Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: akemmanuel/OpenGUI
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v0.7.3
Choose a base ref
...
head repository: akemmanuel/OpenGUI
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v0.7.4
Choose a head ref
  • 8 commits
  • 23 files changed
  • 3 contributors

Commits on Oct 25, 2026

  1. fix(attachments): keep the Host token on the Host's origin 

    HostImage attached the Host bearer token to every http(s) image URL. An
image mention such as `@https://attacker.example/x.png` passes through
resolveAttachmentImageSrc unchanged, so rendering it sent each viewer's
session token to that origin. On hosted web the session token lives in
workspace.authToken, so every viewer was affected, including admins
opening shared Sessions.

- Fetch with the token only when the image URL has the same origin as
  the attachment base URL. Other origins keep the plain request.
- Turn only raster responses into blob URLs. A blob URL shares the app
  origin, and an SVG opened from one would run script there.
- /api/fs/file refuses files over 25 MB with 413 instead of reading them
  into memory on every transcript render.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
    @touch2be @claude
    touch2be and claude committed Oct 25, 2026
    Configuration menu
    Copy the full SHA
    534da05 View commit details
    Browse the repository at this point in the history

  2. fix(files): skip QA copies, task worktrees and .astro in @ file search 

    File mentions searched every directory except .git, node_modules and
dist. On a hosted Astro Project, `.opengui-qa` held 9.8 GiB of baseline
copies: they filled the result limit before the real files, and an exact
image query took over 30 s.

Skip `.astro`, `.opengui-qa` and `.opengui-worktrees` as well, at any
depth. `.opengui-uploads` stays searchable even when Git ignores it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
    @touch2be @claude
    touch2be and claude committed Oct 25, 2026
    Configuration menu
    Copy the full SHA
    02d644a View commit details
    Browse the repository at this point in the history

  3. fix(chat): end failed chat loads and restore a chat reopened mid-load 

    Three ways opening a chat could leave it blank or loading forever:

- A Session snapshot request had no deadline. A stalled request kept the
  spinner up indefinitely. readSession now times out after 15 s.
- A failed snapshot request left the transcript in its loading phase,
  and clicking the same chat again did nothing. The failure now shows the
  translated load error with a retry button; retrying the selected chat
  loads it again.
- Switching A -> B -> A while B was still loading kept B's empty loading
  state on screen, because A's stream was already current and hydration
  was skipped. A's loaded transcript is now shown again, and B's late
  response is ignored.

Adds `sessionError.messagesLoadFailed` in en, de and es.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
    @touch2be @claude
    touch2be and claude committed Oct 25, 2026
    Configuration menu
    Copy the full SHA
    86b3853 View commit details
    Browse the repository at this point in the history

  4. Merge pull request #178 from touch2be/fix/host-image-token-origin 

    fix(attachments): keep the Host token on the Host's origin
    @touch2be
    touch2be authored Oct 25, 2026
    Configuration menu
    Copy the full SHA
    0215407 View commit details
    Browse the repository at this point in the history

  5. Merge pull request #179 from touch2be/fix/file-search-skip-transient-… 

    …dirs

fix(files): skip QA copies, task worktrees and .astro in @ file search
    @touch2be
    touch2be authored Oct 25, 2026
    Configuration menu
    Copy the full SHA
    296525f View commit details
    Browse the repository at this point in the history

  6. Merge pull request #180 from touch2be/fix/chat-load-failures 

    fix(chat): end failed chat loads and restore a chat reopened mid-load
    @touch2be
    touch2be authored Oct 25, 2026
    Configuration menu
    Copy the full SHA
    7933bcc View commit details
    Browse the repository at this point in the history

  7. release: prepare v0.7.4 

    Co-Authored-By: Claude Opus 5.5 <[email protected]>
    @touch2be @claude
    touch2be and claude committed Oct 25, 2026
    Configuration menu
    Copy the full SHA
    0dfa5c5 View commit details
    Browse the repository at this point in the history

  8. Merge pull request #181 from akemmanuel/release/0.7.4 

    release: prepare v0.7.4
    @touch2be
    touch2be authored Oct 25, 2026
    Configuration menu
    Copy the full SHA
    176269f View commit details
    Browse the repository at this point in the history
Loading