Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

apps/web/locales/af-ZA.po

@@ -679,6 +679,11 @@ msgstr "Toekennings"
 msgid "Azerbaijani"
 msgstr "Azerbeidjans"
 
+#. Action returning a signed-in user to the page where they manage linked providers
+#: src/features/auth/pages/error.tsx
+msgid "Back to authentication settings"
+msgstr "Terug na verifikasie-instellings"
+
 #. Secondary navigation button on 2FA verification screen
 #: src/features/auth/pages/verify-2fa.tsx
 msgid "Back to Login"
@@ -688,6 +693,11 @@ msgstr "Terug na Aanmelding"
 msgid "Back to resumes"
 msgstr "Terug na CV's"
 
+#. Action returning the visitor to the sign-in page after a failed sign-in
+#: src/features/auth/pages/error.tsx
+msgid "Back to sign in"
+msgstr "Terug na aanmelding"
+
 #: src/routes/builder/$resumeId/-sidebar/right/sections/design.tsx
 msgid "Background Color"
 msgstr "Agtergrondkleur"
@@ -1498,6 +1508,11 @@ msgstr "Beskrywing"
 msgid "Design"
 msgstr "Ontwerp"
 
+#. Label above the raw error text forwarded by the identity provider
+#: src/features/auth/pages/error.tsx
+msgid "Details from the provider:"
+msgstr "Besonderhede van die verskaffer:"
+
 #. Destructive action button to turn off two-factor authentication
 #: src/dialogs/auth/disable-two-factor.tsx
 #: src/features/settings/authentication/components/two-factor.tsx
@@ -2981,6 +2996,10 @@ msgstr "Netwerk"
 msgid "Never expires"
 msgstr "Verval nooit nie"
 
+#: src/features/auth/pages/error.tsx
+msgid "New account sign-ups are currently disabled on this server."
+msgstr "Nuwe rekeningregistrasies is tans op hierdie bediener gedeaktiveer."
+
 #: src/features/command-palette/pages/navigation.tsx
 #: src/features/command-palette/pages/resumes.tsx
 msgid "New Application"
@@ -4209,6 +4228,11 @@ msgstr "Meld aan met GitHub, Google of 'n pasgemaakte OAuth-verskaffer."
 msgid "Sign up"
 msgstr "Meld aan"
 
+#. Title on the page shown after a failed or cancelled OAuth sign-in
+#: src/features/auth/pages/error.tsx
+msgid "Sign-in didn't complete"
+msgstr "Aanmelding nie voltooi nie"
+
 #: src/features/auth/components/social-auth.tsx
 #: src/features/auth/pages/login.tsx
 msgid "Signing in..."
@@ -4295,6 +4319,10 @@ msgstr "Iets anders…"
 msgid "Something went wrong"
 msgstr "Iets het verkeerd geloop"
 
+#: src/features/auth/pages/error.tsx
+msgid "Something went wrong while signing you in. Please try again."
+msgstr "Iets het verkeerd geloop tydens jou aanmelding. Probeer asseblief weer."
+
 #: src/features/applications/components/application-actions-menu.tsx
 #: src/features/applications/components/application-detail-sheet.tsx
 #: src/routes/builder/$resumeId/-sidebar/right/sections/sharing.tsx
@@ -4570,6 +4598,18 @@ msgstr "Thai"
 msgid "Thank you to our sponsors"
 msgstr "Dankie aan ons borge"
 
+#: src/features/auth/pages/error.tsx
+msgid "That provider account is already linked to a different user."
+msgstr "Daardie verskaffer-rekening is reeds aan 'n ander gebruiker gekoppel."
+
+#: src/features/auth/pages/error.tsx
+msgid "That provider account uses a different email address than your account."
+msgstr "Daardie verskaffer-rekening gebruik 'n ander e-posadres as jou rekening."
+
+#: src/features/auth/pages/error.tsx
+msgid "That sign-in provider is no longer available on this server."
+msgstr "Daardie aanmeldingsverskaffer is nie meer op hierdie bediener beskikbaar nie."
+
 #: src/routes/agent/-components/agent-chat.tsx
 msgid "The agent needs your input."
 msgstr "Die agent benodig jou insette."
@@ -4582,6 +4622,10 @@ msgstr "Die API-sleutel is suksesvol uitgevee."
 msgid "The API key will no longer be able to access your data after deletion. This action cannot be undone."
 msgstr "Die API-sleutel sal nie meer jou data kan toegang nadat dit uitgevee is nie. Hierdie aksie kan nie ongedaan gemaak word nie."
 
+#: src/features/auth/pages/error.tsx
+msgid "The application that sent you here made an invalid authorization request."
+msgstr "Die toepassing wat jou hierheen gestuur het, het 'n ongeldige magtigingsversoek gemaak."
+
 #. Empty-state message when no command palette results match the search query
 #: src/features/command-palette/index.tsx
 msgid "The command you're looking for doesn't exist."
@@ -4600,6 +4644,18 @@ msgstr "Die bladsy waarna jy soek, is dalk geskuif of bestaan nie meer nie."
 msgid "The password you entered is incorrect"
 msgstr "Die wagwoord wat jy ingevoer het, is verkeerd"
 
+#: src/features/auth/pages/error.tsx
+msgid "The provider didn't share an email address, which is required to sign in."
+msgstr "Die verskaffer het nie 'n e-posadres gedeel nie, wat nodig is om aan te meld."
+
+#: src/features/auth/pages/error.tsx
+msgid "The provider rejected this sign-in attempt. Please start again."
+msgstr "Die verskaffer het hierdie aanmeldingspoging verwerp. Begin asseblief weer."
+
+#: src/features/auth/pages/error.tsx
+msgid "The provider's response could not be verified. Please start again."
+msgstr "Die verskaffer se antwoord kon nie geverifieer word nie. Begin asseblief weer."
+
 #: src/features/resume/preview/preview.browser.tsx
 msgid "The resume preview could not be updated. The last valid preview is still shown."
 msgstr "Die CV-voorskou kon nie opgedateer word nie. Die laaste geldige voorskou word steeds gewys."
@@ -4765,6 +4821,10 @@ msgstr "Hierdie afdeling word as 'n leë opskrif weergegee."
 msgid "This section sits in the sidebar."
 msgstr "Hierdie afdeling sit in die sybalk."
 
+#: src/features/auth/pages/error.tsx
+msgid "This sign-in attempt expired or was already used. Please start again."
+msgstr "Hierdie aanmeldingspoging het verval of is reeds gebruik. Begin asseblief weer."
+
 #: src/features/auth/pages/register.tsx
 msgid "This step is optional, but recommended."
 msgstr "Hierdie stap is opsioneel, maar word aanbeveel."
@@ -5310,6 +5370,14 @@ msgstr "Ons kon nie die formaat outomaties opspoor nie — kies dit asseblief hi
 msgid "We couldn't find that page"
 msgstr "Ons kon nie daardie bladsy vind nie"
 
+#: src/features/auth/pages/error.tsx
+msgid "We couldn't link that provider account. Please try again."
+msgstr "Ons kon nie daardie verskaffer-rekening koppel nie. Probeer asseblief weer."
+
+#: src/features/auth/pages/error.tsx
+msgid "We couldn't read your profile from the provider."
+msgstr "Ons kon nie jou profiel by die verskaffer lees nie."
+
 #: src/routes/agent/-components/tool-part-card.tsx
 msgid "Web search"
 msgstr "Websoektog"
@@ -5400,6 +5468,10 @@ msgstr "Jy kan ook jou gebruikersnaam gebruik om aan te meld."
 msgid "You can share your resume via a unique public URL, protect it with a password, or download it as a PDF to share directly. The choice is yours!"
 msgstr "Jy kan jou CV deel via 'n unieke publieke URL, dit met 'n wagwoord beskerm, of dit as 'n PDF aflaai om direk te deel. Die keuse is joune!"
 
+#: src/features/auth/pages/error.tsx
+msgid "You cancelled the sign-in before it finished."
+msgstr "Jy het die aanmelding gekanselleer voordat dit voltooi is."
+
 #: src/hooks/use-form-blocker.tsx
 msgid "You have unsaved changes that will be lost."
 msgstr "Jy het ongestoorde veranderinge wat verlore sal gaan."
@@ -5441,6 +5513,10 @@ msgstr "Jou data is veilig en word nooit met iemand gedeel of verkoop nie."
 msgid "Your data is stored securely and is never shared with third parties. You can also self-host Reactive Resume on your own servers for complete control over your data."
 msgstr "Jou data word veilig gestoor en nooit met derde partye gedeel nie. Jy kan ook Reactive Resume self-host op jou eie bedieners vir volledige beheer oor jou data."
 
+#: src/features/auth/pages/error.tsx
+msgid "Your email address isn't verified with the provider."
+msgstr "Jou e-posadres is nie by die verskaffer geverifieer nie."
+
 #: src/features/resume/builder/draft.ts
 msgid "Your latest changes could not be saved."
 msgstr "Jou jongste veranderinge kon nie gestoor word nie."
@@ -5546,4 +5622,3 @@ msgstr "Zoem uit"
 #: src/libs/locale.ts
 msgid "Zulu"
 msgstr "Zoeloe"
-