zhayujie
75f3952ac6
feat(desktop): render sent images/videos/files
2026-07-06 18:35:33 +08:00
zhayujie
37423fbb31
Merge pull request #2936 from fengyl07/fix/read-env-bypass-2913
...
fix(read): block /proc/environ credential bypass (#2913 )
2026-07-06 16:02:59 +08:00
fengyl07
00c3436d48
test(read): add regression tests for credential-path bypass ( #2913 )
2026-07-06 15:30:13 +08:00
fengyl07
377b4e5cb8
fix(read): block /proc/environ aliases and symlink bypass of credential file
2026-07-06 15:30:13 +08:00
zhayujie
a427586b89
fix(desktop): notarize .app in afterSign hook with fault-tolerant polling
2026-07-06 15:04:12 +08:00
zhayujie
a951494489
fix(desktop): notarize the .app zip
2026-07-06 10:19:54 +08:00
zhayujie
a871c0437d
feat: add deep_dream_enabled config toggle
2026-07-05 21:31:16 +08:00
zhayujie
013960cd5a
feat: update release flow
2026-07-05 21:10:43 +08:00
zhayujie
60aebf41a8
fix: optimize notarize script
2026-07-05 20:28:02 +08:00
zhayujie
2cf521e57e
fix: exception handling in config eval
2026-07-05 12:35:24 +08:00
zhayujie
dad3a84efb
Merge pull request #2927 from shunfeng8421/fix/eval-ast-literal-eval
...
security: replace eval() with ast.literal_eval + document pickle risk
2026-07-05 12:17:54 +08:00
zhayujie
ae864c7ff9
fix(desktop): notarize dmg in a retryable step to survive poll timeouts
2026-07-05 11:23:43 +08:00
zhayujie
3b33114a40
fix(desktop): sign embedded backend via mac.binaries for notarization
2026-07-03 14:59:31 +08:00
zhayujie
e0f49ac619
fix(desktop): sign backend by cert SHA-1 to fix CI keychain lookup
2026-07-03 12:16:44 +08:00
zhayujie
01ec49afd2
build(desktop): enable macOS signing & notarization for release
2026-07-03 12:01:42 +08:00
zhayujie
b44154fe02
desktop: add brand logo to the top-left corner on Windows/Linux
2026-07-01 18:38:45 +08:00
zhayujie
b8dad38622
desktop: fix model config dropdowns and provider listing
2026-07-01 16:28:40 +08:00
zhayujie
80fea77c86
feat(model): support claude-sonnet-5
2026-07-01 10:31:06 +08:00
zhayujie
e5f3eb48d4
desktop: make backend port deterministic (fixed + pre-launch cleanup) and reorder footer menu
2026-06-30 20:05:01 +08:00
zhayujie
ca876b0c65
fix(desktop): isolate backend port from the web console
2026-06-30 10:48:33 +08:00
zhayujie
0a762b8c08
fix(desktop): bundle cli command modules
2026-06-30 10:03:12 +08:00
zhayujie
fd90a89b45
desktop: improve channels page and titlebar UI
2026-06-29 19:52:46 +08:00
zhayujie
f82eb39d23
fix(desktop): stop send button icon flicker
2026-06-29 18:00:46 +08:00
zhayujie
2786148153
fix(desktop): match send button to web
2026-06-29 16:33:10 +08:00
zhayujie
2959cfea32
feat(desktop): align chat UI with web console
2026-06-29 12:17:35 +08:00
zhayujie
e536232963
fix(desktop): bundle document parsing libs
2026-06-29 11:07:08 +08:00
shunfeng8421
778d78cebe
security: replace eval() with ast.literal_eval + document pickle risk
...
- config.py:418 — Replace eval(value) with ast.literal_eval() for
environment variable config overrides. ast.literal_eval only parses
Python literals and cannot execute arbitrary code, preventing
environment-variable-based code injection.
- config.py:310-328 — Add security notes on pickle.load/dump usage.
Pickle is safe here (local appdata file, same-process write/read),
but notes suggest JSON migration or HMAC signing for future hardening.
Fixes: potential RCE via controlled environment variables
2026-06-29 07:33:33 +08:00
zhayujie
538281da51
feat(desktop): support plugin commands
2026-06-27 12:19:12 +08:00
zhayujie
12cd626949
fix(web): reclaim orphaned SSE streams to prevent fd leak #2924
2026-06-27 11:32:19 +08:00
zhayujie
ff64a7930e
Merge branch 'master' of github.com:zhayujie/chatgpt-on-wechat
2026-06-27 11:14:00 +08:00
zhayujie
5d726fe340
fix(desktop): run bundled backend from writable data dir
2026-06-27 11:13:39 +08:00
zhayujie
e1834124d4
Merge pull request #2918 from Tunnello/fix-azure-openai-stream
...
fix: azure openai stream
2026-06-27 10:59:40 +08:00
Eric L
f49e965736
fix: azure openai stream config
2026-06-26 20:54:25 +08:00
Eric L
936eaf5939
fix: azure openai stream
2026-06-25 21:13:50 +08:00
zhayujie
7047b30e27
feat(models): support doubao-seed-2.1 series
2026-06-25 11:53:24 +08:00
zhayujie
5c67e970d1
feat: sync knowledge management to desktop
2026-06-25 11:43:19 +08:00
zhayujie
8023c4e8b7
feat(knowledge): consolidate actions into a New menu and refine docs layout
2026-06-25 11:19:33 +08:00
zhayujie
641b84519c
Merge branch 'pr-2915'
2026-06-25 11:02:55 +08:00
zhayujie
0c8cb974e2
feat(knowledge): auto-maintain index.md, improve import UX, fix embedding provider
...
- Auto-rebuild knowledge/index.md from the real directory tree on
create/import so it never drifts or loses documents (no longer relies
on the agent hand-writing it).
- Auto-open the created/imported document in the tree after success.
- Add create_document status message, shorten EN action buttons, and
localize the "insert template" content.
- Show filename for protected system files (index.md/log.md) in the tree
instead of their H1 heading.
- Reuse a shared embedding-provider factory so knowledge index sync also
gets vectors instead of degrading to keyword-only search.
2026-06-25 11:02:18 +08:00
zhayujie
915edbe145
fix(tools): make web SSRF protection opt-in, disabled by default
2026-06-24 19:40:55 +08:00
zhayujie
0c20c5c159
Merge pull request #2917 from zhayujie/feat-cow-desktop
...
feat: CowAgent desktop client
2026-06-24 19:26:06 +08:00
zhayujie
6211e63f90
fix(desktop): avoid false init failure after long background
2026-06-24 19:19:24 +08:00
zhayujie
44b61684ed
feat(desktop): first-run onboarding, OS-language default, native polish
2026-06-24 16:38:51 +08:00
zhayujie
ab6f49a822
fix(desktop): correct electron-updater import for commonjs
2026-06-24 11:01:45 +08:00
zhayujie
02517e4a01
fix(ci): never mark pre-release versions as latest
2026-06-24 10:32:12 +08:00
zhayujie
2599966cf7
fix(ci): migrate retired macos-13 runner to macos-15-intel
2026-06-24 10:11:18 +08:00
zhayujie
6c68931892
fix(ci): publish per-platform instead of all-or-nothing
2026-06-24 10:04:05 +08:00
zhayujie
41855ed511
fix(ci): only enable mac signing when certificate secret is set
...
GitHub injects unset secrets as empty strings, and electron-builder treats
an empty CSC_LINK as a (broken) certificate path, aborting the mac build
with "desktop not a file". Export the signing vars only when non-empty so
unsigned builds fall back cleanly, matching local behavior. Windows builds
already passed; guarded the same way for consistency.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-23 20:57:01 +08:00
zhayujie
02bc91f4af
fix(ci): track desktop backend packaging sources
...
The global build/ gitignore rule was silently excluding the PyInstaller
spec, desktop requirements, and build script under desktop/build/, so the
release workflow failed at "pip install -r requirements-desktop.txt" with
a missing-file error. Re-include just those source files while keeping the
build outputs (dist/, build-work/) and local venv ignored.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-06-23 20:46:14 +08:00
zhayujie
e9352e6984
feat(desktop): add auto-update via electron-updater + manual CI trigger
2026-06-23 20:37:27 +08:00
