945 Commits
Author SHA1 Message Date
linshen 1ee326fc89 fix(desktop): define Linux executable name 2026-09-11 09:16:02 +08:00
linshen c80c70a738 chore(release): prepare v2.11.10 2026-09-11 08:52:55 +08:00
linshen f089c9cbf3 ci: upgrade Docker actions for Node 24 2026-09-10 22:10:32 +08:00
linshen 0c23a18293 ci: use Node 24 pnpm setup action 2026-09-10 21:55:02 +08:00
linshen cc223808f5 fix: harden model UI and desktop packaging 2026-09-10 21:47:36 +08:00
linshen 5b995b94ea fix(security): update Vite and patch esbuild 2026-09-10 20:09:56 +08:00
linshen e5bab3a6a3 fix: restore model tabs and adopt Node 24 2026-09-10 19:31:41 +08:00
linshen a61e255072 fix(ci): disable unsupported image attestations 2026-09-10 17:30:26 +08:00
linshen 7f1909b06d fix: stabilize prompt panel action keys 2026-09-10 17:01:29 +08:00
linshen bfd1543110 feat: refresh built-in model catalog 2026-09-10 16:42:28 +08:00
linshen e4a281f42d fix: restore model setup access and update dependencies 2026-09-10 15:49:53 +08:00
linshen 8a7f9e7f64 fix(security): require exact auth endpoint bypass 2026-09-10 14:13:32 +08:00
且炼时光 9672c59cab Merge pull request #350 from bluesky4485/develop
fix(security): 修复 /api 路径绕过访问密码校验的未授权访问漏洞
2026-09-10 14:07:25 +08:00
且炼时光 aa2d380a1f Merge pull request #349 from Iams4kura/bugfix/preserve-restored-history-order-20260910t040110z
fix(history): preserve record order when restoring backups
2026-09-10 14:06:58 +08:00
huangkeandAtomCode ac2dd6adc5 fix(security): 修复 /api 路径绕过访问密码校验的未授权访问漏洞
middleware matcher 原先豁免所有 /api 开头路径,而 Vercel 部署下
/api 无对应 serverless 函数,请求会命中 SPA 兜底 rewrite 返回完整
前端应用,导致攻击者无需密码即可通过 /api#/basic/system 进入系统。

现将豁免范围收窄为仅 /api/auth(登录/登出接口),其余 /api/* 路径
全部纳入访问密码校验。

Co-Authored-By: AtomCode (glm5.3-flash) <noreply@atomgit.com>
2026-09-10 12:50:29 +08:00
Iams4kura ef8056cda6 fix(history): preserve record order when restoring backups 2026-09-10 12:26:28 +08:00
linshen 3e677b1d9f chore(release): prepare v2.11.9 2026-08-26 15:56:54 +08:00
且炼时光 ed9ef9416d Merge pull request #345 from ArkciaTheDragon/fix/template-import-message-content
fix(template): preserve advanced template imports
2026-08-26 15:01:59 +08:00
arkcia 390377932b fix(template): preserve advanced template imports 2026-08-25 21:45:37 +08:00
linshen bb79051a88 fix: add gpt-image-2 high-resolution sizes 2026-08-13 22:22:58 +08:00
linshen 69a636921e feat: refresh built-in provider models 2026-08-13 22:13:54 +08:00
且炼时光 4c393babac Merge pull request #338 from octo-patch/octo/20260803-parameter-refresh-recvqtzQ0xWoPg
Refresh MiniMax parameters
2026-08-13 21:05:30 +08:00
且炼时光 2d6ab2594f Merge pull request #339 from Iams4kura/bugfix/standard-import-roundtrip-20260810t080132z
fix(ui): preserve standard prompt imports
2026-08-13 20:57:25 +08:00
octo-patch 87668531f5 Add MiniMax regional endpoint metadata 2026-08-12 02:40:49 +08:00
octo-patch 846fe27ed7 Correct MiniMax M2.7 capabilities 2026-08-11 17:45:05 +00:00
Iams4kura 470a2985f6 fix(ui): preserve standard prompt imports 2026-08-10 17:27:30 +08:00
kapelame a6a5a17c5a Refresh MiniMax parameters 2026-08-03 14:51:02 +08:00
linshen 08b5531b39 chore(release): bump version to 2.11.8 2026-07-25 20:00:00 +08:00
linshen 0c3679511d fix(test): complete Basic/System image attachment support (#196) 2026-07-18 18:13:41 +08:00
linshen 3126ae4530 feat(test): support image attachments in Basic/System tests (#196) 2026-07-17 23:25:52 +08:00
linshen 0e4f58292a fix(desktop): route unsigned macOS updates to releases (#313)
Refs #313
2026-07-16 22:49:54 +08:00
linshen 272238dd6c docs: correct SSRF issue reference 2026-07-15 21:37:42 +08:00
且炼时光 5abad022ef Merge pull request #317 from fix2015/fix/css-bugs-and-cleanup
fix: invalid CSS border value, broken class attribute, passive scroll listener
2026-07-06 09:54:21 +08:00
vitalii.semianchuk 7acb7618e3 fix: invalid CSS border value, broken class attribute, passive scroll listener
- hr had border: 1 which is invalid CSS — changed to border: none
- OutputDisplayCore had max-height: 100% in the class attribute instead
  of a style property — removed it
- scroll listener in useAutoScroll was missing { passive: true }
- removed unused onMounted import from useLazyLoad
- removed shadowed loading prop in FavoriteButton
2026-07-01 18:21:29 +01:00
linshen ce6d1cfc59 chore(release): bump version to 2.11.7 2026-06-22 22:18:54 +08:00
linshen 1554e8a4a0 fix(desktop): support page zoom shortcuts 2026-06-22 21:47:36 +08:00
linshen c08c329b5d fix(docker): add dedicated healthz endpoint 2026-06-21 14:05:55 +08:00
且炼时光 14bb18974c Merge pull request #315 from Neclode/fix/mcp-server-pnpm-verify-deps-crash
fix(docker): launch mcp-server via node directly to avoid pnpm verify-deps crash
2026-06-22 13:43:39 +08:00
Neclode 2358b0a05f fix(docker): launch mcp-server via node directly to avoid pnpm verify-deps crash
The Docker image's mcp-server process crashes on boot with
ERR_PNPM_WORKSPACE_PKG_NOT_FOUND (#314). supervisord starts it via
`pnpm start`, and pnpm 10 runs a dependency-sync check before the script.
From the isolated /app/mcp-server dir it tries to resolve
`@prompt-optimizer/core@workspace:*`, can't find the workspace sibling,
and aborts before node ever runs.

The built artifact is self-contained (deps bundled, NODE_PATH=/app), so the
pnpm wrapper is unnecessary. Call node directly, matching the `start` script:

  node -r ./preload-env.cjs dist/start.cjs --transport=http --port=3000

Verified: mcp-server reaches RUNNING state and serves /mcp on a fresh build
from develop.

Fixes #314
2026-06-18 23:34:54 -07:00
linshen 971d007de7 chore(release): prepare v2.11.6 2026-06-08 21:37:26 +08:00
且炼时光 d7cde6c2fc Merge pull request #308 from chaozai0304/develop
Fixed the OpenAI error when calling large image models: Unknown param…
2026-06-08 14:00:56 +08:00
linshen ecbe788909 fix(evaluation): format provider error details 2026-06-07 10:28:39 +08:00
linshen e039257871 fix(ui): allow unicode variable names in manager 2026-06-06 15:42:17 +08:00
李超 9ed01ce237 Fixed the OpenAI error when calling large image models: Unknown parameter: 'response_format'. (request id: 202606030925559064897917EvHxr7G) 2026-06-03 10:12:58 +08:00
Octopus 74b06cea72 feat: upgrade MiniMax default model to M3 (#307)
- Add MiniMax-M3 to the model selection list and set as the new default
- Retain MiniMax-M2.7 and MiniMax-M2.7-highspeed as alternatives
- Remove deprecated MiniMax-M2.5 and MiniMax-M2.5-highspeed from the list
- Update unit tests to match the new model lineup
2026-06-02 09:53:48 +08:00
linshen d0f97e9463 chore(release): prepare v2.11.5 2026-05-27 23:48:29 +08:00
linshen c7d97d5018 docs: refine deployment guidance
- Align Cloudflare Workers setup across README and user docs
- Clarify build command cleanup and deployment context notes
- Keep frontend API key exposure warnings concise across providers
2026-05-27 23:17:46 +08:00
linshen 9119876b3e feat: add Xiaomi MiMo Token Plan provider 2026-05-27 21:28:37 +08:00
linshen 2e52c0b680 chore: slim deployment contexts 2026-05-19 23:48:05 +08:00
linshen c06cf8adf6 docs: clarify docker compose env file usage 2026-05-18 22:54:46 +08:00