[patrick-chinchill]

Summary

Closing PR of the 4.41 wave. It prepares the 0.4.41 release commit and changes no runtime code.

• Fidelity pin. scripts/upstream_pin.json pin moves to chat@4.41.1 @ f690af3c26a3bd7649387cccad12d215463ed22c, the same as target. lint.yml reads the tag and SHA from that file with jq, so CI's strict step now clones chat@4.41.1 and checks the SHA; the workflow itself needs no edit. --check-docs passes for CLAUDE.md and docs/UPSTREAM_SYNC.md.
• Version. UPSTREAM_PARITY = "4.41.1". It names the pin tag exactly, as "4.31.0" ↔ chat@4.31.0 did; the mapping tables say "not 4.41.0". pyproject.toml version is 0.4.41. Also updated: the README status line and a 0.4.41 → 4.41.1 row in both version-mapping tables (CLAUDE.md, docs/UPSTREAM_SYNC.md; the latter also gets the missing 0.4.31 / 0.4.31.3 rows). uv.lock is not tracked, so there is nothing to bump there.
• Strict tier. Upstream added eight test files in 4.34–4.41, and all are at 0 missing at the pin. They move from TARGET_MAPPING to MAPPING:
  • history/{user,thread,channel,to-prompt}
  • agent-session, app-context, installation-events
  • adapter-shared/download
• Report-only rows. cards, modals, emoji and message stay in TARGET_MAPPING and are documented as issue Extend verify_test_fidelity.py MAPPING to cover all packages/chat/src/*.test.ts #78 work.
• Baseline. fidelity_baseline.json is regenerated for ts_parity: chat@4.41.1. It is still empty, with total_ts_tests: 922.
• Non-parity rows (docs/UPSTREAM_SYNC.md). Two new tables plus fixes to existing rows:
  • New table Skipped upstream changes (4.41 wave): TanStack AI, AI SDK v7, Workflow requestApproval, the workflow serialization entrypoint, Vercel Connect, create-chat-sdk, the catalog entries, a grouped docs/community-adapter/chore row, the Discord import sort and the Telegram test timeout.
  • New table Deferred platforms and adapter modes (demand-gated, [4.41/DEF1] Deferred upstream 4.32–4.41 features (demand-gated backlog) #189). Every [4.41/DEF1] Deferred upstream 4.32–4.41 features (demand-gated backlog) #189 item is listed: Instagram, Notion, X, XChat, Telegram Business, Twilio RCS (with the empty-card fallback), Discord Components V2, and Vercel Connect for Linear, Discord, Telegram and GitHub. XChat is recorded as skipped (no Python bindings, checked on PyPI 2026-09-29). Gmail is listed because [4.41/GMAIL] Gmail adapter (demand-gated): primitives + Chat adapter #241 has not landed.
  • The chat/adapters catalog row is re-verified at chat@4.41.1: 34 entries (20 official, 14 vendor-official), with 10 slugs added since 4.31.0 and none removed.
  • The UNMAPPED TanStack and Workflow reasons now point at their rows.
• CHANGELOG. "Unreleased (4.41 wave)" becomes 0.4.41. It gets a header paragraph, a consumer-visible-changes digest (the migration checklist), the pending live checks and this PR's own entry.

Pending live checks before publishing

This PR does not tag, create a GitHub release or publish to PyPI. The maintainer cuts the release after these checks:

• Teams on SDK 2.1 (fix(teams): support microsoft-teams-apps 2.1, lift cap to <2.2 (#250) #262 / Teams: support microsoft-teams-apps 2.1 (activity_sender removal, activities update signature) #250): native DM streaming, edit_message and delete_message on microsoft-teams-apps 2.1.x
• Slack streamed mentions ([4.41/SL1] Slack outbound mentions: code/URL-aware resolution, native-stream path #206): a streamed @name becomes a real <@U…> ping on the native stream
• Slack stream rotation past 5 minutes ([4.41/SL3] Slack: rotate long native streams before expiry #208)
• Slack agent_view Stop button ([4.41/SL10] Slack Agent Sessions lifecycle + native stop #215)
• Pre-publish git-ref smoke test of downstream consumers (chinchill) against the release commit

Upstream commits mapped

These commits get skip or non-parity rows only; none is ported:

• Skipped features: 2d0d3bf3 TanStack AI, 6714efc3 AI SDK v7, 4cb7e5d5 Workflow requestApproval, bdeb2bf1 serialization entrypoint, ab0e1806 / ba687cb1 / 1136c967 Vercel Connect, ba375ce1 / 927d0dbd create-chat-sdk.
• Adapter catalog entries: 0c761f1b, 3abdc691, 24a04d56, d034b8b5, 06af3e12, f034cd27.
• Community-adapter docs: f691ad58, a8867a0a, eb466e52, ef3f0f63.
• Docs and chore: 86b2fa4b, 1dff4515, b3123815, 99c59850, efa96108, 64b66864, 0642ce33.
• Formatting and test infrastructure: 21962572, 57fa85ca.
• [4.41/DEF1] Deferred upstream 4.32–4.41 features (demand-gated backlog) #189 deferrals: 2a2b2c55, 0ec6a736, 06b04ac4, ef2542c5, 4bca64f0, b6749238, caa63253, fe4ed11e, 043386b5, 75cadbf9, 7a1150ce, 4115c943, 961cf454, a0cba028, 6750d59e, 0fdb9029.

Tests

No new tests are ported, and strict fidelity found no gap at 4.41.1. Test changes:

• tests/test_verify_test_fidelity.py: the committed-pin assertion now expects chat@4.41.1. The CLI tests that need a mid-wave pin (pin ≠ target) now write their own pin file and parity value, so they no longer depend on the committed pin.
• tests/test_callback_url.py: test_handles_legacy_string_format is renamed to test_legacy_string_record_never_resolves_and_is_not_deleted. Its comment said it was kept only until this pin move; it still asserts behavior the upstream test does not cover (the record is never resolved and never deleted).
• tests/test_history_user.py: docstring update only.

Fidelity

Strict tier:

Pin	Mapped files	Tests matched	Missing
chat@4.31.0 (before)	13	733/733	0
chat@4.41.1 (after)	21	922/922	0

At chat@4.41.1 the original 13 files account for 836 tests and the 8 promoted files for 86. Every .each template counts as one test (21 templates across mapped and target files).

The target report (--report-target, chat@4.41.1) shows 964 of 1064 matched (889 exact, 75 fuzzy) and 100 missing. All 100 are in the report-only rows: cards 20, modals 28, emoji 41, message 11.

Delta vs committed report (HEAD): missing 100 -> 100 (+0)

fidelity_target.json changes only the tier field of the eight promoted rows.

Divergences

There are no new behavior divergences. The new rows record upstream changes that are skipped or deferred.

Consumer impact

There is no runtime change. This PR marks the release that carries every behavior change in the wave; the CHANGELOG digest is the consumer's migration checklist. It covers lock heartbeat, mention tri-state, Slack/Teams/Telegram streaming, callback tokens, AI-tool scoping, download caps, webhook auth, and thread/channel ids.

Validation

All of these pass:

• uv run ruff check
• uv run ruff format --check
• audit_test_quality.py: 0 hard failures
• verify_test_fidelity.py --check-docs
• TS_ROOT=<chat@4.41.1 checkout> verify_test_fidelity.py --strict: 922/922
• uv run pytest tests/: 7971 passed, 24 skipped
• uv run pyrefly check: 0 errors

Closes #203
Part of #184

Merge gate

Final HEAD: ba33b37 (up to date with main @ f93c3d0).

Review findings (two reviewers, six items), docs-only fixes in d70385c:

• Fixed: the catalog rows now carry exact refs. X is ef2542c5 (chat@4.33.0), XChat caa63253 (4.36.0), Instagram 2a2b2c55 and Notion 0ec6a736 (4.37.0), and the Gmail listing f034cd27 (chat@4.41.1, not 4.41.0). The Gmail deferred row cites the package commit bfee00af #939 (4.41.0) separately from the catalog commit.
• Fixed: the version table has separate rows. 0.4.31.1 is Slack Slack: empty DM thread_ts hits conversations.replies(ts='') in fetch paths — add conversations.history fallback #138/Slack: chat.startStream fails with team_not_found on Enterprise Grid workspaces #95. 0.4.31.3 is Teams Graph SSRF hardening fix(teams): close mixed-case-scheme bypass in graph SSRF/token-leak guard #178 and NOTICE docs: add NOTICE with Vercel Chat's MIT attribution #179, the same content as the unpublished 0.4.31.2. New tests/test_version_mapping_docs.py keeps the CLAUDE.md and UPSTREAM_SYNC version tables in step and ties the pyproject version to UPSTREAM_PARITY. It fails on the previous table.
• Fixed: the skipped-changes table records 636da193 #972 and 208a5ec2 #964. The 8 test_thread_faithful.py tests for removed schedule() titles are noted as Python-only extras. The table also records the shared adapter test contracts a7fb1bcf/840c0d16/ac5a54ee/e7a396ae, which are [4.41/X1] Shared adapter test contracts (thread-id + self-message) — optional #188, and the CI/example commits 776a849a and 8021c3ea. The completeness sentence now says "runtime change" and says that release/deps/CI/docs-site/example/governance commits are not listed one by one.
• Fixed: Discord Components V2 now cites [4.41/D2] Discord features: ephemeral slash responses, select values, channel allowlist, global mentions opt-in, rename threads #230 as the deferral decision instead of claiming that [4.41/DEF1] Deferred upstream 4.32–4.41 features (demand-gated backlog) #189 lists it. Declined in part: GitHub Connect (6750d59e) is listed in [4.41/DEF1] Deferred upstream 4.32–4.41 features (demand-gated backlog) #189's body under "Vercel Connect hooks", so that row stays.
• Fixed: the CHANGELOG migration checklist adds the Discord thread-interaction id ([4.41/D1] Discord correctness & security: thread-parent validation, starter-message routing, mentions/URLs, forwarded snapshots, downloads #229), WhatsApp BSUID user ids and state keys ([4.41/W1] WhatsApp: business-scoped user ids (BSUID) and inbound context variants #236), Postgres expired-claim reclaim ([4.41/ST1] Postgres state: reclaim expired set_if_not_exists rows, migration-managed schemas #240) and the Teams pre-dispatch email lookup latency ([4.41/T3] Teams inbound: author email hydration, protected inline attachments, secure downloads #218).

gpt-6-astra: 2 rounds.

• Round 1 [P2]: the new doc test raised FileNotFoundError in the sdist because CLAUDE.md is not in the sdist allowlist. Fixed in ba33b37 with a module skipif; checked by building the sdist and running the test there (2 skipped).
• Round 2 on ba33b37: "No actionable regressions found."

Bots: CodeRabbit was rate-limited with no findings. There are no other bot comments.

CI on ba33b37: all green (Lint & Type Check, test 3.12/3.13, CodeQL).

Local validation on ba33b37: ruff check/format, audit (0 hard failures), --check-docs, strict fidelity at chat@4.41.1 (all TS tests matched), pytest 7973 passed / 24 skipped, pyrefly 0 errors. --report-target delta: missing 100 -> 100 (+0).

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 52da289a-1166-4fb4-b614-23c050d64087

📥 Commits

Reviewing files that changed from the base of the PR and between f93c3d0 and ba33b37.

📒 Files selected for processing (14)

• CHANGELOG.md
• CLAUDE.md
• README.md
• docs/UPSTREAM_SYNC.md
• pyproject.toml
• scripts/fidelity_baseline.json
• scripts/fidelity_target.json
• scripts/upstream_pin.json
• scripts/verify_test_fidelity.py
• src/chat_sdk/__init__.py
• tests/test_callback_url.py
• tests/test_history_user.py
• tests/test_verify_test_fidelity.py
• tests/test_version_mapping_docs.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[patrick-chinchill]

Merge gate: CI green (Lint & Type Check, test (3.12), test (3.13), CodeQL / Analyze (python, actions)); local Codex review (gpt-6-astra, xhigh, --base origin/main) on ba33b37: "No actionable regressions found. All 187 focused tests passed, strict fidelity verified 922/922 matches, and documentation consistency, lint, and formatting checks passed."; 2 astra rounds (round 1 P2 sdist FileNotFoundError fixed in ba33b37); HEAD already contains main @ f93c3d0, no merge needed; CodeRabbit rate-limited with no findings, no other bot comments. Merging with --admin (Protect Main requires a code-owner approval).