* fix(web): keep connector errors out of cards
* fix(web): route panel-alert open-details through openConnectorDetails
The new "open details" action on the panel-alert row called
`setDetailConnectorId(alert.connectorId)` directly, bypassing the
`toolPreviewFailedIds` clear that `openConnectorDetails()` does on
every other entry point.
Concrete regression: user opens a connector's drawer from the card,
the tool-preview hydration fetch fails so `toolPreviewFailedIds[id]`
gets stamped with the current `toolPreviewRetryToken`, user closes
the drawer, and later the same connector throws a connect error and
shows up as a panel alert. Clicking the alert's open-details button
re-sets `detailConnectorId` but never clears the failed-fetch token,
so the hydration effect at the previous bail-out check
(`toolPreviewFailedIds[detailConnector.id] === toolPreviewRetryToken`)
returns immediately and the drawer never retries loading tools.
Routing the click through `openConnectorDetails(alert.connectorId)`
restores the same clear-before-set behavior the card and search
entry points already had, so the reopened drawer always gets a fresh
hydration attempt.
* test(web): cover connector panel alert tool retry
* fix(web): clarify connector panel alert status text
* fix(web): clear stale connector cancel alerts
---------
Co-authored-by: lefarcen <935902669@qq.com>
* Refresh French UI locale coverage
* Address French locale review feedback
* Sync French locale with latest main
* Update French locale after latest main
* feat(web): highlight captured Pod component on chip hover
Wires onPointerEnter/Leave on chip + onFocus/Blur on its × so the matching member overlay gets an outline-focused emphasis on canvas.
* ci: trigger re-run for flaky palette dark-mode test
* fix(web): skip non-mouse pointer events on pod chip hover
Gate onPointerEnter/Leave to pointerType === 'mouse' so a touch tap on a chip no longer flickers the captured-member highlight; also add the CommentTargetOverlay class-wiring test, drop the redundant alpha on the hover outline, and document the non-member fallback path.
Use full workspace installs for blog indexing workflows so root postinstall can resolve workspace build dependencies, and enrich sitemap metadata for blog URLs from frontmatter dates.
Co-authored-by: ashley li <ashleyli@ashleydeMacBook-Air-2.local>
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(design-files): add filter-by-kind dropdown
The design files viewer already supports grouping and sorting by kind,
but on projects with many files of mixed kinds you still see everything
in one list. Adds a small dropdown next to the group-by toggle that
filters the visible files to one or more selected kinds.
Behavior:
- Dropdown only appears when the project has at least two distinct
kinds; on a single-kind project the control would be noise.
- Multi-select via checkboxes. Empty set means no filter (show all).
- Each row shows the kind glyph, label, and the per-kind file count.
- Trigger label collapses sensibly: "Filter by kind" when none selected,
the single kind's label when one selected, "{n} kinds" when many.
- Filter applies upstream of sort/group/page, so pagination ranges and
the "1-N of M" counter reflect the filtered total.
- Page resets to 0 on filter change so the user doesn't land on an
empty page.
- Selected kinds that disappear from the file list (after a delete or
refresh) are pruned automatically — a stale filter cannot silently
hide everything.
- Popover closes on outside click and Escape.
i18n keys: designFiles.filterBy, designFiles.filterClear,
designFiles.filterCount. All non-English locales inherit via the
existing `...en` spread pattern; zh-CN is the one fully-explicit
dictionary and gets translated values inline.
No behavior change to the group-by toggle, sort, pagination, selection,
or any other existing control. Filtering is layered alongside.
* fix(design-files): prune selection when filter hides selected rows
Codex review flagged that the filter-by-kind change only reset
pagination, not selection. If a user selected files, then narrowed the
filter to a kind that excludes some of them, the now-hidden rows
remained in `selected`. Bulk delete / download still operated on the
full set, so the user could destructively act on rows they could no
longer see — especially risky for the delete path.
Add a useEffect that prunes `selected` to the filtered set whenever
`filteredFiles` or `kindFilter` changes. The empty-filter branch is a
no-op so clearing the filter doesn't disturb any pre-existing
selection — only narrowing the filter prunes.
Picking a chip such as Slide deck or Image loaded a default prompt
into the Home textarea and rendered an overlay with `{{key}}`
placeholders as interactive `<input>` / `<select>` controls. The
overlay controls and the underlying textarea text were laid out
independently:
- Inputs declared `min-width: 8ch` and `Math.max(displayValue.length
+ 1, 10)ch` of width.
- Selects added 18px of right-padding for the dropdown arrow.
- The textarea kept the raw substituted string in a proportional
font.
The two layouts no longer matched column-for-column, so every slot
shifted the textarea text to the left of where it appeared in the
overlay, compounding across the line. Clicking on visible prose to
position the caret hit a different character offset in the textarea
and subsequent typing or deletion landed in the wrong place.
For example, the Slide deck template
Create a {{slideCount}}-slide {{deckType}} for {{audience}} about
{{topic}}. ...
renders with slideCount=10 (~2 ch in the textarea) under a slot
input forced to 10 ch in the overlay — clicking right after the
literal `-slide` placed the caret several characters into `pitch
deck`. The Image / Video / Audio chips with their pre-filled
subject, style, aspect values reproduced the same drift.
Render the inline pills as read-only `<span>`s carrying the exact
substring the textarea shows at that position, mark them
`aria-hidden` so the textarea remains the single labelled control,
and surface every plugin input field — including the ones referenced
inline — in `PluginInputsForm` underneath. Editing flows through the
form, the parent's `updateActiveInputs` already re-renders the
prompt, and the pills stay aligned with the textarea on every
keystroke.
Also drop the now-unused inline helpers (updatePluginInput,
getTemplateInputNames, shouldRenderSlotAsText, inlineFieldType,
fileInputLabel, fileMetadata) and the dead
`.home-hero__prompt-slot-control/input/select/toggle/file/text` CSS
rules.
Verified:
- pnpm --filter @open-design/web typecheck
- vitest run on HomeHero.plugin-picker, HomeHero.rail, and
HomeView.prefill (29/29 pass; tests updated to reflect the new
read-only span + always-on form contract)
- Manual click-to-edit on Slide deck and Image chips in the
pnpm tools-dev web runtime — caret now lands where the user
clicked.
* fix: rename Pets settings entry from 'Customize in Settings' to 'Manage Pets'
- Change pet.composerOpenSettings label to 'Manage Pets'
- Improves clarity and discoverability of Pets management feature
- Label now accurately reflects the destination (Pets settings tab)
- Fixes#1250
* fix: remove pet.composerOpenSettings overrides from non-English locales
All locales now inherit the updated 'Manage Pets' label from en.ts
* fix: add pet.composerOpenSettings to zh-CN locale
zh-CN.ts does not use ...en spread, so it needs explicit key definition
* fix: restore pet.composerOpenSettings translations in all locales with 'Manage Pets' equivalent
Instead of falling back to English, each locale now has the proper translation:
- ar: إدارة الحيوانات الأليفة
- de: Haustiere verwalten
- es-ES: Administrar mascotas
- fa: مدیریت حیوانات خانگی
- fr: Gérer les animaux
- hu: Háziállatok kezelése
- id: Kelola Hewan Peliharaan
- it: Gestisci animali
- ja: ペットを管理
- ko: 펫 관리
- pl: Zarządzaj zwierzętami
- pt-BR: Gerenciar pets
- ru: Управление питомцами
- th: จัดการสัตว์เลี้ยง
- tr: Evcil Hayvanları Yönet
- uk: Керувати вихованцями
- zh-TW: 管理寵物
reloadConnectorStatuses commits its prune setState (and runs the connectorAuthorizationPendingRef mirror effect) between the two awaits in onFocus, so cancelStaleAuthorizations was reading a post-prune ref and never identified anyone as stuck. Capture the snapshot inside onFocus before reloadConnectorStatuses runs, and pass it explicitly so the expired-auth daemon cancel actually fires.
Refs #1909#1354
Saved Project instructions had no post-save read-back surface. The
header control was a bare pencil icon that opened an editor and closed
on Save, so after returning to the workspace a user could not confirm
what was stored, revisit it, or tell whether it was still active
(#1822).
Make the saved state discoverable: once instructions exist, the header
affordance becomes a persistent "Project instructions" chip. Opening it
shows a read-only review panel with a preview of the saved text and an
"Active - included in every message" status, plus a reopen-to-edit
action. Saving lands back on the review panel so the stored value is
read back immediately. The empty state keeps the pencil and opens the
editor directly.
Persistence and project-level system-prompt injection are unchanged.
Closes#1822
Co-authored-by: multica-agent <github@multica.ai>
`overscroll-behavior: none` on `.newproj-body` prevented trackpad and
mouse wheel scrolling on macOS — the panel only scrolled when hovering
directly over the native scrollbar track. Removing the property restores
normal scroll behavior.
Fixes#1942
Closes#1765
`od plugin publish --to open-design` builds the registry-submission
body from the daemon's `/api/plugins/:id` row. The row carries a
stored `version` plus the full manifest. For project-local plugins —
`generated-plugin/`, snapshots, freshly imported folders — the
stored `version` reads as `'0.0.0'` until the registry handshake
runs and stamps the real version. The manifest's `version`, however,
is the author's real value the whole time.
Before this patch, the publish flow consumed `row.version` directly
and printed `version: 0.0.0` into the registry submission body even
when the plugin's `open-design.json` declared `0.1.0` or any other
non-sentinel version.
Mirror `apps/daemon/src/plugins/marketplaces.ts:298,328` and prefer
the manifest version when the stored row reads as the pre-handshake
sentinel. The fallback chain is now:
1. row.version, when it exists and isn't '0.0.0'
2. row.manifest.version, when it exists and is non-empty
3. row.version (even if '0.0.0'), preserving today's behavior for
plugins that genuinely have no manifest data
4. '0.0.0' literal, when nothing else is available
The fallback chain is conservative: it never substitutes a higher
version that the author didn't already declare somewhere — it just
prefers the manifest over the stored sentinel.
Validation:
- `pnpm --filter @open-design/daemon test -- tests/plugins-publish.test.ts` → green
- `pnpm --filter @open-design/daemon typecheck` → green
Co-authored-by: nicejames <nicejames@gmail.com>
The first-run consent banner had no link to a privacy policy, an
affirmative button ("Help improve") that didn't read as a consent
choice, and a fixed bottom-right card that crowded content on phones.
- Add a "Read the privacy policy" link (external-link icon, accent,
underlined) above the actions, plus a root PRIVACY.md it points to
documenting the telemetry behaviour the modal discloses.
- Rename the CTAs to "Share usage data" / "Don't share" so both name
the action; they stay equal-prominence per the EDPB/GDPR comment.
- Stretch the banner to a bottom-edge bar under 540px with a
safe-area inset so it clears mobile browser chrome.
- Add PrivacyConsentModal tests; sync the new i18n key to every
locale and update the consent-label assertion in App.connectors.
Refs #1756
Walk document.styleSheets so chromatic custom properties on :root/html/body/:host (including @media-nested rules) are hue-shifted via inline setProperty, not just the values returned by getComputedStyle.
Fixes#1393
References: PR #1643 (open, in review) binds the Tweaks toolbar toggle to artifact `.tw-panel` panels via a new `injectTweaksBridge` in `srcdoc.ts` — adjacent surface but different problem. Our fix extends `injectPaletteBridge` to also shift `:root` CSS custom-property colors, which #1643 does not touch.
* fix(web): recover stuck Composio connector when auth is cancelled
When a user closes the Composio system-browser auth window without completing the flow, the connector card stayed in its loading state forever because nothing told the daemon the request was abandoned.
The window-focus refresh now awaits the status poll and, for every connector still in connectorAuthorizationPending whose freshly fetched status is not 'connected', issues cancelConnectorAuthorizationRequest and clears the matching local pending/error UI state. The connected guard is read from the just-returned statuses so a postMessage success that lands just before focus is not racy.
Fixes#1354
* fix(web): gate Composio focus auto-cancel on TTL + cancel response
Require expiresAt to have elapsed before auto-cancelling a pending
Composio auth on focus, and preserve the spinner on a failed cancel
(matching the manual Cancel handler) so the UI never disagrees with
the daemon.
Refs https://github.com/nexu-io/open-design/pull/1909#discussion_r3254152045
Refs https://github.com/nexu-io/open-design/pull/1909#discussion_r3254152046
* feat(web): add manual removal for captured Pod components
Adds `removePodMember` helper and a per-chip × in `BoardComposerPopover`; leaves `comments.ts` untouched (avoid-zone from #1127).
Closes#802
Contract: runs/2026-05-16T08-08-52_open-design_issue-feat/contract.md
* style(web): hide Pod chip × until chip hover
Swaps the unicode × for the existing `Icon name="close"` SVG so the
hit target stays centered, and fades the button in only on chip
hover / keyboard focus for a quieter resting state.
* fix(web): auto-close Pod composer when last chip is removed
Removing the last chip leaves a stale anchor; close so Send cannot attach to elements no longer visible.
* refactor(web): extract BoardComposerPopover and Pod-member reducer
Moves the popover to its own module and lifts the chip-removal reducer into a pure `applyPodMemberRemoval` so unit tests exercise the real code path and the popover's export is no longer test-only.
* fix(web): rebuild Pod anchor when a member is removed
Without this, the popover keeps the original union bbox / selector / label after each chip removal, so a subsequent Send to chat anchors the comment to elements no longer in the Pod.
* fix(web): render every captured chip and scroll on overflow
The previous slice(0, 6) cap left chips beyond the sixth invisible and undeletable. Render the full list inside a 132px-tall scrollable strip.
Clicking Edit on a built-in skill silently issued PUT /api/skills/:id,
which the daemon stores as a user-owned shadow and then hides the
built-in entry from the Settings list. From the user's perspective the
row they just edited disappears with no explanation.
Arm an inline override-warning banner on Edit for source==='built-in'
skills, mirroring the existing inline delete-confirm pattern. The edit
form only opens after the user explicitly confirms. User skills bypass
the warning and edit directly. No daemon or listSkills contract change.
Fixes#1378
The Routines list only exposed Run now / Pause / History / Delete, so any
change to a routine required deleting and recreating it. The daemon already
serves PATCH /api/routines/:id; only the web entry point was missing.
Add an Edit button on each routine row that pre-populates the create form
from the stored schedule and target via a new formFromRoutine helper, and
branch the submit handler on editingId so it PATCHes /api/routines/:id
with the updated fields instead of POSTing a new routine.
Fixes#1373
* fix(web): surface daemon error messages for invalid folder imports
importFolderProject() was swallowing non-2xx responses by returning
null, so the UI could only show a generic "Open folder failed: <path>"
message even though the daemon already returns specific errors like
"cannot import the filesystem root" or "folder not found".
Parse the daemon error body and throw so the panel displays the actual
reason. Also show feedback for empty path input instead of silently
returning.
Fixes#1186
* test(web): update folder import test to match new error propagation
The existing test expected a generic "Open folder failed: <path>"
message from a boolean return. Update to match the new behavior where
the daemon's error message is thrown and displayed directly.
Fixes#1929
Problem:
- When viewing HTML artifacts in preview mode, if iframe content width exceeds
the available workspace width, the entire .split grid container expands
beyond the viewport
- This pushes the left chat panel and top toolbar buttons outside the visible area
- Users cannot access chat or toolbar when viewing wide preview content
Root Cause:
- .split uses grid-template-columns: 460px 8px minmax(400px, 1fr)
- The third column minmax(400px, 1fr) expands to fit content
- No max-width or overflow constraint on .split container
- When iframe content is wider than viewport, grid expands to accommodate it
- Parent containers don't constrain the grid width
Solution:
- Add max-width: 100% to .split to constrain it to parent width
- Add overflow: hidden to prevent content from pushing layout
- Grid columns now stay within viewport bounds
- Only the iframe/preview area scrolls internally
Changes:
- Modified: apps/web/src/index.css
- Added max-width: 100% to .split (line 1491)
- Added overflow: hidden to .split (line 1492)
Impact:
- ✅ Fixes horizontal overflow when iframe content exceeds viewport width
- ✅ Chat panel stays visible and accessible
- ✅ Toolbar buttons remain in their intended positions
- ✅ Layout stays fixed to viewport width
- ✅ Only preview area scrolls internally
- ✅ No breaking changes to existing layouts
- ✅ Works with all viewport sizes
Testing:
1. Open any project and generate an HTML artifact (e.g., todo app)
2. Open the artifact in preview mode (desktop viewport)
3. Verify the layout stays within viewport width
4. Verify chat panel remains visible on the left
5. Verify toolbar buttons remain accessible at the top
6. Verify only the preview iframe scrolls horizontally if content is wide
7. Test with various artifact widths (narrow, normal, extra wide)
8. Test resize handle still works correctly
Before Fix:
- Wide iframe content pushes entire layout beyond viewport
- Chat panel disappears off-screen to the left
- Toolbar buttons disappear off-screen
- Horizontal scrollbar appears on entire page
- Poor user experience with wide content
After Fix:
- Layout stays fixed to viewport width
- Chat panel always visible
- Toolbar always accessible
- Only iframe scrolls internally
- Clean, predictable layout behavior
Fixes#1790
## Problem
Project rename does not take effect in Open Design 0.8.0. After entering
a new name and clicking OK, the project keeps its old name.
## Root Cause
The onRenameProject callback was broken in the prop chain:
App.tsx ──(handleRenameProject)──▶ EntryView ✅
EntryView ──(onRenameProject missing)──▶ EntryShell ❌
EntryShell ──(onRename not in Props)──▶ DesignsTab ❌
DesignsTab.commitRename() → onRename?.() → silent no-op ❌
EntryView received onRenameProject from App but never forwarded it to
EntryShell. Since EntryShell is what renders DesignsTab, DesignsTab
never received the onRename callback. Because the prop is typed optional
(onRename?:), the confirm handler's onRename?.(id, trimmed) call
silently no-ops — no error, no rename.
This was introduced when EntryShell was added to the 0.8.0 codebase as
an intermediate shell layer and the rename prop was missed during the
handoff.
## Solution
Wire the callback through the missing links:
1. EntryView.tsx: Pass onRenameProject={onRenameProject} to EntryShell
2. EntryShell.tsx:
- Add onRenameProject to Props interface
- Destructure it in function params
- Pass onRename={onRenameProject} to DesignsTab
Now the callback chain is complete and project renames work correctly.
## Testing
Verified that:
- Project rename dialog accepts new name
- Clicking OK successfully renames the project
- Project list reflects the new name immediately
- No console errors or warnings
## Impact
3 lines changed across 2 files. Low risk — only restores the missing
prop forwarding, does not change any rename logic or validation.
* fix(desktop): export PDF saves to a file instead of the OS print dialog
The `od:print-pdf` IPC handler called `webContents.print()`, which
opens the printer-first macOS system print dialog. That handler is the
destination of the renderer's `window.__odDesktop.printPdf()` bridge,
so on desktop "Export PDF" felt like a print flow rather than a file
export — from both the PreviewModal share menu (which always uses this
path) and the FileViewer share menu (whose daemon-route fallback lands
here too).
Route the handler through a direct Save-as-PDF flow instead: a native
Save dialog, then `webContents.printToPDF()` straight to the chosen
file — the same shape `exportPdfFromHtml` already uses for the
daemon-backed export path. The flow is extracted into
`savePrintReadyDocumentAsPdf` behind a structural `PrintReadyPdfTarget`
surface that has no `print()` method, so the regression cannot be
reintroduced.
Fixes#1774
Co-authored-by: multica-agent <github@multica.ai>
* fix(desktop): preserve PDF page sizing in print bridge
Co-authored-by: multica-agent <github@multica.ai>
---------
Co-authored-by: multica-agent <github@multica.ai>
Closes#1868
When the daemon runs behind a reverse proxy (Nginx, Caddy, Traefik),
the Host header the daemon observes is the proxy's upstream address,
not the browser-visible origin the user typed in. As a result the
host check inside isLocalSameOrigin rejected requests whose Origin
header was *explicitly listed* in OD_ALLOWED_ORIGINS — defeating the
documented escape hatch for proxy deployments.
Add a single early-return in isLocalSameOrigin: if a non-empty
Origin header exactly matches an entry in OD_ALLOWED_ORIGINS, trust
it. The configuredAllowedOrigins parser already requires the
origin to be a well-formed http(s) URL and rejects unsupported
schemes, so the allow-list is a maintainer-controlled set of
trusted origins.
The existing host-based loopback / private-LAN path remains the
default for no-Origin and unlisted-Origin requests; this change is
strictly additive for the explicit allow-list case.
Validation:
- New tests in apps/daemon/tests/origin-validation.test.ts cover
the nginx-upstream case (Host is a container IP, Origin is the
allow-listed proxy origin) plus three negative cases: foreign
Origin still rejected, no-Origin behavior preserved, trailing
slash mismatch rejected.
- pnpm --filter @open-design/daemon test -- tests/origin-validation.test.ts → green
- pnpm guard → green
Co-authored-by: nicejames <nicejames@gmail.com>
* fix: Localize skill validation messages in Chinese and all other languages
Fixes#1377
Skill creation form validation messages now appear in the user's selected
language instead of always showing English.
**Before:**
- App language set to Chinese
- Leave skill name or body empty
- Validation shows: 'Skill name is required.' (English)
- Mixed-language experience
**After:**
- App language set to Chinese
- Leave skill name or body empty
- Validation shows: '技能名称为必填项。' (Chinese)
- Consistent language experience
**Implementation:**
- Added 'settings.skillsNameRequired' translation key (18 languages)
- Added 'settings.skillsBodyRequired' translation key (18 languages)
- Updated SkillsSection.tsx to use t() instead of hardcoded strings
- Covers: en, zh-CN, zh-TW, de, fr, es-ES, pt-BR, ru, ja, ko, ar, fa, id, pl, hu, uk, tr, th
* fix: Remove line number prefixes from i18n locale files
The previous commit accidentally included line numbers from read_file output
in the locale files, causing TypeScript compilation errors.
This commit removes all line number prefixes (e.g., '1400|') from the
skillsNoFiles entries in all 17 language files.
* fix: Escape apostrophes in Ukrainian skill validation messages
Fix TypeScript syntax error caused by unescaped apostrophes in Ukrainian
locale strings for skill name and body validation messages.
* fix(runtime): auto-annotate imported HTML elements for Tweaks selection (#892)
* fix(runtime): always annotate missing od-ids and broaden selector (#892)
- Remove the conditional gate so annotateMissingOdIds runs for every
srcdoc, not just comment/inspect bridges. This fixes the persistence
regression where saved Inspect tweaks reference synthesized data-od-id
selectors that vanish when the bridge is rebuilt without annotations.
- Expand the selector to cover div-based imported HTML (div[class],
div[id]), headings, buttons, and links so Picker/Pods work on
common anonymous wrapper markup.
Addresses review feedback from lefarcen and mrcfps.
* fix(runtime): narrow div selector, skip iframe/object/embed, add tests (#892)
- Replace broad div[class] with direct-child combinators only under
semantic containers, body, and [id] elements to avoid layout noise
- Add iframe, object, embed to the skip list alongside script/style
- Add tests for: direct-child divs, nested div skip, always-on behavior,
skip list with id attributes, div children of [id] elements
- Format selector as array join and skip tags as Set for readability
* fix(runtime): let annotateManualEditSourcePaths coexist with data-od-id (#892)
annotateMissingOdIds now runs unconditionally, so elements like main/h1
get data-od-id before annotateManualEditSourcePaths runs. The old skip
condition (has data-od-id) incorrectly prevented source-path marking on
those elements. Change the guard to skip only when the element already
has data-od-source-path, allowing both attributes to coexist.
PR #955 moved `skills/open-design-landing/` to
`design-templates/open-design-landing/` but AGENTS.md was not updated,
leaving 5 references pointing at a path that no longer exists.
Update all references to the current `design-templates/` location.
Fixes#1891
Native macOS browser sometimes renders its own disclosure indicator even
with appearance:none, stacking it on top of the CSS background-image SVG
chevron. Apply the same orbit-template-select-wrap pattern: clear the
background-image via explicit wrapper class, use an absolutely-positioned
Icon component for a single, controlled chevron. Affects both the model
picker and reasoning picker selects in the agent-model-row.
* fix(security): resolve hostname before approving external API base URLs
Before this change the daemon-side base-URL validator only inspected the
literal hostname string. A public DNS record that points at an internal
address ('internal.example.com' → 10.0.0.5) passed validation, and the
daemon would issue the upstream request anyway — turning the BYOK proxy
into an SSRF primitive against internal infrastructure.
Add a small companion ('validateBaseUrlResolved') that runs the existing
sync check, resolves the hostname with 'dns.lookup({ all: true })', and
re-applies the block-list against every resolved address. Wire it into
the wrapper the daemon already uses ('validateExternalApiBaseUrl'), so
every proxy/finalize handler picks it up without further edits.
Carve-outs match the existing sync validator:
- Loopback hostnames skip DNS (Ollama-style local LLMs still work,
including '*.localhost' / 'lvh.me'-style names that resolve to 127.0.0.1
per RFC 6761).
- IP literals are already vetted by the sync pass; no need to re-resolve.
- DNS resolver errors fall through to the existing fetch error path —
a transient ENOTFOUND should not turn into a 403.
The 6 callers that previously consumed the sync result now 'await' the
async wrapper. All call sites are already inside async route handlers.
Vitest coverage in apps/daemon/tests/connection-test.test.ts covers:
sync rejection passthrough, loopback / IP-literal short-circuits,
private IPv4 and IPv6 resolution, dual-stack with one private record,
public→public passes (api.openai.com), '*.localhost' resolved→loopback,
and resolver-error fallback.
Detected by: aeon (manual review + semgrep + osv + trufflehog).
Class: CWE-918 (SSRF) — DNS-based bypass.
* fix(security): cover remaining daemon baseUrl fetch surfaces + Ollama redirects
Addresses PR #1176 review feedback (lefarcen / mrcfps): the resolved-IP
wrapper only covered the proxy/finalize routes, leaving three adjacent
SSRF gaps open.
- testProviderConnection (/api/test/connection provider mode): switch
from sync validateBaseUrl to await validateBaseUrlResolved so a
hostname that resolves to a private IP is rejected before the daemon
POSTs the smoke prompt upstream.
- listProviderModels (/api/provider/models): same swap. Import the
DNS-aware helper from ./connectionTest.js since it carries the dns
binding the daemon owns; contracts stays pure.
- Ollama proxy stream fetch: align with the other four proxy routes
by setting redirect: 'error', so a validated public host cannot 3xx
the daemon to a private/internal URL after the pre-fetch check.
Regression coverage:
- POST /api/provider/models — DNS spy returns 10.0.0.5 for a synthetic
hostname; route must respond { ok: false, kind: 'forbidden' } and
must not invoke upstream fetch.
- POST /api/test/connection provider mode — same shape.
- /api/proxy/ollama/stream — fetch mock asserts redirect: 'error' on
the upstream Ollama call.
The existing /api/provider/models timeout test now stubs dnsPromises
so it doesn't race the probe timer against real DNS.
---------
Co-authored-by: aeon <aeon@aaronjmars.com>
The .subtab-pill button hover rule hard-coded `rgba(255,255,255,0.6)` as the
hover background. In light theme this composites to a near-white wash that
sits cleanly under `--text`, but in dark theme it overlays a translucent
white on the dark panel and produces a bright, near-white surface beneath
the same light `--text`, dropping contrast to ~1.87 (well below WCAG AA 4.5).
The reporter (#1795, on 0.6.0) called this out on five Settings surfaces.
Four of them — BYOK / Appearance / Notifications / protocol-chip — were
incidentally fixed by the c5d77a03 dark-palette refresh because they use
the .seg-control / .seg-btn hover path, not the .subtab-pill path. The
Pet → pet source tabs (Built-in / Custom / Community) still reproduce on
0.7.0 because they use .subtab-pill, which never got a theme-aware hover.
Switch the hover background to `var(--bg-muted)`, an existing token that
mirrors `--bg-panel`'s active state shape (one step lighter than
`--bg-subtle`) and is defined per-theme. Composited contrast becomes
~9.4 in dark and ~14.3 in light against `--text`, comfortably above AA.
The same .subtab-pill rule is shared by RoutinesSection and DesignsTab, so
they pick up the fix as a side effect of fixing the source class.
Anchored by a Playwright regression test under e2e/ui/ that asserts WCAG
AA across both themes for the Pet source tabs and the seg-btn surfaces.
The test goes red on this commit's parent (Pets/dark, ratio 1.87) and
green here (all four assertions pass).
a1chzt