v13.11.8

TL;DR

Swaps the stock_bars serverless built-in from Twelve Data to Polygon.io after Twelve Data moved hourly intraday for individual symbols behind its Grow/Venture plan.

Changes

Bug Fixes

• stock: rewrite stock_bars against the Polygon.io aggregates endpoint (/v2/aggs/ticker/.../range/{mult}/{span}/{from}/{to}); display meta (exchange, name, currency) is now resolved through /v3/reference/tickers/{sym} with a 24h cache. A new thirdPartyServiceIntegration.polygon config section (Settings → Third-party integrations) holds the API key. The wire shape ({ meta, bars }), cache key, and TTLs are unchanged, so @mx-space/api-client and apps/admin need no updates (c72cd47).

Upgrade Notes

After upgrading, open Settings → Third-party integrations → Polygon.io, enable it, and paste a Polygon.io API key (the free tier covers 5 req/min and 2 years of history, which is sufficient for the rich-editor stock K-line block). The legacy Twelve Data field is retained for stock_quote, which still uses Twelve Data and will be migrated in a follow-up release.

---

Full Changelog: v13.11.7...v13.11.8

v13.11.7

TL;DR

Hotfix for v13.11.6: restores the stock_quote / stock_bars / geocode_search / geocode_location serverless built-ins so the apikey / key query parameter actually reaches Twelve Data and Amap.

Changes

Bug Fixes

• serverless: v13.11.6 routed Twelve Data and Amap calls through axios.get(url, { params }), but the sandbox's bundled axios was a thin fetch wrapper that silently dropped the params config — so the API key was never appended to the URL and both providers responded with "parameter is incorrect or not specified". All five built-ins (stock_quote, stock_bars, geocode_search, geocode_location, ip-query) now use the global fetch + URLSearchParams, and the fake-axios stub plus its HttpAxios / HttpService type surface have been removed from the sandbox — fetch is the supported HTTP egress (b34034e).

Upgrade Notes

If you maintain a custom serverless snippet that called ctx.getService('http').axios.*, replace those calls with the global fetch (with URLSearchParams for query strings) or require('axios') to install the real axios package.

---

Full Changelog: v13.11.6...v13.11.7

v13.11.6

TL;DR

Fixes Twelve Data stock quotes failing with auth errors on existing deploys, and resolves a ReferenceError in the geocode_search / geocode_location serverless built-ins.

Changes

Bug Fixes

• stock: Trim the decrypted Twelve Data apiKey and route quote/bars calls through axios { params } so URL-encoding is uniform — accidental whitespace or reserved characters no longer truncate the apikey parameter (888af60).
• stock: pourBuiltInFunctions now refreshes the raw source and clears compiled code when the DB-stored built-in differs from the bundled version. Existing deploys previously kept the original buggy snippet forever; the fix now lands on upgrade instead of only on fresh installs (888af60).
• serverless: Read the provider secret from ctx.secret in geocode_search / geocode_location instead of a bare secret reference. With the old form, falling through from an empty adminExtra.gaodemapKey raised ReferenceError instead of reaching the fallback (bbed967).

---

Full Changelog: v13.11.5...v13.11.6

v13.11.5

TL;DR

Patch release ships a built-in stock-data primitive: two cached serverless functions (stock_quote, stock_bars) backed by Twelve Data, plus the admin Lexical decorator node and insert dialog that authors compose with. Also picks up an admin login state refresh.

Changes

• stock: Built-in serverless stock_quote and stock_bars snippets fetch from Twelve Data and cache in Redis (60s for live quotes, one year for frozen historical ranges). API key managed under Settings → Third-party integrations → Twelve Data. (00a8f86)
• admin: New Lexical decorator node under vendor/rich-editor/extensions/stock/ with a single slash-menu entry, variant-aware insert dialog, vertically stacked From/To inputs, and live debounced preview. (00a8f86)
• admin: Refresh auth state after login so cached identity reflects the new session. (068b545)

---

Full Changelog: v13.11.3...v13.11.4

v13.11.4

TL;DR

Patch release ships a built-in stock-data primitive: two cached serverless functions (stock_quote, stock_bars) backed by Twelve Data, plus the admin Lexical decorator node and insert dialog that authors compose with. Also picks up an admin login state refresh.

Changes

• stock: Built-in serverless stock_quote and stock_bars snippets fetch from Twelve Data and cache in Redis (60s for live quotes, one year for frozen historical ranges). API key managed under Settings → Third-party integrations → Twelve Data. (00a8f86)
• admin: New Lexical decorator node under vendor/rich-editor/extensions/stock/ with a single slash-menu entry, variant-aware insert dialog, vertically stacked From/To inputs, and live debounced preview. (00a8f86)
• admin: Refresh auth state after login so cached identity reflects the new session. (068b545)

---

Full Changelog: v13.11.3...v13.11.4

v13.11.3

TL;DR

Patch release that unifies the Lexical runtime across the workspace, eliminating a latent duplicate-instance bug in the admin editor.

Changes

• deps: Unify lexical and every @lexical/* subpackage to ^0.46.0 across apps/admin, apps/core, packages/cli, and packages/editor, and bump six stranded @haklex/rich-plugin-* pins from 0.28.0 to 0.29.0. Before this fix, pnpm install allocated both lexical@0.45.0 (satisfying the stranded plugins' peer floor) and lexical@0.46.0 (satisfying the bumped editor family) in the admin install graph, which manifested at runtime as Lexical error #8 (Cannot find node by key) when inserting nodes whose class was registered against the other lexical heap. The admin editor now resolves a single lexical@0.46.0 end-to-end. (81cf2c5)

---

Full Changelog: v13.11.2...v13.11.3

v13.11.2

TL;DR

Four AI/admin fixes — custom provider endpoints now honored, orphan articles surface in grouped lists, translation glossary scans every note, and /recently writes hydrate link-card enrichments.

Highlights

The AI provider runtime now honors the endpoint configured in the admin drawer even when a registered OpenAI-compatible model matches the request. Previously, a model id like gpt-4o-mini would always route through api.openai.com regardless of the saved endpoint, breaking proxy and relay deployments and causing 403 Country/Region not supported errors in restricted regions. The admin getAiProviderById lookup also stops returning the encrypted ciphertext to the runtime — test-connection and model-list paths now see the decrypted value.

Admin AI panels now show every article, not only those that already have AI records. The grouped lists for summary, insights, and translation merge orphan articles — visible posts/notes that have never been processed (typical after DB-direct writes, migration backfills, or scripted imports) — alongside the records-having groups, with cross-page slicing and search filter propagating through both sides. The translation glossary collector also stops capping at the most recent 100 notes; a single distinct-value query now seeds mood/weather entries from every visible note in history.

The /recently write path now runs link-card enrichment on create and update, so cards no longer come back blank for URLs that the optimistic write didn't pre-resolve.

Changes

Bug Fixes

• AI runtime honors custom provider endpoints; getAiProviderById resolves through the decrypted cache so test-connection no longer sees encrypted API keys (29e082a)
• Summary / insights / translation /grouped admin endpoints include orphan articles with zero AI records (e51621a, #2758)
• Translation glossary seeds from every visible note's mood/weather, not just the last 100 (49aa04f, #2758)
• /recently create/update hydrate link-card enrichments so cards survive the write path (0c62e08)

Other

• Bump @haklex/* editor packages to 0.29.0 (Lexical 0.46 alignment; bundled — no operator action) (806d0f7)
• Workspace dependency refresh: Babel 8, sharp 0.35, nodemailer 9, js-yaml 5, NestJS 11.1.27 (57a26e8)

---

Full Changelog: v13.11.1...v13.11.2

v13.11.1

TL;DR

Translation list endpoints no longer drop current translations wrongly marked stale when their snapshot body was SQL-truncated.

Changes

• List endpoints returning SQL-truncated translation snapshots (left(text, n)) no longer flag otherwise-current rows as stale: the freshness check now routes these through a DB-backed hash recheck, so list responses match the detail endpoint instead of silently dropping live translations (d5f322b)

---

Full Changelog: v13.11.0...v13.11.1

v13.11.0

TL;DR

Snippets become a virtual filesystem and skills become multi-file bundles, with the post-detail wire updated to deliver the bundle manifest under meta.skills.

Breaking Changes

• snippet: the snippet schema drops name, reference, and custom_path columns in favour of a single POSIX-style path. Migration: schema migration 0022_snippet_vfs runs automatically on boot; any external HTTP client that constructed snippet requests around {name, reference, customPath} must be updated to the path-keyed PUT /snippets/by-path surface (admin UI and mxs CLI already do this since 5.4.0).
• post detail response: an attached skill no longer ships under post.skills; it now lives on the response envelope at meta.skills with an asset manifest under assets[]. The legacy PublicSkillView type is replaced by SkillBundleView (no raw field; assets carry path, rawUrl, type, size). Migration: consumers should update to @mx-space/api-client@^5.4.0 and read meta.skills instead of data.skills; an unmigrated frontend simply hides the skill card (no crash).

Highlights

Skill attachments graduate from a single inline markdown blob into a real bundle. A SKILL.md sits at the root of its folder and can reference siblings — references/usage.md, scripts/run.sh, nested subdirectories — and the post detail API now returns the full asset manifest with absolute fetch URLs. AI agents pulling a skill no longer need any list-endpoint plumbing: the manifest plus the existing public /s/<path> route are enough to retrieve every file in one pass.

Under the hood the snippet subsystem is now a virtual filesystem keyed on a POSIX-style path. The legacy (name, reference, customPath) triplet is gone; every snippet is one file row, directories are derived from path prefixes at query time, and the repository gains recursive list, prefix move, prefix delete, and findAssetsByDirs for bundle queries. POST /snippets/import is now transactional and upserts by path so a multi-file bundle can be pushed atomically.

The response envelope picks up a small refactor that pays for the new behaviour: MetaObjectBuilder is now generic over its schema with per-resource subclasses (PostMetaBuilder, NoteMetaBuilder), and resource-attached metadata always lands on meta instead of being mixed back into the entity. This also fixes an existing V2 violation where skills were being merged into the post object.

Changes

Features

• Skill bundles can ship arbitrary supporting files; post detail responses now carry meta.skills with a per-bundle asset manifest (af4b771)
• MetaObjectBuilder split into a cross-cutting base and per-resource PostMetaBuilder / NoteMetaBuilder; note.controller and the AI insights / summary controllers move attached metadata onto the response meta envelope (af4b771)
• Snippet subsystem becomes a path-keyed virtual filesystem with recursive list / move / delete, prefix-aware asset queries, and a transactional POST /snippets/import (54326e2)
• New end-to-end harness drives the mxs CLI against an in-process NestFastify backend with isolated PostgreSQL and Redis per test file; 22 specs / 86 tests cover auth, content CRUD, AI management, file upload, skill rendering, help, and output-mode contracts (#2755)

Upgrade Notes

• Run schema migrations as part of the rolling deploy: pnpm -C apps/core run migrate (or rely on the mx-migrate compose service). Migration 0022_snippet_vfs is destructive — it drops the old name, reference, custom_path columns; ensure any external integration that addresses snippets by those fields has been updated first.
• Yohaku / Shiro / any custom frontend reading post detail should bump @mx-space/api-client to ^5.4.0 and switch from data.skills to meta.skills. The wire change soft-degrades for unmigrated clients (skill card hidden, no crash).

---

Full Changelog: v13.10.10...v13.11.0

v13.10.10

TL;DR

Internal maintenance release; no user-facing changes.

Changes

• chore(deps): bump @haklex/* to 0.27.0, pulling upstream rich-editor fixes (nested plugin wiring, grid focus, and contained table image resizing) (d07036345)

---

Full Changelog: v13.10.7...v13.10.8