). Fallback: NEXE_LANG env → "ca". Aix\xed el selector d'idioma del servidor afecta la cerca RAG immediatament. - Afegides carpetes knowledge/es/ i knowledge/en/ (buides) per docs futurs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- knowledge/es/: 9 documents traduïts (API, ARCHITECTURE, INSTALLATION, LIMITATIONS, PLUGINS, RAG, README, SECURITY, USAGE) - knowledge/en/: 9 documents traduïts - Capçaleres RAG actualitzades: lang ca→es/en, abstract i tags traduïts - Termes tècnics, blocs de codi, paths i URLs preservats intactes - 27/27 documents passen validació parse_rag_header Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- core/ingest/ingest_knowledge.py: usa knowledge/{NEXE_LANG}/ si existeix - core/lifespan.py: aplica mateix filtre de llengua a auto-ingest startup - core/cli/cli.py: aplica filtre de llengua a 'nexe knowledge ingest' - install_nexe.py: detecta subcarpeta de llengua per comptatge de fitxers - knowledge/*.md: eliminats de l'arrel (moviment completat a knowledge/ca/) - requirements.txt: qdrant-client==1.13.3 → >=1.17.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

profiles.py: - CONSUMER: gemma2:2b → phi3.5 (Phi-3.5 Mini 3.8B, millor instruccions) - PRO: llama3.2:3b → llama3.1:8b (adequat per 16-32GB RAM) secondary: gemma2:9b → mistral:7b | embedding: nomic → all-MiniLM-L6-v2 context_window: 16384 → 32768 - ULTRA: llama3.1:8b → llama3.1:70b (qualitat màxima per >32GB) secondary: mistral-nemo:12b → mixtral:8x7b embedding: mxbai-embed-large → all-MiniLM-L6-v2 context_window: 32768 → 65536 registry.py — afegits 4 nous models: - salamandra2b (BSC/AINA, Ollama, llengües ibèriques) - salamandra7b (BSC/AINA, Ollama+GGUF, el millor per català) - mistral7b (MLX+Ollama+GGUF, equilibri qualitat/velocitat) - llama3.1-70b (MLX+Ollama+GGUF, qualitat professional) - mixtral (MLX+Ollama+GGUF, MoE 8x7B) server.toml: - secondary: "mistral-nemo:12b" → "" (engine-specific, no hardcoded) - embedding: "mxbai-embed-large" → "all-MiniLM-L6-v2" (model real del sistema) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…EFAULT_MODEL Problema: _forward_to_ollama usava NEXE_DEFAULT_MODEL que pot contenir una URL HuggingFace (per llama_cpp/mlx), causant fallback silenciós al primer model disponible d'Ollama sense cap avís. Solució: - Prioritat nova: request.model > NEXE_OLLAMA_MODEL > NEXE_DEFAULT_MODEL (si no és URL/path) > config > "llama3.2" - NEXE_DEFAULT_MODEL amb URLs o paths locals s'ignora per Ollama - install_nexe.py escriu NEXE_OLLAMA_MODEL quan l'engine és ollama - _update_env_model_config gestiona NEXE_OLLAMA_MODEL en actualitzacions - Retrocompatible: instal·lacions existents amb NEXE_DEFAULT_MODEL=nom-ollama segueixen funcionant Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

llama_cpp_module/config.py: - chat_format default: "gemma" → "chatml" (2 llocs: dataclass + from_env) - valid_formats ampliat: afegits "llama-3" i "phi-3" install_nexe.py: - MODEL_CATALOG: camp "chat_format" a cada model GGUF · phi35/salamandra2b/salamandra7b: "chatml" · mistral7b/mixtral: "mistral" · llama31_8b/llama31_70b: "llama-3" - generate_env_file: escriu NEXE_LLAMA_CPP_CHAT_FORMAT per engine llama_cpp - _update_env_model_config: actualitza NEXE_LLAMA_CPP_CHAT_FORMAT en reinstal·lació MLX: no requereix canvis — mlx-lm llegeix el chat template del tokenizer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…Server Nexe server.toml — 6 prompts nous [personality.prompt]: - ca_small / ca_full: Nexe com a expert de Server Nexe en català - es_small / es_full: versió castellà - en_small / en_full: versió anglès - small (~100 tok): per a models ≤4B (Phi-3.5, Salamandra 2B) - full (~200 tok): per a models 7B+ (Llama 3.1, Mistral, Salamandra 7B) core/endpoints/chat.py — _get_system_prompt(): - Selecciona prompt per lang (NEXE_LANG/i18n) + tier (NEXE_PROMPT_TIER) - Injecta system prompt automàticament si la request no en porta cap - RAG context sempre s'afegeix al system message (index 0) plugins/web_ui_module/manifest.py: - base_system_prompt llegit de server.toml via _get_system_prompt() - Fallback al mínim hardcoded si config no disponible install_nexe.py: - MODEL_CATALOG: camp "prompt_tier" a cada model (small/full) - generate_env_file + _update_env_model_config: escriuen NEXE_PROMPT_TIER Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El filtre de knowledge docs usava i18n.current_language ("en-US" per defecte del mòdul i18n) en lloc de NEXE_LANG ("ca"). Aixó feia que el filtre metadata{"lang":"en"} no coincidís amb els docs indexats {"lang":"ca"}, retornant 0 resultats de user_knowledge. Fix: _server_lang es determina amb os.getenv("NEXE_LANG","ca") fora del bloc use_rag, garantint que sempre estigui disponible per al system prompt i que el filtre RAG sigui correcte. - Tokens de prompt: 142 → 621 (context RAG real injectat) - user_knowledge: 0 → 3 resultats per query de documentació - .gitignore: COMMANDS.md i personality/.module_cache.json Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El codi d'ingestió exclou explícitament README.md. Eliminem els 3 fitxers (ca/en/es) per evitar confusió. Les capçaleres RAG als 24 documents (8 per idioma) ja estaven afegides en sessió anterior. Verificat: 24/24 capçaleres ✓ (parse_rag_header sense errors) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El codi d'ingestió NO exclou README.md (filtra només fitxers .hidden). El README conté info valuosa: overview del projecte, backends disponibles, estat actual i roadmap. Capçalera RAG: id=nexe-overview, P1, vàlida. Ara tenim 9 documents per idioma (8 docs + README). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chat.py: - Auto-save no es disparava mai: buscava choices[] (format OpenAI) però Ollama retorna message.content (format natiu). Fix: fallback a response.get("message",{}).get("content","") quan choices està buit. - Verificat: 💾 logs de save apareixen correctament server.toml prompts (small, ca/es/en): - Explicita que [CONTEXT MEMÒRIA] conté converses anteriors, no sols docs - "Usa-la com si fos la teva pròpia memòria" per millorar recall de noms Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…idden

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-15T22:28:49Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat per Uatu amb Claude Opus 4.6 en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (Claude Opus 4.6 independent, 2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades per Uatu durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

…1 Cluster 7) 9 independent assignment/arg-type findings closed via minimal annotations or casts (no behavioural change): - installer/installer_catalog_data.py:450 — cast(str, value) after truthy guard (#1) - core/config.py:115 — pre-declare found_path: Optional[Path] before if/else branch (#4) - core/cli/client.py:46 — declare self._ssl_context: Optional[ ssl.SSLContext] = None before populating in if-branch (#13) - core/cli/output.py:33 — annotate module-level console: Any to bridge the dual-decl Console / FallbackConsole (#14) - core/resources.py:110 — cast(Any, resource_path) so Path() accepts the importlib.resources Traversable that exposes __fspath__ (#17) - core/resilience/circuit_breaker.py:76 — annotate __lock_loop: Optional[asyncio.AbstractEventLoop] = None (#18) - core/dependencies.py:43-44 — annotate rate_limit_tracker / start_rate_limit_cleanup_task as Optional[Any] = None in the import fallback (#29, #30) - core/cli/cli.py:215 — annotate found: list[tuple[str, Optional[str], list[int]]] = [] (#62)

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

…1 Cluster 7) 9 independent assignment/arg-type findings closed via minimal annotations or casts (no behavioural change): - installer/installer_catalog_data.py:450 — cast(str, value) after truthy guard (#1) - core/config.py:115 — pre-declare found_path: Optional[Path] before if/else branch (#4) - core/cli/client.py:46 — declare self._ssl_context: Optional[ ssl.SSLContext] = None before populating in if-branch (#13) - core/cli/output.py:33 — annotate module-level console: Any to bridge the dual-decl Console / FallbackConsole (#14) - core/resources.py:110 — cast(Any, resource_path) so Path() accepts the importlib.resources Traversable that exposes __fspath__ (#17) - core/resilience/circuit_breaker.py:76 — annotate __lock_loop: Optional[asyncio.AbstractEventLoop] = None (#18) - core/dependencies.py:43-44 — annotate rate_limit_tracker / start_rate_limit_cleanup_task as Optional[Any] = None in the import fallback (#29, #30) - core/cli/cli.py:215 — annotate found: list[tuple[str, Optional[str], list[int]]] = [] (#62)

jgoy-labs and others added 30 commits February 4, 2026 23:07

fix: unificar nom server-nexe (inconsistències crítiques)

6d7ebe1

- security_logger/logger.py: hostname nexe-server → server-nexe - RUNTIME_CONTRACT.md: nexe.core.server_nexe → core.app (mòdul real) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: unificar nom server-nexe (inconsistències mitjanes)

dd25901

- manifest.toml (×8): server.nexe/ → server-nexe/ (comentaris i paths) - nexe script: path hardcodat /NatSytem/server-nexe → /NatSytem/Nexe/server-nexe Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: unificar nom server-nexe (inconsistències baixes)

86a988a

- cli/output.py: banner title server.nexe → server-nexe - security/manifest.py: comentari server.nexe root → server-nexe root Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: setup.sh — YELLOW no definit

6422363

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: setup.sh detecta python3.11 de Homebrew automàticament

649c027

Prova python3.11/3.12/3.10, paths Homebrew (/opt/homebrew), i /usr/local/bin abans de caure a python3 del sistema. Usa PYTHON_BIN per llançar install_nexe.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: afegir chmod +x a les instruccions d'instal·lació

7f0e097

ZIP de GitHub no preserva permisos d'execució. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: i18n MLX validation strings (ca/es/en)

6228b46

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

jgoy-labs and others added 16 commits March 13, 2026 17:44

fix: afegir lucide.min.js.map buit per eliminar 404 del navegador

7c96f4e

feat: logo SVG al sidebar header, treu v0.8 i text Nexe

811b058

fix: usar logo.png en lloc de SVG (font Nunito no carrega en img)

f4efab8

fix: mides logo sidebar 20px, splash 48px

0dd5ab3

fix: logo splash 450px, sidebar 120px

12a28a5

fix: logo sidebar 160px, splash 550px, object-fit contain, overflow h…

ee763e6

…idden

fix: app-container marges superiors i laterals respecten el marc animat

f59ab64

fix: logo per alçada (28px), treu margin-left del container

7c638b9

fix: crop logo.png (710x73, sense espai blanc) + logo sidebar 24px

6f1dd8a

fix: logo sidebar 16px

2472168

fix: logo sidebar 13px

47470e5

fix: body margin:0 padding:0 per eliminar gap entre body i marc

3dbad58

fix: app-container respecta marc esquerra i dreta

9aa609c

feat: status indicator dinàmic (ping /status cada 10s)

9767b74

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 15, 2026

jgoy-labs force-pushed the main branch from e7641d9 to 96de797 Compare March 15, 2026 20:53

jgoy-labs closed this Mar 15, 2026

jgoy-labs deleted the dependabot/github_actions/actions/download-artifact-8 branch March 15, 2026 22:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump actions/download-artifact from 4 to 8#13

chore(deps): bump actions/download-artifact from 4 to 8#13
dependabot[bot] wants to merge 179 commits into
mainfrom
dependabot/github_actions/actions/download-artifact-8

dependabot Bot commented on behalf of github Mar 15, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 15, 2026

v8.0.0

v8 - What's new

Direct downloads

Enforced checks (breaking)

ESM

What's Changed

v7.0.0

v7 - What's new

Node.js 24

What's Changed

New Contributors

v6.0.0

Uh oh!

dependabot Bot commented on behalf of github Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant