zhayujie
6c353d389b
fix(desktop): switch Windows to oneClick NSIS
2026-07-07 18:22:10 +08:00
zhayujie
583217d396
fix(desktop): smoother update UX
2026-07-07 18:08:05 +08:00
zhayujie
2e74295807
fix(desktop): auto-update install now actually replaces the app
2026-07-07 17:23:10 +08:00
zhayujie
93bf8844de
Merge pull request #2941 from xiaweiwei67-stack/fix/bash-tempfile-utf8
...
fix(bash): write large-output temp file as UTF-8
2026-07-07 17:00:01 +08:00
xiaweiwei67-stack
de9e7f0e84
fix(bash): write large-output temp file as UTF-8
...
When a command's output exceeds DEFAULT_MAX_BYTES the Bash tool spills the full output to a temp file. The file was opened in text mode without an explicit encoding, so it used the platform locale encoding (cp936/GBK on Chinese Windows). Output containing emoji or other characters not representable in that codepage raised UnicodeEncodeError, which propagated out and turned a successful command (exit code 0) into a tool error, discarding all output.
Open the temp file with encoding='utf-8', matching the sibling temp file written in _rewrite_long_python_c. Adds a regression test.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-07 16:45:37 +08:00
zhayujie
ed5b2d6ce6
fix: mac zip artifacts
2026-07-07 16:28:48 +08:00
zhayujie
2cd3fa7981
Merge pull request #2940 from fengyl07/feat/mcp-tool-retrieval
...
feat(mcp): on-demand vector retrieval for large MCP tool sets
2026-07-07 16:22:50 +08:00
fengyl07
f01cc3a0b4
test(mcp): cover retrieval helpers and executor injection paths
2026-07-07 16:01:38 +08:00
fengyl07
51bf09208d
feat(agent): inject retrieved MCP tools in stream executor
2026-07-07 16:01:26 +08:00
fengyl07
bf0831a664
feat(mcp): cache MCP tool vectors with lazy embedding in ToolManager
2026-07-07 16:00:55 +08:00
fengyl07
96b1fccf76
feat(mcp): add stateless on-demand tool retrieval module
2026-07-07 16:00:31 +08:00
zhayujie
d531e14fbf
feat(desktop): mac zip auto-update
2026-07-07 15:11:55 +08:00
zhayujie
8df38a23d2
fix(ci): run electron-builder in its own step so Windows produces installers
2026-07-07 12:32:04 +08:00
zhayujie
38105e6539
fix(desktop/ci): Windows build silently skipped + mac-x64 dmg not registered
2026-07-07 11:49:48 +08:00
zhayujie
14c6577d51
fix(desktop): make update badge/panel re-openable
2026-07-07 11:44:25 +08:00
zhayujie
f051a58db5
fix(desktop): add updater logging + allow prerelease
2026-07-06 20:16:20 +08:00
zhayujie
825d990312
fix(desktop): restore sent images/files from history after restart
2026-07-06 19:34:43 +08:00
zhayujie
cb31013584
build(desktop): decouple macOS notarization from CI into 3-stage release
2026-07-06 19:24:55 +08:00
zhayujie
dd74d1dabe
Merge branch 'master' of github.com:zhayujie/chatgpt-on-wechat
2026-07-06 18:37:33 +08:00
zhayujie
75f3952ac6
feat(desktop): render sent images/videos/files
2026-07-06 18:35:33 +08:00
zhayujie
37423fbb31
Merge pull request #2936 from fengyl07/fix/read-env-bypass-2913
...
fix(read): block /proc/environ credential bypass (#2913 )
2026-07-06 16:02:59 +08:00
fengyl07
00c3436d48
test(read): add regression tests for credential-path bypass ( #2913 )
2026-07-06 15:30:13 +08:00
fengyl07
377b4e5cb8
fix(read): block /proc/environ aliases and symlink bypass of credential file
2026-07-06 15:30:13 +08:00
zhayujie
a427586b89
fix(desktop): notarize .app in afterSign hook with fault-tolerant polling
2026-07-06 15:04:12 +08:00
zhayujie
a951494489
fix(desktop): notarize the .app zip
2026-07-06 10:19:54 +08:00
zhayujie
a871c0437d
feat: add deep_dream_enabled config toggle
2026-07-05 21:31:16 +08:00
zhayujie
013960cd5a
feat: update release flow
2026-07-05 21:10:43 +08:00
zhayujie
60aebf41a8
fix: optimize notarize script
2026-07-05 20:28:02 +08:00
zhayujie
2cf521e57e
fix: exception handling in config eval
2026-07-05 12:35:24 +08:00
zhayujie
dad3a84efb
Merge pull request #2927 from shunfeng8421/fix/eval-ast-literal-eval
...
security: replace eval() with ast.literal_eval + document pickle risk
2026-07-05 12:17:54 +08:00
zhayujie
ae864c7ff9
fix(desktop): notarize dmg in a retryable step to survive poll timeouts
2026-07-05 11:23:43 +08:00
zhayujie
3b33114a40
fix(desktop): sign embedded backend via mac.binaries for notarization
2026-07-03 14:59:31 +08:00
zhayujie
e0f49ac619
fix(desktop): sign backend by cert SHA-1 to fix CI keychain lookup
2026-07-03 12:16:44 +08:00
zhayujie
01ec49afd2
build(desktop): enable macOS signing & notarization for release
2026-07-03 12:01:42 +08:00
zhayujie
b44154fe02
desktop: add brand logo to the top-left corner on Windows/Linux
2026-07-01 18:38:45 +08:00
zhayujie
b8dad38622
desktop: fix model config dropdowns and provider listing
2026-07-01 16:28:40 +08:00
zhayujie
80fea77c86
feat(model): support claude-sonnet-5
2026-07-01 10:31:06 +08:00
zhayujie
e5f3eb48d4
desktop: make backend port deterministic (fixed + pre-launch cleanup) and reorder footer menu
2026-06-30 20:05:01 +08:00
zhayujie
ca876b0c65
fix(desktop): isolate backend port from the web console
2026-06-30 10:48:33 +08:00
zhayujie
0a762b8c08
fix(desktop): bundle cli command modules
2026-06-30 10:03:12 +08:00
zhayujie
fd90a89b45
desktop: improve channels page and titlebar UI
2026-06-29 19:52:46 +08:00
zhayujie
f82eb39d23
fix(desktop): stop send button icon flicker
2026-06-29 18:00:46 +08:00
zhayujie
2786148153
fix(desktop): match send button to web
2026-06-29 16:33:10 +08:00
zhayujie
2959cfea32
feat(desktop): align chat UI with web console
2026-06-29 12:17:35 +08:00
zhayujie
e536232963
fix(desktop): bundle document parsing libs
2026-06-29 11:07:08 +08:00
shunfeng8421
778d78cebe
security: replace eval() with ast.literal_eval + document pickle risk
...
- config.py:418 — Replace eval(value) with ast.literal_eval() for
environment variable config overrides. ast.literal_eval only parses
Python literals and cannot execute arbitrary code, preventing
environment-variable-based code injection.
- config.py:310-328 — Add security notes on pickle.load/dump usage.
Pickle is safe here (local appdata file, same-process write/read),
but notes suggest JSON migration or HMAC signing for future hardening.
Fixes: potential RCE via controlled environment variables
2026-06-29 07:33:33 +08:00
zhayujie
538281da51
feat(desktop): support plugin commands
2026-06-27 12:19:12 +08:00
zhayujie
12cd626949
fix(web): reclaim orphaned SSE streams to prevent fd leak #2924
2026-06-27 11:32:19 +08:00
zhayujie
ff64a7930e
Merge branch 'master' of github.com:zhayujie/chatgpt-on-wechat
2026-06-27 11:14:00 +08:00
zhayujie
5d726fe340
fix(desktop): run bundled backend from writable data dir
2026-06-27 11:13:39 +08:00
