@promptowl/contextnest-community 1.13.0 → 1.14.0

package/CONFIGURATION.md

@@ -87,6 +87,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `RUN_MAX_CONCURRENT_ROOTS` | `50` | Max concurrently-running root (depth-0) runs per nest (clamped 1..1000). The subagent caps bound a single tree; this bounds how many trees can run at once, so triggers can't flood a nest. |
 | `ANTHROPIC_API_KEY` | _(unset)_ | Server-wide default runner key for workflow-plane agent runs. Never returned by the API — the health endpoint reports presence only, and Settings shows a masked tail. |
 | `SLACK_WEBHOOK_URL` | _(unset — connector off)_ | Slack incoming-webhook URL for governance-event notifications (review submitted/approved/rejected, collaborator added). `https://` only — the URL embeds a secret. Also editable from Settings in the UI. |
+| `MSTEAMS_WEBHOOK_URL` | _(unset — connector off)_ | Microsoft Teams incoming-webhook URL for the same governance events, posted as Adaptive Cards. `https://` only — the URL embeds a secret. Also editable from Settings in the UI. See [Microsoft Teams notifications](#microsoft-teams-notifications). |
 | `SMTP_URL` | _(unset — connector off)_ | SMTP connection URL for email notifications (`smtp://` or `smtps://`, credentials inline). Requires `NOTIFY_EMAIL_FROM` and `NOTIFY_EMAIL_TO`. Also editable from Settings. |
 | `NOTIFY_EMAIL_FROM` | _(unset)_ | From address for notification emails. |
 | `NOTIFY_EMAIL_TO` | _(unset)_ | Comma-separated recipients for notification emails. |
@@ -94,6 +95,61 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 
 ---
 
+## Microsoft Teams notifications
+
+Set `MSTEAMS_WEBHOOK_URL` (or paste the URL into **Settings → Notifications →
+Microsoft Teams notifications**) and the server posts the same governance
+events the Slack connector covers — review requested / approved / rejected,
+collaborator added, plus per-nest burst digests — to one Teams channel as
+[Adaptive Cards](https://adaptivecards.io/). Leave it empty to turn the
+connector off. Delivery is fire-and-forget with a short timeout: a Teams
+outage or a bad URL never slows down or fails the action that triggered the
+message.
+
+> Naming note: the setting is `msteams_webhook_url` / `MSTEAMS_WEBHOOK_URL`
+> because "teams" in this product means user groups (the `/teams` API), not
+> Microsoft Teams.
+
+### Create the incoming webhook in a Teams channel
+
+Microsoft retired the classic Office 365 "Incoming Webhook" connectors;
+webhooks are now created with the **Workflows** (Power Automate) app:
+
+1. In Microsoft Teams, open the channel that should receive notifications,
+   click **⋯ (More options) → Workflows**.
+2. Pick the template **"Post to a channel when a webhook request is
+   received"** (searching for "webhook" finds it), sign in if prompted, and
+   confirm the team + channel.
+3. Create the flow and **copy the HTTP POST URL** it shows (a
+   `https://….logic.azure.com/…` or `https://….powerplatform.com/…` address).
+4. Paste that URL into **Settings → Notifications → Microsoft Teams
+   notifications** (or set `MSTEAMS_WEBHOOK_URL`).
+5. Save, then click **Send test** on the card to post a test message and
+   confirm the channel receives it. (The button tests the *saved* URL — save
+   first, then test. The Slack card has the same button.)
+
+If your tenant still has a legacy Office 365 connector webhook, it is expected
+to accept the same payload envelope (legacy connectors documented support for
+Adaptive Card attachments, though we have not verified one end-to-end — the
+card's plain-text `fallbackText` is the safety net) — but create new hooks via
+Workflows.
+
+The URL embeds a secret — anyone holding it can post to the channel, so treat
+it like a password (it is why the setting requires `https://`). The server
+sends the standard envelope Workflows expects:
+`{"type": "message", "attachments": [{"contentType":
+"application/vnd.microsoft.card.adaptive", "content": {…card…}}]}` with a
+plain-text `fallbackText` for clients that cannot render cards.
+
+Per-nest connector rows post the same Adaptive Card format to a nest-specific
+webhook, with per-event filtering: `POST /nests/:id/connectors` with a JSON
+body like `{"channel": "teams", "url": "https://…", "events":
+["review_requested", "review_rejected"]}` (`events` may also be `["*"]`; the
+`url` may be an `env:KEY` reference into the nest's env store). Manage rows
+with `GET`/`PATCH`/`DELETE` on the same path.
+
+---
+
 ## Single sign-on (OIDC)
 
 Generic OpenID Connect sign-in against any spec-compliant identity provider —
@@ -234,7 +290,7 @@ Postgres backend starts empty.
 ### Runtime settings persistence
 
 Settings you change at runtime — everything on the **Settings page** (`/admin/settings`:
-sign-in gate, logo, base URL, upload limit, feature flags, OIDC SSO, Slack/SMTP connectors)
+sign-in gate, logo, base URL, upload limit, feature flags, OIDC SSO, Slack/Teams/SMTP connectors)
 plus the **installed license key** — are stored in the database (`server_settings`
 table), **not** in a `.env` file. This is deliberate: on Cloud Run the container
 filesystem is ephemeral, so a file-based value was wiped by every rebuild, and each

package/README.md

@@ -12,6 +12,7 @@ ContextNest Community Edition is a self-hosted server that lets you:
 
 - Store, version, and govern markdown-based context documents ("nests")
 - Import an existing folder or vault of markdown files in one step
+- Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
 - Serve approved context to AI agents via MCP, HTTP, or CLI
@@ -93,6 +94,7 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
 | Markdown + YAML frontmatter vaults | ✅ | ✅ |
 | Import existing folder / vault | ✅ | ✅ |
+| Export nest as portable bundle (.zip) | ✅ | ✅ |
 | Markdown rendering + wiki cross-linking | ✅ | ✅ |
 | External-edit detection + version diff | ✅ | ✅ |
 | Stewardship workflow (draft/review/approve) | ✅ | ✅ |

package/dist/{chunk-5QQ7WKAI.js → chunk-I5KYGMIT.js}

@@ -27,6 +27,7 @@ if (envFileLoaded && !isTestRun) {
 var canonicalEnvFile = process.env.ENV_FILE_PATH || join(dataRoot(), ".env");
 var canonicalEnvLoaded = null;
 var slackUrlWarned = false;
+var msteamsUrlWarned = false;
 var emailFromWarned = false;
 var emailToWarned = false;
 var oidcIssuerWarned = false;
@@ -355,6 +356,27 @@ var config = {
     }
     return raw;
   },
+  /**
+   * Optional Microsoft Teams incoming-webhook URL (Workflows app) for team
+   * notifications — same events as SLACK_WEBHOOK_URL, posted as Adaptive
+   * Cards. Empty/unset = connector off. https only — a webhook carries an
+   * implicit secret in its path, so it never travels plaintext. Named
+   * MSTEAMS_* deliberately: "teams" in this codebase means user groups.
+   */
+  get MSTEAMS_WEBHOOK_URL() {
+    const raw = process.env.MSTEAMS_WEBHOOK_URL?.trim();
+    if (!raw) return null;
+    if (!/^https:\/\//i.test(raw)) {
+      if (!msteamsUrlWarned) {
+        msteamsUrlWarned = true;
+        console.warn(
+          "[config] MSTEAMS_WEBHOOK_URL rejected: must be an https:// URL. Microsoft Teams notifications disabled."
+        );
+      }
+      return null;
+    }
+    return raw;
+  },
   get FEATURE_WORKFLOW_PLANE() {
     return process.env.FEATURE_WORKFLOW_PLANE === "true";
   },

package/dist/{chunk-ZQS5W45U.js → chunk-IHGPZ6NY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-5QQ7WKAI.js";
+} from "./chunk-I5KYGMIT.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";

package/dist/{chunk-EG77SQHO.js → chunk-JP67WXLA.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-XQ46F76G.js";
 import {
   getDb
-} from "./chunk-5QQ7WKAI.js";
+} from "./chunk-I5KYGMIT.js";
 
 // src/governance/version-service.ts
 import { createHash } from "crypto";