@promptowl/contextnest-community 1.13.0 → 1.15.0

package/CONFIGURATION.md

@@ -87,6 +87,7 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 | `RUN_MAX_CONCURRENT_ROOTS` | `50` | Max concurrently-running root (depth-0) runs per nest (clamped 1..1000). The subagent caps bound a single tree; this bounds how many trees can run at once, so triggers can't flood a nest. |
 | `ANTHROPIC_API_KEY` | _(unset)_ | Server-wide default runner key for workflow-plane agent runs. Never returned by the API — the health endpoint reports presence only, and Settings shows a masked tail. |
 | `SLACK_WEBHOOK_URL` | _(unset — connector off)_ | Slack incoming-webhook URL for governance-event notifications (review submitted/approved/rejected, collaborator added). `https://` only — the URL embeds a secret. Also editable from Settings in the UI. |
+| `MSTEAMS_WEBHOOK_URL` | _(unset — connector off)_ | Microsoft Teams incoming-webhook URL for the same governance events, posted as Adaptive Cards. `https://` only — the URL embeds a secret. Also editable from Settings in the UI. See [Microsoft Teams notifications](#microsoft-teams-notifications). |
 | `SMTP_URL` | _(unset — connector off)_ | SMTP connection URL for email notifications (`smtp://` or `smtps://`, credentials inline). Requires `NOTIFY_EMAIL_FROM` and `NOTIFY_EMAIL_TO`. Also editable from Settings. |
 | `NOTIFY_EMAIL_FROM` | _(unset)_ | From address for notification emails. |
 | `NOTIFY_EMAIL_TO` | _(unset)_ | Comma-separated recipients for notification emails. |
@@ -94,6 +95,61 @@ The server prints a loud warning at startup when `AUTH_MODE=open` is active.
 
 ---
 
+## Microsoft Teams notifications
+
+Set `MSTEAMS_WEBHOOK_URL` (or paste the URL into **Settings → Notifications →
+Microsoft Teams notifications**) and the server posts the same governance
+events the Slack connector covers — review requested / approved / rejected,
+collaborator added, plus per-nest burst digests — to one Teams channel as
+[Adaptive Cards](https://adaptivecards.io/). Leave it empty to turn the
+connector off. Delivery is fire-and-forget with a short timeout: a Teams
+outage or a bad URL never slows down or fails the action that triggered the
+message.
+
+> Naming note: the setting is `msteams_webhook_url` / `MSTEAMS_WEBHOOK_URL`
+> because "teams" in this product means user groups (the `/teams` API), not
+> Microsoft Teams.
+
+### Create the incoming webhook in a Teams channel
+
+Microsoft retired the classic Office 365 "Incoming Webhook" connectors;
+webhooks are now created with the **Workflows** (Power Automate) app:
+
+1. In Microsoft Teams, open the channel that should receive notifications,
+   click **⋯ (More options) → Workflows**.
+2. Pick the template **"Post to a channel when a webhook request is
+   received"** (searching for "webhook" finds it), sign in if prompted, and
+   confirm the team + channel.
+3. Create the flow and **copy the HTTP POST URL** it shows (a
+   `https://….logic.azure.com/…` or `https://….powerplatform.com/…` address).
+4. Paste that URL into **Settings → Notifications → Microsoft Teams
+   notifications** (or set `MSTEAMS_WEBHOOK_URL`).
+5. Save, then click **Send test** on the card to post a test message and
+   confirm the channel receives it. (The button tests the *saved* URL — save
+   first, then test. The Slack card has the same button.)
+
+If your tenant still has a legacy Office 365 connector webhook, it is expected
+to accept the same payload envelope (legacy connectors documented support for
+Adaptive Card attachments, though we have not verified one end-to-end — the
+card's plain-text `fallbackText` is the safety net) — but create new hooks via
+Workflows.
+
+The URL embeds a secret — anyone holding it can post to the channel, so treat
+it like a password (it is why the setting requires `https://`). The server
+sends the standard envelope Workflows expects:
+`{"type": "message", "attachments": [{"contentType":
+"application/vnd.microsoft.card.adaptive", "content": {…card…}}]}` with a
+plain-text `fallbackText` for clients that cannot render cards.
+
+Per-nest connector rows post the same Adaptive Card format to a nest-specific
+webhook, with per-event filtering: `POST /nests/:id/connectors` with a JSON
+body like `{"channel": "teams", "url": "https://…", "events":
+["review_requested", "review_rejected"]}` (`events` may also be `["*"]`; the
+`url` may be an `env:KEY` reference into the nest's env store). Manage rows
+with `GET`/`PATCH`/`DELETE` on the same path.
+
+---
+
 ## Single sign-on (OIDC)
 
 Generic OpenID Connect sign-in against any spec-compliant identity provider —
@@ -223,6 +279,20 @@ On first connect the server creates its schema automatically (idempotent) — no
 manual migration step. There is no built-in SQLite→Postgres data migration; a new
 Postgres backend starts empty.
 
+### First-boot upgrade passes
+
+Some upgrades carry a one-shot data pass that runs at startup, before the server
+accepts requests, and records itself in `schema_migrations` so it never repeats.
+Two exist today: the `node_versions` backfill from `history.yaml`, and the
+version-chain repair added in 1.13 (re-anchors documents whose version chain was
+grafted by an older import, and moves inline patches into `v{N}.diff` files).
+
+Both walk every document in every nest, so on a large vault the **first** boot
+after upgrading can take noticeably longer than usual — reads of the on-disk
+vault, not database work, so an install on network/FUSE storage feels it most.
+Every subsequent boot skips the pass entirely. Progress and a per-pass summary
+are printed to the server log.
+
 > ⚠️ **Cloud Run durability — read this.** Cloud SQL persists only the *metadata
 > database*. The actual **document content and version history** live on the
 > filesystem under `$DATA_ROOT/nests/`, which on Cloud Run is **ephemeral** and is
@@ -234,7 +304,7 @@ Postgres backend starts empty.
 ### Runtime settings persistence
 
 Settings you change at runtime — everything on the **Settings page** (`/admin/settings`:
-sign-in gate, logo, base URL, upload limit, feature flags, OIDC SSO, Slack/SMTP connectors)
+sign-in gate, logo, base URL, upload limit, feature flags, OIDC SSO, Slack/Teams/SMTP connectors)
 plus the **installed license key** — are stored in the database (`server_settings`
 table), **not** in a `.env` file. This is deliberate: on Cloud Run the container
 filesystem is ephemeral, so a file-based value was wiped by every rebuild, and each

package/README.md

@@ -12,6 +12,7 @@ ContextNest Community Edition is a self-hosted server that lets you:
 
 - Store, version, and govern markdown-based context documents ("nests")
 - Import an existing folder or vault of markdown files in one step
+- Export a nest as a portable bundle and re-import it on another self-hosted host
 - Apply stewardship workflows — draft, pending review, approved
 - Share nests with collaborators or publish them read-only to the public
 - Serve approved context to AI agents via MCP, HTTP, or CLI
@@ -93,6 +94,7 @@ For redistribution, hosted-service, OEM, or regulated-industry licensing, contac
 | Configurable nest storage (external / GCS volume mount) | ✅ | ✅ |
 | Markdown + YAML frontmatter vaults | ✅ | ✅ |
 | Import existing folder / vault | ✅ | ✅ |
+| Export nest as portable bundle (.zip) | ✅ | ✅ |
 | Markdown rendering + wiki cross-linking | ✅ | ✅ |
 | External-edit detection + version diff | ✅ | ✅ |
 | Stewardship workflow (draft/review/approve) | ✅ | ✅ |

package/dist/{chunk-ZQS5W45U.js → chunk-5IAKUUZF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-GUNJTORH.js";
 import {
   getDb
-} from "./chunk-5QQ7WKAI.js";
+} from "./chunk-BCFKLY4H.js";
 
 // src/governance/grants-service.ts
 import { v4 as uuid } from "uuid";