probo/cmd/probod/CHANGELOG.md

Changelog

All notable changes to probod (the server, including the bundled @probo/console, @probo/trust, and @probo/ui frontends) will be documented in this file.

Unreleased

[0.208.0] - 2026-06-11

Added

• active status field on access entries
• Import action for catalog vendors in trackers; importThirdPartyFromCommon mutation to pull a catalog vendor into an org
• Catalog vendors surfaced in tracker policy documents
• File download URLs for console file fields

Changed

• Trust and MCP connector logos now use the File type
• Third parties deduplicated by name; unique index enforced per org
• Tracker mapping no longer auto-creates org third parties; explicit import required
• Tracker row and category select restyled; move-to-category confirm dialog removed
• Tracker mapping restored to link existing patterns; "create only" mode removed
• Document major version publishing requires explicit approver_ids
• References updated to probo.com

Removed

• Third-party disambiguation agent and automatic matching removed

Fixed

• DNS TXT lookup retried over TCP on truncated UDP response

[0.207.0] - 2026-06-10

Added

• Neon access-review connector (organization members via Neon API, API-key auth)
• Render access-review connector (workspace members, API-key + Workspace ID)
• Qovery access-review connector (organization members, configurable Token Authorization scheme)
• API-key connector providers can now declare a custom Authorization token scheme (defaults to Bearer)
• regulationSource (DETECTED/DEFAULT) on cookie consent records, with GDPR/OPT_IN applied as the safe default when geolocation does not resolve a known regulation
• --keyword scoping on the banner tracker-reset operator path: rebuilds only patterns whose pattern or display name contains the substring
• parent_third_party_id foreign key on third parties for arbitrary sub-third-party nesting depth; level (int, 1+) replaces the firstLevel boolean

Changed

• Tracker-mapping agent ignores cookie-database/consent-directory operators (Cookipedia, cookiedatabase.org, CookieServe, …) as vendor attributions; CMP own-cookie attributions (OneTrust, Cookiebot, …) still survive
• Tracker-mapping agent ignores own-domain tracker attributions (patterns embedding the scanned site's own eTLD+1) with a deterministic backstop
• Relinking a common tracker pattern to a different third party now updates the confidence on linked org patterns
• Rename console label "Detected Count" to "Distinct Trackers Detected"
• proboctl common-tracker-pattern reenrich now accepts catalog-wide filters with no selection anchor (e.g. --without-description re-enriches every pattern lacking a description)

Fixed

• Null out stale initiator_url/initiator_domain rows on detected_trackers that point at the @probo/cookie-banner bundle, so genuine third-party initiators repopulate on next detection
• Cookie-database denylist now matches domain and URL forms (e.g. cookiedatabase.org, https://www.cookiepedia.co.uk/list), not just bare brand names

Removed

• createThirdPartyThirdPartyMapping and deleteThirdPartyThirdPartyMapping mutations and MCP tools; create a child third party by passing parentThirdPartyId on createThirdParty

[0.206.0] - 2026-06-09

Added

• RiskAssessmentBoundary first-class entity to group nodes within a risk assessment scope, with self-nesting parent boundary, scope-membership validation, nested-subgraph Mermaid rendering, and dedicated IAM actions
• regenerateCookieBannerTrackerPolicy mutation/MCP tool to re-trigger tracker policy generation on a banner that already has a published version, gated by a dedicated regenerate-policy action
• Better Stack access-review connector (Uptime API team members + pending invitations)
• SigNoz access-review connector (organization members, region/tenant or self-hosted base URL)
• commonTrackerPatternId field on TrackerPattern to indicate whether a pattern is linked to the global common-tracker catalog
• Files API: public endpoint GET /api/files/v1/public/{fileID} (unauthenticated, public files only) and private endpoint GET /api/files/v1/{fileID} (session/API key/OAuth2, core:file:get enforced); IAM and not-found errors both return 404
• Static brand assets served via /api/files/v1/static instead of S3

Changed

• Connector provider infos promoted from Organization.connectorProviderInfos to a root-level accessReviewDrivers query, listable by any authenticated identity
• Tracker-mapping, common-pattern enrichment, and third-party disambiguation agents each get their own config (own timeout, own max-turns, own optional provider slot, with fallback to the tracker-mapping slot when unset)
• Console: tracker pages now surface common-tracker/third-party links with a "common" badge and updated pattern properties display

Fixed

• Cookie tracker pattern analysis: removed unused sync re-enrich path and tightened reset/remap scoping

Removed

• ActionFileDownloadUrl (replaced by ActionFileGet) and the standalone pkg/filesign package (folded into file.Service)

[0.205.0] - 2026-06-08

Added

• submitAgentRunApproval mutation to merge human approval decisions into an interrupted agent run and resume it
• Suspendable agent-tool subtrees: nested agent runs can now checkpoint and restore across multi-level tool calls

Changed

• Agent-run worker no longer relies on leases and heartbeats: a graceful suspend returns the run to PENDING, an approval interruption parks it in AWAITING_APPROVAL, and crashed runs are left RUNNING for manual recovery
• AWS credentials now resolve through the full standard AWS SDK credential chain

Fixed

• Auditors can now read the organization context and see the Context page in the console
• NDA upload now correctly sets the organization ID
• Logo updates no longer wipe unspecified fields on partial update
• Cookie tracker pattern analysis now splits on : and . so UUID-bearing keys collapse to a single template

[0.204.0] - 2026-06-05

Added

• Dedicated error page when a magic link has already been used

Changed

• Improved error page layout and messaging

[0.203.0] - 2026-06-05

Added

• Zendesk access-review connector with subdomain URL normalization
• Okta access-review connector with API-key (SSWS) authentication
• Clerk access-review connector
• SendGrid access-review connector with 2FA enforcement checks
• Datadog access-review connector with region selector and OAuth support
• PostHog access-review connector with Cloud OAuth, self-hosted OAuth, and API-key support
• Public-client (CIMD) OAuth support with auto-registration and client metadata document
• SMTP_HELLO_NAME environment variable to configure the EHLO/HELO hostname
• Dedicated expired magic link error page
• Audit reports are now stored as files

Changed

• Clarify trust center access rejection emails
• Cookie banner now supports Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Turkish, Ukrainian, and Chinese

Fixed

• Fix login redirect for password-only authentication flows

[0.202.2] - 2026-06-03

No user-facing changes; tag-only release.

[0.202.1] - 2026-06-03

No user-facing changes; tag-only release.

[0.202.0] - 2026-06-03

Added

• Trigger tracker-policy document generation on banner publish; a background worker regenerates it on every snapshot
• Show tracker type in the cookie tracking policy document
• Include the website origin in the tracker policy title

Changed

• Restrict queries and mutations to session scope
• Move the Display tab first on the cookie banner configuration page
• Link to the generated cookie policy document from tracker rows; revamp tracker row layout
• Number tracker policy section titles

Fixed

• Use stable API URLs for vendor logo fields

[0.201.0] - 2026-06-02

Added

• Add async third-party vetting worker with PENDING/PROCESSING/COMPLETED/FAILED states, exposed through GraphQL and MCP; the third-party detail page polls while vetting runs
• Tune the third-party vetting worker (interval, concurrency, stale-after, agent timeout, max-turns) via config

Changed

• Downgrade access-source instance name resolution failures from error to warning

Fixed

• Guard the GitHub access-source name resolver against empty organization to stop the source-name worker from flooding logs with 404s

[0.200.1] - 2026-06-01

Fixed

• Raise tracker mapping and common-pattern enrichment agent max turns to 10 to prevent MaxTurnsExceededError when the tool-call budget exceeded the limit

[0.200.0] - 2026-06-01

Added

• Add tracker description enrichment worker
• Promote tracker patterns to organization third parties via worker, with first-party origin filtering and sibling-based mapping
• Surface third-party links on TrackerPattern in GraphQL, with batch loaders
• Filter banner trackers by linked third party and show third parties on the banner trackers page
• Expose HTTP cookie source through the console API
• Add document archive row action
• Add stale recovery to the tracker mapping worker
• Tune tracker workers: expose worker interval, concurrency, stale-after, agent timeout, and max-turns as config

Changed

• Deactivate SCIM users when delete is blocked
• Rework tracker and resource row actions
• Reuse the mapping agent to attribute trackers in the enricher
• Raise default agent token budget for reasoning models (1024/512 → 4096)
• Harden catalog vendor resolution and the tracker mapping agent prompt
• Skip shared infrastructure in domain matching during tracker mapping
• Backfill tracker description from the common catalog
• Run tracker mapping outside the persist transaction to remove cross-network row locks

Fixed

• Stop tracker agents from inventing vendors
• Drop sampling params unsupported by the model
• Tolerate source fetch failures during tracker mapping
• Skip mapping when a tracker pattern is deleted concurrently
• Guard LinkToCommon against overwriting an existing catalog link
• Take resolver scope from Authorize rather than the GID
• Copy default LLM pointers when resolving agents

[0.199.1] - 2026-05-28

Fixed

• Fix missing icons in the UI
• Fix Metabase user listing in access reviews
• Fix PostHog resolver name

[0.199.0] - 2026-05-28

Added

• Add PostHog access-review connector
• Add Metabase access-review connector
• Add Grafana access-review connector
• Add Cursor access-review connector
• Support HTTP Basic auth in API-key connections
• Cancel pending signature requests when a contract ends or a connector is deactivated

Changed

• Reject demotion of the last owner of an organization
• Scope document signatures to the major version

Fixed

• Fix Microsoft 365 access review returning too many accounts

[0.198.0] - 2026-05-28

Added

• Add Tailscale connector
• Add Anthropic connector (authenticated via API key)
• Add personal account support for the Heroku connector
• Add Global region option to the vendor country picker
• Allow ordering organization members by email address

Changed

• Connector deletion is now best-effort: remaining steps proceed even when one cleanup step fails

Fixed

• Fix role column in the people list rendered as non-sortable to prevent runtime failures
• Surface an actionable error when a stored Sentry organization slug is no longer accessible to the connected OAuth token
• Stop the source-name worker from retrying indefinitely on a stale Sentry organization slug
• Stop the source-name worker from retrying indefinitely on a stale Heroku personal-account slug

[0.197.0] - 2026-05-28

Added

• Add invitingOrganizations field on the viewer to expose organizations that have sent a pending invitation to the current user

Fixed

• Show SCIM error message in the connector UI

[0.196.1] - 2026-05-27

Fixed

• Fix serialization of SCIM bridge SYNCING and DISABLED states in the GraphQL API

[0.196.0] - 2026-05-27

Added

• Expose bridge sync errors in the SCIM API and on Google Workspace and Microsoft 365 connector cards
• Expose profile source field on users in the MCP API

[0.195.0] - 2026-05-27

Added

• Add archiveUser operation to deactivate a user profile while keeping them in the organization; exposed across the console UI, MCP, CLI, and n8n
• Expire pending invitations for a user when they are archived
• Grant owners full iam:scim-bridge:* and admins read-only SCIM bridge access in IAM policies

Fixed

• Preserve archived and deactivated HubSpot users in access reviews instead of dropping them
• Fix common third-party logo URL returning resource-not-found in the combo box query

[0.194.0] - 2026-05-26

Added

• Add probo-agent CLI and device agent library for endpoint compliance checks
• Add screen lock detection support for i3, KDE, and more Linux desktop environments

Fixed

• Skip unconnectable providers in provider listing
• Reject shell-unsafe paths in FreeBSD rc.d service installer
• Make Windows service uninstall idempotent
• Use platform-specific atomic key replacement on Windows
• Handle FreeBSD check command failures before reading status

[0.193.1] - 2026-05-26

Security

• Fix open redirect bypass in safe redirect

[0.193.0] - 2026-05-26

Added

• Add measure ↔ third-party many-to-many link with tabs on both detail pages
• Add self-referential third-party relations with a first_level filter on the third-party list
• Track source on detected storage trackers (localStorage, sessionStorage, indexedDB, cacheStorage)
• Promote tracker pattern source on detection and trigger a draft banner version when adopting uncategorised patterns

Changed

• Allow initial minor publishing of documents
• Mark page-world extension writes (MV3 main world, userscripts with @grant none) with the new EXTENSION cookie source
• Surface the measure state as a header badge and remove the measure detail right-hand drawer

Fixed

• Fix timing attack on signin
• Reject separator-only glob templates (e.g. __*) in tracker pattern analysis

[0.192.0] - 2026-05-25

Changed

• Enforce IAM authorization on all console resolvers — every data-bearing field now goes through the policy engine and produces an audit log entry; adds ActionCommonThirdPartyGet, ActionCommonThirdPartyList, and ActionElectronicSignatureGet actions wired into Viewer and Auditor policies

Fixed

• Fix signature count mismatch between the document version badge and the signatures tab — both now filter by activeContract: true and state: ACTIVE, so deactivated signers and ended-contract signers are consistently excluded
• Fix MCP server resolvers after the signature filter and authorization changes

[0.191.0] - 2026-05-22

Added

• Add a tracker pattern detail page in the console with a properties section and a list of detected tracker resources

Fixed

• Strip empty ProseMirror text nodes from third-party list documents (and migrate existing document_versions.content to drop them) so Tiptap renders them instead of erroring with "Empty text nodes are not allowed"
• Tailor signature certificate email copy for document approvals — store the per-signature email subject on creation so the certificate worker uses "Your approved