release: v0.6.0 — security audit fixes + 7 new features #3

Merged

Muyue merged 81 commits from release/v0.6.0 into develop 2026-04-27 09:14:46 +00:00

Conversation 0 Commits 81 Files Changed 22 +1236 -145

Muyue commented 2026-04-27 08:14:31 +00:00

Owner

Copy Link

Résumé

Audit de sécurité/concurrence/stabilité (~20 corrections vérifiées) + 7 nouvelles fonctionnalités demandées :

• Nom OS injecté dans le contexte IA (à côté de la date)
• WSL : accès rapide aux distros installées dans l'onglet Terminal (Windows)
• Agents : timeout 30 min par défaut
• Agents : params cwd / wsl_distro / wsl_user
• BMAD-METHOD : Studio AI spécialisé en construction de prompts (personas + gabarit obligatoire)
• Toggle Réflexion avancée (provider inactif produit un rapport préalable)
• Toggle Historique compressé (dernière action seule)

Voir CHANGELOG.md pour la liste détaillée.

CI fix

Le go vet cassait sur develop (cleanAIResponse lowercase au lieu de CleanAIResponse). Corrigé dans ce PR.

Test plan

• go vet passes (corrigé)
• go test ./...
• frontend build via npm run build
• manuel : toggle Réflexion avancée
• manuel : toggle Historique compressé
• manuel : crush_run avec cwd
• manuel (Windows) : crush_run avec wsl_distro + wsl_user
• manuel (Windows) : nouveau tab Terminal sur distro WSL

## Résumé Audit de sécurité/concurrence/stabilité (~20 corrections vérifiées) + 7 nouvelles fonctionnalités demandées : - Nom OS injecté dans le contexte IA (à côté de la date) - WSL : accès rapide aux distros installées dans l'onglet Terminal (Windows) - Agents : timeout 30 min par défaut - Agents : params `cwd` / `wsl_distro` / `wsl_user` - BMAD-METHOD : Studio AI spécialisé en construction de prompts (personas + gabarit obligatoire) - Toggle Réflexion avancée (provider inactif produit un rapport préalable) - Toggle Historique compressé (dernière action seule) Voir CHANGELOG.md pour la liste détaillée. ### CI fix Le `go vet` cassait sur `develop` (`cleanAIResponse` lowercase au lieu de `CleanAIResponse`). Corrigé dans ce PR. ### Test plan - [x] go vet passes (corrigé) - [ ] go test ./... - [ ] frontend build via `npm run build` - [ ] manuel : toggle Réflexion avancée - [ ] manuel : toggle Historique compressé - [ ] manuel : `crush_run` avec `cwd` - [ ] manuel (Windows) : `crush_run` avec `wsl_distro` + `wsl_user` - [ ] manuel (Windows) : nouveau tab Terminal sur distro WSL

Muyue added 81 commits 2026-04-27 08:14:31 +00:00

chore: update CHANGELOG for v0.3.1 5b4a70e690

merge develop into main for v0.3.2-beta.1 d8384cad00

chore: update CHANGELOG for v0.3.2-beta.1 ... 51a599fc83

💾 Generated with Crush

Assisted-by: GLM-5-Turbo via Crush <crush@charm.land>

chore: update CHANGELOG for v0.3.2 28e5113733

feat(config): add system panel with reset and starship theme, add onboarding wizard ... 9188231a05

- Add PanelSystem with reset config and apply starship theme (charm/zerotwo/default)
- Add OnboardingWizard that activates when profile is empty on first run
- Fix <thing> tag parsing in Shell AI messages (wait for </thing> before rendering)
- Add /api/config/reset and /api/starship/apply-theme endpoints
- Wire wizard trigger in App.jsx based on profile completeness

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(onboarding): auto-save on done step, keyboard nav, error feedback ... 1f12b8a4fb

- Trigger save automatically when reaching done step
- Add Escape to go back, Enter to advance (works in text fields)
- Add back button visible between step 1 and last step
- Fix accent encoding in done message
- Show saving state and error with retry button

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(config): per-provider form state to avoid field cross-talk ... e92a2f00f5

- providerForm is now keyed by provider name
- Each provider (minimax/glm/claude) has isolated form data
- Validation and save target the specific provider being edited

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix: register missing /api/config/reset and /api/starship/apply-theme routes ... 275a9a4cc7

- Add resetConfig and applyStarshipTheme to frontend api client
- Register handleResetConfig and handleApplyStarshipTheme in server mux

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(onboarding): require fields before advancing steps ... b6147ddb12

- Validate each step before allowing goNext
- Show required error message on name step if empty
- Clear error on input change

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(onboarding): add minimax api key step and AI-powered editor scan ... 65df15498b

- Add apikey step in onboarding wizard (optional, with validation)
- Add ScanEditors() in scanner package detecting vim/nvim/code/emacs/nano/helix/subl/zed
- Add GET /api/editors endpoint
- Editor step now has scan button to detect installed editors via backend
- MiniMax API key is saved to provider config if provided

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(agent): refactor AI chat with streaming, agent registry, and tool execution ... 61da8039bc

- Replace old tool-call regex with proper agent registry
- Add streaming chat via SSE (handleStreamChat / handleNonStreamChat)
- Add internal/agent package with tool definitions and execution
- Add orchestrator with system prompt and tool scaffolding
- Add internal/agent/ directory
- Studio.jsx: streaming chat with thinking indicator and tool result rendering
- global.css: chat bubble styles, streaming animation, thinking dots
- handlers_chat.go: full rewrite using new agent/orchestrator architecture

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat: add Cobra CLI, LSP/MCP registries, workflow engine, and enriched dashboard ... 485e085bb0

Major changes:
- Refactor CLI entry point to Cobra commands (root, setup, scan, doctor, install, update, lsp, mcp, skills, config, version)
- Add LSP registry with health checks, auto-install, and editor config generation
- Add MCP registry with editor detection, status tracking, and per-editor configuration
- Add workflow engine with planner and step execution for automated task chains
- Add conversation search, export (Markdown/JSON), and detailed token counting
- Add streaming shell chat handler with tool call/result events
- Add skill validation, dry-run testing, and export endpoints
- Enrich dashboard with Tools/Activity/Status tabs and tool cards grid
- Add PRD documentation
- Complete i18n for both EN and FR

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(studio): improve chat context, thinking tags, streaming, and tool results ... 0d8e1b1e1a

- Fix cleanThinkingTags to use proper regex instead of naive ReplaceAll
- Send conversation history (last 20 messages + summary) to AI instead of single message
- Store tool results alongside tool calls so history shows complete execution info
- Stream words instead of characters for smoother SSE rendering
- Add stop button to cancel in-progress AI requests (AbortController)
- Fix markdown rendering: add h2 support, use div for bullets
- Add i18n keys for cancel/stop (EN + FR)

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

refactor(chat): deduplicate streaming code, add multi-conv, and XSS protection ... b0865bc598

- Add ChatEngine for deduplicated chat logic (handlers_chat/shell_chat)
- Add SendWithToolsStream for real-time streaming responses
- Add /help, /plan, /export, /model commands in Studio
- Fix XSS: sanitize HTML after markdown rendering
- Add ConversationStoreMulti for multi-conversation support
- Add Anthropic headers (x-api-key, anthropic-version)
- Add fallback logging when provider switch occurs
- Add API handler tests (handlers_test.go)
- Polish Studio: max-height 200px, word-break on tool args
- Update CLI version to show full info (version, go, platform)

🤖 Generated with Crush

Assisted-by: MiniMax-M2.5 via Crush <crush@charm.land>

feat(dashboard): add quota monitoring, process list, and command history ... c81ebb4e46

- New API endpoints: /providers/quota, /recent-commands, /running-processes
- New grid-based dashboard layout with cards for tools, quota, processes, commands
- Improved OnboardingWizard with required API key validation and scanning feedback
- Auto-initialize config on first run

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(dashboard): single-view grid with live CPU/RAM/Net graphs, API quota, processes, and sudo indicator ... 328e9e6457

- Rewrite dashboard from 4 tabs to single grid view with 5s auto-refresh
- Add live CPU/RAM/Network SVG graphs with rolling 30-point history
- Add backend /api/system/metrics reading /proc/stat, /proc/meminfo, /proc/net/dev
- Add backend /api/providers/quota for MiniMax and Z.AI quota monitoring
- Add backend /api/recent-commands reading bash/zsh history
- Add backend /api/running-processes filtering editors/IDEs/languages
- Add sudo/root indicator (⚡ ROOT) in footer when running as root
- Remove duplicate Ctrl+1-4 shortcut from page-specific footer (keep only right side)
- Add Ctrl+R shortcut on dashboard for metrics-only refresh
- Make API key mandatory in onboarding, auto-scan editors via AI chat
- Remove manual editor input, only show AI-detected editors
- Bump version to 0.3.3

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

merge develop: resolve conflicts, accept develop versions ... 6f7f588e51

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

Merge branch 'develop' 45884ee75c

Merge branch 'develop' d9d1ec5cb7

Merge branch 'develop' 1d521cbf90

Merge branch 'develop' 41cbee8928

Merge branch 'develop' d3755028fb

Merge branch 'develop' 49a0f5c8c3

Merge branch 'develop' 0232bd7afe

Merge branch 'develop' 85edea9ed9

Merge branch 'develop' 028fb364ba

Merge branch 'develop' f88c7a4f3f

Merge branch 'develop' 745e03d00a

Merge branch 'develop' 0b6d5281df

Merge branch 'develop' 52a785ec9a

Merge branch 'develop' 869bf154cc

chore: update CHANGELOG for v0.3.4 c39203cc4b

fix: AI terminal init, Shift+Tab nav, code block rendering, command filtering ... 20237c022f

- Fix AI terminal not initializing (wait for shell col visibility, remove offsetHeight guard)
- Add Shift+Tab to cycle between shell terminals
- Handle unclosed code blocks in renderContent (Shell + Studio)
- Filter irrelevant commands from history (short/non-alpha backend + expanded frontend exclude list)

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix: display all quota models, center card content vertically ... 8db3bd7c6b

- Handle all quota types in providersQuota, not just TIME_LIMIT
- Extract model name from model field or type field
- Use explicit limit value when available
- Add vertical center alignment to quota card content

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

bump: v0.3.5 ... 06810be9a3

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

refactor: remove locale panel, improve provider validation and terminal buffer persistence ... 02ee41c12b

- Remove locale panel from config (language/keyboard already handled elsewhere)
- Add per-provider key validation status with auto-check on load
- Add missing tools section with AI-powered installation
- Improve reset confirmation with modal
- Persist terminal buffer to localStorage with auto-save
- Detect clear command to wipe saved buffer
- Remove AI tab concept (commands routed to active tab instead)
- Remove renderTick hacks, use proper message keys

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix: restore buffer after WebSocket init, fix clear detection, fix streaming chunks ... a1046da67b

- Delay buffer restoration by 300ms to avoid race condition with WebSocket init
- Read current line from terminal buffer on Enter (reliable) instead of keystroke tracking
- Fix streaming to emit full content instead of word-by-word chunks
- Fix WebSocket readyState check in sendToTerminal
- Extract and deduplicate AI message sending logic
- Fix localStorage cleanup on tab close

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(terminal): refactor WS cleanup, improve clear detection, fix sendToTerminal ... 203f57fa31

- Move defer cleanup after async goroutine setup to prevent premature closure
- Remove unused Password field from terminal sessions struct
- Fix line calculation in clear detection using viewportY instead of baseY
- Add onStateChange callback to connectWebSocket for connection state
- Add tabId parameter to sendToTerminal for targeted tab control
- Simplify ShellAIMessage to use specific tab for command sending

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(terminal): refactor WebSocket cleanup, buffer management, and disposal ... 183dd27407

- Add proper disposal tracking to prevent memory leaks
- Move terminal buffer from localStorage to sessionStorage
- Restore buffer immediately after first WS message
- Fix clear detection logic and error handling
- Add signal parameter support for abortable fetch requests

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(shell): add debug logging for tab tracking and WebSocket state ... a905f22f1a

Track which tab messages belong to via _tabId field to ensure AI
responses are sent to the correct terminal tab. Add console.log in
initTerminal, sendToTerminal for troubleshooting tab lifecycle issues.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(shell): improve tab reference stability and command queueing ... e8924be182

Add refs to track activeTab and pending commands outside render cycle.
Flush queued commands after terminal initialization completes.
Fix sendToTerminal to use stable refs instead of stale state.
Enhance debug logging for tab operations.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(studio): add tool results serialization and improve message handling ... 16c5ed6dd9

- Add tool_results array to AI message content with tool_call_id, result, and is_error
- Convert cleanContent to let for potential reuse
- Reset accumulated and streaming state on tool_call events

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(config): remove unused import, reorder hooks, and improve variable naming ... e6447f2f5a

Reorder validateKey function and useEffect to avoid referencing before definition.
Rename loop variable from 't' to 'tool' for clarity.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(shell): initialize activeTabRef with activeTab and move useEffect ... 0a3123ec17

Reorder code to follow React hooks rules - initialize ref with value
instead of null, then update via useEffect.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(ui): redesign recent commands display and fix terminal visibility ... fca53440e6

- Dashboard: add frequency bars for top commands, click-to-copy, time display
- Shell: switch from display:none to visibility:hidden for terminal containers
- CSS: restyle command list with improved hover states and copy indicators

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(ui): add recentUnique to deduplicate recent commands in Dashboard ... b394ef9979

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

feat(ui): refactor copy state to Set and add helper functions ... a994749dcf

- Change copiedIdx (number) to copiedSet (Set) for tracking multiple copied items
- Add copyCmd function to handle clipboard and timeout cleanup
- Add relativeTime function for displaying relative timestamps

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(terminal): use display:none instead of visibility for tab hiding ... e6da61f460

Replace visibility-based hiding with display property for reliable tab
detection. Use offsetParent and offsetHeight checks instead of style
properties to properly detect hidden terminals.

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(ui): adjust global CSS styles ... 5dac191d9a

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(terminal): improve tab visibility checks and positioning ... ab3641d00d

- Add null check for container before accessing offsetHeight
- Validate activeTabRef during initialization and fit operations
- Check for display:none as visibility indicator
- Simplify useEffect dependency array
- Use absolute positioning for terminal wrapper/instance

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(terminal): init all tabs on load, fix excessive zoom ... 9fb5aa8dbf

Use visibility:hidden instead of display:none for inactive terminal tabs
so xterm containers retain their dimensions. This allows all terminals
to initialize independently and prevents fitAddon from miscalculating
cell sizes on zero-height containers.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(terminal): detect shell tab visibility via MutationObserver ... 6596d86db6

Shell is always mounted inside a display:none parent when the app
loads on a different tab. Added MutationObserver on the wrapper to
detect when the shell tab becomes visible and initialize/fit all
pending terminals at that moment. Removed attempt limit so retries
continue until the tab is actually shown.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(terminal): improve terminal dimensions and fit timing ... 18e83479d6

Use min-height:0 on xterm-wrapper (flex child) instead of height:100%
to properly fill available space in flex layout. Add delayed fit()
calls after initialization to let the layout stabilize before
calculating terminal cell dimensions.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): prevent Enter in AI chat from leaking to terminal ... 3651f62127

Stop propagation of Enter keydown in AI input and defer terminal
focus to next event loop tick to prevent xterm from capturing the
same key event.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

feat(terminal): add Ctrl+Shift+C/V copy/paste shortcuts ... c562972da3

xterm captures all keyboard input which prevents standard clipboard
operations. Add custom key handler to intercept Ctrl+Shift+C for
copy (selection) and Ctrl+Shift+V for paste, without interfering
with Ctrl+C (SIGINT) or browser devtools shortcut.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(terminal): use absolute positioning for content panels ... b80562a669

height:100% on .content>div fails because .content uses flex:1
without explicit height. Switch to position:absolute;inset:0 which
correctly fills the content area and gives xterm proper container
dimensions for fitAddon.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

feat(ai): add Xiaomi MiMo provider, ZAI as last-resort fallback ... 68acabd6a1

Add MiMo-V2.5-Pro from Xiaomi Token Plan as a new AI provider with
base URL https://token-plan-ams.xiaomimimo.com/v1. The /model change
command now switches between MiniMax and MiMo only. ZAI is always
placed last in the fallback chain as the provider of ultimate resort.
Config panel shows MiniMax and MiMo cards.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(dashboard): show MiMo quota instead of ZAI on dashboard ... c8506d4dfc

Replace Z.AI quota display with MiMo provider in the API Quota card.
ZAI is now a hidden fallback and should not appear in the dashboard.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(terminal): improve dimension calculation and tab init reliability ... 1885616068

- Guarantee minimum 24x80 dimensions on WebSocket open
- Force reflow before init attempts
- Multiple fit attempts with increasing delays (0/50/100/200/400ms)
- Validate saved tabs structure from localStorage
- Resize active tab after closing another tab

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): resolve savedTabs undefined ReferenceError in activeTab init ... 6cc86b7f89

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(terminal): improve dimensions handling and add system theme for xterm ... 3312005be4

💘 Generated with Crush

Assisted-by: MiniMax-M2.7 via Crush <crush@charm.land>

fix(shell): remove stray 'impo' typo causing ReferenceError ... c607943ca3

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): add missing useI18n import ... 3b819be5ac

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): restore missing MAX_TABS, TABS_STORAGE_KEY, TERMINAL_BUFFER_KEY constants ... 0e7340891c

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): add missing Monitor import from lucide-react ... f9d56de65a

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): restore all missing imports, constants, and utility functions ... 2e98701104

- Restore xterm imports (Terminal, FitAddon, WebLinksAddon)
- Restore all lucide-react icons (Globe, X, Plus, ChevronDown, etc.)
- Restore module-level constants (AI_TAB_ID, MAX_TABS, SHELL_MAX_TOKENS,
  TABS_STORAGE_KEY, TERMINAL_BUFFER_KEY)
- Restore renderContent() and formatText() utility functions
- Add @xterm/xterm CSS import
- Remove duplicate constants from inside Shell component

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

feat(shell): integrate Hyper-like terminal technologies (WebGL, search, unicode11, image) ... e21b47a27c

Add xterm addons from Vercel Hyper terminal: WebGL renderer with DOM
fallback, search bar (Ctrl+Shift+F), Unicode 11 grapheme support, and
inline image protocol. All existing functionality preserved.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(ci): add .npmrc with legacy-peer-deps for xterm addon resolution ... 3104179109

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): enable allowProposedApi for Unicode11 addon ... 97bfb803a6

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(deps): upgrade @xterm/xterm to 6.1.0-beta.203 for addon compatibility ... 7240813de6

The addon-web-links registerApcHandler API requires xterm >= 6.1.0.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

feat(shell): add Ctrl+/- zoom and display all shortcuts in footer ... df46b5c14e

- Ctrl+/Ctrl-/Ctrl+0 to zoom in/out/reset terminal font size
- Zoom badge indicator in tab bar
- All shell shortcuts now shown in statusbar footer
- Added i18n labels for search, zoom, switch tab, next tab

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): default fontSize 10px and init new tabs immediately ... 6b0fcfbd31

- Base font size reduced from 12px to 10px
- New tabs now initialize directly when added (was waiting for
  tab switch because the MutationObserver only fired on visibility
  changes, not on tab additions)
- Zoom level applied to newly created terminals

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

fix(shell): set default terminal fontSize to 6px ... a60435d002

All fallbacks were still using 12px. User confirmed 6px is the
correct baseline on their display.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

chore: update CHANGELOG for v0.3.5 b43e3352e7

Merge branch 'develop' ... 95e6cdaf41

# Conflicts:
#	internal/api/handlers_info.go
#	internal/config/config.go
#	internal/version/version.go
#	web/src/components/App.jsx
#	web/src/components/Config.jsx
#	web/src/components/Dashboard.jsx
#	web/src/components/Shell.jsx
#	web/src/components/Studio.jsx

Merge branch 'main' of https://gitea.legion-muyue.fr/Muyue/MuyueWorkspace f05181b2db

chore: update CHANGELOG for v0.4.0 c9f2932147

feat: AI task API, token-based context windows, SSH password auth, sudo bypass detection ... d98110ce8a

Replace message-count context windows with token-budget based ones for both
studio and shell. Add /api/ai/task endpoint for background tool
check/install/update. Enhance sudo blocking to catch piped/chained elevation
commands. Add SSH password support via sshpass and connection editing UI.
Remove realTokens persistence in favor of consumption tracking. Bump to 0.4.1.

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

feat: agent concurrency, conversation summaries, AI tools config, UI polish ... 3740454201

- Agent slot limiter for concurrent tool execution
- Conversation summarization with soft-delete (MarkSummarized)
- ANSI stripping in terminal tool output
- Configurable crush-run timeout (default 600s, max 900s)
- Starship theme refactor, AI tools config grid, system update UI
- Streaming segments refactor, summarized messages block in feed
- CSS: headings, scrollbars, tool cards, summary block styles
- i18n additions (en+fr) for tools, updates, config

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

merge: develop into main (v0.5.0) ... 0753167fb9

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

release: v0.6.0 — security audit fixes + 7 new features ... 6a7b4d8001

Audit corrections (security, concurrency, stability):
- chat_engine: bound resp.Choices[0] access, release tool slot per-iteration
- conversation_multi: synchronous save under existing lock (was racy fire-and-forget)
- workflow/engine: short-circuit on failed deps (no more infinite busy-wait); track failed/skipped status
- handlers_workflow: rune-aware truncate for plan goal (UTF-8 safe)
- server: CORS limited to localhost origins (was wildcard)
- handlers_info / terminal: mask API keys and SSH passwords as "***" in GET responses; preserve stored secret if "***" sent on update
- terminal: sshpass uses -e + SSHPASS env var (was both -p and -e)
- handlers_chat: MaxBytesReader 50 MB on /api/chat
- image_cache: 10 MB cap per image
- handlers_config: font size <= 72; profile-save unmarshal errors propagated
- handlers_info: /lsp/auto-install ProjectDir restricted to user home
- Shell.jsx: parenthesized resize-condition (operator precedence)
- orchestrator_test: CleanAIResponse capitalization (fixes failing vet)

New features:
- platform: detect OS name (Debian, Ubuntu, Windows 11, macOS X.Y) and inject in Studio system prompt next to the date
- agents: default timeout 30 min for crush_run/claude_run (cap also 30 min)
- agents: new cwd, wsl_distro, wsl_user params; on Windows hosts launch via "wsl -d <distro> -u <user> --cd <cwd> --"
- agents: new claude_run tool (mirror of crush_run for Claude Code CLI)
- terminal: list installed WSL distros individually in new-tab menu (Windows only)
- studio: system prompt rewritten around BMAD-METHOD personas + mandatory delegation template
- studio: "Réflexion avancée" toggle — inactive provider produces a preliminary report injected as [RAPPORT PRÉALABLE] context for the active provider
- studio: "Historique compressé" toggle — collapses past tool calls to last action only, with "Tout afficher" expansion

Muyue merged commit 0d1d8d3ec3 into develop 2026-04-27 09:14:46 +00:00

Muyue referenced this issue from a commit 2026-04-27 09:14:48 +00:00

Merge pull request 'release: v0.6.0 — security audit fixes + 7 new features' (#3) from release/v0.6.0 into develop

Muyue deleted branch release/v0.6.0 2026-04-27 09:14:54 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

Muyue

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Muyue/MuyueWorkspace#3