chore(deps): bump actions/setup-python from 5 to 6 by dependabot[bot] · Pull Request #5 · jgoy-labs/server-nexe

dependabot · 2026-03-08T19:27:24Z

Release notes

Sourced from actions/setup-python's releases.

v6.0.0

What's Changed

Breaking Changes

Upgrade to node 24 by @salmanmkc in actions/setup-python#1164

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Enhancements:

Add support for pip-version by @priyagupta108 in actions/setup-python#1129

Enhance reading from .python-version by @krystof-k in actions/setup-python#787

Add version parsing from Pipfile by @aradkdj in actions/setup-python#1067

Bug fixes:

Clarify pythonLocation behaviour for PyPy and GraalPy in environment variables by @aparnajyothi-y in actions/setup-python#1183

Change missing cache directory error to warning by @aparnajyothi-y in actions/setup-python#1182

Add Architecture-Specific PATH Management for Python with --user Flag on Windows by @aparnajyothi-y in actions/setup-python#1122

Include python version in PyPy python-version output by @cdce8p in actions/setup-python#1110

Update docs: clarification on pip authentication with setup-python by @priya-kinthali in actions/setup-python#1156

Dependency updates:

Upgrade idna from 2.9 to 3.7 in /tests/data by @dependabot[bot] in actions/setup-python#843

Upgrade form-data to fix critical vulnerabilities #182 & #183 by @aparnajyothi-y in actions/setup-python#1163

Upgrade setuptools to 78.1.1 to fix path traversal vulnerability in PackageIndex.download by @aparnajyothi-y in actions/setup-python#1165

Upgrade actions/checkout from 4 to 5 by @dependabot[bot] in actions/setup-python#1181

Upgrade @actions/tool-cache from 2.0.1 to 2.0.2 by @dependabot[bot] in actions/setup-python#1095

New Contributors

@krystof-k made their first contribution in actions/setup-python#787

@cdce8p made their first contribution in actions/setup-python#1110

@aradkdj made their first contribution in actions/setup-python#1067

Full Changelog: actions/setup-python@v5...v6.0.0

v5.6.0

What's Changed

Workflow updates related to Ubuntu 20.04 by @aparnajyothi-y in actions/setup-python#1065

Fix for Candidate Not Iterable Error by @aparnajyothi-y in actions/setup-python#1082

Upgrade semver and @types/semver by @dependabot in actions/setup-python#1091

Upgrade prettier from 2.8.8 to 3.5.3 by @dependabot in actions/setup-python#1046

Upgrade ts-jest from 29.1.2 to 29.3.2 by @dependabot in actions/setup-python#1081

Full Changelog: actions/setup-python@v5...v5.6.0

v5.5.0

What's Changed

Enhancements:

Support free threaded Python versions like '3.13t' by @colesbury in actions/setup-python#973

Enhance Workflows: Include ubuntu-arm runners, Add e2e Testing for free threaded and Upgrade @action/cache from 4.0.0 to 4.0.3 by @priya-kinthali in actions/setup-python#1056

Add support for .tool-versions file in setup-python by @mahabaleshwars in actions/setup-python#1043

Bug fixes:

Fix architecture for pypy on Linux ARM64 by @mayeut in actions/setup-python#1011 This update maps arm64 to aarch64 for Linux ARM64 PyPy installations.

... (truncated)

Commits

a309ff8 Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)
bfe8cc5 Upgrade @actions dependencies to Node 24 compatible versions (#1259)
4f41a90 Bump urllib3 from 2.5.0 to 2.6.0 in /tests/data (#1253)
83679a8 Bump @types/node from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel ...
bfc4944 Bump prettier from 3.5.3 to 3.6.2 (#1234)
97aeb3e Bump requests from 2.32.2 to 2.32.4 in /tests/data (#1130)
443da59 Bump actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pi...
cfd55ca graalpy: add graalpy early-access and windows builds (#880)
bba65e5 Bump typescript from 5.4.2 to 5.9.3 and update docs/advanced-usage.md (#1094)
18566f8 Improve wording and "fix example" (remove 3.13) on testing against pre-releas...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Documentació corregida i actualitzada: - API.md: Endpoints correctes amb /v1/, dual-key auth, X-API-Key headers - SECURITY.md: Configuració real (server.toml), paths correctes, MAX_SCAN_LENGTH - RAG.md: Sistema híbrid embeddings (nomic-embed-text 768d), 3 col·leccions, chunking en caràcters - USAGE.md: CLI real (memory recall/store/stats/cleanup, knowledge ingest), autenticació obligatòria - README.md: Stack correcte (Click+Rich), compatibilitat OpenAI parcial, SECURITY.md afegit Canvis principals documentació: - Models embeddings: Ollama nomic-embed-text (768 dims) + fallbacks documentats - Col·leccions Qdrant: nexe_chat_memory, nexe_documentation, user_knowledge - Thresholds diferenciats: 0.4 (docs), 0.35 (knowledge), 0.3 (memory) - Chunking: 1500/200 chars (text general), 800/100 (RAG endpoint) - Autenticació X-API-Key obligatòria a tots els endpoints /v1/* - CLI real: store|recall|stats|cleanup (no search/list/delete) - Paths correctes: storage/qdrant/, /v1/memory/*, /api/info Codi NEXE 0.8 complet afegit: - Core: FastAPI server, CLI, endpoints, loaders - Plugins: MLX, llama.cpp, Ollama, security, web UI - Memory: RAG system, embeddings, Qdrant integration - Personality: i18n, module management, configuration Eliminats: - PRODUCTION_PLAN.md - REVIEW_SUPERCONSULTOR_2026-01-31.md Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…cepts - memory/rag/routers/endpoints.py: ALLOWED_UPLOAD_EXTENSIONS whitelist, filename sanitization (Path.name) to prevent path traversal, generic 500 error messages (no internal details exposed) - core/endpoints/root.py: /health/ready returns only {status, timestamp} to avoid exposing internal module list without auth - plugins/web_ui_module/session_manager.py: implement cleanup_inactive() with timedelta TTL to prevent session memory leak - memory/memory/engines/persistence.py: QDRANT_API_KEY env var support for authenticated Qdrant deployments - core/endpoints/chat.py: log JSONDecodeError in Ollama stream, handle asyncio.CancelledError on client disconnect - plugins/web_ui_module/memory_helper.py: replace bare except with except Exception + debug logging - .env.example: document all env vars including QDRANT_API_KEY - .dockerignore: exclude .env, storage/, venv/, .git/ from Docker image - .github/workflows/ci.yml: pip-audit CVE scan + unit tests - core/endpoints/tests/test_security.py: 14 security regression tests Assisted by AI

- fastapi 0.109.0 → 0.128.8 (starlette 0.49.1+, tanca GHSA-2c2j + GHSA-7f5h) - uvicorn 0.27.0.post1 → 0.34.3 - pydantic 2.6.0 → 2.10.6 - python-multipart 0.0.6 → 0.0.22 (tanca GHSA-wp53-j4wj-2cfg) - httpx 0.26.0 → 0.27.2 - qdrant-client 1.12.0 → 1.13.3 - structlog 24.1.0 → 25.5.0 - tenacity 8.2.3 → 9.1.2 - python-dotenv 1.0.1 → 1.2.1 - huggingface_hub 0.20.3 → 0.36.2 - sentence-transformers 2.3.1 → 2.7.0 - pypdf 4.0.1 → 6.7.1 (tanca 7 CVEs GHSA-*) - numpy 1.26.4 mantingut (numpy 2.x breaking changes) - rich/typer mantinguts (cadena de compatibilitat) Verificat: pip-audit 0 vulnerabilitats, 14/14 tests passen Assisted by AI

… endpoints M-7: personality/i18n/i18n_manager.py i modular_i18n.py usaven 8 línies de codi duplicat per cercar server.toml. Ara deleguen a core.config.find_config_path (funció centralitzada ja existent). M-8: personality/i18n/__init__.py: _global_i18n = None s'inicialitzava lazy sense lock. Afegit threading.Lock + double-checked locking per evitar race condition en entorns async/multi-thread. T-3: memory/rag/tests/test_endpoints.py: 14 tests unitaris nous pels endpoints RAG (upload, search, add_document, whitelist extensions). Cobreixen: validació extensions, path traversal, errors 500 genèrics, resultats correctes, metadades invàlides, fitxers massa grans. Total tests: 28/28 passen. Assisted by AI

…p.state - factory_state.py: eliminar 4 crides register_service() (codi mort) - lifespan.py: sincronitzar app.state.config amb server_state.config en reload - memory/module.py: substituir get_service() per get_i18n() i get_server_state() - web_ui/manifest.py: substituir get_service("module_manager") per get_server_state() - container.py: marcar com a DEPRECATED (mantingut per tests, eliminar en v0.9) Resultat: font única per a cada objecte; desync config eliminat. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

N-1: server.toml → production, debug=false, reload=false N-2: system.py → PID i kill commands eliminats de respostes HTTP N-3: memory/api/v1.py → str(e) → error genèric + exc_info=True N-4: manifest.py → path traversal /ui/static/ bloquejat (resolve+startswith) N-5: session cleanup asyncio periòdic (cada hora, TTL 24h) N-6: system health → versió llegida de config (no hardcoded "0.7.1") N-7+N-8: manifest.py → import duplicat + _initialized eliminats Tests: +35 (test_security_n_series.py), total 49 passed Docs: SECURITY.md secció N-series afegida Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- security_logger/logger.py: hostname nexe-server → server-nexe - RUNTIME_CONTRACT.md: nexe.core.server_nexe → core.app (mòdul real) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- manifest.toml (×8): server.nexe/ → server-nexe/ (comentaris i paths) - nexe script: path hardcodat /NatSytem/server-nexe → /NatSytem/Nexe/server-nexe Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- cli/output.py: banner title server.nexe → server-nexe - security/manifest.py: comentari server.nexe root → server-nexe root Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- setup.sh: comprovació Python >=3.10 amb missatge clar (brew install python@3.11) (python-multipart==0.0.22 i altres deps requereixen Python 3.10+) - install_nexe.py: logo tagline traduït a català Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- 14 strings hardcoded ara passen per t() (ca/es/en) - Afegides 37 claus noves a les 3 traduccions: - Pantalla selecció de models (mida, model, motor) - Descàrrega Ollama/GGUF/MLX (progress steps) - Metal fallback (opcions, missatges d'error) - rec_label ara usa t('size_small/medium/large') - "Motors:" ara usa t('engines_label') Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Prova python3.11/3.12/3.10, paths Homebrew (/opt/homebrew), i /usr/local/bin abans de caure a python3 del sistema. Usa PYTHON_BIN per llançar install_nexe.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ZIP de GitHub no preserva permisos d'execució. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- MODEL_CATALOG: lang i description ara dicts {ca/es/en} per a 7 models - Afegides claus disk_label i fits_tight a les 3 traduccions - Display: usa model['lang'][LANG], model['description'][LANG] - "💾 Disc:" → t('disk_label') (Disc/Disco/Disk) - "Pot anar just" → t('fits_tight') Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

install_nexe.py: - Strings embeddings download/validation ara usen t() - Passa NEXE_LANG com a env var al subprocess d'ingesta - Afegides claus: embeddings_*, processing_knowledge_*, knowledge_indexed_ok core/ingest/ingest_knowledge.py: - Afegit _I18N dict + _t() que llegeix NEXE_LANG - Tots els missatges ara multilingüe (ca/es/en) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- knowledge/: 9 documents amb capçalera # === METADATA RAG === (id, abstract, tags, chunk_size, priority). README.md mogut de l'arrel a knowledge/ i ara és ingestable (id: nexe-overview, P1). - Exclusió README.md eliminada dels 4 punts d'ingestió (lifespan, cli, ingest_knowledge, install_nexe). - header_parser.py: fix _extract_header — blank lines seguides de comentaris de secció (# ===) ja no trenquen el parsing. - OpenAPI: summary= afegit als 33 endpoints; tags= a routers sense etiquetar (system, modules); descripció global enriquida a factory_app.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Docs moguts a knowledge/ca/ (estructura multi-idioma). El glob **/*.md ja era recursiu, cap canvi de codi a ingestió. - knowledge/en/ pot afegir-se quan calgui. - chat.py: cerca user_knowledge filtra per lang=NEXE_LANG (default 'ca') via filter_metadata — usa FieldCondition Qdrant existent. Cada idioma de servidor retorna només docs en el seu idioma. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- chat.py: llegeix idioma de req.app.state.i18n.current_language en runtime (p.ex. "ca-ES" → "ca"). Fallback: NEXE_LANG env → "ca". Aix\xed el selector d'idioma del servidor afecta la cerca RAG immediatament. - Afegides carpetes knowledge/es/ i knowledge/en/ (buides) per docs futurs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- knowledge/es/: 9 documents traduïts (API, ARCHITECTURE, INSTALLATION, LIMITATIONS, PLUGINS, RAG, README, SECURITY, USAGE) - knowledge/en/: 9 documents traduïts - Capçaleres RAG actualitzades: lang ca→es/en, abstract i tags traduïts - Termes tècnics, blocs de codi, paths i URLs preservats intactes - 27/27 documents passen validació parse_rag_header Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- core/ingest/ingest_knowledge.py: usa knowledge/{NEXE_LANG}/ si existeix - core/lifespan.py: aplica mateix filtre de llengua a auto-ingest startup - core/cli/cli.py: aplica filtre de llengua a 'nexe knowledge ingest' - install_nexe.py: detecta subcarpeta de llengua per comptatge de fitxers - knowledge/*.md: eliminats de l'arrel (moviment completat a knowledge/ca/) - requirements.txt: qdrant-client==1.13.3 → >=1.17.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

profiles.py: - CONSUMER: gemma2:2b → phi3.5 (Phi-3.5 Mini 3.8B, millor instruccions) - PRO: llama3.2:3b → llama3.1:8b (adequat per 16-32GB RAM) secondary: gemma2:9b → mistral:7b | embedding: nomic → all-MiniLM-L6-v2 context_window: 16384 → 32768 - ULTRA: llama3.1:8b → llama3.1:70b (qualitat màxima per >32GB) secondary: mistral-nemo:12b → mixtral:8x7b embedding: mxbai-embed-large → all-MiniLM-L6-v2 context_window: 32768 → 65536 registry.py — afegits 4 nous models: - salamandra2b (BSC/AINA, Ollama, llengües ibèriques) - salamandra7b (BSC/AINA, Ollama+GGUF, el millor per català) - mistral7b (MLX+Ollama+GGUF, equilibri qualitat/velocitat) - llama3.1-70b (MLX+Ollama+GGUF, qualitat professional) - mixtral (MLX+Ollama+GGUF, MoE 8x7B) server.toml: - secondary: "mistral-nemo:12b" → "" (engine-specific, no hardcoded) - embedding: "mxbai-embed-large" → "all-MiniLM-L6-v2" (model real del sistema) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…EFAULT_MODEL Problema: _forward_to_ollama usava NEXE_DEFAULT_MODEL que pot contenir una URL HuggingFace (per llama_cpp/mlx), causant fallback silenciós al primer model disponible d'Ollama sense cap avís. Solució: - Prioritat nova: request.model > NEXE_OLLAMA_MODEL > NEXE_DEFAULT_MODEL (si no és URL/path) > config > "llama3.2" - NEXE_DEFAULT_MODEL amb URLs o paths locals s'ignora per Ollama - install_nexe.py escriu NEXE_OLLAMA_MODEL quan l'engine és ollama - _update_env_model_config gestiona NEXE_OLLAMA_MODEL en actualitzacions - Retrocompatible: instal·lacions existents amb NEXE_DEFAULT_MODEL=nom-ollama segueixen funcionant Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

llama_cpp_module/config.py: - chat_format default: "gemma" → "chatml" (2 llocs: dataclass + from_env) - valid_formats ampliat: afegits "llama-3" i "phi-3" install_nexe.py: - MODEL_CATALOG: camp "chat_format" a cada model GGUF · phi35/salamandra2b/salamandra7b: "chatml" · mistral7b/mixtral: "mistral" · llama31_8b/llama31_70b: "llama-3" - generate_env_file: escriu NEXE_LLAMA_CPP_CHAT_FORMAT per engine llama_cpp - _update_env_model_config: actualitza NEXE_LLAMA_CPP_CHAT_FORMAT en reinstal·lació MLX: no requereix canvis — mlx-lm llegeix el chat template del tokenizer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…Server Nexe server.toml — 6 prompts nous [personality.prompt]: - ca_small / ca_full: Nexe com a expert de Server Nexe en català - es_small / es_full: versió castellà - en_small / en_full: versió anglès - small (~100 tok): per a models ≤4B (Phi-3.5, Salamandra 2B) - full (~200 tok): per a models 7B+ (Llama 3.1, Mistral, Salamandra 7B) core/endpoints/chat.py — _get_system_prompt(): - Selecciona prompt per lang (NEXE_LANG/i18n) + tier (NEXE_PROMPT_TIER) - Injecta system prompt automàticament si la request no en porta cap - RAG context sempre s'afegeix al system message (index 0) plugins/web_ui_module/manifest.py: - base_system_prompt llegit de server.toml via _get_system_prompt() - Fallback al mínim hardcoded si config no disponible install_nexe.py: - MODEL_CATALOG: camp "prompt_tier" a cada model (small/full) - generate_env_file + _update_env_model_config: escriuen NEXE_PROMPT_TIER Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El filtre de knowledge docs usava i18n.current_language ("en-US" per defecte del mòdul i18n) en lloc de NEXE_LANG ("ca"). Aixó feia que el filtre metadata{"lang":"en"} no coincidís amb els docs indexats {"lang":"ca"}, retornant 0 resultats de user_knowledge. Fix: _server_lang es determina amb os.getenv("NEXE_LANG","ca") fora del bloc use_rag, garantint que sempre estigui disponible per al system prompt i que el filtre RAG sigui correcte. - Tokens de prompt: 142 → 621 (context RAG real injectat) - user_knowledge: 0 → 3 resultats per query de documentació - .gitignore: COMMANDS.md i personality/.module_cache.json Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El codi d'ingestió exclou explícitament README.md. Eliminem els 3 fitxers (ca/en/es) per evitar confusió. Les capçaleres RAG als 24 documents (8 per idioma) ja estaven afegides en sessió anterior. Verificat: 24/24 capçaleres ✓ (parse_rag_header sense errors) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

El codi d'ingestió NO exclou README.md (filtra només fitxers .hidden). El README conté info valuosa: overview del projecte, backends disponibles, estat actual i roadmap. Capçalera RAG: id=nexe-overview, P1, vàlida. Ara tenim 9 documents per idioma (8 docs + README). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chat.py: - Auto-save no es disparava mai: buscava choices[] (format OpenAI) però Ollama retorna message.content (format natiu). Fix: fallback a response.get("message",{}).get("content","") quan choices està buit. - Verificat: 💾 logs de save apareixen correctament server.toml prompts (small, ca/es/en): - Explicita que [CONTEXT MEMÒRIA] conté converses anteriors, no sols docs - "Usa-la com si fos la teva pròpia memòria" per millorar recall de noms Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Eliminat `^/ui/` de _CSRF_EXEMPT_PATTERNS: chat i upload reben protecció CSRF real (la UI ja enviava X-CSRF-Token via fetchWithCsrf) - Afegit header_name="X-CSRF-Token" al CSRFMiddleware per alinear-lo amb el codi JS (el default de starlette-csrf és x-csrftoken, diferent) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ci.yml: - Separat job 'badge' (contents: write) del job 'tests' (contents: read) El permís d'escriptura queda aïllat al job mínim que el necessita - Test credentials via secrets amb fallback dummy per coherència: NEXE_CI_API_KEY / NEXE_CI_CSRF_SECRET (GitHub Secrets opcional) core/ingest/ingest_docs.py: - Substituïts tots els print() per logger.info/error (structured logging) core/ingest/ingest_knowledge.py: - log() ara usa logger.info() en comptes de print() core/server/tests/test_factory_cache.py: - Skip documentat amb raó i path forward (integration test) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 6. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-15T22:28:50Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat per Uatu amb Claude Opus 4.6 en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (Claude Opus 4.6 independent, 2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades per Uatu durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

Fix-All BUS sobre 3 tracks paral·lels per resoldre tots els bugs del QA post-BUS de normalització abans del DMG v0.9.0. 8 commits dev consolidats en aquest sync. TRACK A — Memory/RAG/Sessions - Bug #1 (PID file canònic) — single source of truth a storage/run/server.pid - F5 — 3 col·leccions canòniques (nexe_web_ui, user_knowledge, nexe_documentation) creades a get_memory_api() en lloc de només la primera - F7 — ingest_knowledge defaulteja a nexe_documentation (era user_knowledge) i és idempotent (eliminada la sequence delete_collection + create_collection destructiva que esborrava docs ad-hoc dels usuaris a cada install) - F8 — root cause empíric Bug #4: MemoryModule obria un SEGON QdrantClient real a storage/vectors/qdrant_local/, divergent del singleton del pool. MEM_SAVE escrivia a una col·lecció, MEM_RECALL llegia d'una altra. Ara tots dos comparteixen storage/vectors/. - F1 — _check_duplicate retorna contracte honest (success=False, duplicate=True) enlloc de fingir success=True amb document_id=None. Era el segon root cause de Bug #4: el dedup bloquejava SAVEs amb fals positius silenciats. - F2 — typo cols list (nexe_web_ui duplicat) - F3 — list_memories scroll-based (sense semantic search amb query anglesa) - Bug #10 — collections= filter a list/save/delete (sidebar checks reals) - Bug #6 — frontend hydration document attached. Eren 2 bugs encadenats: l'endpoint /history no retornava attached_document, i removeFilePreview() feia POST /clear-document destructiu cada switch de sessió. - Bug #3 — MEM_SAVE-only response fallback. Quan el model emet només [MEM_SAVE: ...] sense text envoltant, ara genera 'Memòria desada: <fact>' perquè el bloc save s'executi i el frontend mostri confirmació. - auto_save crida eliminada per HOMAD memoria v1 (2026-04-01) — manual MEM_SAVE only fins a Part 2. TRACK B — Tray / Multi-instance / Packaging - Bug #1 (PID file) compartit amb Track A - Bug #2 — setproctitle a server i tray (server-nexe / nexe-tray a ps/Activity Monitor). Force Quit encara mostra Python perquè requereix CFBundleName via .app bundle real (deute v0.9.1). - Bug #9 — menu polish: server-nexe.com duplicat substituït per '📖 Documentació' al main level (3 idiomes), website_item es manté al submenú Configuració. TRACK C — UX cosmètic - Bug #5 — slow_request middleware exclou /ui/upload (uploads naturalment triguen >1s i el log apareixia duplicat amb l'access log d'uvicorn). - Bug #8 — 3 ⓘ visibles als checkboxes del sidebar de col·leccions amb tooltips als 3 idiomes (la infraestructura CSS/i18n ja existia). Pytest D-1 final: 4424 passed, 0 failed, 35 skipped, 1 xfailed, 86% coverage en 76.11s. Baseline pre-BUS era 4396. +28 tests nous, ZERO regressions. Tests nous: - tests/test_pid_file.py: 7 tests Bug #1 - tests/test_ingest_knowledge_idempotent.py: 8 tests F7 (3 classes) - plugins/web_ui_module/tests/test_memory_helper_async.py: 1 test F1 - plugins/web_ui_module/tests/test_memory_delete.py: 7 tests F3+Bug#10 - plugins/web_ui_module/tests/test_mem_save_injection.py: 5 tests Bug #3 Out of scope (deute v0.9.1+): - routes_chat.py 54KB decapitació general (deute formal P0) - Bundle .app real amb py2app per CFBundleName (deute v0.9.1) - Resums per capítol (Part 2 redisseny memory) - RDBMS font de veritat + vector store reconstruïble (HOMAD memoria v1, Part 2)

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

Fix-All BUS sobre 3 tracks paral·lels per resoldre tots els bugs del QA post-BUS de normalització abans del DMG v0.9.0. 8 commits dev consolidats en aquest sync. TRACK A — Memory/RAG/Sessions - Bug #1 (PID file canònic) — single source of truth a storage/run/server.pid - F5 — 3 col·leccions canòniques (nexe_web_ui, user_knowledge, nexe_documentation) creades a get_memory_api() en lloc de només la primera - F7 — ingest_knowledge defaulteja a nexe_documentation (era user_knowledge) i és idempotent (eliminada la sequence delete_collection + create_collection destructiva que esborrava docs ad-hoc dels usuaris a cada install) - F8 — root cause empíric Bug #4: MemoryModule obria un SEGON QdrantClient real a storage/vectors/qdrant_local/, divergent del singleton del pool. MEM_SAVE escrivia a una col·lecció, MEM_RECALL llegia d'una altra. Ara tots dos comparteixen storage/vectors/. - F1 — _check_duplicate retorna contracte honest (success=False, duplicate=True) enlloc de fingir success=True amb document_id=None. Era el segon root cause de Bug #4: el dedup bloquejava SAVEs amb fals positius silenciats. - F2 — typo cols list (nexe_web_ui duplicat) - F3 — list_memories scroll-based (sense semantic search amb query anglesa) - Bug #10 — collections= filter a list/save/delete (sidebar checks reals) - Bug #6 — frontend hydration document attached. Eren 2 bugs encadenats: l'endpoint /history no retornava attached_document, i removeFilePreview() feia POST /clear-document destructiu cada switch de sessió. - Bug #3 — MEM_SAVE-only response fallback. Quan el model emet només [MEM_SAVE: ...] sense text envoltant, ara genera 'Memòria desada: <fact>' perquè el bloc save s'executi i el frontend mostri confirmació. - auto_save crida eliminada per HOMAD memoria v1 (2026-04-01) — manual MEM_SAVE only fins a Part 2. TRACK B — Tray / Multi-instance / Packaging - Bug #1 (PID file) compartit amb Track A - Bug #2 — setproctitle a server i tray (server-nexe / nexe-tray a ps/Activity Monitor). Force Quit encara mostra Python perquè requereix CFBundleName via .app bundle real (deute v0.9.1). - Bug #9 — menu polish: server-nexe.com duplicat substituït per '📖 Documentació' al main level (3 idiomes), website_item es manté al submenú Configuració. TRACK C — UX cosmètic - Bug #5 — slow_request middleware exclou /ui/upload (uploads naturalment triguen >1s i el log apareixia duplicat amb l'access log d'uvicorn). - Bug #8 — 3 ⓘ visibles als checkboxes del sidebar de col·leccions amb tooltips als 3 idiomes (la infraestructura CSS/i18n ja existia). Pytest D-1 final: 4424 passed, 0 failed, 35 skipped, 1 xfailed, 86% coverage en 76.11s. Baseline pre-BUS era 4396. +28 tests nous, ZERO regressions. Tests nous: - tests/test_pid_file.py: 7 tests Bug #1 - tests/test_ingest_knowledge_idempotent.py: 8 tests F7 (3 classes) - plugins/web_ui_module/tests/test_memory_helper_async.py: 1 test F1 - plugins/web_ui_module/tests/test_memory_delete.py: 7 tests F3+Bug#10 - plugins/web_ui_module/tests/test_mem_save_injection.py: 5 tests Bug #3 Out of scope (deute v0.9.1+): - routes_chat.py 54KB decapitació general (deute formal P0) - Bundle .app real amb py2app per CFBundleName (deute v0.9.1) - Resums per capítol (Part 2 redisseny memory) - RDBMS font de veritat + vector store reconstruïble (HOMAD memoria v1, Part 2)

… Cluster 6) PEP 484 forbids implicit Optional. Annotates Optional[X] = None in: - core/config.py:261 — get_module_allowlist(config) (#5) - core/cli/utils/api_client.py:29 — NexeAPIClient.__init__(base_url) (#9) - core/cli/chat_cli.py:99 — _format_stats_line(model_name) (#19) - core/endpoints/chat.py:67 — _get_system_prompt(lang) (#59) The dependent arg-type finding #28 (chat_cli.py:423 forwarding the dict value to _format_stats_line) disappears via the #19 fix. 5 mypy findings closed in one edit, no behavioural change.

… nous Release consolidada v0.9.0 resultant de dues fases de treball: ## Fase 1 — Sprints 0-4 vacances 2-5 abril (42 bugs) Coordinat en sessions independents: - **Sprint 0-1**: memoria v1 (Qdrant embedded singleton, SessionManager v1) - **Sprint 2**: fix critic tray.py bloqueja teclat (_RamMonitor background) - **Sprint 3**: 13 bugs test instal·lacio neta + 5 fixes installer - #12 guard thinking+MEM_SAVE, #13 labels col·leccions, #14 pantalla benvinguda clickable, #15 i18n general, #16 tray nom+versio, #17 tray link web, #20 SEC-004 MIME validation - Installer: select_model() prompt_tier+chat_format, validacio Metal MLX - **Sprint 4**: refactoring — helpers extrets (ollama_helpers.py, tray_monitor.py, lifespan_modules.py), DEFAULT_VECTOR_SIZE constant, i18n get_message() complet - **Director 01/04**: 5 UX features (copy, sidebar, rename, donate, X doc) + 3 memory fixes (MEM_SAVE post-render strip, XSS fix, race condition Lock, [MEM:N] token mismatch) Auditoria global final APTE (2026-04-02). ## Fase 2 — HOMAD 2026-04-06 (27 bugs + Ollama GUI) 3 blocs de bugs del fitxer bugs-server-nexe.md (pre-release test): **Bloc 1 — Critics (5)** - #7 Reinstal·lacio 3 modes (wipe/overwrite/backup) + stop server + Keychain - #8 TOCTOU master key (os.open atomic) - #10 DreamingCycle connection leak (6/6 funcions) - #29 Phi-3.5 fora del cataleg - Ollama GUI: ollama serve headless (no open -a Ollama al Dock) **Bloc 2 — Mitjana (12)** - #21 validate_string_input API v1 - #22 auth 21 endpoints + docs gated - #17 MEM_SAVE injection strict (whitelist Unicode, blacklist) - #32 history_floor context budget - #15 Ollama breaker semantic (4xx no infra) - #16 SessionManager RLock reentrant - #19 MLX cache singleton double-checked locking - #11 Bootstrap token renewal + retry backoff (1,5,30) - #13 Qdrant pool flush + logger.warning - #20 Module cycles consumer + startup summary - #9 SQL MIN portable (Python min()) - #28 Installer --skip-model-download **Bloc 3 — Baixa (11)** - #3 HF_TOKEN warning silenciat - #4 ANSI constants buides sense TTY - #5 Qdrant didactic isatty guards - #6 warnings position_ids + Some weights filtered - #12 discover_modules early return - #14 TQDM_DISABLE runtime servidor - #18 encoding fallback utf-8 → cp1252 → latin-1 - #23 Ollama no silent fallback → HTTPException 404 - #26 _backend_model_exists best-effort + logger mitigant - #27 _BACKEND_ALIASES backwards-compat - #30 Info.plist LSUIElement=false verificats Workflow HOMAD: Dev paral·lels (Opus) + 9 passades Consultor independents amb Dev D intermedi per findings. Tot verificat al codi real. ## Pytest consolidat **4389 passed**, 7 fails pre-existents (test_chat_unit::test_long_text_truncated, test_root::test_enabled_modules, test_security::test_long_context_truncated, 4× test_memory_helper_async::TestGetMemoryApi), 0 regressions. ## Fitxers nous - core/endpoints/chat_engines/ollama_helpers.py (Sprint 4) - core/lifespan_modules.py (Sprint 4) - installer/tray_monitor.py (Sprint 4) - installer/installer_reinstall.py (Bloc 1 Bug 7) ## Stats - 61 fitxers modificats (57 codi/knowledge/tests/installer/personality + README.md + 3 nous) - +1870 / -674 linies ## Version bump v0.8.5 → v0.9.0 (cataleg, pyproject, README, CHANGELOG, index.html, footer) ## Post-release pendent - Build DMG v0.9.0 (/dmg-nexe) amb tots els fixes - Notaritzacio Apple (re-firma si cal) - Test manual DMG per Bug 30 (icona Dock) + smoke tests release - Webs .org i .com ja desplegades durant vacances NO PUSH en aquest commit — pendent OK explicit Jordi per al tag v0.9.0 final i push a GitHub release.

Fix-All BUS sobre 3 tracks paral·lels per resoldre tots els bugs del QA post-BUS de normalització abans del DMG v0.9.0. 8 commits dev consolidats en aquest sync. TRACK A — Memory/RAG/Sessions - Bug #1 (PID file canònic) — single source of truth a storage/run/server.pid - F5 — 3 col·leccions canòniques (nexe_web_ui, user_knowledge, nexe_documentation) creades a get_memory_api() en lloc de només la primera - F7 — ingest_knowledge defaulteja a nexe_documentation (era user_knowledge) i és idempotent (eliminada la sequence delete_collection + create_collection destructiva que esborrava docs ad-hoc dels usuaris a cada install) - F8 — root cause empíric Bug #4: MemoryModule obria un SEGON QdrantClient real a storage/vectors/qdrant_local/, divergent del singleton del pool. MEM_SAVE escrivia a una col·lecció, MEM_RECALL llegia d'una altra. Ara tots dos comparteixen storage/vectors/. - F1 — _check_duplicate retorna contracte honest (success=False, duplicate=True) enlloc de fingir success=True amb document_id=None. Era el segon root cause de Bug #4: el dedup bloquejava SAVEs amb fals positius silenciats. - F2 — typo cols list (nexe_web_ui duplicat) - F3 — list_memories scroll-based (sense semantic search amb query anglesa) - Bug #10 — collections= filter a list/save/delete (sidebar checks reals) - Bug #6 — frontend hydration document attached. Eren 2 bugs encadenats: l'endpoint /history no retornava attached_document, i removeFilePreview() feia POST /clear-document destructiu cada switch de sessió. - Bug #3 — MEM_SAVE-only response fallback. Quan el model emet només [MEM_SAVE: ...] sense text envoltant, ara genera 'Memòria desada: <fact>' perquè el bloc save s'executi i el frontend mostri confirmació. - auto_save crida eliminada per HOMAD memoria v1 (2026-04-01) — manual MEM_SAVE only fins a Part 2. TRACK B — Tray / Multi-instance / Packaging - Bug #1 (PID file) compartit amb Track A - Bug #2 — setproctitle a server i tray (server-nexe / nexe-tray a ps/Activity Monitor). Force Quit encara mostra Python perquè requereix CFBundleName via .app bundle real (deute v0.9.1). - Bug #9 — menu polish: server-nexe.com duplicat substituït per '📖 Documentació' al main level (3 idiomes), website_item es manté al submenú Configuració. TRACK C — UX cosmètic - Bug #5 — slow_request middleware exclou /ui/upload (uploads naturalment triguen >1s i el log apareixia duplicat amb l'access log d'uvicorn). - Bug #8 — 3 ⓘ visibles als checkboxes del sidebar de col·leccions amb tooltips als 3 idiomes (la infraestructura CSS/i18n ja existia). Pytest D-1 final: 4424 passed, 0 failed, 35 skipped, 1 xfailed, 86% coverage en 76.11s. Baseline pre-BUS era 4396. +28 tests nous, ZERO regressions. Tests nous: - tests/test_pid_file.py: 7 tests Bug #1 - tests/test_ingest_knowledge_idempotent.py: 8 tests F7 (3 classes) - plugins/web_ui_module/tests/test_memory_helper_async.py: 1 test F1 - plugins/web_ui_module/tests/test_memory_delete.py: 7 tests F3+Bug#10 - plugins/web_ui_module/tests/test_mem_save_injection.py: 5 tests Bug #3 Out of scope (deute v0.9.1+): - routes_chat.py 54KB decapitació general (deute formal P0) - Bundle .app real amb py2app per CFBundleName (deute v0.9.1) - Resums per capítol (Part 2 redisseny memory) - RDBMS font de veritat + vector store reconstruïble (HOMAD memoria v1, Part 2)

… Cluster 6) PEP 484 forbids implicit Optional. Annotates Optional[X] = None in: - core/config.py:261 — get_module_allowlist(config) (#5) - core/cli/utils/api_client.py:29 — NexeAPIClient.__init__(base_url) (#9) - core/cli/chat_cli.py:99 — _format_stats_line(model_name) (#19) - core/endpoints/chat.py:67 — _get_system_prompt(lang) (#59) The dependent arg-type finding #28 (chat_cli.py:423 forwarding the dict value to _format_stats_line) disappears via the #19 fix. 5 mypy findings closed in one edit, no behavioural change.

Synced from dev since sync-20260519. Highlights: Security (Tier S — security audit 96/100 PUSH OK): - S2 XSS api_key UI sanitization (web_ui_module/ui/app.js) - S3 /installer/finalize legacy gate via idempotency marker - S9 path traversal reject in _resolve_model_path - S10 SQLiteStore thread-safe via check_same_thread + RLock - S1 health URL boot fix - S6 fsync before close on atomic writes - S7 CancelledError catch + mid-startup signal logging - TOCTOU atomic on /installer/finalize idempotency marker - basename guard applied to all model_id download pipelines Bug fixes vespre (2026-05-21 sessions): - Bug #5 fix(qdrant): retry-with-backoff lock acquisition at startup - Bug #4 test(live): order slow LLM tests after fast ones + 10s cooldown - Bug #2+#3 test(security): replace fragile inspect-based assertions - Bug #1 chore(installer): document accepted CVEs + portable OSV checker - Bug A fix(chat): remove data:[DONE] sentinel from text/plain stream - Bug B iter-2 fix(chat): natural-language date phrase replaces "Now:" tech UI productiva (F5.5 revert + post-revert): - web_ui_module serves full UI in sidecar mode again - footer i18n + version persistence - frontend reads nexe_api_key from query string on first launch F5.3 + F5.4 onboarding wizard: - HTTP endpoints for wizard (installer/finalize, preflight, progress) - NEXE_VERSION UI injection - onboarding_state.py + optional HF token via macOS Keychain (never on disk) - installer_constants.py + installer_progress.py + check_cves_osv.py Hygiene: - 113 hardcoded "Nexe 0.9" → version centralized (UI) - /v1/system/* blocklist on sidecar URL guard - ruff/mypy/pyright/typos cleanup (multiple commits) 54 files changed total. Nous tests: 17 (security regression sentinels + onboarding wizard + qdrant + installer + sqlite concurrent + sqlite store singleton).

jgoy-labs and others added 30 commits February 4, 2026 23:07

fix: unificar nom server-nexe (inconsistències crítiques)

6d7ebe1

- security_logger/logger.py: hostname nexe-server → server-nexe - RUNTIME_CONTRACT.md: nexe.core.server_nexe → core.app (mòdul real) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: unificar nom server-nexe (inconsistències mitjanes)

dd25901

- manifest.toml (×8): server.nexe/ → server-nexe/ (comentaris i paths) - nexe script: path hardcodat /NatSytem/server-nexe → /NatSytem/Nexe/server-nexe Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: unificar nom server-nexe (inconsistències baixes)

86a988a

- cli/output.py: banner title server.nexe → server-nexe - security/manifest.py: comentari server.nexe root → server-nexe root Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: setup.sh — YELLOW no definit

6422363

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: setup.sh detecta python3.11 de Homebrew automàticament

649c027

Prova python3.11/3.12/3.10, paths Homebrew (/opt/homebrew), i /usr/local/bin abans de caure a python3 del sistema. Usa PYTHON_BIN per llançar install_nexe.py. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: afegir chmod +x a les instruccions d'instal·lació

7f0e097

ZIP de GitHub no preserva permisos d'execució. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: i18n MLX validation strings (ca/es/en)

6228b46

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

jgoy-labs and others added 2 commits March 8, 2026 17:45

chore: GitHub polish + tests hardening + pypdf security bump

0a54a91

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Mar 8, 2026

jgoy-labs and others added 8 commits March 8, 2026 20:35

ci: linux coverage + faster pip-audit; skip auto-ingest in tests

6ecbe29

test: fix linux CI env + integration markers

6d1f7ba

test: stabilize linux unit suite (no sentence_transformers import)

e897feb

ci: add coverage summary; fix CLI escape warnings

52983cd

ci: add coverage badge

971c820

docs: add linux test instructions

498b374

dependabot Bot force-pushed the dependabot/github_actions/actions/setup-python-6 branch from b662d0e to b8bae35 Compare March 8, 2026 23:57

jgoy-labs force-pushed the main branch 2 times, most recently from e7641d9 to 96de797 Compare March 15, 2026 20:53

jgoy-labs closed this Mar 15, 2026

jgoy-labs deleted the dependabot/github_actions/actions/setup-python-6 branch March 15, 2026 22:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump actions/setup-python from 5 to 6#5

chore(deps): bump actions/setup-python from 5 to 6#5
dependabot[bot] wants to merge 75 commits into
mainfrom
dependabot/github_actions/actions/setup-python-6

dependabot Bot commented on behalf of github Mar 8, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v6.0.0

What's Changed

Breaking Changes

Enhancements:

Bug fixes:

Dependency updates:

New Contributors

v5.6.0

What's Changed

v5.5.0

What's Changed

Enhancements:

Bug fixes:

Uh oh!

dependabot Bot commented on behalf of github Mar 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Mar 8, 2026 •

edited

Loading