7187 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Juan Castro	057aa116a4	Merge origin/main into juancastro/put-2251-let-apps-send-notifications-to-their-own-user	2026-10-27 10:44:11 -04:00
Daniel Salazar	1cea1b2a0a	perf(thumbnails): keep read URLs stable within an hour (#4379)	2026-10-26 22:16:54 -07:00
Daniel Salazar	6c78d2f9e9	fix(ui): reject failed desktop IPC requests (#4378)	2026-10-26 22:14:19 -07:00
Daniel Salazar	e8aa12ace5	fix(puter-js): replay requests with fresh body credentials (#4376)	2026-10-26 22:10:24 -07:00
Daniel Salazar	f1964778b4	fix(puter-js): coordinate sign-in callbacks and filesystem sockets (#4375)	2026-10-26 22:09:52 -07:00
Daniel Salazar	c8f7b1ceda	fix(auth): support recovery codes when disabling two-factor auth (#4374)	2026-10-26 22:07:52 -07:00
Daniel Salazar	0411a92f4e	perf(dashboard): share launch-app requests and size recent icons (#4373)	2026-10-26 22:07:33 -07:00
Daniel Salazar	5cfd4d1f53	fix(hosting): honor user-granted subdomain permissions (#4372)	2026-10-26 22:07:04 -07:00
Daniel Salazar	e1a36215f6	fix(sharing): preserve team grants and scope link invalidation (#4371)	2026-10-26 22:06:16 -07:00
Daniel Salazar	6f13b1f457	fix(apps): compare normalized index URLs before update checks (#4370)	2026-10-26 22:05:21 -07:00
Daniel Salazar	996d85148e	fix(fs): remove app data requested during uninstall (#4369)	2026-10-26 22:05:05 -07:00
Daniel Salazar	09da68424e	fix(fs): preserve stored path spelling and app ACL identity (#4368)	2026-10-26 22:04:36 -07:00
Daniel Salazar	7bccde40a8	fix(hosting): use the current authenticated visitor for asset billing (#4364)	2026-10-26 22:04:17 -07:00
Daniel Salazar	cf5d2c60a5	perf(permission): resolve default grants through full-access issuers (#4361)	2026-10-26 22:03:45 -07:00
Daniel Salazar	b7a0276337	fix(fs): preserve paging and file read-copy contracts (#4367)	2026-10-26 22:03:09 -07:00
Daniel Salazar	bbc056cc49	fix(hosting): track trashed roots and cached backing misses (#4363)	2026-10-26 21:58:05 -07:00
Daniel Salazar	e2f6c2ed05	fix(cache): widen tombstone window to 5s (#4381)	2026-10-26 21:42:23 -07:00
Daniel Salazar	745b3a4318	perf(auth): coalesce session activity writes across processes (#4360)	2026-10-26 21:37:54 -07:00
Daniel Salazar	2dfd93687f	perf(database): defer primary fallback for user lookups (#4359)	2026-10-26 21:37:06 -07:00
Daniel Salazar	91554a137e	fix(apps): keep app provenance and permission caches consistent (#4357)	2026-10-26 21:28:40 -07:00
Daniel Salazar	52da7b571c	perf(permission): read a large holder's user-to-user grants per permission (#4349) ... A user-to-user grant check loaded the holder's whole row set, from one Redis blob or one SELECT, and filtered it in JS. Every KV share handle a user receives adds a row, so the cost of each check grew with incoming shares. Holders with up to 200 grants keep the whole-set cache. Past that the cache holds a marker and each check reads only the permissions it names, off a new (holder_user_id, permission) index. Matches stay exact in JS, since MySQL compares `permission` case-insensitively. The batched multi-holder read shares the same chunked query. Migrations: mysql_mig_51, postgres_mig_40, sqlite 0097.	2026-10-26 20:51:46 -07:00
Nariman Jelveh	9e1ccf7ff3	fix(dashboard): ninth adversarial review of Files — bugs, UX, a11y, perf (#4356) ... * fix(dashboard): keep Files keys away from the rows under a publish dialog With Publish as website or Publish as Worker open and focus on one of its buttons, the arrow keys moved the listing's selection behind the dialog, Ctrl/Cmd+A selected every row, and Delete trashed whatever was selected. The Files shortcuts already stood aside for the share and properties modals; they now do for the dashboard dialog overlay too. * fix(dashboard): let type-to-select in Files find names with spaces Typing "my z" to reach "my zebra.txt" stopped at "my notes.txt": the space went to the image preview instead of the name being typed, and the search went on as "myz". A space typed while a name is being typed now belongs to it; on its own, Space still opens and closes the preview. * fix(gui): say so when a rename can't reach the server A rename that failed on the network (offline, connection dropped) put the old name back without a word, so in Files it looked as if the rename had been ignored; only failures the server answered with a message were reported. Every failure is now reported, with the unknown-cause message when there is no other. The rename's own promise was also left to reject unhandled on every failure, conflicts included; the error callback already handles it. * fix(dashboard): show a grid tile's full name on hover A tile name cut short to fit shows in full on hover, but in the grid views the hover never reached it: the badge layer is the size of the whole tile and sat on top of the name. The name now sits above that layer, so its tooltip shows; clicking and dragging by the name behave as before. * fix(dashboard): make the empty-folder notice readable in dark mode "No files in this directory." and "This folder couldn't be opened." were styled inline with no color of their own and inherited the page default, black, which on the dark theme's background could hardly be seen. Both now share a class with the muted text color the Apps tab's empty state uses, in either theme. * fix(dashboard): let a folder be published again once its website is removed Disassociating a folder's website in Properties took the globe badge off its row, but the row's entry still said it had a website: its menu kept Publish as website greyed out, and going into another folder and back brought the badge back. The entry the menu and the listing read is now updated with the row, and the sites cache is refreshed, as publishing does. * fix(dashboard): keep a just-published worker's badge across navigation Publishing a .js file as a worker badged its row, but the row's entry still listed no worker. Going into a folder and back redrew the row from that entry (the folder's cached listing), so the badge went away and the menu offered Publish as Worker again, which would deploy the file a second time. The entry now records the worker, as publishing a website records its site. * fix(dashboard): badge a folder published from inside it once you go up Publishing the folder on screen (from the listing's background menu) and going Up showed its row without the globe badge, and with Publish as website on offer again: the parent's listing came from puter.js's cache, and adding a website sends no fs event to clear it. Removing a website from inside the folder (Properties > Disassociate) left the badge behind the same way. Both now drop the parent folder's cached listing. * fix(dashboard): don't offer a second website for a published folder A folder's own row greys out Publish as website once the folder has a site, but its menu on the sidebar, a breadcrumb or the listing's background kept offering it, and publishing again gave the folder a second address. Those menus now check the user's sites as well. * fix(dashboard): give Files' row menu button a finger-sized target on tablets On a touch screen with room for the full list columns (an iPad in landscape, say), a row's '⋯' was a 20x23px target right beside a row whose tap opens the item, so a near miss opened the file instead of its menu. On touch it now answers across the row's height and 44px wide; phones' two-row layout keeps its 44px square, and mouse pointers are unchanged. * fix(dashboard): keep Files' Back arrow clear of the phone menu button On phones the breadcrumb row was shorter than the fixed menu button beside it, so the button hung over the arrows below, and its enlarged tap area took the top quarter of Back: a tap there opened the menu. The crumb row is now as tall as the button, which also lines the crumbs up with it, and on touch the crumbs themselves get a taller tap target. * fix(dashboard): fit the Files image preview to the image and the listing The Space preview was a strip the full width of the listing whatever the image's size (a 64px icon sat in a card 900px wide), and at 3px from each edge rather than the 20px it was given, its padding coming on top of its width. In a short listing (a phone in landscape) it ran past the bottom of the screen and cut off the file name. The card now wraps the image, stays 20px inside the listing both ways, and shrinks the image to keep the name in view. * fix(dashboard): let the last grid tile scroll clear of the phone footer On a phone with a home indicator (a web app on the home screen, or Safari with its bars collapsed) the Files footer grows by the bottom safe area. The list makes room for that, but the grid views clear the footer with a fixed 30px margin, so the bottom 17px or so of the last tile stayed behind the footer even scrolled to the end. The grids' margin now grows with the footer; select mode already made room for its bar and is unchanged. * fix(dashboard): don't claim a large shared selection is restricted Sharing more than 50 items skips listing who has access, but General access still said "Restricted: only people with access can open these items" without having looked, though some of them may be open to anyone with the link. Choosing Restricted to close them did nothing either, since it was already the selected option. It now says the link access wasn't checked, and either choice applies to every item. * fix(dashboard): don't let "Add to all" lower access on an item it couldn't list Sharing several items lists who has access to each. When one item's listing failed, the person's row counted that item as one they couldn't reach and offered "Add to all", which granted it at the row's mode: someone who could edit that item was quietly brought down to view. "Add to all" now extends a grant only to items whose access was listed. * fix(dashboard): let a click through as soon as a Files dialog closes The share, properties and publish dialogs fade out for 200ms after they close, and while they did, their invisible backdrop still took the pointer: a click on a row right after Escape or Close was lost. The backdrop now takes clicks only while the dialog is showing. * fix(dashboard): don't make a removal under way look cancelled on Escape In the share dialog, Escape on an open "Remove access" confirmation puts the person's row back. Pressed after Remove was clicked, while the request was still out, it did the same: the row came back as if the removal had been called off, and then vanished when it finished. Escape now leaves a removal that is under way alone. * fix(dashboard): keep Share down while a share is on its way Editing the name in the share dialog while a share was still being made enabled the Share button again, so Enter sent a second share alongside the first; the first one's end then took the spinner off while the second was still running, and the two results raced for the status line. The button now stays down until the share in flight is done. * fix(gui): find the web address of files inside a published folder again Files under a folder served as a website carry a link badge and their address on the site. Working that out read `dir_path` and `address` off each of the user's sites, which the hosting list no longer returns, so no file ever had one. In Files the badges publishing just put up were gone at the next listing. The folder and address are now read from the site's root_dir, where the list carries them. * fix(dashboard): show the link badge in the dark list view In dark mode the list view drew a file's link badge (it is served by a published website) as its black glyph on the dark row, where it couldn't be seen. The grid view already gave it a light disc; the list view now draws the glyph light. * fix(dashboard): let Undo take back a paste of something cut from its menu A row menu's Cut puts the item's bare path on the clipboard, where the Files keys and the selection bar put { path, uid }. Pasting it moved the item but recorded nothing for Undo (and didn't point Back/Forward at a moved folder), so Ctrl/Cmd+Z then undid whatever came before, a rename say. A bare path is now taken as an item like the rest. * fix(gui): undo one action per Ctrl/Cmd+Z The Undo shortcut sits in a handler bound to both keydown and keyup, and ran on each: letting Z go before Ctrl/Cmd, as one usually does, undid a second action straight after the first. In Files that could put back a rename or delete an upload the user never meant to touch. It now runs on the key going down only. * fix(dashboard): re-sort and re-icon a Files row renamed elsewhere A file or folder renamed in another tab, on another device or in a desktop window took its new name in the listing but kept the place its old name sorted to, and the icon of its old type (notes.txt renamed to notes.png still showed a text icon). A renamed folder also left Back/Forward on its old path. Such a row is now handled as a rename made in Files is. * fix(dashboard): stop failed and cancelled Files uploads throwing uncaught An upload from Files reports a failure in its progress window, through the error callback, but the upload's promise also rejected with nobody listening, so every failed or cancelled upload logged an uncaught error. It is now handled there.	2026-10-26 17:21:35 -07:00
Filip Kujundžić	8f94514692	feat(ai): add GPT-6.1 Terra to the OpenAI catalog (#4350)	2026-10-26 16:01:44 -07:00
Juan Castro	32b28c1994	Merge origin/main into juancastro/put-2251-let-apps-send-notifications-to-their-own-user	2026-10-26 16:28:48 -04:00
Neal Shah	21625de22e	Merge pull request #4315 from HeyPuter/codex/kimi-k3-1-pro ... Codex/kimi k3 1 pro	2026-10-26 21:01:04 +01:00
Juan Castro	d366861321	Merge origin/main into juancastro/put-2251-let-apps-send-notifications-to-their-own-user	2026-10-26 13:12:23 -04:00
Daniel Salazar	f850155411	KV share handles: hardening, higher limits, batch share, uninstall data deletion, account-deletion cleanup (#4344) ... * fix(kv): sign share handle ids and drop retired handles from every node's cache New handle ids carry a short HMAC (kvh-<uuid>.<mac>); an id whose mac does not verify is refused before any lookup. Unsigned ids keep working but no longer fall back to the primary on a replica miss. Retiring or changing a handle now broadcasts outer.pubsub.kv.share.forget so every node drops its cached row. Event subscribes and delivery rechecks refuse a handle whose owner is suspended, as the driver does. * fix(kv): an app its user removed stops reaching shares An app acting for a user exercises a share grant only while the user still has the app authorized: at least one user-to-app permission row, which every app token path leaves and revoke-user-app '*' removes. The share itself stays; authorizing the app again restores access. The answer rides the permission cache, keyed by the app-under-user generation the revoke bumps, so live subscriptions go quiet too. * feat(kv): list keys through a watch-level share handle list with as: 'keys' through a handle needs only watch, which already learns every key written in the region. Values and entries still need read. * feat(kv): filter share listings by app and by state GET /kv/shares and GET /kv/shares/with-me take an optional appUid: an app uid, or null for the app-less store. An account session may name any app; an app is refused any namespace but its own. GET /kv/shares also takes state=live|revoked|all, all by default. * feat(puter.js): appUid and state options on the KV share listings listShared() and listSharedByMe() pass appUid (null for the app-less store), and listSharedByMe() passes state. Docs cover the new options and that a watch share can list keys without their values. * feat(kv): indexes and store counts for share-handle quotas and retention Adds covering indexes for the owner's live count, the owner-holder pair, app-filtered listings and retired rows, plus store methods to count a pair's live handles and delete rows retired before a cutoff. The live handle cache holds up to 50,000 entries; the miss cache stays at 10,000. * feat(kv): higher share-handle caps, a per-holder cap, and sharing with several recipients Live share handles per account go to 25,000 paid / 5,000 free, and per app to 10,000 / 2,000. One owner may hold out 256 live handles to one holder on every plan, which bounds the rows a revoke or unshare walks. Re-sharing an existing region takes no slot and is never refused. POST /kv/shares takes recipients (1 to 50) as an alternative to recipient: one region, level and label for all. Caps and a new per-recipient grant budget (300/min, 2,000/hour) are checked for the whole batch up front; failures about one recipient are reported on its item. The single-recipient request and response are unchanged and run through the same code path. * feat(kv): delete share handles 30 days after they stop A daily job deletes retired share-handle rows older than 30 days, in batches of 500. One node runs it per day; it stops on shutdown. * feat(puter.js): share a KV prefix with several users in one call puter.kv.share() takes an array of recipients, positionally or as recipients in the options form, and resolves to one item per recipient: the share, or an error with its message and code. The single-recipient forms are unchanged. * feat(kv): delete an app's data on uninstall, and close account-deletion gaps Uninstall: - POST /auth/revoke-user-app takes an optional `deleteData` boolean, only with `permission: '*'` (400 otherwise). AuthService.uninstallApp revokes every grant, deletes the app's worker sessions, then awaits `app.uninstalled` { userId, userUuid, appUid, deleteData }. - With deleteData, KvShareService retires the handles the user shares out of that app's namespace (as the platform, in batches) and then empties the namespace in the background, 5,000 items per step, stopping on shutdown. Handles shared with the user are not touched. - SystemKVStore.purgeNamespace(namespace, { maxItems }) deletes up to maxItems items of one `v1:<uuid>:<appUid>` namespace, reading keys only, with no mutation events or usage, and reports `done` once it is empty. It refuses the system namespace and anything else. flush shares its page-delete path. - puter.perms.revokeApp(appUid, '*', { deleteData: true }); the desktop's uninstall dialog has an unchecked "Also delete this app's data" option. Account deletion: - EventsService settles each of a deleted account's apps on `user.delete` (they cascade without `app.changed`) and drops the owner's subscription keys. - The flat permission entries the account held are purged in pages. Suspension: - `user.suspended` / `user.unsuspended` events; the share-handle store drops cached rows owned by that user here and on other nodes. * fix(permission): await a peer's flat-permission deletes so emitAndWait sees them applied * fix(kv): strongly consistent purge pages, and an uninstall purge stops once the app is authorized again A stale empty page could end a purge as done while items remained. The background purge after an uninstall now checks before each step that the user hasn't authorized the app again, so data written after that is kept. * fix(kv): flush keeps eventually consistent page reads; only a purge reads strongly consistent * fix(user): emit user.suspended and user.unsuspended when the user store changes an account's suspension	2026-10-26 09:43:55 -07:00
Juan Castro	b57fef8c9d	Merge origin/main into juancastro/put-2251-let-apps-send-notifications-to-their-own-user	2026-10-26 11:29:13 -04:00
Reynaldi Chernando	7c0cf6f6a1	docs(fs): drop batch-write fallback notes from puter.fs.upload() (#4332)	2026-10-26 17:25:23 +07:00
Nariman Jelveh	7f93166560	fix(hosting): disconnect the directory when update gets a null root_dir (#4345) ... puter.hosting.update(name, null) sends root_dir: null, which the driver stringified into a lookup for a folder named "null" and rejected, so disassociating a website from a folder's properties always failed.	2026-10-25 23:28:45 -07:00
Nariman Jelveh	21846192d1	feat(dashboard): publish websites and workers from Files in dashboard dialogs (#4342) ... * feat(dashboard): publish websites and workers from Files in dashboard dialogs The Files tab's Publish as website and Publish as Worker actions open dashboard form dialogs instead of desktop windows: the address field shows the domain inline and shapes the typed name into a valid one, workers get a Sandboxed switch, and success shows the live address with copy and open. Published rows get their badges right away. The form dialog gains suffix and switch fields and a shared copy row, which the API token dialog now uses too. The save-account / confirm-email gate before publishing moves to one helper shared by both flows. * fix(gui): ask a just-saved account to confirm its email before publishing Saving a temporary account can leave its email unconfirmed when signup doesn't require confirmation. The publish gate returned right after the save, skipping the confirm-email step the old inline checks still ran. * fix(dashboard): link a published site to the address the server reports The success screen built https://<name>.<hosting domain>, which is wrong on a self-hosted instance serving sites over http. Use the address the create response carries, the one the rest of the GUI shows, and fall back to the built one only when it's missing. * fix(dashboard): dim a suffixed field as one box while the form submits Only the input inside it dimmed, leaving the domain after the name at full contrast while the field was locked. * fix(dashboard): point a taken or reserved publish name at the address field The server's reason showed in the status line, but the field stayed unmarked and focus stayed on Publish, so changing the name took an extra click. Mark the field invalid and focus it for the rejections that mean "pick another name". * fix(dashboard): type into a suffixed field when its suffix is pressed The domain after the name is drawn inside the field's box but was a plain span, so pressing it focused nothing. A press there now focuses the field with the caret at the end, and the suffix shows a text cursor. * chore(dashboard): drop a phone width rule the icon buttons never used The form dialog's phone flex rule sizes these buttons, so the width never applied; touch screens get 44px from the coarse-pointer min-width. * fix(dashboard): read an underscore in a website address as a word break A website name can't hold an underscore, so typing My_Cool Site gave mycool-site. Underscores now become a hyphen, as spaces do; a worker name keeps them. * fix(dashboard): keep the letter when an accented one is typed into a publish address Café became caf: an accented letter isn't a DNS character, so it was dropped whole. The accent comes off and the letter stays. * fix(dashboard): cap a website address at a hostname label's 63 characters The server takes a 64-character subdomain, but DNS caps a label at 63, so the site it publishes can't be reached. The field now stops at 63, as the worker one does. * fix(dashboard): let a publish address finish composing before shaping it The address was reshaped on every input, composing included: a dead key's accent turned into a hyphen before its letter arrived, and IME text was rewritten under the composition. Composed text is now shaped once it's in.	2026-10-25 21:34:39 -07:00
Nariman JelvehandClaude Opus 5.5	b9f0c8601d	fix(dashboard): eighth adversarial review of Files — bugs, UX, a11y, perf (#4330) ... * fix(dashboard): don't preview a file named after an image type, or a failed image Space on a file named "png" (no extension) opened the image preview over a broken image: the type was read from the last dot-separated part of the name, which for an extensionless name is the whole name. It's now read from the extension. A preview whose image URL couldn't be fetched left the previous image up under the newly selected row and raised an unhandled rejection. It now closes instead. * fix(dashboard): sort Files names by number, and break size/date ties by name Names were compared as plain text, so "file10" sorted before "file2" and "dir10" before "dir2". They now compare as a file manager does, with runs of digits by value. Sorting by size or date left rows with the same value (every folder, when sorting by size) in whatever order the server listed them, and a row added afterwards (a new folder, a rename) landed after its equals instead of where a fresh listing would put it. Ties now fall back to the name, in the full sort and in the single-row insert alike. The sort also parsed each trashed item's metadata on every comparison; it now reads each entry's sort key once. * fix(dashboard): ask about "this item" when permanently deleting one Trash item The Delete key and the phone selection bar's Delete Permanently asked "Are you sure you want to permanently delete these items?" for a single item too. One item now gets the single-item question, as from its own menu. The three copies of the confirm-and-delete step (Delete key, selection bar, multi-select menu) are now one. * fix(dashboard): don't let saved column widths squeeze out an auto-width name Saved widths too wide for the listing fall back to the defaults, but only when the Name column had a saved width too. Beside an auto-width name, a Size or Modified column widened on a large screen kept its width on a smaller one and squeezed the names to nothing, with the row scrolling sideways. The check now counts an auto-width name at its 100px minimum. * fix(dashboard): give Files names a phone's full row, not a desktop column width A narrow listing drops the columns for two-row rows, where each name has the row's width. Names were still cut to the Name column's saved width whenever the saved columns happened to fit, so a 120px column set on a desktop cut names to about 100px on a phone with 280px to spare. * fix(fs): refuse to replace a folder that contains the item being moved or copied Moving or copying an item onto a name taken by one of its own parent folders, with overwrite, removed that folder recursively first, and the item went with it. Cutting the inner "photos" out of photos/photos, pasting it next to the outer one and choosing Replace deleted both folders and everything in them. Such an overwrite is now refused before anything is removed. * fix(dashboard): keep the Files selection when an upload lands in another folder An upload into a folder other than the one on screen (a drop on a folder row, a sidebar folder or a crumb, or Upload from a folder's menu) still listed the folder on screen again when it finished. That cleared whatever was selected there and left an open menu acting on rows no longer on the page. Only an upload into the folder on screen refreshes it now. The Upload picker ran its own copy of the upload flow; it now goes through the same one as drops. * fix(dashboard): keep Files rows up while a refresh reads web link and app icons A refresh of the folder on screen keeps its rows until the new listing is in, so it doesn't flash blank. But it cleared them before reading the icons, and a web link's or .app's icon is read from the file over the network, so in such a folder every re-sort, upload or return to the tab blanked the pane for those reads. The icons are now read before the rows are swapped. * fix(dashboard): Ctrl/Cmd-drag a Files selection as a whole Pressing Ctrl (Cmd on a Mac) on a row that was already selected took it out of the selection at once, so a drag starting there collapsed the selection to that one row: a Ctrl-drag of three files to copy them copied one, under a ghost that still read "3". The row now leaves the selection when the button is released without a drag, as in a desktop file manager, and a drag carries the whole selection. * fix(dashboard): let Enter open the row the arrow keys moved to in Files Clicking a sidebar folder, crumb or toolbar button leaves it focused, and the arrow keys and type-to-select still move the row selection from there. Enter, Space and the menu key then went to that focused control: after clicking Documents and pressing Down twice, Enter opened Documents again and dropped the selection instead of opening the highlighted row. The listing now takes the focus when these keys move the selection, so the keys after them act on the rows, and Shift+Tab goes back to the toolbar. * fix(dashboard): let Files' image preview be cancelled while it loads, and close it with the tab The preview only counted as open once its image URL had come back (two round-trips), so nothing could cancel it before then: Escape cleared the selection and the image popped up anyway, a second Space opened it instead of closing it, and opening a folder left the old image to appear over the new one. It now counts as open from the start, so each of those cancels it. Browser Back/Forward to another dashboard tab left the preview floating over that tab, where Escape and Space no longer reach it. A route change away from Files now closes it, as it does Share and Properties. * fix(dashboard): keep Files keys off a new folder until the server has made it A new folder's row goes up with the name editor open before mkdir answers. Clicks and menus already wait on it, but the keyboard didn't: pressing Escape and then Delete on a slow connection sent a move for the row's placeholder and showed "Moving New Folder: Subject does not exist", and Enter opened the predicted path before it existed. Enter, Delete, Ctrl/Cmd+C and Ctrl/Cmd+X now skip such a row, as do Cut and Delete in the multi-select menu and the phone's selection bar. * fix(dashboard): explain a Files action that fails on the network A request that fails at the network level is rejected with no message. New Folder then took its row back with no alert at all, and Restore and the New menu's files showed "[object XMLHttpRequest]". A failed move from the clipboard named the item and nothing else. Each now falls back to "An unknown error occurred." * fix(dashboard): don't offer Trash folders, or view-only shares' crumbs, as Files drop targets Inside the Trash a folder row lit up as a drop target and then refused the drop with an untranslated "Cannot move items into a deleted folder.", and a crumb inside the Trash took the move, though only Restore may take an item out of the Trash. A crumb of a folder shared with the user to view only lit up too, and the drop ended in one refusal per item from the server. Such folders no longer light up, and a drop on one goes back, as a drop on a view-only folder row already did. A view-only crumb still opens on a dwell. * fix(dashboard): count a new folder, not the old selection, in the Files footer New Folder selects the new row, but the footer was updated before that and kept describing what was selected before ("3 items selected"), as did the phone's selection bar, whose buttons by then acted on the new folder. A Shift+click also still extended from the old anchor. The footer now follows the new selection, and the new row is the anchor. * fix(dashboard): update the Files footer when Enter ends a rename Ending a rename with Enter selects the row, and then called the desktop Explorer's footer update, which finds no footer in the dashboard. Renaming a row from its menu while another was selected left the footer at "1 item selected" with two rows selected. * fix(dashboard): stop Files' image preview from running out of read URLs The preview fetched a read URL for every image it showed, and read URLs share the access-token allowance of 20 an hour. Stepping through a folder of images with the arrow keys spent it in seconds, after which the preview (and any app asking for a read URL) failed for the rest of the hour. The preview now reads the image directly and shows it from memory, freed when it closes or moves on, and a held arrow key loads only the image it stops on. * fix(dashboard): don't offer to publish a folder the user may not share from Files' folder menus The background, crumb and sidebar menus offered Publish as Website for any folder, so in a folder shared with the user to view or edit it opened the publish dialog only for the server to refuse. Publishing takes the right sharing does; the item now stays disabled without it, as on a folder row's own menu. * fix(dashboard): open a Files folder under its new name when it's opened mid-rename Double-clicking a folder right after typing its new name (the first click sends the rename) opened it under the old path, which the rename then took away: the view sat in a folder that no longer existed, with crumbs and Back/Forward disagreeing about its name, and New Folder or Upload there failed. Opening a row (double-click, tap, Enter, or Open from its menu) now waits for a rename still on its way, and goes by one path. * fix(dashboard): keep Files' Back/Forward in step with folders moved or trashed Back and Forward kept a folder's old path after it was moved or deleted, here or from elsewhere: going into a folder, back out, and dragging it somewhere else (or deleting it) left Forward leading to "This folder couldn't be opened", with New Folder and Upload gone. History entries now follow a moved folder and what is inside it, and a trashed or deleted one's entries are dropped. * fix(dashboard): keep screen readers from reading Files' icon file names The crumbs' separators, the folder sidebar's icons and every row's icon were images with no alt text, so a screen reader announced each one, by file name in some ("triangle-right.svg"), between every crumb and before every name. They are decorative beside the text they sit next to and are now marked so. The crumb of the folder on screen is marked as the current page. * fix(dashboard): make double-click on a Files column divider fit the column Double-clicking a column divider measured the text in system-ui, but the listing renders in Inter, and took the cells' padding as 8px a side where Size and Modified have 10. Right after "fit to content", the longest name was still cut in the middle and every Modified cell ended in an ellipsis ("40 minutes a…"). Each column is now measured in its cells' own font and padding. * fix(dashboard): keep a renamed item among its sharer's in Files → Shared With Shared sorted by "Shared by", renaming an item shared with the user to edit placed its row by name alone, so it could land among another person's items until the listing was loaded again. A row put back in place now goes by its sharer first there, as the listing does. * fix(dashboard): keep every item, and empty folders' places, in a downloaded zip Downloading several items as one zip keyed each by its name, so two items with the same name (in Files → Shared, two people can each share a "Notes.txt") came out as one file, the other silently gone. Such names now get " (1)" and so on in the zip, as a folder does for a duplicate. Empty folders were put at the top of the zip by their own name, not where they sat: zipping a folder holding x/y gave "y/" next to "x/". They now keep their place. dedupedName moves to helpers/, now that the zip uses it as well. * fix(dashboard): give Files grid tiles both lines of their name A tile has room for two lines of name, but names were cut to fit one: "Quarterly financial report final version.pdf" showed as "Quarterl…l version.pdf" over an empty second line. A name now shows whole when it wraps into the two lines, and is cut in the middle, keeping its extension, only as far as it has to be to fit them. Where the browser wraps a name can't be told from text widths alone, so the tiles are written and read back together, one layout a round rather than one a tile. * fix(dashboard): keep the Files listing when a refresh can't reach the server A refresh of the folder on screen that failed for any reason replaced the listing with "This folder couldn't be opened." and took New Folder and Upload away. Returning to the tab triggers one, so opening a laptop before its Wi-Fi reconnected, or a moment's lost connection during a re-sort, left a folder that was fine looking broken until it was opened again. A refresh that doesn't reach the server now leaves the rows as they are; one the server answers with an error (the folder is gone) still says so. * fix(dashboard): don't drop files added to a Files folder while a new folder is made While New Folder (or New › file) waited for the server, every item added to the folder on screen was dropped, not only the one being made, so a file uploaded from another tab or device in that moment didn't show up until the folder was listed again. Such items are now held until the create is done and added then; the create's own comes through as an update of the row already drawn for it. * perf(dashboard): refresh Files on return to the browser tab only when Files is showing Coming back to the browser tab listed the Files folder again even with another dashboard tab in front, and in Files → Shared that meant every share all over again. The refresh now waits until Files is next shown. * fix(dashboard): move the keyboard focus off a Files arrow that disables itself Pressing Enter on Back to reach the first folder disables Back while it has the focus, and a disabled arrow is drawn at 10% opacity, focus ring included, so the keyboard user lost track of where they were. The focus now moves on to an arrow that still works, or to the listing. * fix(dashboard): show "can't drop here" when dragging files from the computer where Files takes none Files dragged in from the computer showed the copy pointer everywhere in Files, then dropping on the Trash, in Shared, on a folder shared to view only, or while a folder was loading did nothing. The pointer now shows the drop isn't possible there. * fix(dashboard): let Files' type-to-select find names with "i" in a Turkish browser Typed letters were lower-cased for the browser's language and the names they're matched against without one. In Turkish, "I" lower-cases to "ı", so typing it never reached "Invoices". Both are now lower-cased alike. * fix(dashboard): bring Files' Back/Forward along when a folder rename is undone Renaming a folder points Back and Forward at its new name, but undoing the rename left them there: Forward then led to "This folder couldn't be opened" for a name the folder no longer had. Undo now takes them back to the old name too. * fix(dashboard): don't shrink Files → Shared's name column when it's dragged wider In a narrow Shared listing, "Shared by" is laid out narrower beside a name column with no set width. Dragging the name's divider gave it a width, at which "Shared by" sprang back to its own and pushed the name narrower than it started: dragging right made it 30px smaller, and there it stuck. Sizing the name now keeps "Shared by" at the width it had on screen. * docs(fs): note that move and copy never overwrite a folder holding the source * fix(dashboard): keep the Files drop zone after files dragged in cross a folder row Leaving a folder row while dragging files in from the computer also took the highlight off the listing around it, as the row's notice bubbled up to the listing's own. With the "can't drop here" pointer going by that highlight, a drop on the listing after crossing a folder row was refused. The row's notices stay with the row, and the listing goes by whether the folder takes uploads. * fix(dashboard): don't let a Files folder wait for ever on a rename to open Opening a row waits for a rename on its way, which settles in the last step of the rename's handling. A failure after the rename itself (such as refreshing the folder's websites) never got there, and the folder then wouldn't open until it was listed again. Opening waits five seconds at most. * docs(fs): drop the note on overwriting a folder that holds the source The refusal is an edge case, and its error message already explains it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 18:59:24 -07:00
Daniel Salazar	24aac2f6d2	fix: app token (#4338)	2026-10-25 11:50:25 -07:00
Daniel Salazar	1eb4e36cf4	fix: add beta flag to kv share docs to match kvhandle beta status (#4337)	2026-10-25 09:17:12 -07:00
Daniel Salazar	3160b99f11	chore: bump ver (#4335) 26.10.1	2026-10-25 08:24:40 -07:00
Daniel Salazar	589a98b12c	feat(kv): share KV prefixes with other users at watch/read/write, and bound what apps can be granted (#4331) ... * feat(kv): share key-value prefixes with other users, and bound what apps can be granted - KV share handles move out of Events into KvShareService, served at /kv/shares (the /events/kv-handles routes stay as an alias). - Shares have watch, read and write levels, encoded in the permission root (kv-share, kv-share-read, kv-share-write) with write implying read and watch. - Every puter.kv method takes optConfig.handle; keys are relative to the shared prefix, cursors are sealed, and private entries stay hidden. - New puter.kv.share, unshare, listShared and listSharedByMe; optional label; kv.share.received notice in the app's mailbox only; recipient blocks apply. - puter.kv.set gains onlyIfAbsent. - fs and kv events gain viaWorker, and kv events report self from the writer. - /auth/grant-user-app only accepts canonical permissions from a fixed set of families; the consent dialog, puter.perms and docs follow. - Migrations: kv_share_handles gains revoked_by, label, and grantee and app indexes (mysql_mig_49, postgres_mig_38, sqlite 0095). * fix(kv): never name a private key in a cross-app or handle cursor, and bound flat-permission scans - Listings of another namespace (cross-app or through a handle) resume after the last entry they returned, and their cursors are sealed, bound to the namespace or handle, and padded to one length. Old plain cross-app cursors are still read when they name the target namespace; other namespaces get 400. - PermissionStore scans flat permissions a few roots at a time and skips roots nested under another root in the same call.	2026-10-25 08:16:19 -07:00
Toshit ChawdaandReynaldi Chernando	ec3ad1cb2f	docs: easy/medium/hard networking recipes (#4040) ... * add net category + http request recipes * add tcp/tls socket recipes * add complex recipes * minor refine --------- Co-authored-by: Reynaldi Chernando <reynaldichernando@gmail.com>	2026-10-25 19:22:45 +07:00
Reynaldi ChernandoandDaniel Salazar	c7cc64e45c	docs: medium events recipes (PUT-1971) (#4333) ... * docs: easy events recipe (PUT-1961) * docs: catch-up-on-notifications events recipe (PUT-1961) * docs: events recipe corrections from a run against a live server (PUT-1961) * docs: medium events recipes (PUT-1971) * docs: simpler wording in medium events recipes (PUT-1971) * refine --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-25 19:18:55 +07:00
Nariman Jelveh	0c67499dc2	fix(dashboard): serve stale profile pictures to every caller, skip detached roots ... While a picture refreshed after its TTL, only the first caller got the stale answer; every later one waited on the network, so in Files → Shared one row showed the picture at once and the rest fell back to initials. paintAvatars now also folds a frame's roots into one pass and skips roots re-rendered away before the frame, so they fire no lookups.	2026-10-24 19:05:54 -07:00
Nariman Jelveh	34d74d36bd	feat(dashboard): show profile pictures on people avatars (#4328) ... * feat(dashboard): show profile pictures on people avatars Avatars that name a person now show that person's profile picture once it loads, and keep the initial-and-color avatar when there is none: - Files → Shared: the "Shared by" cell and the people filter chips. - Share dialog: the owner row and each person with access. Teams, invited emails and link shares keep their initial. - Properties: a new Owner row with avatar for items someone else owns, and avatars beside each version's author. Lookups go through one cache: each person is looked up once and shared by every avatar of theirs, answers (including "no picture") are kept for five minutes, at most 100 are kept, and at most four run at once. Calls made while a listing renders row by row fold into one pass per frame. The signed-in user's own picture is read from their loaded profile, so it takes no request and follows changes in the Account tab. The picture is set as an image's src property, never through markup. * fix(dashboard): profile picture review — stale refresh, picker avatars, limiter - Serve a stale picture while a fresh one loads, so a listing re-rendered after the cache expires no longer drops everyone back to initials. - Show pictures on people in the share recipient suggestions, matching the rows of the dialog they open from. - Free a lookup slot when a lookup throws before returning a promise. - Move profilePictures.js to helpers/, now that a shared helper uses it.	2026-10-24 19:01:05 -07:00
Nariman Jelveh	0bdc2197b0	feat(dashboard): show who shared each item in Files → Shared (#4327) ... * feat(dashboard): show who shared each item in the Files tab's Shared view The Shared view now names the person behind every item: - List view gets a sortable, resizable "Shared by" column with the share modal's initial-and-color avatar. The tooltip names the owner too when someone else re-shared the item. - Grid tiles show the sharer under the item name. - Narrow listings lead each row's second line with the sharer. - A people filter above the listing (one chip per sharer, with counts) narrows the view to one person. It shows once two or more people have shared something, and scrolls sideways on small screens. Sorting by "Shared by" applies only in the Shared view; other folders keep sorting by name while it is the saved sort. * fix(dashboard): keep the name column readable beside "Shared by" In a listing between the phone layout and about 700px wide, the fixed 160px "Shared by" column squeezed an auto-width name down to a few characters. Beside an auto-width name, "Shared by" now takes at most 40% of the room the two split, and resizing it stops at the same width. * fix(dashboard): keep the "Shared by" header on one line Narrowed, its two-word label wrapped onto a second line that spilled out of the 32px header row. It now stays on one line and ends in an ellipsis, as longer translations need too. * fix(dashboard): fit "Shared by" to its longest name on double-click Auto-fitting the column measured names in a font the cell doesn't use and left out part of its padding, so the longest name still ended in an ellipsis. It now reads the font, padding, avatar and gap off a rendered cell. * fix(dashboard): keep the people filter on coming back to Shared Opening a folder from a filtered Shared view and going Back reset the filter to Everyone, so going through one person's folders meant picking them again each time. The filter now lasts while the user browses what was shared with them, and clears once they go back to their own files. * fix(dashboard): update Shared after Remove from Shared Remove from Shared only took the row away, leaving the people filter counting the item. Removing the last item of the person filtered to left a blank pane under a chip that still claimed one. Shared is now listed again afterwards, which updates the filter, the empty notice and the footer. * fix(dashboard): show a notified share past the people filter Opening a "shared with you" notification, or a share link, while Shared was filtered to someone else picked out nothing: the item was filtered away. The filter now gives way to everyone's when it hides an item the notification or link names. * fix(dashboard): truncate a long sharer name on phone-width rows In the two-line row layout, a long username grew the details line past the row, pushing the date off screen and under the ⋯ button. The name now ends in an ellipsis, and the line keeps clear of the button as the name line does. * perf(dashboard): sort the Shared view by sharer with one collator Each sharer comparison called localeCompare with options, which builds a collator per call: sorting 2,000 rows took about 25ms in Chrome. One shared Intl.Collator orders them the same in under 1ms. * fix(dashboard): make share avatar initials readable for every name The initial-and-color avatar drew its letter at too little contrast for nearly half the hues a username can map to: yellows and greens came out near 3:1 in light mode, and lower still on a selected row. The letter is now darker in light mode and lighter in dark mode, reaching 4.5:1 for every hue on the page, selected rows and the share suggestions' hover row. The share dialog and the Shared listing change together, so a person keeps one look. * fix(dashboard): show every folder when a drag springs into Shared Dragging an item out of a shared folder and holding it over Up, Back or the Shared crumb opens Shared to drop into a folder there. The people filter, which now lasts while browsing shared items, could hide those folders, and its chips can't be pressed mid-drag. A drag arriving in Shared now sees everyone's folders. * fix(dashboard): keep filtering Shared when it can't be listed again A chip click lists Shared again so its rows are current. When that request failed, the listing was replaced with "This folder couldn't be opened" and the chips disappeared, though only a filter had changed. A filter change now applies to the rows already loaded when the listing can't be fetched. * fix(dashboard): return a drag let go over Shared to where it began A drag that springs into Shared and is let go over the listing rather than a folder tried to move the items into Shared itself, which is a query and not a folder: nothing moved, nothing said so, and the user was left in Shared. Let go over a listing that takes no items, the drag now goes back to the folder it started in, as the cancel zone does. * fix(dashboard): don't offer read-only shared folders as drop targets Folders shared read-only lit up under a drag and took the drop, which the server then refused with "Forbidden". They no longer light up, and a drop on one sends the drag back where it began; they still open on a dwell. * fix(dashboard): slide a drag back when a read-only folder refuses it A drop a read-only shared folder refused left the drag chip to vanish where it was let go, as if something had happened. It now slides back to where the drag began, as any drop that doesn't land does.	2026-10-24 18:10:27 -07:00
Nariman Jelveh	7759f7afe9	fix(dashboard): seventh adversarial review — bugs, UX, a11y, perf (#4326) ... * fix(dashboard): show notification times in Brazilian Portuguese, Ukrainian and Traditional Chinese The notification panel and toasts handed Puter's language code straight to Intl, and a few of those codes aren't BCP 47 tags. Brazilian Portuguese (`br`) is Breton to Intl, so times read "5 munut zo"; Ukrainian (`ua`) fell back to the browser's default language; and `zhtw` threw, so Taiwan users got English. Those codes are now mapped to pt-BR, uk and zh-TW before formatting. * fix(dashboard): count "yesterday" and "N days ago" in calendar days Notification times rounded the elapsed hours to whole days, so at 23:30 something from 00:45 the same day read "yesterday", and on Wednesday morning something from Monday night (34 hours earlier) read "yesterday" too. Days are now counted from midnight to midnight in the reader's time zone; anything from today stays in hours. * fix(dashboard): don't let deploy results crowd notifications out of the panel The panel listed the 30 newest notification rows and then dropped the ones it never shows, a worker's deploy results among them. A developer with 30 deploys since their last share saw "No notifications" and no badge while the share sat behind them. The listing now asks for up to 200 rows and keeps the newest 30 the panel shows. * fix(dashboard): keep every unread notification in the panel The socket replays up to 200 unread notifications on connect, but the panel's listing held only the 30 newest, and the first refresh after that dropped the rest: 45 unread read "45" until the panel was opened, then "30", and "Mark all as read" left the other 15 unread on the server for the next visit. The panel now keeps unread notifications past the newest 30, up to the 200 a listing returns. * fix(dashboard): let Undo take back a new Files folder or file The Files tab creates folders and New › files itself rather than through the desktop's helpers, and never recorded them for Undo. Undo then reversed whatever came before: upload notes.txt, create a folder, press Ctrl+Z, and notes.txt was deleted for good (undoing an upload deletes it outright, not to Trash) while the new folder stayed. Both now record themselves, so Undo removes what was just created, as on the desktop. * fix(dashboard): let Undo take back a Files cut and paste Pasting cut items in the Files tab moves them itself rather than through the desktop's move_items, and recorded nothing for Undo. Undo after a paste reversed the action before it instead, which deletes an upload for good. The paste now records the move as move_items does, so Undo puts the items back where they were cut from. * fix(dashboard): don't drop a Files selection onto one of its own folders With folders A and B selected, dragging A onto B moved A into B and then stopped on "Cannot move a directory into itself" for B. Hovering B also sprang it open mid-drag. A folder row that is part of the drag is no longer a drop target, so the drag reverts as it does over any other non-target. A drop elsewhere (a sidebar folder, say) also leaves out the target folder itself and any folder that holds it. * fix(dashboard): don't drop a Files refresh asked for during another A refresh of the folder on screen was ignored while another refresh of it was loading. Drop two files: when the second finished during the first's refresh, its own refresh was dropped, the earlier listing (read before the file existed) was drawn, and the file's item.added was ignored meanwhile too, so it stayed missing until a manual refresh. Paste, Refresh and returning to the browser tab could lose items the same way. A refresh now takes over from one in flight, as opening another folder already did; a navigation in progress still holds. * fix(dashboard): keep the phone selection bar after cancelling a delete In select mode on a phone, tapping Delete permanently and then Cancel left every item selected but hid the floating action bar, the only way to act on the selection, until the selection next changed. The same happened when nothing in the selection could be moved to Trash. The bar now goes away only once something is actually deleted or trashed. * fix(dashboard): show the phone selection bar when Select starts with a selection Uploaded or pasted items arrive selected. Tapping Select on a phone then turned select mode on with them selected but no floating action bar, until a row was toggled. Entering select mode now brings the bar up for the selection it starts with. * fix(dashboard): give Files footer sizes in the rows' format The footer used the desktop's byte formatter while the rows use their own, so a 5-byte file read "5 B" in its row and "5.00 Bytes" below it, 1.5 KB read "1.50 KB", and a folder of folders read "0 Byte". The footer now formats sizes as the rows do. * fix(dashboard): title a trashed folder's Properties with its name Properties from the breadcrumb of a folder opened inside Trash was titled with the folder's uid, the last segment of its trashed path, while the crumb itself showed the original name. It now uses that name. * fix(dashboard): show delete and log-out confirmations without entities The Files tab's "delete these items permanently?" confirmation and the dashboard's "close your apps and log out?" one passed HTML-encoded i18n strings to UIAlert, which encodes its message and button labels again. In Igbo both questions read "Ị ji n&#039;aka …". These alerts, and the Files tab's name-conflict and folder-depth ones, now pass plain strings. * fix(gui): read the Trash's state fresh when updating its icon refresh_trash_state stats the Trash to pick the empty or full icon, and its comment calls for a strong read, but it asked for an eventual one. Once a listing of Home had cached the Trash entry (without `is_empty`), the stat came back without it: permanently deleting the last items from Trash in Files left the full-Trash icon up, and other tabs were told the same. The stat is now strong, as intended. * fix(dashboard): don't add a Files row to a folder opened meanwhile A file added from elsewhere (an upload, another tab, an app) is checked against the folder on screen and then drawn once its icon resolves. A web link's or app's icon is read from the file, and opening another folder during that read put the row into the new folder's listing, where it stayed and opened the file from the old one. The checks now run again once the icon is in. * fix(dashboard): let a focused folder or crumb take the Menu key The Files tab answered the Menu key and Shift+F10 with the selection's menu wherever focus was. With a file selected and a sidebar folder, a breadcrumb or Home's Shared row focused, the key opened the file's menu; with nothing selected it cancelled the browser's contextmenu, so the focused element opened none. A focused control now gets the browser's contextmenu event, and its own menu, as with a right-click. * fix(dashboard): don't drop New Folder during a Files refresh New Folder did nothing while the folder on screen was refreshing (after an upload or paste, or on returning to the browser tab). A refresh keeps the rows up with no spinner, so the click just looked ignored. It now takes over the refresh and makes the folder once the listing is in; during a navigation to another folder it is still dropped, as before. * fix(dashboard): step through Files names on a repeated letter Type-to-select meant to move past the selected row to the next name with the same start, but returned early whenever the selected row matched, so the stepping never ran: with readme, report-a and report-b, pressing "r" again stayed on readme, and "rr" matched nothing. A repeated letter now steps through the names it starts, wrapping around, as file managers do; a longer prefix still stays on a selected row it matches. * fix(dashboard): open one touch menu per long-press A long-press on Android fires both contextmenu and taphold. The Files rows already ignore the second, but a breadcrumb, a sidebar folder, Home's Shared and Trash rows and the listing's empty space each opened a second sheet over the first; picking an item or tapping the backdrop then left the other one up. The touch menu now doesn't open while another is on screen. * fix(dashboard): treat Ctrl+click on a Mac as a right-click in Files On a Mac, Ctrl+click opens the context menu, but the Files rows read it as a Ctrl-toggle first: Ctrl+clicking one of three selected files deselected it and the menu then acted on that file alone, and on an unselected file it was added to the selection. On a Mac it now leaves the selection alone, as a right-click does; Cmd+click still toggles. * fix(dashboard): keep arrow keys in the open phone drawer on Apps With the drawer open over the Apps tab, an arrow key moved focus out of it to the first app tile behind the scrim, and the next Tab then walked the page behind it. The open drawer now keeps the arrow keys, as the notifications panel and dialogs already do. * fix(dashboard): act once on a held Enter or Space in Apps Holding Enter on an Apps folder opened it, moved focus to its first app, and the key's repeats then launched that app; held on the "+" tile, the repeats picked "Browse the App Center" in the dialog it opened, and held in the search box they launched the first match again and again. Key repeats now do nothing on a tile, in the search box or on the add-app dialog's options. * fix(dashboard): don't blank the Apps grid when it re-flows on resize When a resize changed how many columns or rows fit (resizing the window, collapsing the sidebar, zooming, an Android keyboard), the grid was rebuilt behind the first load's fade, which waits on page one's icons. With an icon host that was slow or unreachable the grid went blank for up to 1.5s each time. A grid already on screen now re-flows at once; one still loading keeps its fade. * fix(dashboard): open an app from the add-app dialog at once during a search "Browse the App Center" and "Build with AI" play an intro from the app's tile, and wait up to 3s for that tile to appear. With a search that leaves the app out (the case the "+" tile stays for: a search that found nothing), the tile never appears, so the app opened only after the full 3s. The intro now gives up as soon as the search is what hides the tile, and the app opens straight away. * fix(dashboard): make the Apps search's clear control a button The "×" that clears the Apps search was a bare SVG with a click handler: Tab couldn't reach it, screen readers had nothing to announce, and on a phone it was a 16px target inside the field. It is now a labelled button after the field in the Tab order, with a focus ring, and on touch it hit-tests at 44x44 while keeping its look. * fix(dashboard): tell screen readers when an Apps search finds nothing Typing in the Apps search re-renders the grid silently, and the "No apps match your search" line is drawn into it fresh each time, which screen readers don't announce. A search that matched nothing gave no feedback at all. A persistent status region now says so. * fix(dashboard): keep keyboard focus on an Apps tile across a re-render The grid is rebuilt wholesale whenever its data or size changes: the refresh that follows opening the tab, a resize or zoom that changes how many columns fit, an uninstall that fails. A keyboard user who had arrowed onto a tile lost focus to <body>, so Enter did nothing and the next arrow started over from the first tile. Focus now moves to the same app's or folder's new tile. * fix(dashboard): don't offer Change username to a temporary account A temporary account's Account tab offered Change username, whose dialog asks for an account password the account doesn't have: left empty it said "All fields are required", and anything typed got a 403 from the server, which refuses temporary accounts. The button is now left out until the account is saved, as the Password card already is; saving it re-renders the tab with the button. * fix(dashboard): don't offer Change email to a team seat A team seat's Account tab offered Change email, and after the user filled in the new address and their password the server refused it: "Your team set this address. Ask a team admin to change it." The Email card now shows that note in place of the button, as the Username card already does for seats. * fix(dashboard): don't let a slow picture removal undo a newer picture Saving a profile picture is ordered so an older save can't put its picture back over a newer one, but Remove picture stood outside that order. Clicking Remove on a slow connection and then saving a new photo before the removal answered left the default avatar on screen, and Remove hidden, while the account had the new photo. A removal now yields to a picture saved after it. * fix(dashboard): show placeholders in the Usage headers until they load The Storage and Resources headers started out as " · used of " with the numbers left blank, and stayed that way when reading the storage space or the month's usage failed. They now start at "--% · -- used of --", as Home's cards start at "--", and keep that if the read fails. * fix(dashboard): write Home's trial dates in the dashboard's language The free-trial note on Home formats its dates with the browser's language, not the one chosen in Puter, so with Puter in French and the browser in English it read "…le Mar 5", and the other way round "First charge on 5 mars". The dates now follow the dashboard's language. The notification panel's mapping of Puter's language codes to Intl tags (Brazilian Portuguese, Ukrainian, Traditional Chinese) moves to i18n/intlLocale.js so both use it. * fix(dashboard): write credit and dollar amounts in the dashboard's language Credits were always formatted with English separators and dollar amounts with "$" and English separators, so in German Home read "5,000 monatliche Credits", which a German reader takes as five, and Usage showed "2.5" and "$1,234.50". Both now use the dashboard's language ("5.000", "2,5", "1.234,50 $"); English is unchanged. * fix(dashboard): say why Create token is off where everyone can read it When the account's email isn't confirmed, Create token is disabled and the reason ("Verify your email address to create an API token.") lived only in a hover tooltip: a disabled button isn't reachable by Tab, a phone has no hover, and screen readers don't read a plain span's title, so those users met a dead button with no explanation. The reason now replaces the card's description while the button is off. The tooltip, which encoded the already-encoded text again, now uses it as is. * fix(dashboard): announce that a new API token is shown only once After a token was created, focus moved to Done and a screen reader read "Done, button" and nothing else: the done state arrives already filled in a status region, which isn't announced, and Done is described by the message only for plain-text results. The token dialog's warning ("Copy this token now — it won't be shown again…") now describes Done, so it is read out when focus lands there. * fix(dashboard): show an email change confirmed in another tab Confirming a change of email from its link sets the new address and marks it confirmed, but sends no socket event, unlike confirming a code. Back in the dashboard the user was re-read on returning to the browser tab, yet nothing redrew: Account kept the old address under the username, Create token stayed disabled and Security had no 2FA card until a reload. Account and Security now redraw after that re-read when the address or its confirmation changed. * fix(dashboard): close the share dialog after leaving a share Someone the owner let share could remove their own row in the share dialog to leave. The removal went through, but the dialog then reloaded its access list with the access just given up: the server refused it, the success line gave way to "Subject does not exist" over an empty list, and the item stayed in the Shared view until a reload. Leaving now closes the dialog and refreshes the folder on screen, which drops the item, as "Remove from Shared" does. * fix(dashboard): say the access list couldn't load, not that sharing failed When the share dialog couldn't read who has access (a network error, which carries no message of its own), it said "Could not share this item." though nothing had been shared or attempted. It now says "Could not load who has access." * fix(dashboard): don't pull focus back after a share change saves When a change in the share dialog finished saving (a level change, Add to all, a removal, a share), focus was put back on that row's control or the add field, wherever the user had gone meanwhile. Someone who changed a person's level and then started typing a name had the next keystrokes land on that person's level select, where a matching letter picked another level and granted it. Focus now goes back only when the save took it away; focus the user moved elsewhere stays there. * refactor(gui): move the localized time formatting to i18n/formatTime.js formatRelativeTime and formatAbsoluteTime lived in the notification center's module; Files and Properties are about to use them too. * fix(dashboard): write Files and Properties dates in the dashboard's language The Files tab's Modified column and Properties' Modified, Created and version times came from timeago, which has no language but English registered, so a German dashboard read "3 hours ago" beside "Geändert". They now use the same localized formatter as the notification panel ("vor 3 Stunden"), which also gives a date past a week rather than "3 weeks ago". Its formatters are now made once per language, since a listing formats one date per row. * fix(dashboard): style the Usage table's Show less button in dark mode The button's dark variant was written for an `html.dark-mode` class that nothing sets, so in dark mode it kept its light look: grey text at 3.4:1 on the dark card, a light border, and a light chip on hover. Its rules move under prefers-color-scheme, as the table's fade overlay already did. * fix(dashboard): show the Files breadcrumb separators in dark mode The chevrons between breadcrumbs are a black stroke at 20% opacity, which vanishes on the dark header: a nested folder read "Home Documents Work" with nothing between the names. In dark mode they are now inverted, like the toolbar's icons. * fix(dashboard): show the website-link badge on dark Files tiles In grid view a file inside a published folder carries a link badge: a black glyph on a disc of the page's background color. In dark mode that is black on near-black and can't be seen. The badge now gets the white disc the shortcut and worker badges already have. * fix(dashboard): skip disabled Back, Forward and Up when tabbing in Files The Files header's arrows stayed in the Tab order while disabled, drawn at 10% opacity, which takes their focus ring with them. Tabbing into Files, the first two stops (Back and Forward, disabled on arrival) looked like nothing had focus. A disabled arrow now leaves the Tab order, as a disabled button does, and returns once it can be used. * fix(dashboard): give the Delete account button an AA-contrast red The Account tab's Delete account button used the desktop's danger red (#f00808), which puts its white label at 4.4:1, under the 4.5:1 that WCAG AA asks of text. It now uses the dashboard dialogs' danger red (#d90707, 5.3:1) and their darker hover, so the two match. * fix(dashboard): label collapsed sidebar items for keyboard users too With the sidebar collapsed, each item shows only its icon, and its name appeared in a tooltip on mouse hover alone. Tabbing through the sidebar showed a row of icons with no names. The tooltip now also shows while an item has keyboard focus. * fix(dashboard): keep Share and Properties inside the visible screen Both dialogs capped their height at 85vh (88vh as phone sheets), and vh is the viewport with the browser's bars hidden. With the bars showing, on a phone in landscape say, the card plus the overlay's padding was taller than the screen, and the overlay centers without scrolling: the title and the buttons were cut off with no way to reach them. Each card is now also held within its overlay, as the dashboard's dialogs are, and its body scrolls instead. * fix(dashboard): outline the off state of the 2FA switch Off, the switch was a light grey track (#e0e0e0) with a white thumb, 1.3:1 against a white card and 1.2:1 against the amber card the 2FA toggle sits on while 2FA is off, so the control could barely be seen where it matters most. WCAG asks 3:1 for a control's boundary. The off track now carries a 1px slate outline (4.3:1 on the amber card); the on state is unchanged. * fix(dashboard): make the keyboard focus ring visible on sidebar, tiles and lists The sidebar items, the Files folders, crumbs and arrows, the app tiles, Home's cards and recent apps, the notification rows and the Usage sort buttons show keyboard focus with a 2px outline and nothing else, drawn in --select-ring: the selection color at 40% (50% dark), about 1.6:1 against the surfaces it sits on. Keyboard users could hardly tell where focus was; a focus indicator needs 3:1. Those outlines now use the solid selection color (3.7:1 on white), as the switch and pager dots already do. Field halos, which come with a colored border, are unchanged. * fix(dashboard): bring text in the selection blue up to AA contrast The selection blue is 3.7:1 against white, and a few places set text in it or white text on it, under the 4.5:1 that text needs: the active folder in the Files sidebar, the share dialog's "Add to all" link, the add-app dialog's Send button, the notification count badge, the drag count badge, and a breadcrumb whose menu is open. They now use the same hue darkened to 45% (5.3:1; a lighter one for text in dark mode), from two new tokens, --select-text and --select-fill. * fix(dashboard): give the Apps page dots a 24px touch target The Apps pager's dots, and a folder's, are 17px buttons side by side, under the 24px a target needs when it has neighbors, so on a phone or tablet a tap meant for one page often opened the next. On a touch screen each dot is now 24px around the same 7px dot; mouse layouts are unchanged. * fix(dashboard): return from a drag-opened folder while it is still loading Hovering a dragged file over a folder springs it open. Cancelling the drag (Escape, the Cancel zone, or a drop outside the listing) is meant to go back where the drag started, but while the sprung folder was still loading the return was dropped like any navigation during another, and the user was left in the folder they had backed out of. The return now takes over from that load. * fix(dashboard): drop into a drag-opened folder while it is still loading When a dragged file springs a folder open, the drop anywhere in the listing moves it into the folder now shown. Until that folder's listing arrived, though, the Files tab still counted the folder the drag left as the one on screen, so a drop in that time was taken as a move to where the file already was and did nothing. It now goes to the folder being opened. * fix(dashboard): say "Incorrect password" when the account password is wrong The account dialogs showed the server's message as is. A wrong current password in Change password read "Password mismatch", in English in every language, beside a dialog that says "New Password and Confirm New Password do not match" when those two differ, so users corrected the wrong fields. A wrong code read "Incorrect code." and too many attempts "Too many requests.", also always in English. These now show the translated messages the GUI already has, and a wrong password puts the status on the password field, focused for retyping. * fix(dashboard): don't send an account change to the value it already has Change username with the account's own name got "This username is already taken." and used up one of the hour's password attempts. Change email with the current address was accepted: it mailed a confirmation and a change notice to the same inbox, and following the link unlinked any sign-in provider. Change password to the current password signed out every other session and mailed a "password changed" notice. Each dialog now says the value is already the account's and sends nothing. * fix(dashboard): ask for the new password after a provider-only account sets one An account that signs in only through a linked provider can set a password with Change password, after which the server treats it as a password account. This session's copy still said provider-only, so Change username, Change email and Delete account went on hiding the password field and sending the user through the provider's popup until a reload. The copy now changes with the password. * fix(dashboard): let Escape cancel a session rename without closing Manage sessions In Manage sessions (Security), Escape in a session's rename field cancelled the rename and then closed the whole modal, and Escape in the search box closed it too, search and all. Escape now cancels the rename or empties the search, and only an Escape with neither closes the modal. * fix(dashboard): show the server's message when a session can't be revoked Manage sessions put a refused request's raw response body in its alert, so revoking a session already signed out from another tab read {"message":"Session not found","code":"not_found"}, and the stale row stayed listed; a failed rename and "Revoke all other sessions" did the same. The alerts now show the message itself, and a session found gone reloads the list. * fix(dashboard): show 2FA as it is when its dialog closes without success The Security tab's 2FA toggle assumed nothing had changed whenever its dialog closed without success. With 2FA turned on in another tab, the setup here refused ("2FA is already enabled."), the toggle went back to off, and every retry got the same refusal, with Disable never offered; a code accepted just as the user closed the setup dialog left the same state. The tab now re-reads the account and shows its real 2FA state. * fix(gui): leave Ctrl/Cmd+Z to the text field being typed in Ctrl/Cmd+Z ran the file Undo wherever focus was, and cancelled the field's own text undo. Typing a new name (F2) or anything in another field and pressing it undid the last file action instead; when that was an upload, the uploaded file was deleted for good. Undo now leaves text fields alone. * fix(gui): let Escape on a context menu close only the menu Escape removed any open context menu and then went on to the Files tab's own Escape handling, which, finding no menu left, cleared the selection and closed the image preview. Select three files, open their menu, press Escape: the menu closed and the selection was gone. When Escape closes a menu, nothing else now acts on it; a second Escape clears the selection as before. * fix(dashboard): close the Files image preview when an app opens over it The image preview sits above every window, and only a double-click closed it on the way to an app. Opening the image with Enter, or with Open or Open With from its menu, started the app underneath the preview, which went on covering it while keyboard focus moved into the app, so Space and Escape no longer reached the preview. It now closes whenever an app window comes on screen. * fix(dashboard): close the Files image preview when its file goes away Deleting the previewed image (the Delete key, the menu, the phone selection bar), moving it, or having it removed from another tab took its row out of the listing but left the preview up, still showing the image. The preview now closes with its row; a refresh of the folder, which redraws the row, keeps it. * fix(dashboard): download one selected file as itself from the phone selection bar In select mode, the floating bar's Download zipped whatever was selected, so a single photo arrived as "photo.jpg.zip" where its own menu's Download gives "photo.jpg". One selected file now downloads as itself; folders and several items are still zipped. * fix(dashboard): don't offer New Folder, Upload or Paste in a view-only share Inside a folder shared with the user to view only, the Files tab still showed New Folder and Upload, offered New and Paste in its menu, and took files dropped on the listing or on a folder in it; each then failed: an upload window ending in an error, or a new folder row with its name field open, then taken back with a Forbidden alert. Those are now left out there, as in Trash. A share whose level isn't known yet stays as before, the server deciding. * fix(dashboard): move through Files with Home, End, Page Up and Page Down The Files listing took the arrow keys but not Home, End, Page Up or Page Down, and as the listing itself never has focus the browser didn't scroll it on them either: in a folder of hundreds of items the keyboard could only step through them one row at a time. Home and End now select the first and last item, Page Up and Page Down move a screenful, and Shift extends the selection as with the arrows. With a menu open they are left to it, as the arrows are. * fix(dashboard): apply the hidden-files setting to a renamed Files row With Show hidden off, renaming notes.txt to .notes.txt left the row in the listing until the folder was next loaded, and with it on the row wasn't dimmed as other dot-files are; renaming .env to env left it dimmed. A rename made in another tab did the same. A renamed row now follows the setting as listing the folder would. * fix(dashboard): open a recent app once on a double-click Double-clicking an app under Home's "Recently used" opened it in two new browser tabs, one per click. The second click of a double-click is now ignored, as on the Apps tab's tiles. * fix(dashboard): don't say "No recent apps yet" before Home's list has loaded Home's "Recently used" card was drawn from the list as it stood when the page opened, which is empty until the request answers: every visit first read "No recent apps yet / Apps you use will appear here" and then swapped in the apps, and if the request failed the card kept saying there were none. It now stays blank until the list arrives, and a first load that fails says the apps couldn't be loaded; a list already shown stays when a later refresh fails. * fix(dashboard): drop "Save session" when the account was saved in another tab A temporary account saved in one browser tab stayed temporary-looking in its other dashboard tabs: Home kept its "Save session" button, which opened Save Account for an account already saved, and Account and Security kept their temporary-account layout. Coming back to such a tab re-reads the account; that now removes the button and redraws the two tabs when the account is no longer temporary. * fix(dashboard): let go of the phone drawer when the window widens With the sidebar open as a drawer below 768px, widening the window past it (an iPad turned to landscape) drew the sidebar as the desktop one but left it marked open: Tab stayed trapped in it, so the content couldn't be reached by keyboard, and the Apps grid ignored the arrow keys, until an Escape or a click in the content. The drawer now closes when the window widens, leaving focus where it is. * fix(dashboard): don't let a #files/<path> link pull Files back to its folder Files doesn't keep the folder on screen in the URL, but a link like /dashboard#files/alice/Documents stayed in the address bar once opened. After the user moved on to Pictures, went to Home and pressed Back, the browser returned to that link and Files jumped back to Documents; a reload did the same, and Files' own Back/Forward lost track, as the jump wasn't recorded in it. The link's path is now consumed once opened, as a share link's is, and a folder opened from such a link is a step in Files' history. * fix(dashboard): close the drawer and Files' dialogs on browser Back and Forward Browser Back or Forward switched tabs but left whatever was open on screen: on a phone, Android's Back changed the tab under the open menu drawer and left it open; in Files, the Share or Properties dialog stayed up over Home, still acting on Files rows; an open context menu stayed too. These now close with the tab, as with a sidebar click. * fix(dashboard): fill Home's storage and usage meters without waiting on the plan Home read the plan first and only then asked for storage and the month's usage, so every visit paid for one more round-trip before either meter filled in. The plan request had no timeout either: one that never answered kept both meters at "--" and, as later loads wait for the one in flight, held every later refresh of the cards for the rest of the session. The three now load side by side, and the plan read gives up after 15 seconds. * fix(dashboard): link Home's card headers to their tabs The headers of Home's cards (Recently used, Usage, Your Plan, Your Storage, Resources) linked to "#", so opening one in a new browser tab (middle-click, the browser's menu) showed Apps rather than the tab it names, and Cmd/Ctrl+click switched tabs in place. They now link to the tab they open, and a modified click is left to the browser, as on the sidebar. * fix(dashboard): prefill the username when saving a session from Home Home's "Save session" button opened Save Account with an empty username, so a temporary user had to make one up, while the same action in the user menu fills in the account's current name and starts at the email field. Both now open it the same way. * fix(dashboard): measure Home's storage meter by the amount it shows On a self-hosted install the storage card names the disk's use (Puter's files and everything else on it) but filled its meter, and gave its percentage, from Puter's files alone, so it could read "93 GB used · 0% of 466 GB". The meter and percentage now come from the same amount the card shows. * fix(dashboard): refresh Home's recently used apps on returning to the tab Recent apps open in a new browser tab, and coming back to the dashboard refreshed the usage cards but not "Recently used", whose comment said it followed the same triggers: the app just opened only moved up the list after switching away from Home and back. Returning to the tab now re-reads the list too. * fix(dashboard): leave IME keystrokes to the IME in Apps Typing Japanese or Chinese in the Apps search or a folder's name, the keys that drive the input method reached the tab's own handlers: ArrowDown to pick a candidate moved focus to the first tile and cut the conversion short, Enter to confirm one named the folder half-written or launched the first match, and Escape put the old name back. The search box's Enter meant to skip composition, but read isComposing off jQuery's event, which never carries it. Keys during composition are now left to the IME. * fix(dashboard): leave IME keystrokes to the IME in the share recipient field With a Japanese or Chinese input method on, even a Latin username is composed, and the share dialog's recipient field took the keys that drive it: the arrows moved through its suggestions instead of the IME's candidates, and Enter to confirm the text picked a suggestion instead. Keys during composition are now left to the IME. * fix(dashboard): re-read the Apps layout on returning to its browser tab The Apps tab read its order and folders only when it was opened, and saves write its whole copy of them. With the dashboard open in two browser tabs, a folder made in one was wiped as soon as the other, showing Apps since before, changed anything (a reorder, a new folder, a rename), as was the order arranged in the first. The tab now reads the layout again when its browser tab comes back into view. * fix(dashboard): undo a drag out of an Apps folder when the drag is cancelled Dragging an app past the edge of an open folder takes it out, closes the folder and carries the drag on over the grid, and the removal was saved right then. Pressing Escape, or the window losing focus, cancels the drag but left the app out; out of a two-app folder that dissolved the folder for good, its name with it (dragging the app back made a new "Folder"). A cancelled drag now puts the folder and the order back. * fix(gui): show the 2FA setup's confirmations without entities The 2FA setup window, which the dashboard's Security tab opens, encoded already-encoded translations for its labels, so in French the two checkboxes before enabling read "J&apos;ai enregistré mes codes…" and "Je suis prêt à activer l&apos;A2F". The labels, and the window's other translated text set the same way, are now encoded once. * fix(gui): don't leave the 2FA dialogs stuck when a request can't be sent Turning 2FA on or off from the dashboard's Security tab while offline, or on a dropped connection, left the dialog busy for good: enabling kept its spinner up with the code boxes disabled, and disabling kept its button and password field disabled, with nothing said either way. A request that gets no answer is now reported like a refused one, and the dialog can be tried again. * fix(gui): stop disabling 2FA when the provider sign-in doesn't happen For an account that signs in through a linked provider, turning 2FA off opens the provider's sign-in popup. When the popup was closed or blocked, the dialog showed why for a moment and then sent the request anyway, whose refusal ("OIDC revalidation required") replaced the reason. It now stops at the popup's error.	2026-10-24 15:05:56 -07:00
404oopsandClaude Fable 5.1	68249028ef	test(ai): assert replayed Kimi tool arguments reach the wire decoded once ... Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-24 22:59:04 +02:00
404oops	cbcbdc2599	Merge branch 'fix/replayed-tool-call-arguments' into codex/kimi-k3-1-pro	2026-10-24 22:57:54 +02:00
404oopsandClaude Fable 5.1	3296c1b0d6	fix(ai): bill Kimi K3.1 Pro from reported usage at the published rates ... Cache writes now meter under `cache_write_tokens` at the model's write rate, split out of `prompt_tokens` by the shared usage splitter, so K3 gets the same breakdown. The credit hold reserves the prompt and any replayed reasoning at the input rate, and a stream that ends without a usage chunk is charged the estimate like every other provider. The per-TTL response headers, the 502 accounting error and the one-hour write prices are gone: the cache is scoped to the account and nothing here requests a one-hour TTL, so those writes never occur and Moonshot publishes no rate for them. The catalog entries carry the release date so responses normalize by default, the provider suite no longer imports the SDK, and the docs cover the reasoning efforts, replay and cache usage keys in their existing sections. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-24 22:55:10 +02:00
404oopsandClaude Fable 5.1	a10a9d9b93	fix(ai): keep replayed tool-call arguments serialized once ... An OpenAI-shaped `tool_calls` entry normalizes with its `arguments` still a JSON string, and hoisting it back into `tool_calls` stringified that string again, so every OpenAI-compatible provider received a JSON string literal instead of the call's arguments. Hoisting now sends a string `input` as is and only serializes object inputs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-24 22:54:39 +02:00
Filip KujundžićandClaude Fable 5.1	bbb780eb31	feat(ai): MiniMax video generation (H3 and Hailuo) (#4309) ... * feat(ai): MiniMax video generation (H3 and Hailuo) Adds a minimax-video-generation provider to the video driver. H3 models go through MiniMax's v2 task API and are billed per second of output; Hailuo models go through the v1 API, exchange a file id for a download URL, and are billed per clip. The shared `minimax` chat key is reused, with the chat block's `/v1` base URL reduced to its host. WIDTHxHEIGHT sizes now map onto tiers for catalogs that include a 2k or 4k tier. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(ai): validate MiniMax video inputs and resolution tiers --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-24 13:49:21 -07:00
Juan Castro	c701b8d7c0	fix(notifications): show the sending app on app messages ... App messages carry the sending app's uid and name (and its icon when it is an https URL), set by the server; the desktop toast and the dashboard panel show the name above the title. Title and text drop invisible formatting marks and control characters, with newlines kept in text and whitespace-only text left out. The icon is stored as its normalized URL, and a target may not hold dot segments or non-ASCII characters. Both rate-limit windows are read before either is spent, so a refused call counts against neither. The docs say what ttl means for push delivery.	2026-10-24 16:02:54 -04:00
Juan Castro	4b41b9cd54	feat(notifications): apps can notify the user they act for ... Adds the app.message type (audience app-user). An app, its workers and the tokens it issues can create it through puter-notifications create, only for their own user and under their own app. The value is validated against a fixed format, the write is not silent, and each app has a per-user budget of 30 per minute and 300 per day, configurable with notificationAppMessageLimits. Holders keep creating the other types silently and cannot create app.message.	2026-10-24 16:02:54 -04:00
Nariman Jelveh	8a55debdae	fix(dashboard): sixth adversarial review — bugs, UX, a11y, perf (#4314) ... * fix(dashboard): render in the user's saved language The dashboard never read the account's preferences: only the desktop did, on boot. Everyone saw it in English whatever language they had chosen, until the Files tab's Show hidden toggle switched a running session over, to the browser's language when none was saved, since that was the fallback the toggle wrote back. The desktop's preference loading moves into load_user_preferences, which the dashboard now runs in the background. The first paint uses the language this browser last loaded, so nothing waits on the read; a saved language that differs reloads into it, and a changed Show hidden setting refreshes the open folder. The tab names are read when the sidebar is drawn rather than when the modules load. A failed read keeps the cached preferences instead of resetting them to English. * fix(dashboard): label credit amounts with a key meant for them Home's allowance and the Usage tab's total and Credits column used the `credits` key, which the translations render in its acknowledgments sense: "5,000 Mitwirkende" (contributors) in German, "Авторы" in Russian, "特别鸣谢" in Chinese. They now use `usage_credits`, which falls back to English until it is translated, as `monthly_credits` already does. * fix(dashboard): enable the token and 2FA cards once the email is confirmed The dashboard had no handler for the `user.email_confirmed` socket event, and Account and Security pick the token button's state and whether to offer 2FA when they render. A user who confirmed their email in another tab, or in this one through the confirmation prompt, kept a disabled "Create token" and no 2FA card until a reload. The dashboard now refreshes the user on that event and renders both tabs again, as it already does after a temporary account is saved. * fix(dashboard): save only the profile fields that were edited Edit profile sent both the display name and the bio on every save, taken from this session's copy of the profile. That copy comes from the cached user and can be stale (the profile changed on another device) or empty (the profile read failed), so changing only the bio wrote the old display name back, and a save from an empty prefill erased the bio. The dialog now sends just the fields whose value changed from what it opened with, and closes without a request when nothing did. * fix(dashboard): don't show storage as 100% while there is room left Home and Usage rounded the storage share to a whole percent, so an account at 99.5% or more read "100%" while uploads still fit. The usage meter already holds at 99% until the allowance is spent; that rule moves into meterPercent and the storage meters use it too. * fix(dashboard): keep keyboard focus inside the open phone drawer Below 768px the sidebar is a modal drawer over a scrim, but opening it left focus on the menu button, and Tab past its last entry walked into the dimmed content behind the scrim. Opening it now focuses the current page's entry, and Tab and Shift+Tab cycle within it while it is open. * fix(dashboard): tapping into a Files name field edits the name On a phone or tablet, tapping the name field of a new folder or a rename (which iOS needs before it shows the keyboard) reached the row's tap handler, which opened the folder or launched the file and threw the edit away. A long-press in the field opened the touch sheet instead of selecting text, and on desktop a right-click in it showed the file menu instead of the browser's Cut/Copy/Paste. The row's tap and menu handlers now leave the name field alone. * fix(dashboard): don't offer Cut on items the user can't move A file's menu offered Cut on anything that wasn't immutable, and Shared rows aren't marked immutable. Cutting a file someone shared with you, or anything inside a read-only shared folder, then pasting it, ended in a "Forbidden" alert and an emptied clipboard. Cut now needs the same permission as Delete in that menu, as Ctrl+X and the selection's Cut already do. * fix(dashboard): don't paste or upload into the folder being left Opening a folder clears the listing at once but only moves currentPath when the new listing arrives. Ctrl+V, a file dropped from the computer onto the pane, or Paste from the background menu during that wait went into the folder the user had just left, and since the refresh then showed the new one, the items seemed to vanish. Those three now refuse while another folder is loading, as New Folder already did. * fix(dashboard): clear the drop highlight when Escape cancels a drag Escape ends a Files drag with a synthetic mouseup, which jQuery UI treats as a release outside every target: it fires no `out`, so the folder row under the pointer kept its dashed drop outline and tint (and a sidebar folder or breadcrumb its highlight) after the drag was gone. The Escape branch now takes those off. * fix(gui): show the "can't rename in Trash" alert without entities Pressing F2 on a trashed item (on the desktop or in the dashboard's Files tab) showed "This item can&apos;t be renamed because it&apos;s in the trash": the message was encoded by i18n and then again by UIAlert. * fix(gui): show the failed-upload title without entities The upload progress window writes its error title with innerText, but was handed the HTML-encoded i18n string, so French showed "Échec de l&apos;importation des fichiers". The Files tab's two upload paths and the desktop's now pass the plain string. * feat(dashboard): open a Files row's menu with the Menu key or Shift+F10 Share, Download, Open With and Properties were reachable only by pointer: the ⋯ button isn't focusable, and the keyboard's menu keys fired a contextmenu on <body>, which the listing ignores. Both keys now open the selection's menu at its row's ⋯ button, where arrow keys and Enter already work. * fix(dashboard): let Shift+Arrow shrink a Files selection Shift+Arrow only ever added the next row, so after Shift+Down twice, Shift+Up left all three rows selected instead of going back to two. A run of Shift+Arrows now selects the range from the row it started on to the cursor, on top of whatever was selected before the run, so moving back shrinks it. A click or a plain arrow starts a new run. * fix(dashboard): name folders in the Back/Forward history menus as the crumbs do Holding Back or Forward listed each folder by its path's basename: `/` was a blank entry, the Shared view read "shared", Trash stayed in English, and a trashed folder showed its uid. The menus now use the same names the breadcrumbs show. * fix(dashboard): show a shortened Files name in full on hover Grid tiles and a resized Name column shorten long names in the middle ("Quarterl…draft v2.xlsx"), and nothing showed the rest short of opening Rename or Properties. A shortened name now carries the full one as its tooltip. * fix(dashboard): keep keyboard focus on the Files breadcrumbs Every listing rebuilds the breadcrumbs, which took a keyboard-focused crumb with it: pressing Enter on one, or any refresh of the folder while a crumb had focus, left focus on <body>, and the next Tab started over from the top of the page. Focus now moves to the same folder's crumb, or to the one for the folder just opened. * fix(dashboard): reach Home's Shared and Trash rows from the keyboard At 480px wide or less (a phone, or a desktop browser zoomed in) the folder sidebar is hidden and Home lists Shared and Trash as rows instead. Those rows only had a click handler, so a keyboard user couldn't get to either. They are now focusable links that open on Enter or Space, with the sidebar's focus ring. * fix(dashboard): keep the Files selection across a sort or view change Sorting by a column, switching between list and grid, or toggling Show hidden lists the folder again, and the rebuild dropped the selection and the shift anchor: select three files, sort by Size, and nothing was selected. Only the refresh on returning to the browser tab carried them across. That logic is now refreshKeepingSelection, and those three use it too. * fix(dashboard): don't drop a folder open during a Files refresh A refresh of the folder on screen (after an upload or paste, Refresh, a sort, or returning to the browser tab) set the same "already rendering" flag that a navigation sets, so double-clicking a folder, a sidebar folder, a crumb or Back during that round-trip did nothing, with no spinner to explain it. Opening another folder now takes over from a refresh in flight; the refresh notices it was superseded and drops its result. A navigation during another navigation is still ignored, as before. * fix(dashboard): keep the Files marquee when an item arrives mid-drag Adding a row clears the empty-folder notice by removing every non-row child of the listing, and the selection marquee is one. A file added from elsewhere (an upload, another tab, an app) while the user was drawing a selection made the rectangle vanish under the pointer. * perf(dashboard): don't rewrite unchanged Files names while resizing Every width change (a window resize, collapsing the sidebar) re-fits the item names, at most once a frame, and wrote each name's text back even when it came out the same. Each write invalidated layout for the whole list. With 300 rows that took ~6.4ms a frame in list view and ~4.9ms in grid; skipping the unchanged writes brings it to ~0.7ms and ~3.2ms. * fix(dashboard): tell assistive tech the Files Select toggle's state The Select button only toggled a class, so a screen reader announced a plain button with no state; it now carries aria-pressed. Sort and View open menus and now say so with aria-haspopup. * fix(dashboard): show a person's strongest grant in the share list When someone held two grants on one item (the owner gave them view access, and someone the owner let share gave them edit), the share dialog showed whichever grant the listing returned first, so their row could read "Can view" while they could edit. A second grant on the same item now counts toward the row with the stronger of the two levels. * fix(dashboard): only offer share controls on grants the user can change The backend lets an item's owner change or withdraw any share of it, and anyone else only the grants they issued (or their own access). The share dialog offered the level select and Remove on every row. Someone the owner let share who removed a person the owner had added got "Removed bob" while nothing changed, and lowering their level added a second grant that changed nothing either. The access list now records who issued each row's grants. A user who doesn't own the selection gets the controls only on rows whose grants they issued all of, plus Remove on their own row to leave; other rows show their level as a tag. * fix(dashboard): update Files' shared markers after the share dialog closes The share dialog marks the Files rows it covers as shared or not from the listings it reloads after each change, and skipped that whole reload once it was closed. Closing it while a share or removal was still saving left the row without its shared marker (or with a stale one) until the folder was reloaded. The markers are now updated either way; only the dialog's own list is skipped once it's gone. * fix(dashboard): mark rows shared after sharing more than 50 at once The share dialog updates the Files rows' shared markers from the share listings it reloads after a change, and doesn't reload them for more than 50 items. Sharing such a selection, with a person or by link, reported "Shared with bob on 55 items" while no row showed the marker until the folder was reloaded. Those grants now mark their rows directly. * fix(gui): unbind each context menu's mousemove handler with the menu The submenu-aim code bound a mousemove handler on the document for every menu and submenu and never removed it. Each one kept its closed menu and items alive and ran on every mouse move for the rest of the session; ten right-clicks in Files left five such handlers behind. The handler now comes off when its menu is removed. Moving diagonally into a submenu still keeps it open. * fix(gui): ignore clicks on a context menu's dividers A divider is an <li> like the items, so a click on one (they're 11px tall, easy to hit between two items) ran the item handler with no action behind it and threw "Cannot read properties of undefined". The item handler now skips dividers; the menu stays open, as a native menu's separator does. * fix(dashboard): warn that removing a team removes everyone in it Removing a team from a single item's share dialog asked "Remove Design's access to this item?", the wording used for one person. The desktop's share window adds "Everyone in the team loses it."; the dashboard now uses that confirmation for teams too. * fix(dashboard): count folders, not items, in "via N folders" A person who reaches a multi-item selection through more than one shared ancestor gets a "via N folders" note in the share dialog, and N was the number of items reached that way: five files under two shared folders read "via 5 folders". It is now the number of distinct folders. * fix(dashboard): don't treat a long tail after a dot as a file extension Files middle-truncates long names and keeps everything after the last dot whole as the extension. For "Report v1.2 final draft for the board meeting" that kept ".2 final draft for the board meeting", so the tile read "….2 final draft for the board meeting" and lost the start of the name. Only a short tail without spaces now counts as an extension; this one shortens to "Report v1.…d meeting". * fix(dashboard): keep Tab inside the touch context menu The touch menu sheet is modal, but Tab and Shift+Tab left it for the page behind the backdrop while it stayed open; closing it then no longer returned focus, since focus was elsewhere. Tab and Shift+Tab now move between its items like the arrow keys, wrapping at the ends. * fix(dashboard): say "the other item" when one item is missing a grant The share dialog's "Add to all" link told screen readers "Give bob access to the other 1 items" when the person was missing from a single item of the selection. That case now has its own singular string. * fix(dashboard): announce a failed Properties load, on both tabs When Properties couldn't read the item, the General list showed the error but stayed aria-busy, so screen readers kept it unannounced, and the Versions tab stayed blank. The list is no longer busy once the error shows, and Versions shows the same error. * perf(dashboard): launch the add-app modal's apps without reloading the grid "Browse the App Center" and "Build with AI" go through the same intro as a deep link, which first awaited loadApps(). With the grid already loaded that started a fresh fetch of every app list and the saved layout, and the launch waited on it: with an 800ms connection, ~1.35s before anything opened instead of ~0.1s. The intro now uses the grid already loaded, and only joins or starts a load when there is none. * fix(dashboard): don't hide the Apps grid on every search keystroke Search re-rendered the grid behind the first load's fade-in, which waits for page one's icons. Each keystroke made fresh <img> elements, so an icon that was slow or failing (an unreachable icon host) blanked the whole grid until it settled, about a second per keystroke with a 1s icon and up to 1.5s if it never answers. Search, its clear button and entering reorder mode now render the results at once. * fix(dashboard): stop the Apps pager's dots jumping back mid-flip A page arrow, a dot, or the wheel starts a smooth scroll and marks the target page at once, but the scroll handler then read the pages passed over on the way as the current one. The active dot went forward, back to the old page, and forward again, and a second click on the arrow added to the stale page: two quick clicks showed 0 → 1 → 0 → 2 → 1 → 2. While such a scroll is on its way, the pager (and the open folder's) now ignores the positions in between, until it arrives or a second has passed. The user's own scrolling still moves the dots. * fix(dashboard): keep paging while a dragged app is held at the edge Holding a dragged tile still at the Apps grid's edge (or an open folder's) turned one page and stopped: the next dwell only started on another pointer move, so a mouse held steady stayed on the second page of three. Once a flip settles, the dwell starts again if the pointer is still in the edge zone. * fix(dashboard): don't turn Apps pages on a trackpad pinch A pinch on a trackpad reaches the page as wheel events with ctrlKey set, and the Apps grid (and an open folder) read them as a wheel flick and turned the page while the user zoomed. Those events are now left alone. The handlers also called preventDefault() from a listener the app makes passive, which does nothing and logged a console warning on every wheel tick; that call is gone, as the scroller has no vertical scroll to stop. * feat(dashboard): open the first Apps search result on Enter Typing in the Apps search and pressing Enter did nothing; reaching a result took ArrowDown and then Enter. Enter in a non-empty search now opens the first match (or a folder that matches), as launchers do. It does nothing while an IME composition is open, or when nothing matches. * fix(dashboard): include an open folder's page dots in its Tab cycle The open folder keeps Tab inside it, but its list of stops left out the page dots, which are buttons. Tab never reached them, and once one had focus (clicking it focuses it) the next Tab walked out of the modal folder to the page behind. The dots are now part of the cycle. * feat(dashboard): open an app tile's menu with the Menu key or Shift+F10 An app or folder tile's menu (Open in New Tab, Copy Link, Uninstall, Remove from Folder; a folder's Rename and Ungroup) opened only on a right-click or long-press, and browsers don't all turn the keyboard's menu keys into a contextmenu event (macOS has none). The Menu key and Shift+F10 on a focused tile now open its menu at the tile, where arrow keys and Enter work. * fix(dashboard): keep keyboard focus on the grid after Ungroup Ungrouping a folder from its menu re-rendered the grid without the folder's tile, so a keyboard user who had it focused was left on <body> and the next Tab started from the top of the page. Focus now moves to the folder's first app, which takes the folder's place. * fix(dashboard): give links AA contrast in the light theme Link-colored text (Home's "View more" and "Upgrade", the notification panel's "Mark all read" and "Retry", Properties' website links, the token dialog's sessions link) used #5271ff, 4.07:1 on white and 3.97:1 on the content background, under the 4.5:1 AA minimum for text that size. The light theme's link is now #3d5bd9 (5.7:1), with a darker hover. Dark mode already passed. * fix(dashboard): give success text AA contrast in the light theme Success text (the 2FA "enabled" line, Home's active-plan badge, the share dialog's confirmations) used #03933a: 4.01:1 on white and 3.80:1 on its green tint, under the 4.5:1 minimum. It is now #15803d (5.02:1 and 4.75:1); the success check icons that share the token darken with it. Dark mode already passed. * fix(dashboard): give danger buttons and error text AA contrast White text on the red fills fell short of 4.5:1: the Apps uninstall confirm (#e53935, 4.23:1), the delete-account button (#f00808, 4.43:1) and the Files drag "Cancel" zone (#ef4444, 3.76:1). So did light-theme danger text on its pink tint (#dc2626 on #fef2f2, 4.41:1), used for form, share, crop and notification errors and the past-due badge. The fills are now #d32f2f, #d90707 and #dc2626 (4.8:1 to 5.3:1), each with a darker hover, and danger text is #b91c1c (5.9:1 on the tint). * fix(dashboard): give the app feedback dialog's Send button AA contrast The feedback dialog's primary button (Send, and Close once sent) put white text on a light-blue gradient, 2.66:1 at the top and 3.42:1 at the bottom. It now uses the dashboard's primary button colors, which meet 4.5:1 in both themes, like the dialogs around it. * fix(dashboard): show the drop outline and dwell fill on grid folders Dragging files over a folder in grid view only tinted it like a selection: the grid's own border, hover and selected rules out-ranked the shared drop-target and spring-load rules, and the hover rule's background shorthand wiped the dwell fill. The folder then opened after 700ms with no sign it was about to. Grid and compact-grid folders now get the list's dashed outline and filling dwell, with the padding trimmed to match so the tile doesn't shift. * fix(dashboard): keep the Files preview and drag ghost above the window The Space-bar image preview (z-index 9999) and the drag ghost (10000) are appended to <body>, beside the dashboard window. On a touch-only tablet with a keyboard every window is pinned to 9999999, so the preview opened invisibly behind it from the first press; on desktop the window's z-index climbs with each click and overtakes both in a long session. Both now sit in the band the sidebar tooltip and the toasts already use. * fix(dashboard): give small dashboard controls 44px touch targets Several controls a phone or tablet user taps were under the 44px minimum touch size, with nothing enlarging them on a coarse pointer: the Files toolbar buttons (32px), the touch menu's rows (36px tall), the drawer's close button (32px), the notifications close (30px), the Properties close (32px), the feedback dialog's ✕ (30px), the add-app Back arrow (26px), the Apps modal buttons (34px tall) and the share dialog's Copy link (38px tall). Following the earlier touch fixes, the icon buttons keep their look and get a 44x44 hit area, and the text buttons and menu rows grow to 44px. Mouse and trackpad layouts are unchanged. * fix(dashboard): keep a landscape phone's notch clear of the dashboard A phone held sideways and wider than 768px (an iPhone Pro Max, a large Android) gets the desktop layout, and the page asks for the full screen with viewport-fit=cover. Nothing in that layout read the side safe-area insets, so with the notch on the left the sidebar's icons sat under it (x=24 against a 47px inset), and with it on the right the content's edge and the toasts did. The sidebar (open or collapsed) now adds the left inset, and the content area, including Apps and Files, and the toasts add the right one. The insets are 0 everywhere else, so other layouts don't change. * fix(dashboard): size the touch menu and bottom sheets to the visible height The touch context menu, the app feedback dialog and the profile-photo crop sheet capped their height in vh. On phones 100vh is the viewport with the browser bars hidden, so while they show these could be taller than the screen. The touch menu, which ContextMenu.js keeps inside the visible height, then ran its last rows off the bottom on a landscape phone, and the bottom sheets could push their header off the top. They now cap in dvh, as style.css already does. * fix(gui): move keyboard focus into the Manage sessions dialog The sessions dialog is modal but never took focus: opening it from the keyboard left focus on the button behind the backdrop, and Tab walked the page underneath instead of the session list. It now focuses its close button on open, keeps Tab inside, and hands focus back to the control that opened it when it closes. * fix(dashboard): return focus after the Security tab's dialogs close Closing Blocked people, or the 2FA setup or disable dialog opened from the switch, left keyboard focus on <body>, so the next Tab started at the top of the page. The 2FA switch also disables itself while its dialog is up, which drops focus even before then. Focus now goes back to the button or switch that opened the dialog once it has gone.	2026-10-24 08:30:57 -07:00