Documents the agent writes open in the workspace panel instead of another
application, and local images the agent mentions show up in the conversation.
Workspace preview
- PDF (pdf.js with its own layout and text layer), Word (docx-preview inside a
scripts-disabled sandboxed iframe) and Excel (SheetJS; .xlsx, .xlsm, .xls) open
in the side panel with zoom and fit, per-file scroll/zoom/sheet memory, and a
refresh when the agent rewrites the file. The engines load lazily.
- Bytes come from a new GET /api/sessions/:id/workspace/raw route, with an
extension allowlist, size caps, the workspace boundary and canonical-path
checks. The file endpoint returns metadata and a version for documents. The
client fetches with the bearer credential, so it works in Electron, LAN H5 and
remote access alike.
- Chat links, output cards and the change card open pdf/docx/xlsx in the
workspace; documents outside the workdir still go to the system application.
- Image viewer with fit, zoom and pan, and "open in system app".
Chat images
- Markdown images outside the workdir, at ~/, C:\ and file:// paths render, open
in the viewer, and offer "open original" (pictures only).
- Images returned by tools such as Read appear as thumbnails under the call.
Hardening found in review
- previewFsUrl escapes each path segment; a double-escaped %2e%2e used to leave
/preview-fs/<session>/.
- The CORS, API timing and remote-access header decorators set headers in place.
Rebuilding the response buffered whole files in memory and dropped
Content-Length.
- The engine owns the pdf.js worker, so closing one document no longer fails the
next open.
- Office archives are inflated in steps to check their real sizes, not the sizes
they declare.
- A viewer that fails to load stays in its panel instead of taking the window down.
Adds pdfjs-dist, docx-preview, xlsx (SheetJS 0.20.3 tarball) and fflate as
renderer dev dependencies; Vite bundles them.
Refs #1397
The localized copy for a request-too-large rejection blamed the selected model
and told users to delete large files. The limit belongs to the provider or
relay, and the runtime now removes earlier images and documents by itself on
the next message, so say that and point to compacting or a new session if the
request still fails.
Refs #1399
A 413 from the API or a relay was reported as "Request too large (max 20MB)",
which is the PDF-only limit, and the only recovery stripped top-level media
from the single turn before the error. When the bytes sat in tool results,
@-mentioned images or older turns, nothing shrank and every later message
failed the same way.
The error now reports the size of what was sent and how much of it is images or
documents, names the provider or relay as the side that rejected it, and keeps
the upstream's own text in errorDetails. After the error, images and documents
in everything the failed request carried are replaced with placeholders,
including media nested in tool results and from @-mentioned attachments. The
rejection carries no sourceModel, so it still applies after a model switch.
Transcripts saved with the old wording keep working, and compaction shares the
placeholder logic instead of keeping its own copy.
Refs #1399
A UTF-8 BOM (PowerShell 5.x) or a zero-filled file (crash mid-write on NTFS)
made every read of scheduled_tasks.json and scheduled_tasks_log.json throw, so
listing and creating scheduled tasks failed with 500 until the file was fixed
by hand.
Both readers now strip the BOM and treat a blank file as empty. Content that
has data but does not parse still throws and is never overwritten.
Refs #1400
A tool call the server rejected as invalid stays in the transcript, and its
card is rebuilt from that input on every replay. An option description that
came back as an object threw React #31 and replaced the whole app with the
error page, again on every launch because the open tab is restored.
AskUserQuestion now renders only the string fields it can show, and each
transcript row sits in its own error boundary so a bad record no longer takes
the whole window down.
Refs #1400
The "Session running" dialog treats a running background task as the session
being busy, but Stop & Close only called stopGeneration, which interrupts the
foreground turn and Agent tasks. A background shell command (and its CLI) kept
running, so the reopened session spun again and asked the same question on the
next close.
Stop & Close now also stops every running background task, before the socket is
closed. "Is the session running" and "which tasks to stop" share one predicate
in backgroundTasks, so the dialog cannot offer a Stop that leaves the task that
raised it alive. Keep running sends nothing.
Refs #1398
Everything the assistant did between a <task-notification> turn and the next
real user message was hidden, so the reply a model gave once a background
command finished (and any tool work after it) never reached the chat, live or
after a reload, even though it was written to the transcript.
Drop that suppression from every session history projection (full, paged,
recovery, sub-agent lookup) and from the desktop store (history mapping and the
live-stream flag). Only the injected notification prompt stays hidden; the
background task cards still come from its notification data. The suppression
was added for #886 to quiet replies to stale notifications; the CLI already
avoids those at the source when the model has read the task's result.
Refs #1389
Keep explicit file identities across output cards and prose links, preserve
shell outputs without checkpoint evidence, and retain a file card when
video preview fails. Add cross-project path and opening regressions.
* fix(provider): honor configured output budget for direct Anthropic providers
Anthropic-format providers connecting directly to an upstream could not set a
reply output budget: the field was hidden in the UI, stripped before
persistence, and dropped by a local-proxy-only gate at request build time, so
low-cap relay upstreams returned 400/truncation with no user recourse.
Surface the budget for Anthropic, persist it as a budget-only object so stale
OpenAI-compatibility options cannot leak, and remove only the numeric gate in
getConfiguredProviderOutputBudget. getOutputBudgetHeaders keeps its local-proxy
guard so the internal provenance header never reaches an external provider.
Adds kernel/desktop unit tests for the direct-budget path and the provenance
non-leak.
* fix(provider): disable optional manual thinking below its token minimum
---------
Co-authored-by: gugugaga <267102352+omazili-guga@users.noreply.github.com>
Co-authored-by: 程序员阿江(Relakkes) <relakkes@gmail.com>
* fix(swarm): serialize team config writes under the file lock
Route every team config.json mutation through mutateTeamFileAsync so each update reads its snapshot inside the lock, and publish via a same-directory temp file + rename with bounded Windows retry instead of truncating the live file. Await the now-async writers in the UI and CLI callers.
* test(teams): cover TeamsDialog mode cycling and teammate removal
The changed-lines gate scored TeamsDialog.tsx as 0/20 because no test
imported it, so the new async removeMemberFromTeam/setMemberMode paths went
unrecorded in LCOV. Drive both the list and detail views through input
handlers and keybindings, including the rejection paths, to bring
changed-lines coverage from 84.91% to 93.53%.
程序员阿江(Relakkes)