Sentryward 0.4.0

Sentryward remains pre-1.0, and this release changes some default behaviour:
adding someone to a team now sends them an invitation to accept, and
invite-only registration accepts fewer team invites. AI findings still need
human verification.

Upgrade notes

• Back up the database and ENCRYPTION_KEY before upgrading. The server
  applies this release's migrations on start.
• Adding a team member by email now creates an invitation the recipient must
  accept, and the add-member account picker is hidden. To restore immediate
  additions, an instance admin turns on Allow direct member additions
  under Administration > Instance settings > Policy. It is off on upgraded
  installations too; existing memberships are unaffected.
  GET /api/workspaces/:id/member-candidates answers 403 while it is off, and
  POST /api/workspaces/:id/members returns { invite, link, emailed }
  instead of { member }.
• In invite-only mode, a team invite only creates new accounts when its
  creator is currently an instance admin. Reissue other outstanding invites
  from an admin, or use an instance invite.
• WORKER_SHUTDOWN_DRAIN_MS (default 10 minutes) sets how long a stopping
  worker waits for in-flight reviews before handing them back to the queue.
  Keep WORKER_STOP_GRACE_PERIOD a few minutes above it (the defaults, 10m
  and 15m, already are), or Compose kills the worker before the hand-back.

Added

• The LLM Config tab shows what was detected for the model that will run the
  review (thinking and tool support), and a Test model button runs it on that
  connection without saving. Connections whose key was rejected, could not be
  verified, or are blocked are marked in the connection picker (#190).
• Fallback models can be moved up and down (#191).
• The LLM Config tab shows the model's price, with a link to set one when it is
  unknown, and what an auto context budget resolves to for the model, max
  output tokens and thinking level, warning when a typed budget leaves no room
  for the reply. GET /api/config/schema now also returns the context windows
  and thinking budgets, and GET /api/settings/model-prices/lookup?model=
  returns the price a review of any model gets (#192).
• The Triggers tab can check a sample change, under a Will this be reviewed?
  toggle that starts closed: an event, title, author, labels,
  branches and draft state are run through the worker's own skip rules with
  the unsaved settings, and it answers Reviewed (with or without the PR
  summary, every file or new commits only) or the reason it would be skipped.
  It is served by the new POST /api/config/triggers/check.
• The header links to the GitHub repository beside the theme picker.

Changed

• The verification model and verification thinking are greyed out while
  Verify findings is off, and the walkthrough model while the walkthrough is
  off, with a link to the tab that turns them on. Saved values are kept (#193).
• LLM Config tab polish: effective values are only shown when they come from
  somewhere other than the scope being edited, Profile sits above the tabs
  since it applies to all of them, Connection capabilities overrides are under
  an Advanced disclosure (kept open while one is set), Reset to defaults
  explains what it keeps and why it may be disabled, and the Model,
  Temperature, Max output tokens and Context budget descriptions match what
  the server does (#194).
• The Finding Types tab is regrouped into Severity, What gets reported,
  Accuracy, Scope and context, Static analysis and Fixes, with a summary panel
  beside it showing what a review reports and blocks on, unsaved edits
  included. A severity scale labels each severity as blocking, reported or
  hidden, and warns when the block level sits under the report level (those
  findings are dropped before they can block). Caller depth is greyed out
  while Surrounding code is off, and the agent limits unless Review context is
  Agentic. Categories have descriptions, a count and All/None buttons, and Min
  confidence has a slider. On every tab, a field's effective value now sits
  beside its label and the "leave empty" hint moved behind an info icon.
• The Triggers tab is regrouped into Automatic reviews, PR summary, Commands
  and replies, and Skip rules (by change, people and branches), with a summary
  panel of when Sentryward runs, unsaved edits included. While automatic
  reviews are Manual only, the push switches, the PR summary trigger and the
  skip rules are greyed out, since the worker never reaches them; the PR
  summary trigger is also greyed out while the walkthrough is off, with a link
  to the Display tab. Each skip list is tagged with how it matches, the review
  trigger spells out what happens to drafts, and a repository's list says it
  replaces the inherited one.
• Team membership requires consent. Adding someone by email creates an
  email-bound invitation (emailed when SMTP is configured, otherwise a link to
  copy), and access begins only when they accept. Team admins no longer see
  which emails have accounts, unless an instance admin turns on Allow direct
  member additions, which brings back the account picker and immediate
  additions (#206).
• Stopping or upgrading the worker no longer leaves unfinished reviews waiting
  for stale-lock recovery. The worker waits up to WORKER_SHUTDOWN_DRAIN_MS
  for in-flight reviews, then puts any still running back in the queue without
  using one of their attempts, so the new worker picks them up about half a
  minute later. Each handed-back review stays leased until any forge call the
  old worker had in flight has finished, so it cannot be run twice (#212).

Fixed

• Invite-only registration now requires an instance invite or a team invite
  whose original creator is currently an instance admin. Other team invites
  still let existing accounts join, but cannot create new accounts. Demoting
  or deleting the creator removes a team invite's registration authority;
  resending does not grant it (#205).
• Logging in with an unknown email runs the same argon2 work as a wrong
  password, so response time no longer reveals whether an email has an
  account. Registration still answers 409 for a taken email, by design (#208).
• Audit log export filenames use the viewer's local date instead of UTC (#214).
• When two registrations race for the same email, the one that loses gets the
  usual 409 email field error instead of a server error.
• The SSRF guard refuses reserved IPv4 ranges and IPv6 addresses that carry
  an internal IPv4 address (IPv4-mapped, NAT64 and 6to4), classified by the
  address they carry. Local-only mode keeps its previous list of internal
  addresses, so it does not start trusting public hosts reached through those
  ranges (#207).
• The agentic search_code tool on GitHub sends the model's term as one
  quoted phrase, so search qualifiers in it (such as repo: or org:) can no
  longer point the search at other repositories. An empty term finds nothing
  instead of failing the caller search (#211).
• Turning reviews on for a repository twice at once, or after a forge request
  that timed out, no longer leaves a duplicate or orphaned webhook. The
  registration is reconciled with the forge's existing hooks by URL, and a
  hook created for a repository removed meanwhile is deleted.
• timeAgo rounds values that reach a full unit up to that unit instead of
  showing "60 minutes ago" or "24 hours ago", and past and future times now
  round halfway values the same way (90 seconds ago reads "2 minutes ago")
  (#213).
• The worker's forge cache can no longer grow without bound on large changes.
  It was limited to 200 entries whatever their size, so a few big monorepo
  pull or merge requests (whole file lists with patches, or full files) could
  push the worker toward running out of memory. Cached entries now also stay
  under 64 MB in total, and a single answer over 8 MB is used for the review
  but not cached. Closes #188.
• Renewing a GitLab OAuth connection's access can no longer lose the tokens
  GitLab issued. If the refresh transaction timed out or failed to commit after
  GitLab answered, the new tokens were rolled back while the old refresh token
  was already spent, and the connection needed a manual reconnect. The token
  request is now capped to the time the transaction has left, and tokens from a
  refresh whose transaction fails are still stored, unless the connection was
  updated in the meantime (#187).
• A review whose worker stalled past the lock timeout, and was retried by
  another worker, can no longer finish or fail the retry when it wakes up.
  Finishing and failing a job now apply only to the attempt that holds it, so
  the retry's result and findings are stored instead of being dropped.
  Closes #185.
• A pull or merge request that is closed and then reopened without a new push
  is reviewed again. The review cancelled by the close no longer counts as one
  already done for that head, so the reopen webhook queues it instead of
  answering duplicate. Closes #184.
• A forge that accepts the connection but never answers no longer hangs a
  review or a webhook. Every forge API request, including each redirect hop,
  is now aborted after 30 seconds, so the worker fails the run and frees it
  instead of keeping the whole change in memory, and webhook handlers that
  call the forge respond. Closes #186.
• Two reviews of the same pull or merge request no longer run at the same
  time. A newer push now waits for the running review to finish, so an older
  head that finishes last can no longer overwrite the newer review's summary
  comment, reopen its fixed findings or become the latest review. A review
  cancelled from the dashboard or stopped by the run time limit finishes
  stopping before the next one starts, and if a worker dies mid-review the next
  review of that change starts within about three heartbeats (3 minutes by
  default). Closes #183.
• Deleting an account no longer leaves its forge webhooks behind. Self-service
  account deletion and an admin removing a user now take Sentryward's hooks
  off the repositories of the personal workspace, and of any team where the
  user was the only member, before those workspaces cascade-delete, the same
  way deleting a workspace, connection or repository already does. Closes
  #210.