- A redirect followed for a custom base URL also drops the key headers of
providers that do not use Authorization (x-api-key, x-goog-api-key,
api-key) when it goes to another origin.
- A second Enter or click while a message is being prepared (attachments
read, diagram exported) no longer sends it twice.
- The admin Test on the deployment's own endpoints (EdgeOne, the server's
keyless Ollama, an address on the server's network) counts toward the
quota like a chat; the chat and the Test share one rule for it. The
Test of an Azure entry set up by AZURE_RESOURCE_NAME only goes where chat
goes.
- EdgeOne's function is called at the site root again, as on main: EdgeOne
serves edge functions there, outside Next's base path.
- MCP History: the state before a write is kept unless the browser saved
no change of the user's since the last server write (draw.io's sync copy
of it adds no entry), and the dedupe compares the exact text again, so a
change of page size or other settings only is its own version.
- MCP: an edit keeps untouched labels as draw.io shows them (a literal line
break in an attribute is a space); a new document of empty pages the
user named is auto-saved; load_diagram reads only regular files, so a
pipe cannot hold up the other write tools; the preview does not load
back its own push still on its way (an undo made meanwhile is saved).
- Two overlapping saves of a new chat no longer reload the canvas from the
older copy.
- At most three screenshot checks per user turn, passed or failed, as
documented.
- Desktop: the main window navigates only within the app (draw.io stays in
its frame); a presets file that is not JSON and cannot be moved aside is
not overwritten.
- A last self-closing cell with a raw "<" in a value is not taken for cut
off output.
- README: Material Design shapes load their icons from fonts.gstatic.com.
- Apply preset env after app ready, so Windows/Linux get decrypted keys
- Never re-encrypt ciphertext; restore env when switching or removing presets
- Block navigation away from the app, open external links in the browser, check IPC senders
- Keep inherited proxy settings, default NO_PROXY for localhost
- Serialize server start/restart, kill stuck processes, follow port changes
- Atomic config writes, keep corrupt files as backups, remember the server port
- Menu and settings window stay in sync; dev script gets the decrypted preset env
- Use app.isPackaged, parse inline .env comments, drop .env files from the bundle
- Try legacy port (61337) first to preserve existing users' localStorage,
fall back to 13370 which is below the Windows Hyper-V ephemeral range (#705)
- Bind server and all URL references to 127.0.0.1 instead of localhost
to fix IPv4/IPv6 mismatch on Linux (#684)
- Add OS-assigned port fallback (port 0) so startup never throws
- Log error codes in port checks for easier debugging
- Update localhost guards in index.ts and window-manager.ts to also
match 127.0.0.1
Related: #705, #684
* feat(electron): add desktop application support with electron
- implement complete Electron main process architecture with window management,
app menu, IPC handlers, and settings window
- integrate Next.js server for production builds with embedded standalone server
- add configuration management with persistent storage and env file support
- create preload scripts with secure context bridge for renderer communication
- set up electron-builder configuration for multi-platform packaging (macOS,
Windows, Linux)
- add GitHub Actions workflow for automated release builds
- include development scripts for hot-reload during Electron development
* feat(electron): enhance security and stability
- encrypt API keys using Electron safeStorage API before persisting to disk
- add error handling and rollback for preset switching failures
- extract inline styles to external CSS file and remove unsafe-inline from CSP
- implement dynamic port allocation with automatic fallback for production builds
* fix(electron): add maintainer field for Linux .deb package
- add maintainer email to linux configuration in electron-builder.yml
- required for building .deb packages
* fix(electron): use shx for cross-platform file copying
- replace Unix-only cp -r with npx shx cp -r
- add shx as devDependency for Windows compatibility
* fix(electron): fix runtime icon path for all platforms
- use icon.png directly instead of platform-specific formats
- electron-builder handles icon conversion during packaging
- macOS uses embedded icon from app bundle, no explicit path needed
- add icon.png to extraResources for Windows/Linux runtime access
* fix(electron): add security warning for plaintext API key storage
- warn user when safeStorage is unavailable (Linux without keyring)
- fail secure: throw error if encryption fails instead of storing plaintext
- prevent duplicate warnings with hasWarnedAboutPlaintext flag
* fix(electron): add remaining review fixes
- Add Windows ARM64 architecture support
- Add IPC input validation with config key whitelist
- Add server.js existence check before starting Next.js server
- Make afterPack throw error on missing directories
- Add workflow permissions for release job
---------
Co-authored-by: dayuan.jiang <[email protected]>
dayuan.jiang