* feat(daemon): add OD_ALLOWED_INTERNAL_HOSTS allowlist for internal provider endpoints
Fixes#3225. The 0.8.0 SSRF hardening blocks provider base URLs that
resolve to private/internal ranges, with no way to opt a trusted host
out -- breaking internally-hosted LiteLLM/Ollama gateways on VPN-only
RFC1918 addresses.
Add an operator opt-in: OD_ALLOWED_INTERNAL_HOSTS exempts listed hosts
from the internal-IP guard, threaded only into user-configured provider
endpoints (connection test, model discovery, BYOK chat). The
attacker-controllable asset-download guard stays strict. Malformed and
CIDR entries are dropped with a warning rather than silently trusted.
The Settings base-URL field no longer rejects internal-IP URLs
client-side, deferring the authoritative decision to the daemon.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test(e2e): update BYOK base-URL P0 for relaxed internal-IP validation (#3225)
The P0 spec used an internal-IP URL as its 'invalid' example to assert the
client-side error; that URL is now accepted (the daemon owns the allowlist
decision). Switch to a non-http scheme, which is still rejected client-side.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(web): defer internal-IP base URL to the daemon in BYOK draft validation (#3225)
isValidApiBaseUrl was relaxed, but the Test and model-fetch actions gate
on validateByokDraft -> blockingByokDraftIssues, which still treated any
validateBaseUrl error (including a forbidden internal IP) as a blocking
base_url_invalid. So the Test button appeared but the action stayed
blocked client-side and never reached the daemon allowlist. Treat a
syntactically-valid forbidden URL as non-blocking here too; genuinely
malformed / non-http URLs still block.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GitHub targets a developer audience, so the repo README keeps the SEO keyword
as its lead; the Vibe Design Workspace umbrella lives on the website instead.
Restore the H1 and the What-is intro to the Claude-Design-alternative lead
(keeping the local-first placement and count-free phrasing), drop the extra
tagline line, and add the shipped 0.10.0-0.13.0 roadmap milestones.
Co-authored-by: Joey <276262049+xne998808-ai@users.noreply.github.com>
* docs: align README positioning with the Vibe Design Workspace umbrella
Lead with the product's own category (The Vibe Design Workspace) instead of the
competitor keyword, keeping 'open-source Claude Design alternative' as the
subtitle / SEO phrase. Move 'local-first' off the front of the main keyword to
describe the desktop app, and replace the hardcoded skill/system/plugin counts
in the hero alt and intro line with keyword phrasing (the counts stay in the
dedicated Skills / Design Systems sections). Scoped to the README top; the
translated READMEs under docs/i18n/ are a follow-up.
* docs: refresh the README release callout to 0.13.0 (Stay in Flow)
The top-of-README release blurb was still on 0.10.0, three releases behind
(0.11 The Bazaar, 0.12 Brand-backed Design System, 0.13 Stay in Flow). Update
it to 0.13.0 with its session-resume / model-picker / export-handoff theme and
point the links at the 0.13.0 download and release notes.
* docs: rename AMR to Open Design Cloud across the README
AMR (Agentic Model Router) has been folded into Open Design Cloud, so the
callout, top-nav link, and roadmap entry now say Open Design Cloud and point at
/cloud/ instead of /amr/. Also normalizes the one-word OpenDesign Cloud mention
in the 0.13.0 blurb.
* docs(i18n): rename AMR to Open Design Cloud across the translated READMEs
Mirror the EN README rename in all 13 localized READMEs (ar de es fr ja-JP ko
pt-BR ru th tr uk zh-CN zh-TW): the model-service callout, CTA, top-nav link,
and roadmap entry now say Open Design Cloud and point at /cloud/ instead of
/amr/. Brand name kept in English per convention.
* docs: join the README H1 value props with '&' instead of an em dash
* docs: unlink Claude Design mentions in the READMEs
The 'Claude Design' text was a reference link to an X/Twitter post. Drop the
link (and the shared [cd] reference definition) across the EN and 13 localized
READMEs so 'Claude Design' stays plain keyword text and we don't hand a
competitor an outbound backlink.
* docs: make the hero image alt text descriptive for screen readers
The hero alt had drifted into positioning/SEO copy that also no longer matched
the image. Rewrite it to describe what the banner actually shows — the
headline, the classical columns-and-figures artwork, and the stat cards — so
screen readers get an accurate description. Categories are named without
hard-coding counts.
* docs(i18n): refresh the translated README release callouts to 0.13.0
Sync the localized release banners from the stale 0.10.0 blurb to the 0.13.0
'Stay in Flow' announcement (session resume / faster model pick / export
handoff) across all 13 locales, matching the EN README and pointing at the
0.13.0 download + release notes. Resolves the EN/localized version divergence
at the README entry point.
---------
Co-authored-by: Joey <276262049+xne998808-ai@users.noreply.github.com>
Windows users running agent CLIs inside WSL were landing on the native Windows guide and copying the README MCP command directly, which left Linux /usr/bin/od shadowing, daemon origin, Node ABI, and Codex config parse failures unexplained. Add a WSL2 guide and teach the Codex config normalizer to drop nested feature tables that current Codex parses as maps instead of boolean flags.
Constraint: WSL agent CLIs need the same Linux environment for the wrapper, daemon, Node modules, and credentials
Rejected: Docs-only workaround | would leave daemon-launched Codex runs failing on nested features tables
Confidence: high
Scope-risk: narrow
Directive: Keep WSL-specific guidance separate from native Windows PowerShell troubleshooting
Tested: pnpm --filter @open-design/daemon exec vitest run -c vitest.config.ts tests/codex-config-normalize.test.ts
Tested: pnpm --filter @open-design/daemon typecheck
Tested: pnpm guard
Tested: git diff --check
Not-tested: Manual WSL2 end-to-end MCP install on a Windows host
Related: Fixes#4648
The "install into your coding agent" sections pointed users at
`curl -fsSL https://open-design.ai/install.sh | sh -s <agent>`, but that
URL returns 404 — the bootstrap script was never published, and a
standalone `od` CLI is not yet distributed. Every README (English + 12
i18n) shipped a copy-paste command that fails.
Replace it with the real, shipped command `od mcp install <agent>`,
matching the Platform Compatibility table already present in each file
("Once OD is installed, a single `od mcp install <agent>` ..."). The
surrounding "one-line install" comment stays accurate and the
install-OD-first prerequisite is covered by that table.
Co-authored-by: Joey <276262049+xne998808-ai@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(daemon): add Amp CLI as a coding-agent adapter
Amp (ampcode.com) runs headless via `amp -x --stream-json`, which emits
the Claude Code-compatible stream JSON format the daemon already parses,
with the prompt delivered over stdin. Add it as a coding-agent adapter
reusing the claude-stream-json parser; the model picker maps to Amp's
agent --mode (smart/deep/rush).
- new ampAgentDef + registry entry + install metadata
- web agent label/alias
- replay mock (renders via the claude renderer)
- docs adapter-catalog row + README CLI count (21 -> 22)
- adapter buildArgs/stream-format test
* fix(daemon): order Amp adapter at P2, not first-run default
Move ampAgentDef next to copilot (the other P2 local headless CLI adapter)
instead of the head of BASE_AGENT_DEFS. The daemon preserves AGENT_DEFS
order in /api/agents and the web app fills an empty config with
agents.find((a) => a.available), so listing Amp first made it the default
engine ahead of AMR/Claude/Codex for any user with amp on PATH and no
persisted agentId — inconsistent with its P2 classification. Reordering
restores the prior first-run default. Addresses PR review feedback.
---------
Co-authored-by: Siri-Ray <2667192167@qq.com>
* docs(readme): announce 0.10.0 and add AMR entry across all READMEs
* docs(readme): link Gemini CLI and Kimi CLI rows in agent compatibility table
* docs(readme): expand AMR acronym to Open Design Model Router in the AMR blockquote
* docs(readme): rename nav AMR link to Model Router and correct acronym to Agentic Model Router
---------
Co-authored-by: qiongyu1999 <2694684348@qq.com>
* chore(docs): move translated docs into docs/i18n/
Collect the translated README/QUICKSTART/CONTRIBUTING/MAINTAINERS files
(including the Korean set) into docs/i18n/, leaving only the English sources
in the repo root so the GitHub project home page file list stays clean.
Rewrite internal links for the new layout (../../ for repo-root resources,
sibling filenames between translations), update both switcher conventions,
the i18n-check mixed-layout support, the contributors-wall workflow globs,
TRANSLATIONS.md guidance, and drop now-dead root translation paths from the
fork-PR docs allowlist.
* fix(docs): correct root-relative links in Korean contribution guide
Prefix repo-root targets (scripts/sync-design-systems.ts, TRANSLATIONS.md,
package.json, .github/pull_request_template.md) with ../../ so they resolve
from the new docs/i18n/ depth; sibling translated docs stay bare.
Generated-By: looper 0.8.1 (runner=fixer, agent=claude-code)
---------
Co-authored-by: qiongyu1999 <2694684348@qq.com>
* docs: bring 0.9.0 / AMR README (13 langs) to main, R2-aware
Port the finalized 0.9.0 README set from the preview line onto main:
all 13 languages with the AMR announcement, product tour, 21-agent
grid, plugin usage/build/contribute, corrected counts (150/261/21),
Fellow callout, and the #3524 discussion link.
Follows main's R2 asset strategy (#3492): banner / banner-zh / star-us
/ github-metrics are referenced from repo-assets.open-design.ai, not
committed to the repo. coding-agents.png and the product screenshots
stay in-repo, matching how docs/screenshots/* is handled on main.
⚠️ Requires uploading banner-zh.png to R2 before/at merge (see PR body).
* docs: compress two product screenshots under the 1MB file-size guard
studio-image.png (2.5MB) and studio-hyperframe.png (1.1MB) tripped the
"Guard changed file sizes" CI (MAX_CHANGED_FILE_BYTES=1MB). Downscale to
1600px wide + palette PNG — now 0.47MB / 0.18MB, still crisp, kept
in-repo alongside the other product screenshots.
* docs: move coding-agents + product screenshots to R2
Follow the #3492 R2 asset strategy fully: the 10 large PNGs this PR was
keeping in-repo (docs/assets/coding-agents.png + docs/screenshots/product/*)
now reference repo-assets.open-design.ai/resources/images/ instead, and the
binaries are dropped from the tree.
Uploaded to R2 (200 verified):
- resources/images/coding-agents.png
- resources/images/product/{automation,design-system,home,integrations,
plugin,studio-hyperframe,studio-image,studio-ppt,studio-prototype}.png
Pre-existing main assets (docs/screenshots/skills/*, 01-entry-view,
07-magazine-deck) stay local, unchanged. banner-zh.png is now live on R2,
resolving the prior broken-banner blocker.
* docs: unify all language READMEs on the new 0.9.0 hero banner
The non-Chinese READMEs pointed at resources/images/banner.png, which was
still the old "Design with the agent" art — only README.zh-CN rendered the
new 0.9.0 hero. The new hero is language-neutral (English copy), so all 13
READMEs now reference a single canonical resources/images/hero.png instead
of the split banner.png / banner-zh.png pair.
Using a fresh object key sidesteps the stale Cloudflare/camo cache on the
old banner.png URL.
* docs: restore RTL wrapper on README.ar.md
The 0.9.0 localized rewrite dropped the <div dir="rtl"> wrapper that main's
README.ar.md uses to force right-to-left layout, so the Arabic landing page
would render mixed/LTR. Re-wrap the whole document in <div dir="rtl"> … </div>
to match main.
* docs: restore text language switcher and localize core-doc links (fix i18n P0)
The merge-queue Preflight job runs `pnpm i18n:check`, which is skipped for
docs-only PR-level CI — so this only surfaced once the PR entered the queue.
Two regressions from the 0.9.0 rewrite:
- Language switcher: all 13 READMEs replaced the single-line text switcher
with a multi-line image-badge block that i18n-check's parser can't read
(it scans one line and extracts <a href>text</a>, not <img alt>). Restore
the canonical text switcher, each README bolding its own language.
- Core-doc links: localized READMEs (de/fr/ja-JP/pt-BR/zh-CN, and zh-TW for
QUICKSTART) linked the English QUICKSTART.md/CONTRIBUTING.md while a
localized version exists. Point QUICKSTART at the localized file; label the
CONTRIBUTING translations-row original as [English](CONTRIBUTING.md).
`pnpm i18n:check` passes locally.
---------
Co-authored-by: qiongyu1999 <2694684348@qq.com>
Co-authored-by: lefarcen <935902669@qq.com>
The actual count of SKILL.md files in the skills/ directory is 139,
but README.md was showing 137 in multiple places. This updates all
occurrences to reflect the correct count.
Verified with: find skills -name 'SKILL.md' | wc -l
* docs: bump skill count to 137 in TL;DR and header badge
* docs: sync at-a-glance and comparison-table counts, drop broken arithmetic
* docs: sync remaining body references to 137 skills
* docs: update README skill and design system counts to 132/150
Fixes remaining 7 stale count references identified in #2186:
- Line 3: intro paragraph (31→132, 72→150)
- Line 33-34: shields.io badges (131→132, 149→150)
- Line 68: feature comparison table Skills row (31→132)
- Line 114-115: screenshot caption (72→150, ×2)
- Line 876: user templates note (31→132)
- Line 902: comparison table Skills row (31→132)
Actual counts verified:
- skills/: 132 (134 entries - AGENTS.md - README.md)
- design-systems/: 150 (152 entries - _schema - AGENTS.md)
* fix: deduplicate example cards by skill ID to prevent duplicate rendering
Fixes#2889
The ExamplesTab component was rendering duplicate task-selection cards
when rawSkills contained multiple entries with the same skill.id. This
was particularly visible in the official xhs-white-editorial example flow.
Solution: Add deduplication logic in the skills useMemo hook. After
filtering out aggregatesExamples skills, we now use a Map to ensure
each skill.id appears only once, keeping the first occurrence.
This prevents duplicate cards from being rendered while preserving the
existing filter and sort behavior downstream.
* fix: prevent cursor jumping during IME composition after @ mention
Fixes#2851
When using Chinese input method (IME) after typing @ in the chat
composer, the cursor would jump to the previous character position,
making it confusing and difficult to type Chinese text.
Root cause: The handleChange function was detecting @ mentions and
updating the mention state during IME composition events. This caused
React to re-render and reset the cursor position while the user was
still composing characters.
Solution: Skip mention and slash-command detection when composingRef
indicates an active IME composition session. The existing
onCompositionStart/End handlers already track this state; we now
respect it in handleChange.
This fix applies to all IME-based input methods (Chinese, Japanese,
Korean, etc.) and prevents cursor jumping when typing after @ or /
triggers.
* docs(README): refresh stale skills and design-systems counts
The English README still reported 31 skills / 72 design systems and a
prototype(27)+deck(4) split last accurate around v0.4.1. Counted from
SKILL.md / DESIGN.md entry files at the current HEAD: 132 skills
(32 prototype, 9 deck, plus image/video/audio/template/design-system/
utility modes) and 150 design systems.
Updates the eight inline references in README.md plus the two ASCII
tree comments under `skills/` and `design-systems/`. Adds a one-line
note that the mode taxonomy now spans more than just prototype + deck
so the description stops contradicting the visible mode chips in the
picker.
Translations (README.de/fr/es/ko/ja-JP/zh-CN/zh-TW/pt-BR/ar/ru/uk/tr)
still carry the old numbers and need follow-up PRs from their original
translators; intentionally out of scope here to keep this PR easy to
review.
Refs #2186.
* docs(README): include utility mode in catalog summary
The mode summary listed image/video/audio/template/design-system but
dropped utility. The tree comment later in the same file already
mentions utility, and one skill (pptx-html-fidelity-audit) is registered
with mode: utility. Add utility to the inline list so the README stays
internally consistent with the registry the surrounding counts cite.
