Huge updates today: Beyond fixes and hacking attempts

[orgaralf]

First we started a massive vibe session on some of the planning details with huge steps forward - the architecture update is already partly done and we have finished most of the nextcloud/opencloud combination in the core repo today. Then we had some bug reports (again from @bilogic - thanks, buddy!) that we merged already. And when I wanted to call it a day, we had a severe hacking attack with fake users creating SEPA paid fake accounts.

All that in one nice package since I started working on the code this morning: That means we will have a new release today with more fraud protection, bugs fixed and with more "cloud file" options...

Stay tuned!

[orgaralf]

The day in pull requests. 35 merged onto main (29 from us, 6 dependency updates). The latest published release is still v5.5.4 from yesterday, so this is the package the next release picks up.

Cloud files: Nextcloud and ownCloud in the core

A saved task can read a connected folder, say exactly what it read, and hand those files to the next step with their text.

• #2666 — the run card says what was read and from where: “Read 12 files from Nextcloud › Invoices/2026”, with the file names and one line per file that was left out. A refused folder says nothing was read, and how to allow it.
• #2668 — those files reach the next step with their text, the same way an upload does. Walked locally: three invoices in a Nextcloud folder became a three-row spreadsheet.
• #2674 — a small reference cloud app, so copies, folder reads and account linking can be tested before a real Nextcloud or ownCloud speaks the protocol. It also fixed file ids going out as JSON numbers, which had made a folder read answer “no files matched”.
• #2694 — a linked cloud reports its version, what it can do, and whether Synaplan can actually reach it. An admin approves a private hostname from the instance row, and can take that approval back with one click.
• #2702 — one identity row per person and cloud: provision, adopt, and sign-in bind. Chat completions and the model list accept that cloud’s login token. A login token is not treated as an API key.
• #2706 — a copy to ownCloud is labelled ownCloud.
• #2707 — a question about files in a connected folder has to read the folder. The answer only talks about files a step actually read.

A full server answers instead of hanging

• #2687 — AI streams get their own PHP workers. When that pool is full, the request comes back at once as busy (Retry-After: 5). Health checks kept answering in a few milliseconds while the stream pool was saturated.
• #2696 — chat and the widget retry that busy answer three times: “Synaplan is busy — your answer starts in a moment.” If it is still full, the message was not sent, the text is back in the input box, and Try again is one click.
• #2690 — starting a container no longer walks every uploaded file on the shared disk to repair permissions. That walk was adding about seven minutes to a production restart.

Research, not in the product yet

@cristiangrxs landed the next pieces of a real research run. None of this is reachable from chat yet.

• #2688 — model slots for reading sources and for fact-checking.
• #2691 — a run can store its sources, quotes, budget and event history.
• #2697 — the stages: brief, plan, search, reading, and a cited report.
• #2708 — one step per queue message, and a worker that disappears is picked up again.
• #2712 is still open. That is the piece that would start a run and put the report in the chat.

Bugs, including @bilogic’s

• #2703 fixes #2678: Import stays on screen when the model list is long.
• #2704 fixes #2679: deleting a model that is the default moves the default first, then removes the row. Search is cleared, not pointed at another embedding model.
• #2710 fixes #2680: a model the provider no longer lists is marked withdrawn. The row stays.
• #2709 fixes #2617: an API completion can set incognito: true and skip being stored as the key owner’s memory.
• #2682 — a Synaplan Demo install shows a model in the Memory Extraction slot again.

The SEPA incident

#2711 — Stripe Checkout no longer offers SEPA Direct Debit by default (card, Link and Klarna stay). A SEPA mandate is accepted before any money settles, and the paid tier was granted at that moment. On 24 October that window was used to open several hundred BUSINESS and TEAM accounts on fake IBANs. The live cluster was already running without SEPA. This makes the shipped default match, and a test now fails if sepa_debit is sent to Stripe again. Turning it back on needs the tier to wait until invoice.paid, plus signup limits and a kill switch.

Planning notes for the same day: the open-issues sprint (#2701) and the roadmap update (#2664). Dependency updates covered Vite, Centrifugo, the frontend set and the Ollama image.