xiaweiwei67-stack
de9e7f0e84
fix(bash): write large-output temp file as UTF-8
...
When a command's output exceeds DEFAULT_MAX_BYTES the Bash tool spills the full output to a temp file. The file was opened in text mode without an explicit encoding, so it used the platform locale encoding (cp936/GBK on Chinese Windows). Output containing emoji or other characters not representable in that codepage raised UnicodeEncodeError, which propagated out and turned a successful command (exit code 0) into a tool error, discarding all output.
Open the temp file with encoding='utf-8', matching the sibling temp file written in _rewrite_long_python_c. Adds a regression test.
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-07 16:45:37 +08:00
zhayujie
d531e14fbf
feat(desktop): mac zip auto-update
2026-07-07 15:11:55 +08:00
zhayujie
8df38a23d2
fix(ci): run electron-builder in its own step so Windows produces installers
2026-07-07 12:32:04 +08:00
zhayujie
38105e6539
fix(desktop/ci): Windows build silently skipped + mac-x64 dmg not registered
2026-07-07 11:49:48 +08:00
zhayujie
14c6577d51
fix(desktop): make update badge/panel re-openable
2026-07-07 11:44:25 +08:00
zhayujie
f051a58db5
fix(desktop): add updater logging + allow prerelease
2026-07-06 20:16:20 +08:00
zhayujie
825d990312
fix(desktop): restore sent images/files from history after restart
2026-07-06 19:34:43 +08:00
zhayujie
cb31013584
build(desktop): decouple macOS notarization from CI into 3-stage release
2026-07-06 19:24:55 +08:00
zhayujie
dd74d1dabe
Merge branch 'master' of github.com:zhayujie/chatgpt-on-wechat
2026-07-06 18:37:33 +08:00
zhayujie
75f3952ac6
feat(desktop): render sent images/videos/files
2026-07-06 18:35:33 +08:00
zhayujie
37423fbb31
Merge pull request #2936 from fengyl07/fix/read-env-bypass-2913
...
fix(read): block /proc/environ credential bypass (#2913 )
2026-07-06 16:02:59 +08:00
fengyl07
00c3436d48
test(read): add regression tests for credential-path bypass ( #2913 )
2026-07-06 15:30:13 +08:00
fengyl07
377b4e5cb8
fix(read): block /proc/environ aliases and symlink bypass of credential file
2026-07-06 15:30:13 +08:00
zhayujie
a427586b89
fix(desktop): notarize .app in afterSign hook with fault-tolerant polling
2026-07-06 15:04:12 +08:00
zhayujie
a951494489
fix(desktop): notarize the .app zip
2026-07-06 10:19:54 +08:00
zhayujie
a871c0437d
feat: add deep_dream_enabled config toggle
2026-07-05 21:31:16 +08:00
zhayujie
013960cd5a
feat: update release flow
2026-07-05 21:10:43 +08:00
zhayujie
60aebf41a8
fix: optimize notarize script
2026-07-05 20:28:02 +08:00
zhayujie
2cf521e57e
fix: exception handling in config eval
2026-07-05 12:35:24 +08:00
zhayujie
dad3a84efb
Merge pull request #2927 from shunfeng8421/fix/eval-ast-literal-eval
...
security: replace eval() with ast.literal_eval + document pickle risk
2026-07-05 12:17:54 +08:00
zhayujie
ae864c7ff9
fix(desktop): notarize dmg in a retryable step to survive poll timeouts
2026-07-05 11:23:43 +08:00
zhayujie
3b33114a40
fix(desktop): sign embedded backend via mac.binaries for notarization
2026-07-03 14:59:31 +08:00
zhayujie
e0f49ac619
fix(desktop): sign backend by cert SHA-1 to fix CI keychain lookup
2026-07-03 12:16:44 +08:00
zhayujie
01ec49afd2
build(desktop): enable macOS signing & notarization for release
2026-07-03 12:01:42 +08:00
zhayujie
b44154fe02
desktop: add brand logo to the top-left corner on Windows/Linux
2026-07-01 18:38:45 +08:00
zhayujie
b8dad38622
desktop: fix model config dropdowns and provider listing
2026-07-01 16:28:40 +08:00
zhayujie
80fea77c86
feat(model): support claude-sonnet-5
2026-07-01 10:31:06 +08:00
zhayujie
e5f3eb48d4
desktop: make backend port deterministic (fixed + pre-launch cleanup) and reorder footer menu
2026-06-30 20:05:01 +08:00
zhayujie
ca876b0c65
fix(desktop): isolate backend port from the web console
2026-06-30 10:48:33 +08:00
zhayujie
0a762b8c08
fix(desktop): bundle cli command modules
2026-06-30 10:03:12 +08:00
zhayujie
fd90a89b45
desktop: improve channels page and titlebar UI
2026-06-29 19:52:46 +08:00
zhayujie
f82eb39d23
fix(desktop): stop send button icon flicker
2026-06-29 18:00:46 +08:00
zhayujie
2786148153
fix(desktop): match send button to web
2026-06-29 16:33:10 +08:00
zhayujie
2959cfea32
feat(desktop): align chat UI with web console
2026-06-29 12:17:35 +08:00
zhayujie
e536232963
fix(desktop): bundle document parsing libs
2026-06-29 11:07:08 +08:00
shunfeng8421
778d78cebe
security: replace eval() with ast.literal_eval + document pickle risk
...
- config.py:418 — Replace eval(value) with ast.literal_eval() for
environment variable config overrides. ast.literal_eval only parses
Python literals and cannot execute arbitrary code, preventing
environment-variable-based code injection.
- config.py:310-328 — Add security notes on pickle.load/dump usage.
Pickle is safe here (local appdata file, same-process write/read),
but notes suggest JSON migration or HMAC signing for future hardening.
Fixes: potential RCE via controlled environment variables
2026-06-29 07:33:33 +08:00
zhayujie
538281da51
feat(desktop): support plugin commands
2026-06-27 12:19:12 +08:00
zhayujie
12cd626949
fix(web): reclaim orphaned SSE streams to prevent fd leak #2924
2026-06-27 11:32:19 +08:00
zhayujie
ff64a7930e
Merge branch 'master' of github.com:zhayujie/chatgpt-on-wechat
2026-06-27 11:14:00 +08:00
zhayujie
5d726fe340
fix(desktop): run bundled backend from writable data dir
2026-06-27 11:13:39 +08:00
zhayujie
e1834124d4
Merge pull request #2918 from Tunnello/fix-azure-openai-stream
...
fix: azure openai stream
2026-06-27 10:59:40 +08:00
Eric L
f49e965736
fix: azure openai stream config
2026-06-26 20:54:25 +08:00
Eric L
936eaf5939
fix: azure openai stream
2026-06-25 21:13:50 +08:00
zhayujie
7047b30e27
feat(models): support doubao-seed-2.1 series
2026-06-25 11:53:24 +08:00
zhayujie
5c67e970d1
feat: sync knowledge management to desktop
2026-06-25 11:43:19 +08:00
zhayujie
8023c4e8b7
feat(knowledge): consolidate actions into a New menu and refine docs layout
2026-06-25 11:19:33 +08:00
zhayujie
641b84519c
Merge branch 'pr-2915'
2026-06-25 11:02:55 +08:00
zhayujie
0c8cb974e2
feat(knowledge): auto-maintain index.md, improve import UX, fix embedding provider
...
- Auto-rebuild knowledge/index.md from the real directory tree on
create/import so it never drifts or loses documents (no longer relies
on the agent hand-writing it).
- Auto-open the created/imported document in the tree after success.
- Add create_document status message, shorten EN action buttons, and
localize the "insert template" content.
- Show filename for protected system files (index.md/log.md) in the tree
instead of their H1 heading.
- Reuse a shared embedding-provider factory so knowledge index sync also
gets vectors instead of degrading to keyword-only search.
2026-06-25 11:02:18 +08:00
zhayujie
915edbe145
fix(tools): make web SSRF protection opt-in, disabled by default
2026-06-24 19:40:55 +08:00
zhayujie
0c20c5c159
Merge pull request #2917 from zhayujie/feat-cow-desktop
...
feat: CowAgent desktop client
2026-06-24 19:26:06 +08:00
