David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
6042 commits 2 branches 0 tags 158 MiB
Commit graph

6042 commits

This branch
This branch
All branches
Author SHA1 Message Date
nesquena-hermes
82e401362a
Merge pull request #5299 from nesquena/release/stage-4969b 
Release v0.51.781 — deep-link ?q= composer prefill, converged (#4969)
 2026-06-30 16:18:47 -07:00
nesquena-hermes
f7ec3c7b39 test(#5217): scope follow-intent ordering assertion to _handleStreamError + strip EOF blank line (Codex gate nits) 2026-06-30 23:18:00 +00:00
nesquena-hermes
740a3a693e docs(changelog): deep-link ?q= composer prefill, converged (#4969) 2026-06-30 23:08:16 +00:00
nesquena-hermes
373c3e4b63 Merge #4969 into stage 2026-06-30 23:07:53 +00:00
Frank Song
fdeb37bbe2 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 07:02:01 +08:00
nesquena-hermes
e94b8ac85b
Merge pull request #5297 from nesquena/release/stage-b1 
Release v0.51.780 — Kanban default-board dispatch + PWA new-chat hydration (#5289 #5287)
 2026-06-30 15:55:14 -07:00
nesquena-hermes
a616163523 docs(changelog): default-Kanban dispatch fix (#5289) + PWA new-chat hydration defer (#5287) 2026-06-30 22:45:35 +00:00
nesquena-hermes
338060e910 Merge #5287 into stage-b1 2026-06-30 22:45:08 +00:00
nesquena-hermes
7df031592c Merge #5289 into stage-b1 2026-06-30 22:45:06 +00:00
Frank Song
52f5d15214 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 06:42:56 +08:00
nesquena-hermes
cbb9f79c8a
Merge pull request #5296 from nesquena/release/stage-4738b 
Release v0.51.779 — two opt-in neon skins (#4738)
 2026-06-30 15:24:59 -07:00
nesquena-hermes
ec5f9715a1 docs(changelog): two opt-in neon skins (#4738) 2026-06-30 22:22:14 +00:00
Frank Song
f874f4027c Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 06:22:02 +08:00
nesquena-hermes
3e84d7bf11 Merge #4738 (savagebread neon skins + skin-persistence fix) into stage 2026-06-30 22:21:28 +00:00
nesquena-hermes
0b2507ac9f fix(#4738): register neon-soft/neon-paint in _SETTINGS_SKIN_VALUES (server-side skin persistence) 2026-06-30 22:13:36 +00:00
nesquena-hermes
7d19792a4a
Merge pull request #5295 from nesquena/release/stage-5005 
Release v0.51.778 — opt-in Shift+Enter send-key mode (#5005)
 2026-06-30 15:07:20 -07:00
Frank Song
36fcd10db7 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 06:01:53 +08:00
nesquena-hermes
a20d42893d docs(changelog): opt-in Shift+Enter send-key mode (#5005) 2026-06-30 21:52:20 +00:00
nesquena-hermes
78ca4d43a1 Merge #5005 (futureworld678 Shift+Enter) into stage 2026-06-30 21:51:42 +00:00
nesquena-hermes
05e9be1429
Merge pull request #5293 from nesquena/release/stage-5120 
Release v0.51.777 — configurable provider budget + %-used (#5120)
 2026-06-30 14:47:29 -07:00
Frank Song
4da83ada63 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 05:42:12 +08:00
nesquena-hermes
512824dcc3 docs(changelog): configurable provider budget + %-used (#5120) 2026-06-30 21:34:35 +00:00
nesquena-hermes
0b74397fa6 Merge #5120 (rodboev budget limit) into stage 2026-06-30 21:28:51 +00:00
nesquena-hermes
673edbf054
Merge pull request #5292 from nesquena/release/stage-5002 
Release v0.51.776 — opt-in per-project new-conversation shortcuts (#5002)
 2026-06-30 14:22:57 -07:00
nesquena-hermes
f579ed83dc fix(#5002): repaint sidebar after quick-create newSession (Codex: newSession doesn't render; callers must) 2026-06-30 21:12:14 +00:00
nesquena-hermes
ee7f6b584d fix(#5002): hydrate _projectQuickCreate at boot + rebuild sidebar on toggle change 
Codex gate findings: (1) the opt-in flag was only set when Settings opened, so an
enabled setting didn't take effect on a fresh load — now hydrated from /api/settings
at boot (mirrors _largeTextPasteAsAttachment, default-false); (2) toggling the
checkbox now rebuilds the sidebar so the + buttons appear/disappear immediately.
 2026-06-30 21:06:35 +00:00
Frank Song
bb95539918 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 05:02:19 +08:00
nesquena-hermes
34f4a72256 docs(changelog): opt-in per-project new-conversation shortcuts (#5002) 2026-06-30 20:56:49 +00:00
nesquena-hermes
8a5172275d Merge #5002 (per-project quick-create, opt-in) into stage 2026-06-30 20:56:05 +00:00
nesquena-hermes
dc569ee0fb
Merge pull request #5290 from nesquena/release/stage-5079b 
Release v0.51.775 — OpenAI-compatible TTS backend, SSRF-hardened (#5079)
 2026-06-30 13:47:49 -07:00
nesquena-hermes
a103775e42 docs(changelog): OpenAI-compatible TTS backend, SSRF-hardened (#5079) 2026-06-30 20:39:51 +00:00
nesquena-hermes
ba401d3784 Merge #5079 (OpenAI TTS + SSRF hardening) into stage 2026-06-30 20:39:04 +00:00
nesquena-hermes
eb2c4b1e7d fix(#5079): no-redirect opener for OpenAI TTS (block redirect-to-private SSRF + bearer leak) 
A public TTS host could 301/302/303-redirect POST /audio/speech to an internal
target (e.g. http://169.254.169.254), and urllib's default redirect handler
would follow it carrying the Authorization bearer — both an SSRF bounce past the
base-url guard and a credential leak. Now uses a no-redirect opener
(_NoRedirectTtsHandler raises on any redirect) via the _tts_open seam. +redirect
rejection regression test. Residual DNS-rebinding TOCTOU (re-resolve at connect)
is a narrower low-severity window noted for follow-up.
 2026-06-30 20:37:43 +00:00
nesquena-hermes
6bcb728f08 fix(#5079): block private/link-local/reserved IP targets in OpenAI TTS base_url (SSRF hardening) 
The base_url validator accepted any https host; an https URL pointing at an
internal/link-local/loopback/reserved IP (e.g. https://169.254.169.254 cloud
metadata, https://10.x internal) passed the scheme-only check. Now resolves the
host and rejects blocked-target addresses (private/loopback/link-local/reserved/
multicast/unspecified), while still allowing public OpenAI-compatible hosts and
the explicit localhost-over-http dev case. DNS-resolution failure is allowed
(unreachable host can't be an SSRF vector + avoids false-rejecting public hosts
that don't resolve in sandboxed envs). +5 regression vectors.
 2026-06-30 20:37:43 +00:00
Frank Song
7f069100cc Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 04:23:09 +08:00
Rod Boev
027ad18834 test(#5231): harden JS source extraction coverage 2026-06-30 16:06:39 -04:00
nesquena-hermes
df9c643a80
Merge pull request #5288 from nesquena/release/stage-4881 
Release v0.51.774 — Kanban modal fields (#4881)
 2026-06-30 13:05:32 -07:00
Frank Song
ab4844f54a Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 04:02:12 +08:00
nesquena-hermes
93d31ebad5 docs(changelog): Kanban modal skills/max_runtime/parents (#4881) 2026-06-30 19:51:22 +00:00
nesquena-hermes
027699b570 Merge #4881 (rodboev Kanban modal fields) into stage 2026-06-30 19:50:46 +00:00
Rod Boev
e8631b808f fix(#5231): unblock Run dispatcher on the default Kanban board 2026-06-30 15:49:09 -04:00
nesquena-hermes
b098e5c658 feat(#4676): gate per-project quick-create buttons behind opt-in setting 
Add a default-OFF 'project_quick_create_buttons' setting that gates the
per-project '+' quick-create buttons on sidebar project chips. The chip
render site only calls _attachProjectQuickCreateButton when the new
window._projectQuickCreate runtime flag is enabled, so the buttons do
not appear unless the user opts in via Settings.

Mirrors the large_text_paste_as_attachment opt-in plumbing (defaults,
allowlist, settings collect/restore/save, window hydration at both sites,
checkbox row, i18n across all locales).
 2026-06-30 19:49:07 +00:00
nesquena-hermes
4e8bd002f7
Merge pull request #5286 from nesquena/release/stage-4871 
Release v0.51.773 — Mermaid toolbar controls in chat (#4871)
 2026-06-30 12:43:18 -07:00
Frank Song
54cbc35155 Merge origin/master into PR #5271 
Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-07-01 03:41:54 +08:00
santastabber
4b33458c4b fix(pwa): defer new-chat model hydration 2026-07-01 05:29:34 +10:00
Rod Boev
66fc8722c1 fix(#4676): expose quick-create button purpose to screen readers 2026-06-30 19:28:28 +00:00
Rod Boev
80dbbc1e93 fix(#4676): swallow duplicate quick-create inflight rejections 2026-06-30 19:28:27 +00:00
Rod Boev
0ea9e72a9a docs(#4676): clarify quick-create rollback ownership 2026-06-30 19:28:27 +00:00
Rod Boev
a109f86946 Keep project quick-create filter changes in sync with session creation outcomes 2026-06-30 19:28:27 +00:00
Rod Boev
08c4004271 Preserve touch quick-create clicks while blocking chip long-press leakage 2026-06-30 19:28:27 +00:00