Commit Graph

318 Commits

Author SHA1 Message Date
Afloat 16c6e364ed Reject invalid TCP header lengths (from #712) 2026-11-04 01:18:22 +07:00
Afloat 22c74345a2 Keep UDP payloads within declared datagram lengths (from #711) 2026-11-04 01:17:28 +07:00
Afloat 9ff8ad7bae Remove every duplicate JSON configuration key (from #710) 2026-11-04 01:16:34 +07:00
Afloat aa030550da Keep comments when adding the first JSON configuration value (from #709) 2026-11-04 01:15:40 +07:00
Afloat ddfd031795 Preserve JFFS2 sizes when recovery budgets are exhausted (from #708) 2026-11-04 01:14:45 +07:00
Afloat 6cedc883e9 Keep PyInstaller modules within their PYZ archive (from #707) 2026-11-04 01:13:52 +07:00
Afloat 03a2d7a304 Distinguish missing ext data from sparse holes (from #706) 2026-11-04 01:12:58 +07:00
Afloat cacaa2aade Preserve sparse ext positions across indirect levels (from #705) 2026-11-04 01:12:03 +07:00
Afloat 009313c429 Report incomplete cramfs block output (from #704) 2026-11-04 01:11:09 +07:00
Afloat 9a3f12e062 Traverse ROMFS dot and empty root directories (from #703) 2026-11-04 01:10:15 +07:00
Afloat e66c8051de Validate ASAR header framing (from #702) 2026-11-04 01:09:21 +07:00
Afloat e178bb447b Keep ZIP64 values within their extra field (from #701) 2026-11-04 01:08:26 +07:00
Afloat 422e65820a Check ZIP member sizes after decompression (from #700) 2026-11-04 01:07:31 +07:00
Afloat 74ca0753c0 Apply ZIP output limits to stored entries (from #699) 2026-11-04 01:06:37 +07:00
Afloat 2713f5d714 Keep Android string pools within declared chunks (from #698) 2026-11-04 01:05:43 +07:00
Afloat dedc0cdb49 Stop repeated SQLite overflow pages from fabricating data (from #697) 2026-11-04 01:04:49 +07:00
Afloat fd4cb3f71f Keep SQLite cell reads within their page (from #696) 2026-11-04 01:03:50 +07:00
Afloat 6085a1ce98 Read SQLite text using the database encoding (from #695) 2026-11-04 01:02:33 +07:00
Afloat a230f5ac1a Reject invalid DEX array payload element widths (from #694) 2026-11-04 01:01:39 +07:00
Afloat 0872a25f35 Reject impossible DEX invocation register lists (from #693) 2026-11-04 01:00:45 +07:00
Afloat be4c6dc527 Validate Java invocation operands before decoding calls (from #692) 2026-11-04 00:59:50 +07:00
Afloat d7e508b51f Reject invalid widened Java instructions (from #691) 2026-11-04 00:58:56 +07:00
Afloat 5509a4ed3b Preserve valid text around damaged modified UTF-8 (from #690) 2026-11-04 00:58:00 +07:00
Afloat 4a1fd2e657 Reject signed LEB128 values outside the 64-bit range (from #688) 2026-11-04 00:57:03 +07:00
Aek 12b0c1e0ba Offer "Work on my project" on New project: pick your project's folder and edit its files in place (#686)
New project offers a third choice, "Work on my project": pick your project's folder, say what you want, and its files are edited in place (R2.9).
2026-11-04 00:51:02 +07:00
Firefly 5430c5a7c6 Offer the other model providers by name when their key is set (#684)
Moonshot, DeepSeek, xAI, Groq, Mistral, Together, Fireworks and DeepInfra are offered by name when their key is set, from one table of base URLs, key variables and default models.
2026-11-04 00:38:41 +07:00
BFlat 636b3ff3d7 Bound CPIO checksum work across firmware probes (#683)
CRC cpio checksum work shares one byte allowance across a firmware scan and stops when the scan is cancelled; checksum fields must be eight hex digits, and skipped verification is reported (R3.12). Replays #676.

Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
2026-11-04 00:33:08 +07:00
Ryan Missel 87174476d9 Add Copilot CLI support and shared agent investigations (#455)
GitHub Copilot CLI can be a coding agent over ACP, with its models chosen through the shared agent model catalogue; options that could bypass the app's tool restrictions are refused, and agents share investigation findings safely.
2026-11-04 00:29:11 +07:00
Firefly c7caf7de15 Offer OpenCode Go as a backend, with its session header (#672)
OpenCode Go can be added as a backend: offered when OPENCODEGO_API_KEY (or OPENCODE_GO_API_KEY) is set, on its documented base URL, with a stable per-installation x-opencode-session header kept in the AI settings. Not run against the service.
2026-11-03 23:57:07 +07:00
BFlat b79fc506e2 Auto mode deletes inside projects whose path has capitals, and reads quoted paths with spaces whole (#682)
Auto mode's delete check compares paths as written and reads quoted or escaped paths with spaces as one argument, so it neither refuses deletes inside a project with capitals in its path nor lets a delete of the folder beside the project through. Replays #357.

Co-authored-by: samurai <samuraideng@gmail.com>
2026-11-03 23:24:57 +07:00
Afloat 5ac0e2b68d Preserve empty query pairs in older stand-in recordings (#673)
Older stand-in recordings keep their empty query pairs when current credential rules are reapplied, so replay matches the right page (follow-up to #648).
2026-11-03 23:16:53 +07:00
Afloat 75bf5a3f0d Handle generic GGUF paths and numeric task versions in chat discovery (#675)
Local chat discovery reads a generic GGUF file name by its model folder and treats task names with version numbers as specialised, so an embedding or reranking model isn't picked for chat (follow-up to #653).
2026-11-03 23:14:26 +07:00
Afloat 2122a619e9 Verify stand-in session cleanup by answerer lifetime (#677)
The stand-in session cleanup test checks that the answerer is released instead of reconnecting to a port another listener may reuse.
2026-11-03 23:14:18 +07:00
Firefly 9ff2b43de4 Point the snapshot's extractor at the Kimi backend that exists (#678)
The snapshot example's extractor names the Kimi K3.1 Pro backend that exists since #655.
2026-11-03 23:14:11 +07:00
Thân Minh Nghĩa 2e0d0813e0 Ignore switched-off screens and shared PCI ids when picking the Linux GPU (#671)
On Linux a switched-off screen (a closed laptop lid) no longer counts as the one the GPU drives, and PCI ids pick a card only when no other card shares them (follow-up to #659).
2026-11-03 22:54:25 +07:00
Afloat c7031174dc Exercise the unterminated DER OID guard (#674)
The unterminated DER OID regression test ends with 0x81, so it reaches the arc-completion guard instead of the non-minimal-encoding check (follow-up to #652).
2026-11-03 22:54:14 +07:00
Shaikh Fardin 4759d37ad2 Offer a Google AI Studio (Gemini) key in Settings and first run (#670)
A Google AI Studio (Gemini API) key is its own choice in Settings → AI and first run, through Gemini's OpenAI-compatible endpoint, read from GEMINI_API_KEY like the other providers (fixes #646).
2026-11-03 22:38:43 +07:00
Max Mittelstädt e1d962163b Ignore EOCD signatures inside ZIP comments (#660)
A ZIP's end-of-central-directory record is the one whose comment length reaches the end of the file, so a signature inside the comment can't hide the real entries; a file with bytes after its comment still opens.
2026-11-03 22:14:41 +07:00
Max Mittelstädt 2920a7c40f Restrict Claude Code tools and require approval for unknown tools (#637)
Claude Code chats get no built-in tools and builders an explicit list (commands, files, search, todos), so tools that message other sessions, publish or schedule work never start; in Auto mode a tool without an approval rule is refused (fixes #635).
2026-11-03 22:01:45 +07:00
BFlat f05f019691 Draw on the GPU that drives the screen on Linux, so laptops with two GPUs open fast and don't lag (#659)
On Linux the window is drawn on the GPU that drives the screen (the built-in panel's, or the only one with displays), so laptops with two GPUs open fast and don't lag; WGPU_ADAPTER_NAME and WGPU_POWER_PREF still decide (fixes #571). Replays #578.

Co-authored-by: Thân Minh Nghĩa <thanminhnghia3@gmail.com>
2026-11-03 21:57:08 +07:00
BFlat 0ea700d1e1 Add Korean, Czech and German UI catalogs (#662)
Replays #590, #647 and #482: Korean, Czech and German UI catalogs, each with the strings added since it was written.

Co-authored-by: 아야진 <ayajin@Mac-Studio.local>
Co-authored-by: Losminek <301412321+Losminek@users.noreply.github.com>
Co-authored-by: Ilor29 <hello@einzelstein-software.de>
2026-11-03 21:40:15 +07:00
BFlat 9fd46b818b Builder limits, OpenRouter tools, a software-renderer fallback, calmer spinners, lean local builders, lldb calls and LM Studio ports (#657)
Replays #576, #577, #581, #589, #624, #625 and #628. Builder steps stop after 25 failed builds in a row, OpenRouter tool requests ask for a provider that supports tools, a start that never opened a window draws in software next time, spinners stop redrawing every frame, local builders get a lean tool list, lldb call observation works and reports failures, and LM Studio is found on other ports.

Co-authored-by: Fábio Soares <fabiodev1123@gmail.com>
2026-11-03 21:16:34 +07:00
Firefly 2d06e6642e Offer Kimi K3.1 Pro instead of the older Kimi K3 (#655)
Detect offers Kimi K3.1 Pro (moonshotai/kimi-k3.1-pro) on OpenRouter instead of the older Kimi K3, with OpenRouter's list price ($2 / $10 per Mtok, $0.20 cached).
2026-11-03 21:15:18 +07:00
BFlat ba00f86f30 The command palette stays where it's scrolled (#658)
The command palette follows its selection only when the arrow keys or typing move it, so the wheel's scroll isn't pulled back to the top on the next frame (fixes #584).
2026-11-03 21:05:27 +07:00
YoSiem ad5cd81b6a Paste pictures into the prompt box with Ctrl+V and show attachments as picture tiles (#631)
Pictures can be pasted into the prompt box with Ctrl+V (Cmd+V, Shift+Insert): a copied image is saved as a PNG in the person's own cache folder and attached, copied picture files are attached as they are, and attachments show as picture tiles.
2026-11-03 20:50:05 +07:00
BFlat ebed13d0fc Keep ARM32 conditional call values, esbuild dependencies and window labels right (#656)
Replays #640–#642. Conditional A32 calls keep the skipped path's value, esbuild dependencies survive unrelated calls, and window comparison labels stay distinct without renumbering occurrences.

Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
2026-11-03 20:49:11 +07:00
BFlat aeb86a69a3 Agent setup and streaming fixes: Aider, Antigravity on Windows, chat-only models, SSE limits and retries (#653)
Replays #616, #617, #619, #620 and #621. Aider isn't offered until it has an adapter, Antigravity is found under a redirected LOCALAPPDATA, servers with only specialised models aren't set up for chat, an SSE event's data is capped, and a retry keeps the original request when the agent's session can't be restored. Program lookup adds lower-case extensions on Windows.

Co-authored-by: Afloat <132809511+Afloat16@users.noreply.github.com>
2026-11-03 20:41:06 +07:00
Max Mittelstädt 99bfba88bf Restore originals from long inline source maps (#368)
JavaScript analysis reads a source map comment from the last eight lines of the whole script and keeps its full URL, so originals are restored from large inline source maps.
2026-11-03 20:41:02 +07:00
BFlat 0e79ffaaa5 Remember "Always for this project" on a tool's consent card (#654)
"Always for this project" on a consent card is remembered in the project, and a tool allowed that way isn't asked about again (fixes #563). Replays #575.

Co-authored-by: Fábio Soares <fabiodev1123@gmail.com>
2026-11-03 20:40:55 +07:00
Fábio Soares e9852f8c58 Name every place the website check accepts a site, and where the app really is (#627)
When the website check finds no built site, it names every place a site is accepted (dist/, build/, out/, or a plain index.html without package.json) and where the app really is (fixes #494).
2026-11-03 20:35:03 +07:00