chore(release): prepare v0.3.0 - #38
Merged
Merged
Conversation
- Add internal/llm/ module with OpenAI and Anthropic support - Support 3 modes: regex (default), openai, anthropic - Config stored at ~/.config/myworktree/config.json (0o600) - Environment variables (OPENAI_API_KEY/ANTHROPIC_API_KEY) take precedence - Add /api/llm/config and /api/llm/test API endpoints - UI shows LLM settings panel on error with retry/fallback options - Branch name validation: lowercase, 100 chars max, letter start - 10s timeout for LLM calls, no silent fallback on error - Update PRD, ARCHITECTURE, and API docs Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
…name - Refactor LLM config from 'mode' to 'protocol' (openai/anthropic/openai_compatible) - Add APIAddress and Model fields for custom endpoint and model selection - Add POST /api/llm/generate endpoint for branch name generation - Update UI: separate LLM Settings dialog, AI Generate button, Branch Name input - Support manual branch name input (skip LLM when provided) - Update docs: PRD, API, ARCHITECTURE aligned with implementation Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
feat: LLM-powered branch naming from task description
- Upgrade xterm.js from bundled version to v6.0.0 - Upgrade xterm-addon-fit to v0.11.0 - Add VSCode-style custom scrollbar CSS for better UI integration - Add download-xterm.sh script for reproducible vendor upgrades - Update NOTICE and index.html with correct version info This upgrade provides better terminal rendering and enables future enhancements for Chinese IME input handling. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Add dependency checks for curl and python3 - Fetch package metadata (tarball URL, integrity hash) from npm registry - Verify tarball integrity using SHA-512 hashes from npm - Use staging directory for atomic installation - Clean up staging on exit (success or failure) - Extract files using tarfile with filter='data' to prevent path traversal - Add source map files for debugging (xterm.js.map, addon-fit.js.map) This addresses supply chain security concerns by: 1. Using official npm registry instead of third-party CDN (jsdelivr) 2. Dynamic integrity verification instead of hardcoded hashes 3. Atomic installation that doesn't touch vendor until all steps succeed Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
…llwidth build: upgrade xterm.js to v6.0.0 with custom scrollbar styles
- Backend: concurrent git diff --cached/--numstat with per-section error reporting, returning 500 only when both commands fail - Frontend: mutually exclusive accordion in sidebar; toggle triggers re-render so errors follow the expanded section - Docs: updated PRD, ARCHITECTURE, and API docs
- Remove Archived/ArchivedAt fields from ManagedInstance - Remove Archive(), PurgeArchivedInstances() from instance manager - Modify Delete() to work on stopped instances directly - Modify Restart() to auto-delete old instance instead of archiving - Remove /api/instances/archive and /api/instances/purge routes - Remove instance_archive, instance_purge MCP tools - Remove Archive/Purge buttons, Show archived checkbox from UI - Update API docs
Resolved conflicts in docs/API.md: kept staged/unstaged git status split, removed archive/purge (favoring direct delete), kept LLM configuration section from develop.
…ng_split, tighten availability check - Remove openai_compatible protocol; consolidate into openai - Remove auto-fill defaults for model and API address (user must configure explicitly) - Add reasoning_split toggle as a configurable option - Add thinking: false to disable DeepSeek thinking mode by default - IsAvailable() now requires all four fields (protocol, key, address, model) non-empty - Anthropic auth header auto-detects based on URL (x-api-key for api.anthropic.com, Bearer otherwise) - UI: mute AI Generate button when LLM not fully configured, click opens settings - Remove dead DefaultModel/DefaultAddress functions - Sync docs (API.md, PRD.md) with current implementation
feature: UI & API improvements — accordion Changes panel, label removal, LLM config cleanup
feat: prioritize main/develop branches in Base Ref dropdown sorting
fix: add WebSocket connection timeout and improve reconnect handling
fix: pass git repo Root to instance Manager for MainWorktreeID resolution on restart
feat: add tags config directory open and default tags support
TestHandleWorktreeStatusPartialFailure used PATH-hacked shell scripts as a fake git, which timed out under parallel package execution due to macOS process/resource limits. Add gitRunner field to Server so the handler is testable without fragile exec-path manipulation.
… badge - Add git ls-files --others --exclude-standard to detect untracked files - Count file lines for untracked files (skip >1MB and binary files) - Render untracked files with purple U badge in unstaged list - Surface ls-files errors as warning field (non-blocking, distinct from error) - Add unit tests for untracked merge, line counts, and ls-files failure path
fix: make git diff runner injectable to fix flaky status test
- Architecture: claimer pattern (TCP port as distributed lock), reverse proxy + loopback bypass - Security: CSP with hash-based script/style whitelist, CSRF double-submit cookie, HttpOnly token cookie, rate limiting - Features: global auth token config, dashboard HTML, tailscale serve auto-management - Config: auth.json (atomic write, Load() distinguishes file-not-found vs JSON corruption) - Auth: POST /api/auth returns 400 when token not configured; /api/logout requires CSRF token - Cookie: mw_token 24h sliding expiration via Set-Cookie on each authenticated request - Edge cases: Portal SPOF 10-15s failover window, Serve unexpected exit with Warn log
- README.md/zh-CN.md: expand Remote Access section (global token, Portal dashboard, Tailscale HTTPS, network security table), add CLI examples (mw config, --portal-port), add Portal output - PRD.md: add Portal Dashboard as key feature, expand security section, update implementation status, add MVP acceptance criteria - ARCHITECTURE.md: add Portal/dashboard overview, new internal/config and internal/portal packages, auth.json/portal registry/server.json, dual-layer auth architecture, CLI flags chapter - API.md: add mw_token Cookie auth source, new Portal Dashboard endpoints section (7 endpoints with schemas, CSRF, reverse proxy)
- 添加 loopback 请求跳过校验（isLoopbackRequest） - Token 提取优先级：Authorization Bearer → ?token= → mw_token Cookie - 提取 extractAuthToken() 函数，使用 r.Cookie() 精确匹配 - 添加单元测试覆盖 loopback 放行、Cookie token、速率限制 [Task 4] §2 Auth中间件改造 (行118-145), §7 Cookie认证 (行446-470)
- Strip /s/<repo-hash>/ prefix before forwarding to target instance - Validate repo-hash format (lowercase hex only) to prevent path traversal - Set proxy.ErrorLog to logWriter for 502 errors with repo_hash context - Add integration tests: auth required (401), invalid hash (400), not found (502), sliding cookie, WebSocket bidirectional message exchange - WebSocket test: waitForPort retry loop instead of time.Sleep - wsWriteFrame: fix mask key offset and extended payload length field
- Add gen.go (//go:build ignore) that reads dashboard.html and generates csp_gen.go with SHA256+base64 hashes for inline <script> and <style> blocks - Add csp_gen.go with CSPHashes [][2]string exported variable - Replace placeholder cspHashes with generated CSPHashes in portal.go - Add //go:generate go run gen.go directive for re-generation - Add CSP hash verification tests supporting multiple same-type blocks: TestCSPHashes_MatchesDashboardHTML (slice-based comparison) TestCSPHashes_NotEmpty TestCSPHashes_NoDuplicateTypes - Fix duplicate style block in gen.go styles loop - Fix test to strip quotes from CSPHashes entries for comparison
- Start Portal in Server.Start() after listener init, with graceful degradation on failure
- Add Shutdown() method for clean teardown: stop Portal, shutdown HTTP server, close listener
- Replace select{} with signal handling in CLI (SIGINT/SIGTERM → Shutdown)
- Add TailscaleDNSName() helper to display Tailscale URL at startup
…code host to 0.0.0.0 ; add tailscaleServeOK guard to suppress stale-check log spam
…dback - Replace hardcoded port 12345 with s.cfg.PortalPort in app.go - Add PortalPort > 0 guard before opening browser - Show 'Portal is disabled' when portalPort is 0 instead of misleading 'Opening browser...' message - Add color CSS property to button in index.html
feat: improve remote access UI and functionality
- Add CSS variables for dialog-shadow, status-bar colors, overlay colors - Add dark mode overrides for all newly added variables - Fix generic dialog: add background, color, overflow-y, remove hardcoded padding - Add unified .modal-titlebar / .modal-close-btn / .modal-title pattern - Apply unified pattern to all 5 modals (Create Worktree, LLM Settings, Import Worktree, Start Instance, Resource Monitor) - Remove parallel .monitor-titlebar/.monitor-close-btn/.monitor-title - Convert #connection-overlay inline styles to CSS class with variables - Fix JS hardcoded error color in Import Worktree modal - Fix .wt-item.active box-shadow to use CSS variable - Fix .wt-action-btn:hover to use var(--hover-bg) - Fix #status-bar hardcoded colors - Fix button.primary hardcoded border - Fix .tab .tab:hover .tab.active CSS nesting indentation - Add 2px thin horizontal scrollbar for #tabs-container - Add overflow-y: hidden to prevent vertical scrollbar flash - Fix .tab-rename-input undefined --bg-primary variable
fix(ui): unify modal titlebar styles and improve dark mode adaptation
- Add mw config regen command to regenerate and persist a strong random token - Change withAuth middleware to read auth token from config file on every request instead of caching it at startup, enabling hot-reload of tokens - Add y/N confirmation prompt before replacing existing token - Update app handleLogin to use live config.Load() for token verification - Add tests for configRegenAuth covering empty config, skip confirmation, user abort, and successful regeneration - Add tests for withAuth to use isolated config files
docs: sync documentation with actual code implementation
- build(release): add CGO_ENABLED=0 for pure-Go cross-compilation - build(release): remove -w ldflag to preserve macOS code signing compatibility - build(release): add optional macOS codesign + notarization job - docs: add v0.3.0 changelog entry - docs: add Apple Silicon quarantine troubleshooting to README
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.3.0 Release
Build hardening for Apple Silicon
CGO_ENABLED=0确保从 Linux 到 Darwin 的纯 Go 交叉编译-wldflag 以保留 macOS 代码签名兼容性vars.APPLE_ENABLE_CODESIGN启用）Documents
xattr -d com.apple.quarantine）排障指引Fix