ChatWalaʻau v0.93.1

This release adds two new features to ChatWalaʻau -- Inbound Webhook Gateway and Teams Meeting Pipeline -- and fixes web sign-in / SPA delivery behind a TLS-terminating tunnel or reverse proxy (e.g. Microsoft Dev Tunnels).

Highlights

Inbound Webhook Gateway

• Drive ChatWalaʻau from external events. A new Webhooks icon in the sidebar footer (next to Declarative Agents) opens a Cron-Scheduler-style portal to manage webhook sources, review per-source received-notification records (accepted / duplicate / rejected, with the job each one spawned), and toggle a source on or off.
• Microsoft Graph is the first source. Manage Graph change-notification subscriptions from the portal -- subscribe / renew / delete / maintain -- plus a credentials Token health check, a notification-handshake Validate self-test, and a manual Fetch to run a meeting summary on demand.
• Secure by design. The public ingress (/api/webhook/{source}) is protected by the Graph validation handshake, a constant-time clientState check, and optional source-CIDR / resource allowlists; the management API is authenticated like every other write endpoint. Graph lifecycle events (reauthorization / removal) are handled automatically.
• Off by default. Enable with WEBHOOK_ENABLED=true; Microsoft Graph access uses a dedicated GRAPH_* app-only credential set. See the setup guide for the Graph app registration, the Teams Application Access Policy, and the tunnel.

Teams Meeting Pipeline

• Automatic meeting summaries. When a Teams meeting transcript becomes available, ChatWalaʻau resolves the meeting, fetches the transcript via Microsoft Graph, summarizes it into a structured JSON with the LLM, and writes the result into your coding workspace.
• Observable lifecycle. It runs as a Pipeline job with explicit stages -- received -> resolving_meeting -> fetching_transcript -> summarizing -> writing_output -> done (or failed) -- visible with run history in the Pipelines portal.
• Works with or without a subscription. Trigger it live from a Graph notification, or on demand via Fetch (meeting organizer + a Join URL or Graph meeting id) -- handy for testing and backfill. The fetch waits for the transcript artifact (which can lag the end of a meeting) up to a configurable timeout.

Cron Scheduler: system-managed jobs

• The Cron Scheduler can now host feature-owned internal jobs (no script, no coding-workspace gate). Such jobs are shown in the Cron portal but are protected from deletion. The first one renews Microsoft Graph webhook subscriptions; it is created while you have at least one subscription and runs while CRON_ENABLED=true.

Fixes for tunnel / reverse-proxy access

• No more login redirect loop over a tunnel/LAN with only an API key. A web browser cannot send the Bearer API key, so an instance protected by API_KEY alone (with browser sign-in disabled) used to loop between the chat and the login page. ChatWalaʻau now shows a clear "browser sign-in is not enabled" message instead of looping. To use the web app remotely, enable the web sign-in lane (AUTH_USERNAME + AUTH_PASSWORD_HASH); API_KEY alone only covers command-line / SDK clients.
• Session cookie no longer dropped behind a tunnel / reverse proxy. The web sign-in cookie now defaults to SameSite=Lax (was Strict, which could be dropped on cross-site entry into a tunnel domain and re-trigger the loop), and its Secure flag follows X-Forwarded-Proto so it is correct when the browser is on HTTPS while the backend serves HTTP behind the proxy. New AUTH_COOKIE_SAMESITE setting (lax default | strict | none).
• "Failed to fetch dynamically imported module" (404) after an update. The app shell is no longer cached, so the browser always loads an index that matches the current assets; the app also auto-reloads once if a chunk is stale (e.g. a tab left open across an update).

Breaking changes (read first)

None. This release is fully additive and default-off: the Webhook Gateway and everything it adds are inert unless you set WEBHOOK_ENABLED=true, the Cron Scheduler's new managed jobs do not affect existing script jobs, and the auth/cookie changes are backward compatible (new AUTH_COOKIE_SAMESITE defaults to lax). Upgrading requires no operator action. (One behavior to know: automatic Graph subscription renewal runs as a Cron job, so it needs CRON_ENABLED=true -- otherwise renew manually from the portal.)

Included in this release

This release includes implementation work from:

• v0.93.0 through v0.93.1

Notes

• Internal design management content and architecture control artifacts are intentionally omitted from this release note.

Installation

See the repository README for setup and usage instructions.

Version

• Release version: 0.93.1
• Previous release: 0.92.0