v1.4.0

v1.4.0

Cumulative minor release since v1.3.0. Contains breaking changes — please review the Upgrade notes before deploying.

Highlights

• Persona Clone / OBO v2 — feat(bot_api) v0 backend (#82) → v2 fan-out narrowing, persona_prompt, typing indicators, grant mutex (#109); implicit scope + Gate 4 (#121); adapter-side GET /v1/bot/obo-grant (#136); active toggle on grants (#131).
• OIDC self-service — bind flow for autolink failures (#73); account creation from SSO claims via /bind/create (#93); bind redirect carries provider + Referrer-Policy: no-referrer (#80).
• Auth — new login.local_off system_setting to disable local-account login when full OIDC is configured (#104).
• Voice → octo-speech adapter — modules/voice retired, replaced by modules/voice_adapter calling the external octo-speech service (#113). feedback_url in voice config API (#90), request_id in /transcribe response (#67), per-space voice feedback settings API (#130).
• conv_ext cascade follow — channel → threads cascade with fan-out on new threads (#123).
• Redis TLS — RedisTLS config propagated to all direct go-redis.NewClient call sites (#134).
• Business-error metric — new Prometheus counter dmwork_http_business_error_total via response-body sniffing (#141).
• Mention ingress regularisation — mention.ais=1 is expanded to mention.uids at ingress; bot reminders filtered accordingly (#144). all → ais rewrite removed from mentionrewrite (#143). @所有AI legacy-adapter compat in AIS broadcast fan-out (#138).

⚠️ Upgrade notes (breaking)

• Voice module retired. Deploy octo-speech and set SPEECH_SERVICE_URL / SPEECH_API_KEY (plus optional SPEECH_TIMEOUT, SPEECH_MAX_BODY_SIZE, SPEECH_MAX_CONTEXT_LENGTH, SPEECH_MAX_FILE_SIZE, VOICE_FEEDBACK_PRIVACY_URL). Remove the now-unused VOICE_* / ASR_LOG_* env vars. VOICE_MAX_VOICE_CONTEXT_LENGTH is still read as a fallback for SPEECH_MAX_CONTEXT_LENGTH.
• docker/octo/ and docker/tsdd/ retired. Deployment source-of-truth moves out of this repo — use the dedicated deployment repo / Helm chart instead.
• Schema: user.phone and user.zone restored to NOT NULL (fixes #54). The migration backfills existing NULL rows to '' first, then ALTER MODIFY — no manual action required; ALTER is INSTANT/INPLACE on MySQL 8 InnoDB.
• Toolchain: build image bumped from golang:1.20 to golang:1.25-alpine. Rebuild downstream images.
• OIDC env vars renamed. Use DM_OIDC_PROVIDER_* (issuer / client_id / client_secret / redirect_uri / scopes / require_email_verified / require_pkce / auto_link_by_email / auto_link_by_phone / allow_new_user / clock_skew / http_timeout / sync_interval / sync_concurrency). The legacy DM_OIDC_AEGIS_* aliases are still accepted as fallback. DM_OIDC_RT_ENC_KEY (base64, decodes to 32 bytes) is now required when OIDC is enabled.

What's Changed

• fix(oidc): always serialize masked_email/masked_phone in /bind/info @an9xyz (#149)
• fix(mention): expand mention.ais=1 into mention.uids at ingress chokepoint @yujiawei (#144 / #145)
• feat(metrics): add dmwork_http_business_error_total via response body sniffing @an9xyz (#141)
• refactor(mentionrewrite): remove all→ais rewrite (GH#142) @yujiawei (#143)
• fix(robot): @所有AI 兼容旧 adapter — 在 ais 广播 fan-out 中给每个 bot 的 payload 副本追加 uid 到 mention.uids @yujiawei (#138)
• feat(obo): add GET /v1/bot/obo-grant for adapter-side persona pull @yujiawei (#136)
• fix(obo): add active field to oboUpdateGrantReq — persona toggle switch (#129) @yujiawei (#131)
• feat(user): add per-space voice feedback settings API @ploy-elison (#130)
• chore: add @Mininglamp-OSS/server-maintainers to CODEOWNERS @lml2468 (#128)
• fix(obo_fanout): decodeMentionGate honors mention.humans (Plan X @所有人) (#125) @yujiawei (#126)
• feat(conv_ext): cascade follow channel → threads with fanout on new threads @an9xyz (#123)
• feat(obo): implicit scope + persona_prompt + fan-out Gate 4 @yujiawei (#121)
• fix: add 'dependencies' label to release-drafter config @lml2468 (#120)
• fix: pr-contributor-welcome permission pull-requests:write → issues:write @lml2468 (#119)
• chore: add dependabot config for automated dependency updates @lml2468 (#118)
• fix(obo): fan-out findActiveGrantsForChannel honors global_enabled for groups @yujiawei (#114)
• feat(voice): replace voice module with octo-speech adapter @Jerry-Xin (#113)
• feat(ci): add PR contributor welcome caller @lml2468 (#110)
• feat(obo): v2 fan-out narrowing + persona_prompt + typing + grant mutex @yujiawei (#109)
• fix(ci): use _ for unused loop counter to clear shellcheck SC2034 @lml2468 (#107)
• feat(bot_api): Persona Clone OBO backend v0 (PR-A) @yujiawei (#82)
• fix(ci): use pull_request_target in octo-pr-feed to fix fork PR notifications @lml2468 (#106)
• feat(auth): add login.local_off switch to disable local-account login @an9xyz (#104)
• fix(category): close TOCTOU window in moveGroupToCategory + FollowDM @tongjichao (#79)
• chore(ci): standardize reusable workflow refs to @main @lml2468 (#100)
• feat(oidc): self-service account creation from SSO claims via /bind/create @an9xyz (#93)
• chore(ci): pin octo-issue-feed caller to @v2 @lml2468 (#92)
• feat(ci): simplify octo-issue-feed to new/reopen only @lml2468 (#91)
• feat(ci): add release drafter and gated release publish @lml2468 (#89)
• feat(ci): add CodeQL security scan and Workflow Sanity check @lml2468 (#88)
• feat(voice): add feedback_url to voice config API @ploy-elison (#90)
• fix(ci): replace negation filter with positive-pattern filter @lml2468 (#85)
• fix(pr-feed): use pull_request trigger, pin SHA, add feed_group_id @lml2468 (#59)
• feat(ci): refine CI + add stale and PR labeler @lml2468 (#84)
• fix(oidc): bind redirect carries provider + Referrer-Policy no-referrer @an9xyz (#80)
• feat(oidc): self-service binding for OIDC autolink failures @an9xyz (#73)
• feat(voice): return request_id in transcribe API response @ploy-elison (#67)

CI / Infrastructure

• feat(redis): wire RedisTLS config into direct go-redis NewClient sites @an9xyz (#134)

Full Changelog: v1.3.0...v1.4.0