Commit graph

22 commits

Author SHA1 Message Date
Alessandro
0e3e8a159a fix(api): block path traversal in download_work_dir_file (CVE-2026-4307)
Reject download requests whose resolved path escapes the runtime base
directory before file metadata lookup or streaming.

This keeps valid in-base absolute paths working in both Docker and
development setups while preventing arbitrary file reads via
/download_work_dir_file (CVE-2026-4307).

Reported by Edward-x (@YLChen-007). Thanks again.
Refs:
- https://nvd.nist.gov/vuln/detail/CVE-2026-4307
- https://gist.github.com/YLChen-007/1819c843ad26aaaaecdc768a789df022
- https://vuldb.com/vuln/351337/cti
2026-04-12 02:31:24 +02:00
Jan Tomášek
9390ba9624
Merge pull request #1344 from keyboardstaff/ws-rework
refactor: Comprehensive WebSocket System Rework
2026-03-30 16:45:49 +02:00
keyboardstaff
0749ddc932 fix: WsDevTest non-standard error format and align doc examples
- Fix two error returns in ws_dev_test.py using non-standard {"_error": True, ...} format, which _collect_results misidentifies as a success response and wraps as ok=True, sending a false-success to the client
- Switch to WsResult.error(code=..., message=...) standard API, consistent with all other handlers
- Fix 5 occurrences of process_event → process in documentation examples
- Remove non-existent HANDLER_ID and HANDLED_EVENTS class attribute examples from docs
- Fix validate_event_types (plural) → validate_event_type (singular) in docs
2026-03-27 23:34:52 -07:00
frdel
ffa6ac5433 Replace hardcoded SUPPORTED_BRANCHES with dynamic branch discovery from remote repository
- Add _get_remote_branch_names helper to fetch available branches via git ls-remote with caching
- Add _get_local_origin_branch_names fallback for offline scenarios
- Add get_available_branch_values and get_available_branches to expose filtered branch list
- Add _is_excluded_self_update_branch helper to filter out HEAD, PR branches
- Add _sort_branch_names to deduplicate and sort branches with main first
- Add
2026-03-26 11:30:17 +01:00
frdel
192d6e2cae Add latest selector option to self-update with branch head resolution for testing/development and newest tag resolution for main
- Add LATEST_SELECTOR_TAG constant and is_latest_selector_tag helper to identify "latest" selection
- Add split_describe_version helper to parse git describe output into tag and commit count
- Replace fetch_release_refs with resolve_requested_target that handles both specific tags and "latest" resolution
- For main branch, resolve "latest" to newest reachable release tag
- For testing/development branches
2026-03-26 10:44:12 +01:00
keyboardstaff
1160195fb5 fix(api): image_get 500 error for non-ASCII filename uploads
- Fixes 500 error when uploading images with non-ASCII filenames via /api/image_get
- Improves file path handling to support both development and Docker environments
- Adds exception handling to gracefully fall back to Docker path logic if path correction fails
- Ensures robust error handling so path issues do not crash the entire endpoint
2026-03-26 01:19:17 -07:00
keyboardstaff
1d81f72a31 refactor: Backend core rewrite - WsHandler + WsManager + handler migration
- Add WsHandler base class, WsManager (connection tracking / event routing / buffering), WsResult
- Extract network.py (is_loopback_address) and context_utils.py (use_context) to eliminate duplication
- Migrate three handlers to api/ following the ws_* py naming convention
- Simplify run_ui.py WebSocket init from ~170 lines to ~10
- Update import paths in api.py, plugins.py, state_monitor.py
2026-03-26 00:58:01 -07:00
frdel
27829350ae Add ready branch to Docker workflow and refactor self-update to use preloaded version selector
Some checks are pending
Build And Publish Docker Images / plan (push) Waiting to run
Build And Publish Docker Images / build (push) Blocked by required conditions
- Add ready branch to Docker publish workflow alongside testing and main
- Replace tag search/autocomplete UI with standard select element preloaded with current major version tags
- Add get_selector_tag_options helper that filters tags to current major line and returns list of higher major versions available
- Show attention banner with Docker update guide link when newer major versions exist on selected
2026-03-26 08:45:23 +01:00
frdel
e680256b29 Refactor API key handling and update system improvements
- Refactor API key management: move from global env-only to per-model config with dotenv fallback
- Add API key placeholder masking and reveal functionality in WebUI
- Consolidate API key validation logic into `has_provider_api_key()` helper
- Improve update system: add branch filtering for tags, simplify backup naming
- Add branch detection to version info and default to current branch for updates
- Extract configure model settings link to constant
2026-03-24 14:41:46 +01:00
frdel
94edfeaf8d Update system prototype 2026-03-24 13:49:12 +01:00
keyboardstaff
1bd5bc01d6 refactor(chat_branching): ID-based log ↔ history linking for precise branch trimming 2026-03-24 03:04:09 -07:00
frdel
a5620506d5 refactor: rename state_sync namespace to webui and simplify handler event registration
- Rename /state_sync namespace to /webui throughout codebase
- Remove get_event_types() from WebSocketHandler - handlers now process all events for their namespace
- Replace per-event handler registration with namespace-wide registration
- Add validate_event_type() class method for runtime event name validation
- Update UserMessage instantiation to use keyword arguments (message=, attachments=)
- Move send_data
2026-03-20 15:34:59 +01:00
Jan Tomášek
112ea2af53
Merge pull request #1262 from keyboardstaff/models-config-plugin
Models config plugin
2026-03-18 21:03:30 +01:00
keyboardstaff
3b86ebb837 feat: Standalone preset storage, override permission hardening & bug fixes
- Extract presets into global presets.yaml; move editor to plugin main screen
- Add project-wide override sync and three-layer permission checks
- Fix embedding change detection, new-chat inheritance, and preset name leak bugs
- Clean up dead imports/params and fix description text
2026-03-18 06:49:54 -07:00
Alessandro
2a6820064d plugins: rename init to execute 2026-03-16 17:13:11 +01:00
Alessandro
7b1f3fbbac rename init to execute.py; update docs + create plugin skill 2026-03-16 04:04:37 +01:00
frdel
a48ac95a29 feat(plugins): Add extensibility and hooks system to plugin API
Add @extension.extensible decorators to all plugin API handler methods and core plugin functions to enable extension points. Implement plugin hooks system allowing plugins to define custom behavior via hooks.py file. Add call_plugin_hook function to execute plugin-specific hooks for events like uninstall, save_plugin_config, and get_plugin_config. Introduce uninstall_plugin function that calls uninstall hook before deletion. Move circular
2026-03-12 13:21:33 +01:00
frdel
e5bd449d66 refactor(api): Extract plugin action handlers into separate methods
Refactor the Plugins API handler by extracting inline action handlers into dedicated private methods. This improves code organization and readability by separating each action (get_config, get_toggle_status, list_configs, delete_config, delete_plugin, get_default_config, save_config, toggle_plugin, get_doc, run_init_script, get_init_exec) into its own method while maintaining the same functionality.
2026-03-12 07:55:35 +01:00
frdel
999a14e31f Optimize plugin reload notifications to check for webui extensions
Add plugin_names parameter to after_plugin_change() and send_frontend_reload_notification() to enable targeted extension checking. Only send reload notification if changed plugins have webui extensions (checks extensions/webui directory existence). Defer notification send by 1 second to allow multiple rapid changes to coalesce. Update delete_plugin() to send notification before deletion for proper extension checking. Pass plugin names
2026-03-10 13:51:41 +01:00
frdel
1b89a0d359 Add tool request validation and plugin change notifications
Introduce validate_tool_request() extensible method in agent.py to validate tool request structure (dict with tool_name string and tool_args dict fields) before processing. Add after_plugin_change() helper in helpers/plugins.py that clears cache and sends a frontend reload notification (throttled to display_time interval) with a reload button. Update plugin installer install/delete flows to call after_plugin_change(). Extend notification
2026-03-10 13:08:48 +01:00
frdel
ab9fc4ee7f Refactor extensions to async/sync API
Redesign extension handling to support explicit async/sync execution. helpers/extension.py rewrites the extensible decorator, adds call_extensions_async / call_extensions_sync, and a helper to gather extension classes; caching flag adjusted. Updated call sites across the codebase (agent, APIs, plugins, tools, settings, extensions) to use extension.extensible and the new call_extensions_async/sync API, and converted several extension handlers from async to sync. Also small frontend tweaks (use globalThis.runtimeInfo) and minor import updates (csrf_protect in run_ui). This centralizes extension discovery/execution and avoids previously scattered asyncio.run usage.
2026-03-06 11:32:08 +01:00
frdel
d02dda3667 BIG PYTHON REFACTOR
Python scripts moved out of python/ folder to root to be unified with plugins

+ frontend extension around api calls
2026-03-05 17:28:11 +01:00