7100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dependabot[bot]	53e27f3d41	chore(deps): bump mysql2 from 3.24.5 to 3.24.6 (#4279) ... Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.24.5 to 3.24.6. - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](https://github.com/sidorares/node-mysql2/compare/v3.24.5...v3.24.6) --- updated-dependencies: - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:25:23 -07:00
dependabot[bot]	deac121675	chore(deps-dev): bump eslint-plugin-prettier from 5.5.6 to 5.5.7 (#4278) ... Bumps [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) from 5.5.6 to 5.5.7. - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/eslint-plugin-prettier/compare/v5.5.6...v5.5.7) --- updated-dependencies: - dependency-name: eslint-plugin-prettier dependency-version: 5.5.7 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:22:09 -07:00
Nariman Jelveh	53e6e3179b	refactor(gui): remove the AI side panel and its desktop button (#4286) ... The desktop no longer launches the `ai` app at boot. This removes the `is_panel` window mode, which existed only for that launch, and the toolbar/taskbar/window/popover offsets tied to it. It also removes the desktop sparkles button that showed the panel, and the `silent_on_failure` launch option, whose only caller was the boot launch. "Open in AI" in the item context menu still launches the app as a normal window.	2026-10-20 15:21:21 -07:00
dependabot[bot]	73624bf1d0	chore(deps): bump smtp-server from 3.19.21 to 3.19.23 (#4276) ... Bumps [smtp-server](https://github.com/nodemailer/smtp-server) from 3.19.21 to 3.19.23. - [Release notes](https://github.com/nodemailer/smtp-server/releases) - [Changelog](https://github.com/nodemailer/smtp-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/smtp-server/compare/v3.19.21...v3.19.23) --- updated-dependencies: - dependency-name: smtp-server dependency-version: 3.19.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:19:00 -07:00
Nariman Jelveh	1a9e43f5e5	fix(dashboard): adversarial review — bugs, a11y, perf, i18n (#4285) ... * fix(dashboard): size the Notifications sidebar row like its neighbors The bell button's font: inherit overrode the sidebar item's font-size (16px instead of 14px, 15px in the drawer), and its icon wrapper stayed 18px while the drawer grows nav icons to 20px. * test(dashboard): scope the directory-note assertion to the directory row The 2FA row reuses .teams-directory-note, so the unscoped selector read both notes and the test failed. * fix(dashboard): only treat a picked file as a new avatar while the avatar picker is open The Account tab listened for every file_opened on the dashboard window, so choosing an image for a web link's Change Icon in the Files tab opened the profile-picture crop modal, and saving it replaced the avatar. * fix(dashboard): let dialogs over the Files tab keep their keyboard The Files keydown handler ran under an open confirm, so pressing Enter on the focused Delete button of the permanent-delete prompt opened the trashed item instead (stacking a second alert), and arrows or Delete acted on the rows behind the dialog. * fix(dashboard): keep Apps grid keys away from an open context menu Choosing a tile's menu item with Enter (e.g. Open in new tab) also launched the focused app in place, and arrows moved tile focus while they walked the menu. * fix(dashboard): Escape on a menu or modal inside an app folder keeps the folder open The menu's and the uninstall modal's Escape handlers removed them before the folder's listener ran, so it saw nothing above it and closed the folder with the same keystroke. * fix(dashboard): a tap on the drawer or sheet scrim only dismisses it Outside-press handlers closed the mobile drawer and the notifications sheet on touchstart/pointerdown, which took away the scrim's hit area before the click, so the tap also landed on the app tile or file row underneath. * fix(dashboard): let the sidebar nav scroll on short viewports The nav clipped its overflow, so in a landscape phone's drawer (or a short desktop window) Usage, Account, and Security fell below the fold with no way to reach them. * fix(dashboard): keep the mobile drawer full width when the desktop sidebar is collapsed The remembered collapse outranked the drawer's width rule, so below the drawer breakpoint it opened as an unlabeled 50px icon strip, and the toggle that would undo it is hidden there. * perf(dashboard): stop refetching account data each time focus leaves an app Home's window focus listener fired whenever focus came back from an app's iframe, so every click from an app to the dashboard re-pulled whoami, subscription, storage, and usage (5 requests), on any tab. It now only refreshes after the page itself lost focus to another window. * fix(dashboard): show a seat's team name unescaped in the plan card i18n escapes its arguments for HTML, but the note is set with .text(), so a team called "Bob's & Co" read "Managed by Bob&apos;s &amp; Co". * fix(dashboard): stop double-escaping app names in uninstall alerts UIAlert escapes its message, so an app titled "Tom & Jerry" read "Tom &amp; Jerry" in the uninstall-failed and sessions-not-ended alerts. * fix(dashboard): roll back an uninstall whose revoke failed puter.perms.revokeApp resolves with error set instead of rejecting, so a failed revoke still removed the tile, marked the app removed for later sessions, and ended its sign-in, while the app kept its permissions and the rollback and error alert never ran. * fix(dashboard): read a team account's suspension when its name matches an Object member The per-account state map was a plain object, so a username such as constructor or toString was already "in" it, its audit entries were skipped, and a suspended account showed as active with no Delete. * fix(dashboard): update the profile card and sidebar name after a username change Neither carried the .username class that the rename refreshes, so both kept showing the old name until reload. * fix(dashboard): ask how to restore a trashed item whose name is taken Restore moved without overwrite or dedupe, so when the original location already had an item of that name the move 409'd and nothing happened: an uncaught error from the item menu, a console line from the others. All three restore entry points now share one path that offers the Replace / Keep Both prompt the paste flow uses, alerts on other errors, and updates the footer and empty notice once the rows are gone. * fix(dashboard): refresh a renamed row's name, icon, and position in the Files tab The Files tab passed rename_file a callback it never accepted, so a renamed row kept the desktop's 20-character truncation even in a wide column, kept its old type icon, and stayed out of sort order. rename_file now takes an optional onDone (carried through undo), which the Files tab uses to fit the name to its column, refresh the icon and type, and move the row into place. A cancelled rename no longer truncates the name either. * fix(dashboard): drop Publish and Properties from the Shared view's menu The Shared view is a query, not a folder, so both acted on the virtual shared path: Properties showed an unknown error and Publish opened a dialog for a path that doesn't exist. * fix(dashboard): close the Files image preview on Escape and when leaving the folder Escape cleared the selection but left the Space preview open with nothing selected, the preview stayed over a different folder after navigating, and a preview whose URL arrived after it was dismissed or replaced still opened. * fix(dashboard): don't move Files history for a navigation that's dropped renderDirectory ignores a navigation while another folder is loading, but every caller had already pushed or stepped history, so after a click during a load the listing and history disagreed and the next Back or Forward seemed to do nothing. History now only moves when the render will run; back/forward steps share one helper. * fix(dashboard): reopening the current folder adds no Files history entry Clicking the folder already on screen (e.g. Home in the sidebar) pushed a duplicate entry, so the next Back reloaded the same folder. * fix(dashboard): show installed apps when the recommended list fails to load get-launch-apps sat in the same Promise.all as the installed apps and its body was parsed without a status check, so a network error or a proxy's HTML error page replaced the whole grid with "Failed to load apps". A failed list now falls back to the last one that loaded. * fix(dashboard): fit the app uninstall dialog on narrow phones The card is mounted outside the dashboard's border-box rule, so its 320px min-width plus padding came to 370px and was clipped on 360px screens; a long unbroken app title also overflowed it. Desktop sizing is unchanged. * fix(dashboard): keep a new team account's one-time password on screen until dismissed The credential box lived only in the DOM inside the panel that every refresh repaints, so revisiting the Teams tab or any later action wiped a password that can't be retrieved again. It is now kept in state, for the team it belongs to, and drawn with the panel. * fix(dashboard): reload the Teams tab after a change made while it was loading refresh() handed back any load already in flight, so an action or team switch made during a revisit's background load awaited data read before the change: a toggled setting snapped back, and a team switch could paint one team's roster next to another's record. A change during a load now queues one more load, the stale one skips its paint, and revisiting the tab doesn't start a second load while init's is still running. * fix(dashboard): send one re-enable request for a double click in Teams Re-enable has no confirm dialog to absorb a second click, and nothing held the action while it ran, so a double click enabled the account twice (two audit entries). A suspend or re-enable already in flight for an account now ignores further clicks. * fix(dashboard): revert the avatar and say so when saving a new photo fails The crop's Save showed the new picture everywhere and revealed Remove without waiting for the upload, and update_profile swallows failures, so a failed save looked saved until reload. The save is now awaited: a failure puts the previous picture back with an error hint, and Remove waits for the upload so it can't race it. * fix(dashboard): hide the Usage tab's plan button for team seats A seat's plan belongs to its team, so Home already hides its upgrade link; the Usage tab still offered Upgrade, which only reaches a refusal. * fix(dashboard): don't drop Home's forced usage refresh during a running load loadUsageData handed any caller the load already in flight before looking at force, so a subscription change (or a return from the billing portal) during a routine load was answered with data read before the change, and the plan card stayed stale until the next refresh. A forced call now runs once more after the running load. * fix(dashboard): activate Apps when the URL names an unknown tab An unknown hash rendered Apps as the active tab but skipped its activation, so the grid kept the generic content padding and Apps' onActivate never ran. * fix(dashboard): make the sidebar user menu reachable from the keyboard The user button was a div with no tabindex, so Log Out, account switching, and Contact Us were out of reach without a pointer. It is now a button (rendering unchanged), with aria-haspopup. * fix(dashboard): name the sidebar's collapse and drawer buttons for assistive tech The collapse toggle held only two unlabeled images, so screen readers announced an unnamed button; it now carries a translated label and aria-expanded that follow its state. The drawer's open/close labels were hardcoded English and now go through i18n. * fix(dashboard): make Home's recent apps reachable from the keyboard Each recent app was a click-only div, so keyboard users couldn't open one. They are now buttons with a focus ring; the icon is decorative since the title names the button. * fix(dashboard): name the Security tab's 2FA switch for assistive tech The checkbox sat in a text-less label, so screen readers announced an unnamed checkbox. It now carries the translated Two Factor Authentication label, as the Teams switches do. * fix(dashboard): sort the Usage table from the keyboard The sortable headers were click-only th cells. Each now holds a button, carries aria-sort, and keeps focus across the re-render a sort causes. The Resource/Units/Cost headers go through i18n. * fix(dashboard): don't rebuild the Files listing under an open menu Returning to the browser tab re-rendered the folder even with a context menu or action sheet open, so its actions then targeted detached rows: Rename did nothing, Restore faded a row that was already gone. The refresh now waits while a menu is up, as it does for a rename. * fix(dashboard): point the Files sidebar's Documents at the current home The entry read window.documents_path, which globals.js sets once from the cached user and nothing updates; login and username changes keep window.docs_path current instead. After a username change, Documents pointed at the old home and showed "This folder couldn't be opened", even after reloading. * fix(dashboard): let only the newest share listing render in the share dialog Each action ends in a refresh, and refreshes from overlapping actions (or the opening load) could finish out of order, so an older listing landed last and undid what the user just did, e.g. the link control snapped back to restricted after turning the link on. Older refreshes now drop their result. * perf(dashboard): load a team's record, roster, and plan in parallel loadSelected awaited the audit log (every page of it), then the members, then the plan, on every visit to the Teams tab. They don't depend on each other, so they are now fetched together. * fix(dashboard): keep keyboard focus on the Teams control that was used Every Teams action repaints the whole panel, which dropped focus to <body>: a keyboard user toggling a switch or suspending an account was sent back to the top of the page. The repaint now refocuses the same control, or the same account's new action when the old one is gone. * fix(dashboard): give the app uninstall prompt dialog semantics and focus The prompt had no dialog role or label and never took focus, so keyboard and screen-reader users stayed on the inert grid behind it. It is now a labelled modal dialog that focuses Cancel on open and returns focus to the app's tile when dismissed. * fix(dashboard): keep the add-an-app tile when there are no apps With no apps at all, the empty state replaced the whole grid, add tile included, so a new user on an instance with no recommended apps had nothing to act on. The empty line now sits above a grid that keeps the tile, as a search with no matches already does. * fix(dashboard): don't rebuild the Apps grid under an active drag An uninstall finishing (or a failed one rolling back) re-rendered the grid even while another tile was being dragged, replacing the dragged tile with a fresh copy: the copy showed under the ghost and the drop was lost. Renders asked for mid-drag now wait for the one the drop does; the folder eject, which rebuilds the grid as part of the drag, still can. * fix(dashboard): return focus to the drawer toggle when the mobile drawer closes Closing the drawer (Escape, the close button, a tab pick) left focus on controls that had just become hidden, so it fell to <body>; closing the notifications sheet opened from the drawer tried to refocus the bell inside the closed drawer. Both now land on the drawer toggle. * fix(dashboard): truncate Files names between graphemes, with a binary search The middle truncation sliced UTF-16 code units, so at many widths a long name with emoji showed a half surrogate (rendered as a replacement character) or a broken joined emoji. It also measured one more character per step, a measureText call per character of every long name on each render and column resize. The cut now falls between graphemes and is found by binary search; output for other names is unchanged. * fix(dashboard): translate the Home tab's hardcoded English The tab label, the recent-apps empty state, card subtitles, the plan badge and trial wording, the upgrade/manage links, and the usage cards' "Used" / "of" lines were English literals. They now go through i18n, with placeholders where values are interpolated. * fix(dashboard): translate the sidebar's remaining English The Apps, Files, and Usage tab labels, the user button's fallback name, and the user menu's Developers item were English literals; they now use i18n keys like the other tabs. * fix(dashboard): translate the Usage tab's hardcoded English The subtitle, the "used of" meter lines (now the existing used_of key), Usage Details, the plan button, Show more/less, and the details error were English literals. * fix(dashboard): translate the Account and Security tabs' hardcoded English Both subtitles, the delete-account description, the sessions hint, the username fallback, and the avatar picker's window title were English literals. * fix(dashboard): translate the Apps tab's hardcoded English The uninstall prompt and its failure alert, empty and no-match notices, pager and folder-dot labels, the search placeholder, the edit toggle, and the tile menu's Open in New Tab / Quit / Uninstall were English literals. * fix(dashboard): translate the Files tab's hardcoded English The folder sidebar, footer counts (now the existing item-count keys), sort and view menus, upload status and errors, the empty and can't-open notices, the reserved-name alerts, the move error, and the loading text were English literals. * fix(dashboard): translate the action sheet's Back row and match delete in any language The touch action sheet styled an item red when its label contained the English word "delete", so Delete lost its danger styling in every other language; it now compares against the translated Delete labels. Its submenu Back row and the properties panel's Directory/disassociate labels were English literals. * fix(dashboard): make the Files sidebar, crumbs, and nav arrows keyboard-operable The folder sidebar, the breadcrumbs, and the back/forward/up arrows were click-only li/span/img elements, out of the tab order. They now take focus, carry button/link roles (the arrows with labels and aria-disabled), answer Enter and Space, and show a focus ring. The rows' Enter/Space shortcuts also no longer swallow those keys from a focused control: with rows selected, Enter on Upload opened the selection. * perf(dashboard): read grid name widths before writing any in the Files tab fitItemNames read each tile's name width right after writing the previous name, forcing a layout per row. Reading them all first, then writing, cuts switching 400 files into grid view from about 300ms to 170ms; the rendered names are identical.	2026-10-20 13:44:42 -07:00
3 people	242a654166	feat(ai): add Kling for video, image and speech generation (#4274) ... * feat(ai): add Kling for video, image and speech generation One `kling` API key now registers a provider on three drivers: - txt2vid: Kling 3.0 Turbo, 3.0, 3.0 Omni, O1, 2.6 and 2.5 Turbo, with first/last frames, reference images on the omni models, native audio, and editing a source video on 3.0 Omni and O1. Billed per second at the resolution, audio and video-input rate; an edit is held at the longest source and billed for the clip Kling returns. - txt2img: Kling Image 3.0, 3.0 Omni, O1 and 2.1, billed per image. - txt2speech: Kling TTS with its English and Chinese voices, billed per request. Kling's business error codes map onto the driver error contract, so an exhausted resource pack reports as credit exhaustion and a submit-time content block as `moderation_flagged`. "Risk control" failures now count as content-filter refusals. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): treat Kling's unknown-model codes as a Puter-side failure Kling answers 1202/1203 when the method or model isn't one it serves. Puter picks both, so these meant catalog drift but surfaced as a 400 that blamed the caller and raised no alarm. They now return 502 upstream_failed with a warning alarm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): tighten Kling input checks and error mapping - 3.0 Turbo takes at most 2,500 prompt characters with a first frame, the image-to-video endpoint's limit. - O1 refuses reference images together with a first and last frame. - 3.0 Omni accepts a source of up to 15.5 seconds, and an edit is held at 16 seconds to cover it. - A source video Kling can't decode fails as 400 upstream_bad_request instead of a Puter-side 502. - A 1201 about the model counts as catalog drift, like 1202/1203. - Auth failures no longer pass Kling's console wording to the caller. Adds integration tests for the image, video and TTS providers, gated on PUTER_TEST_AI_KLING_API_KEY. * feat(ai): wait up to 14 minutes for a video job Video jobs, Kling edits in particular, can take over 10 minutes. The poll window and the Gemini Omni deadline move to 14 minutes, under the SDK's 15-minute idle timeout, with holds and signed source links lengthened to match. The keep-alive default moves to 920 seconds so it stays above a 15-minute proxy idle timeout. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-20 12:32:19 -07:00
Daniel Salazar	41e4b582d3	fix(subdomains): emit subdomain.delete for sites deleted with an app (#4273) ... Sites and workers tied to an app go with it by FK cascade, on app delete and on deleting the app owner's account. Only caches were dropped for them, so the subdomain.delete listeners (CDN purge, worker script teardown, worker sessions, site cleanup) never ran.	2026-10-20 12:31:40 -07:00
Reynaldi Chernando	2a49689fad	fix contradicting jsdocs and docs (#4282)	2026-10-20 18:39:49 +07:00
Juan Fernando CastroandDaniel Salazar	b54b76715a	feat(fs): finish a home rename that stopped partway (#4255) ... * feat(fs): finish a home rename that stopped partway FSEntryStore.rebaseUserSubtree runs renameUserHome's owner-scoped cascade on its own (same subtree matching, same rebased-cache invalidation) and also drops the home row's cached copies at either path. countUserSubtree counts the owner's rows under a prefix with that same matching, from the primary. renameUserHome now uses the shared cascade. * fix(telemetry): resolve the tracer per span so a test's provider is the one used withSpan held a ProxyTracer built at module load, which caches the first provider it delegates to. Test files sharing a worker then sent spans to a provider an earlier file had already shut down. * fix(fs): drop cached copies of only the rows a home rebase moves The owner-scoped rewrite read its invalidation set from everything under the new prefix, which for a finishing rebase is the whole live home; it now reads the rows it is about to move. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-20 00:59:40 -07:00
Juan Fernando Castro	d978538c9d	feat: let a subdomain claim keep the main pipeline (#4268) ... `extension.claimSubdomain(name, { mainPipeline: true })` serves `<name>.<domain>` the way core's own subdomains are served: through CORS, body parsing, auth and every route, `subdomain: '*'` ones included. Routes declared for the name are ordinary routes, with no option restrictions. Gated claims (`{ authorize, checkRoute? }`) behave as before. onlyoffice's subdomain now comes from its extension's claim, so core no longer lists it among the subdomains it serves itself. Without that claim `onlyoffice.<domain>` gets the unclaimed-subdomain 404 like any other name.	2026-10-20 00:43:54 -07:00
4 people	e83e27f306	feat(ai): edit a source video with txt2vid (Gemini Omni, FLUX 3) (#4272) ... * feat(ai): edit a source video with txt2vid on Gemini Omni txt2vid takes an `inputVideo` option (sent as `input_video`): a URL, data URI or Puter file path to an MP4, QuickTime or WebM video of up to 32 MiB. Gemini Omni receives it inline next to the prompt, which describes the edit or extension. Google enforces the 10-second limit. Models declare `videoInput` in the catalog, and the driver rejects a source video for any other model instead of letting the provider drop it. The credit hold adds 16,000 input tokens for a source video, since countTokens reports far fewer tokens than the reply bills. loadFileInput takes an optional `timeoutMs` for web URLs, and cancels the body of a failed response. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(ai): edit a source video with FLUX 3 on Together AI FLUX 3 takes `input_video` as Together's `media.source_video`. A web URL goes through for Together to fetch; a data URI or Puter file is read with the caller's access, capped at 32 MiB, sniffed as a video and sent inline. Editing is estimated and billed at the 1080p rate of $0.54/s, since FLUX 3 jobs report no cost. Image inputs can't be combined with a source video. Seedance 2.0 ignores `source_video`, treats `reference_videos` as a loose reference rather than an edit, and Seedance 2.5 fails on reference videos, so neither declares `videoInput`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(ai): name FLUX 3 as a video editor in the AI overview Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai): match Hailuo 02 to Together's price and document estimate billing Together quotes $0.56 for a Hailuo 02 clip; the catalog had $0.49. Together's video jobs no longer report what they cost, so every Together clip is billed at the catalog's highest published rate. The docs said the charge was the amount Together reports; they now describe the estimate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: enforce video edit durations and propagate source fetch cancellation * fix(ai): pass media inputs as Puter files and stream source videos Source videos were read whole into the API process, base64-encoded and sent twice to Gemini (countTokens and the interaction), which held about 128 MiB per in-flight edit for up to ten minutes. - Video inputs are a URL, a Puter file path or a data URI of at most 1 MiB. Together gets a Puter file as a 15-minute presigned S3 URL and fetches it itself; Gemini streams it into the request body with an exact Content-Length, so it's never held as one string. - Gemini counts only the prompt and image for a source video, and both providers read the source only after the credit hold. - txt2img and txt2vid image inputs accept Puter file paths, read within the caller's access right before the provider call. Existing URL, data URI and base64 inputs are unchanged. - puter.js writes a Blob, File or data URI over 1 MiB to a temporary file under .tmp, sends its path, and deletes it once the call settles. - FLUX 3 edits bill at the 720p editing rate, matching their 1280x704 output. * fix(ai): stage inputs after website sign-in, keep images working without a write - puter.js chose the temporary file path before signing a website visitor in, so it fell outside the app's data directory and the upload was refused. It now signs in first, then picks the path. - An image that can't be written (no access, storage full) is sent inline as before instead of failing the call. Videos still fail, since a large inline video isn't accepted. - Telling raw JPEG base64 from a path decodes only the first 24 characters instead of the whole input. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-19 23:33:03 -07:00
Udit AgarwalandDaniel Salazar	54f542ace4	fix(gui): refresh Start menu apps without blocking cached rendering (#4244) ... * fix(gui): refresh Start menu apps without blocking cached rendering * docs: remove desktop Start menu limits from SDK reference * fix(gui): drop the 1 MiB cap on the launch-apps refresh Recent entries carry each app's raw icon column, which can still hold a data URL of up to 5 MB, so a large icon tripped the cap on every request, including the one at startup, and left the Start menu with no apps. Replace the cap's test with one for the unlaunchable-app filter. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-19 16:13:55 -07:00
Daniel Salazar	18b96d529c	fix: misc scan fixes (#4270)	2026-10-19 12:32:13 -07:00
Kunal Jaiswal	f146da16d1	fix(gui): drop deleted apps from the start menu (#4243) ... The start menu read a session-cached launch-apps list and only refetched when it was empty, so an app deleted after page load (for example in Dev Center) stayed in Recent and Recommended until a reload. Refetch on every open, and filter out entries the backend marks unlaunchable, so a reclaimed or inaccessible app leaves the list too. Apply the same filter to the dashboard's Recent apps. Adds helpers/launchAppsList.js with filterLaunchableApps and its unit test.	2026-10-19 10:50:36 -07:00
Daniel Salazar	dd56d54753	docs(bug-bounty): add eligibility rules (#4269) ... Bounties cover user security/privacy and platform security/health only. Reports must show a direct attack without pre-assumed access, and exploits that rely on sharer/sharee trust are hardening or lower severity. Also generalizes the metering non-issue, adds existence-only oracles, and tightens duplicate, proof and first-contact rules.	2026-10-19 10:49:12 -07:00
Daniel Salazar	e5fd30ccf0	fix(ai): validate large base64 by decoded length, not regexps (#4265) ... * fix(ai): validate large base64 without anchored regexp loops Gemini TTS replies over ~4 MB of base64 (~65 s of audio) failed with "Maximum call stack size exceeded". Once a process holds enough compiled code, V8 compiles new regexps unoptimized, and `^[...]+={0,2}$` then pushes a backtrack entry per character until its stack overflows. TTS now searches for a character outside the alphabet instead. The raw base64 icon/reference-image check drops its own anchored regexp; decodeStrictBase64 already rejects the same inputs. * perf(ai): validate base64 by decoded length instead of regexp passes Unoptimized regexp scans dominated large payloads: 186 ms for max-length TTS audio, 880 ms in decodeStrictBase64 for 30 MB of video. Buffer.from skips characters outside the alphabet, so comparing the decoded length with the one the input length predicts catches them for free. decodeStrictBase64 now does that plus rejecting the URL-safe alphabet (~10 ms for 30 MB), and TTS reuses it instead of its own check. Non-canonical trailing bits now decode instead of being rejected. * fix(ai): reject non-ASCII base64 that Node decodes by its low byte Node reads code units above 0xFF by their low byte, so U+012B decodes as '+' and keeps the decoded length the input predicts. Require ASCII (~1-2 ms for 43M chars) before the length check.	2026-10-18 21:56:29 -07:00
Neal Shah	517efda38a	automerge emergency fix (#4264)	2026-10-19 00:18:58 -04:00
Neal Shah	ea3801fb74	PUT-2058 and PUT-2096 (#4256)	2026-10-18 23:30:01 -04:00
Daniel Salazar	0786cc7db2	fix(webdav): PROPPATCH checks write access and answers with the masked path (#4260) ... PROPPATCH now requires write access on the target, like PUT and DELETE, and its response href goes through the request's share-path masker the way PROPFIND's do.	2026-10-18 00:33:54 -07:00
Daniel Salazar	592020c899	docs(bug-bounty): list re-claimed abandoned site and worker names as a known non-issue (#4261)	2026-10-18 00:33:49 -07:00
Daniel Salazar	9ff224e22f	perf(backend): cut sequential round trips on auth, fs, driver, event and site paths (#4259) ... Pipeline - CORS preflights send Access-Control-Max-Age: browsers stop re-preflighting authed calls every 5 s. - `req.ua` is parsed on first read instead of on every request. - JSON `rawBody` reuses the parsed buffer instead of copying it. - `emitAndWait` returns early when nothing listens: no span or closure per unlistened driver call. - SQLBatcher sends a lone query on the next tick while fewer than 8 flushes are in flight, and waits `maxTimeInQueue` as before otherwise. Lone reads skip the 10/30 ms wait; batching under load is unchanged. Auth and permissions - Token-to-actor auth starts the user, session and app lookups together and checks them in the same order: fewer sequential Redis round trips per authed request. - get-user-app-token and check-app reuse the resolved app row. getOrCreateApp skips the re-select after its own insert and doesn't wait on the cache write for replica rows. - getOrCreateApp reads the race winner from the primary when its insert loses, so it no longer hands out a session that was never written. - whoami runs the email check and the OIDC/taskbar/team lookups in parallel; key order unchanged. - OIDC providers are memoized once every discovery succeeds, with one discovery fetch in flight per URL, and the Apple key is parsed once. - gui-token and sync-cookie use `req.actor.user` instead of re-reading the user. - listSessions batches app lookups. App icon probes run together, and the original-icon probe skips the lineage fallback. - Default-granted permissions are answered from config before the scan cache, and exploded options are deduped: one less Redis read per /drivers/call. - ACL resolves ancestors lazily (owners and full-access tokens skip them) and scans the node first, then the ancestors concurrently on a miss. Filesystem - Missing-path lineage lookups run 10 at a time: batch-upload path resolution drops from about 1.3 s to about 40 ms per 100 new files. - MySQL single-file inserts return the row built from the written values, falling back to the primary read: one less primary round trip per new file. - Batch thumbnails are stored with one UPDATE per chunk (200 rows or 4M chars), with a per-row fallback. - storage.quota.bonus listeners run concurrently next to the usage SUM, and the payload carries `userUuid`: quota checks and /df no longer serialize the listener reads. - readdir cache backfill is one pipeline instead of 3xN SETEX. - Profile reads skip the lineage fallback; the own profile is read alongside the user lookup. - Legacy /stat runs is_empty (new `hasChildrenByParentUid`), owner and thumbnail concurrently. - Downloads and the video proxy pipe through `pipeToResponse`: aborts release the storage stream at once with no extra 'close' listeners, and the video proxy no longer crashes on a mid-stream upstream error. - mkdir looks up target and parent together. - Upload completion reuses the session from the access check (status is still re-read before completing), and multipart signing reads it once. - Moving a shared file to Trash skips two lookups that always returned the entry itself. Drivers and events - Subscription resolvers run concurrently and are folded in registration order. - SubdomainDriver and WorkerDriver overlap independent lookups. - The events "anyone subscribed?" check is one Redis pipeline when the region is warm. - Handler publish overlaps the count with the size check. - Broadcast flushes peers concurrently over a keep-alive agent, so a slow peer no longer delays cross-region invalidations to the others. Sites, share and AI - Hosted sites resolve the owner first, then the app and root together. Site config loads only on 404s. The hosted-app query selects only the columns it uses and moves into AppStore. - shareFlags asks about the plan only when an item is shared by link only. - Share listings run the count, teams and plan reads alongside their page query. - Claude attachment cleanup no longer blocks the response. - New util `awaitLater` for promises started early and awaited later.	2026-10-17 12:03:35 -07:00
Daniel Salazar	9ad7b99607	fix(puter-js): handle file picker cancel message (#4257)	2026-10-16 23:51:55 -07:00
Daniel Salazar	28f162ee92	fix(metering): fence settles, idempotent monthly claim, split addon consumption (PUT-2001) (#4236) ... * fix(metering): pin metering writes to one replica, fence settles, idempotent monthly claim (PUT-2001) store-kv-v1 is a last-writer-wins global table, and every region settled its metering buffer into its local replica, so concurrent increments to the same per-actor item from two regions could drop one side. Writes and consistent reads of metering:* and policy:actor:* items now go to the dynamo.home replica. Buffered settles record each write on the claim with a fence token before sending it, and the KV store refuses a token the item already holds, so a re-driven claim applies its write once. Claims are serialized per counter within a cache so one writer's tokens land in order. The monthly charge claim is a set-if-absent of a random token, and a failed claim write keeps its token for the retry, so a write that landed anyway still charges exactly once. * fix(metering): drop home-replica pinning; keep addon consumption off the purchase record (PUT-2001) Pinning every metering write and exact read to one replica put a cross-region round trip on credit checks near the allowance and on every settle, and made one region's outage stall metering everywhere. The per-item clash it guarded against is rare and undercharges at most a flush window. The one clash that loses money is a credit purchase and an overage settle landing on the addons item in different regions at once. Consumption now goes to its own item and getActorAddons sums it with what the purchase record already holds. * perf(metering): read addon consumption only for accounts with purchased credit (PUT-2001) * perf(metering): settle counters through a sliding pool instead of waves (PUT-2001) * feat(metering): consistent-read option on getActorAddons (PUT-2001) Admin credit checks read the purchase record directly to get a consistent read, which misses consumption now that it lives on its own item. They can call getActorAddons with consistentRead instead. Also formats the lines this PR added.	2026-10-16 23:49:23 -07:00
Daniel Salazar	fa62b3fb76	move template menu entries into a tested helper (#4258) ... Builds the "New > User templates" entries in helpers/templateMenuItem.js and covers the label with tests, including HTML encoding of both the extension and the name.	2026-10-16 23:45:04 -07:00
Filip Kujundžićand404oops	e950a87f29	Add Gemini Omni video generation with token metering (#4235) ... * Add Gemini Omni video generation with token metering * Keep explicit Gemini video model selection within provider * Settle reported Gemini video usage before validating output --------- Co-authored-by: 404oops <oops404@util.404oops.com>	2026-10-16 23:21:48 -07:00
3 people	1cb9dd756a	Add Gemini transcription with consistent usage settlement (#4234) ... * feat(ai): add Gemini unary transcription * Clarify transcription language results and omit pricing * style(ai): keep Gemini transcription sources prettier-clean Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ai-speech2txt): charge Gemini transcriptions that fail after Google answers Google bills an interaction it processed whether or not it completed, so an incomplete, failed or malformed reply was free to the caller and paid by Puter; audio whose transcript overran the output cap could be resubmitted at no cost. Usage is now recorded before the reply is checked, falling back to the counted audio tokens when the reported usage can't be read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Preserve transcript text with optional malformed annotations * Keep speech provider spacing consistent --------- Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 23:21:47 -07:00
4 people	be16bca1d9	Keep Gemini speech instructions separate and validate speech requests (#4233) ... * fix(ai): keep Gemini speech instructions separate from transcript * Clarify Gemini speech instructions * style(ai-tts): keep Gemini cost comment prettier-clean Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Validate speech requests and settle reported Gemini usage * Clarify speech settlement for unreadable responses * Reserve the published Gemini speech token budget * Clarify speech accounting for bounded responses * Limit only Gemini TTS text to 3000 characters; charge overrun replies The 3000-character text cap moves from the TTS driver into the Gemini provider, so other providers keep their own limits. The Gemini reply cap rises to 64 MiB, which fits the full 16,384-token audio budget. A reply that still overruns it or times out reports no usage, so it is charged the held budget and the error tells the caller to split the text. --------- Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-16 23:21:47 -07:00
3 people	2305d50e36	Restore supported Gemini chat models and align scheduled pricing (#4232) ... * feat(ai): restore available Gemini models and align pricing * Exclude deprecated Flash Image additions and share scheduled pricing * Bill Gemini 2.5 Pro at its current list rates Cache reads are $0.125/M, and prompts over 200k tokens bill every rate at the long-context tier ($2.50 in, $15 out, $0.25 cached). --------- Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-16 23:21:47 -07:00
3 people	352427687e	Add Gemini Argon with mode-specific limits and native usage metering (#4231) ... * feat(ai): add Gemini 4 Argon with native usage metering * test(ai): isolate Argon HTTP smoke test from optional extensions * fix(ai): preserve Gemini native completion and refusal reasons * Refer model specifications and pricing to the directory * Bound unary Argon requests and reject unsupported content * Keep Gemini tool metadata out of Claude requests * Describe provider-specific chat timeout boundaries * Keep Gemini extra_content off other providers; report Gemini timeouts as 504 Replayed tool calls only carry extra_content for providers that opt in (Gemini), so OpenAI-compatible and Responses vendors don't see an unknown field. The native Gemini client now owns its request deadline: the SDK's own timeout aborted without a reason and read as an internal error. A deadline timeout returns 504 upstream_timeout and leaves the route in rotation. --------- Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-16 23:21:46 -07:00
3 people	145d54cf69	Handle unavailable chat model routes and exclude batch variants (#4230) ... * Handle model access denials and filter batch chat variants * Raise a low alarm when a provider denies model access A 403 model_not_found still returns 400 upstream_bad_request, but now alarms at info so a lost provider entitlement gets noticed. HttpError gains an alarmSeverity option the terminal alarm gate honors. --------- Co-authored-by: 404oops <oops404@util.404oops.com> Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-16 23:21:46 -07:00
Reynaldi ChernandoandClaude Opus 5.5	471b900462	remove private access routing from docs (#4252) ... Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 20:14:21 +07:00
Daniel Salazar	2b254b8892	fix: misc bugs (#4251)	2026-10-15 23:49:17 -07:00
Neal Shah	2a15afc570	Resolve PUT-2059 (#4250)	2026-10-16 01:45:56 -04:00
dependabot[bot]	f9860b036b	chore(deps-dev): bump prettier from 3.9.9 to 3.9.10 (#4240) ... Bumps [prettier](https://github.com/prettier/prettier) from 3.9.9 to 3.9.10. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.9...3.9.10) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 14:46:31 -07:00
dependabot[bot]	76e1f79b5e	chore(deps): bump smtp-server from 3.19.17 to 3.19.21 (#4242) ... Bumps [smtp-server](https://github.com/nodemailer/smtp-server) from 3.19.17 to 3.19.21. - [Release notes](https://github.com/nodemailer/smtp-server/releases) - [Changelog](https://github.com/nodemailer/smtp-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/smtp-server/compare/v3.19.17...v3.19.21) --- updated-dependencies: - dependency-name: smtp-server dependency-version: 3.19.21 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 14:43:54 -07:00
dependabot[bot]	943a3427c6	chore(deps-dev): bump @types/busboy from 1.5.4 to 1.5.5 (#4241) ... Bumps [@types/busboy](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/busboy) from 1.5.4 to 1.5.5. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/busboy) --- updated-dependencies: - dependency-name: "@types/busboy" dependency-version: 1.5.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 14:38:42 -07:00
dependabot[bot]	38469a3615	chore(deps): bump libphonenumber-js from 1.13.14 to 1.13.15 (#4239) ... Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.13.14 to 1.13.15. - [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/compare/v1.13.14...v1.13.15) --- updated-dependencies: - dependency-name: libphonenumber-js dependency-version: 1.13.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 14:35:15 -07:00
dependabot[bot]	a4d4a5595e	chore(deps-dev): bump vite from 8.1.5 to 8.1.6 (#4238) ... Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.5 to 8.1.6. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v8.1.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.1.6/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.1.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 14:35:07 -07:00
dependabot[bot]	de69269b10	chore(deps): bump uuid from 14.0.2 to 14.0.3 (#4237);'''"???????????????????? ... Bumps [uuid](https://github.com/uuidjs/uuid) from 14.0.2 to 14.0.3. - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](https://github.com/uuidjs/uuid/compare/v14.0.2...v14.0.3) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-15 13:25:49 -07:00
Neal Shah	8faff74793	PUT 2057 and PUT 2068 (#4245)	2026-10-15 02:02:00 -04:00
Neal Shah	e5ca303c50	PUT-1903 (#4226)	2026-10-14 20:29:55 -04:00
Juan Fernando Castro	c6c0dd5e29	fix: bound how many accounts a team owner can provision (#4223) ... * feat: bound provisioning by what an owner may mint, not only what is live Seat and team caps express how much may exist at one time. This adds the other half of the rule: how much an owner may create over a window, and the checks a provisioned account answers to. - Provisioning puts each seat through `SignupService.runSignupGate`, the same extension-owned gate a signup answers, and refuses what it blocks. It fails closed, since a check that could not run is not a check that passed. - A per-owner budget over a rolling window, sized to every seat the owner may hold live across every team they may own, times the churn allowed on top. It is spent on creation and is not returned. Keyed on the owner's uuid so a recycled id cannot inherit someone else's spend, and charged after validation so a taken username costs nothing. * refactor: tighten the provisioning gate and budget after review - The gate runs before the seat-cap lock. A listener has no deadline and the lease is ten seconds with nothing to renew it, so the lock must not be held across one. - `failOpen: false` rethrows rather than returning false, so a backend outage is answered 503 instead of escaping the handler. - An address goes through `validateEmail` first, as it does on every other path that creates an account. - The gate always runs; a request only enriches what it is told, so one being absent is no reason to skip it. - The gate is told it is looking at a seat, whose address is optional. - A refusal carries the gate's own code and request code, as a blocked signup does, so support can correlate it. - Restored `provisionAccount`'s docblock, which an insert had displaced. Tests: the spy restores in `finally`, and the cap overrides are taken after the fixtures, so one failure cannot cascade through the file. * fix: show a provisioning refusal as a rule, not a failure The console special-cases the seat cap and sends everything else to "Something went wrong", which reads as a fault rather than an answer. The provisioning budget refuses the same way the cap does, so it is presented the same way.	2026-10-14 11:54:35 -04:00
Juan Fernando Castro	e32bfa839d	fix: count one app open per account per app per hour (#4152) ... * fix: count one app open per account per app per day `app_opens` is read two ways at once: `open_count` is a row count and `user_count` is distinct accounts. A repeated open moves the first without the first moving the second, and the incentive report prices opens. An open is now marked as it is recorded and skipped for the rest of the day, before both the row and the event ClickHouse ingests, so the two stores agree. The marker is set only when absent, so the first open of the day wins a race; an unreachable marker counts the open, since counting twice beats not counting. * fix: count one app open per account per app per day, at the count Dropped the row-suppression approach. `app_opens` is not only a counter: `getRecentAppOpens` orders the desktop's recent list by `MAX(_id)`, and `app.opened` is the socket event other tabs reorder on. Suppressing the repeat row froze both at the first open of the day. Every open is recorded as before. `open_count` counts each account once per day instead, which is the figure `user_count` is read against. `countDistinctUserDays` folds the pair into one number because `COUNT(DISTINCT a, b)` is MySQL-only, and `dayBucket` covers MySQL's decimal division. ClickHouse has uniqExact over the tuple. Note the figure's meaning changes at deploy: a period spanning it mixes rows with account-days, so a comparison across that point is not one. * fix: count one app open per account per app per hour Review feedback: a day is too long a window for the repeat to collapse into. The period is now an argument rather than a baked-in 86400, held in one constant on AppStore beside the other store policy numbers, so the SQL and ClickHouse sites cannot drift and a future change is one line. The fold `COUNT(DISTINCT user * N + bucket)` is only injective while the bucket index stays under N. Hourly buckets are 24x the day index and pass the old 1000000 in 2084, so N moves to 10000000. Buckets are clock hours, not a rolling window, so two opens a minute apart either side of the hour still count twice — tested, and the same property the day version had at UTC midnight. The detailed-stats fixture gave its repeat open a 60s offset, which under hourly buckets would have counted twice whenever the suite ran in the first minute of an hour. It now shares a timestamp with the open it repeats.	2026-10-14 11:54:17 -04:00
Daniel Salazar	ff815f730d	fix: harden token delivery, session revokes, app identity and fs scoping (#4229) ... - relay sign-in popups take the opener origin from the referrer only - session revokes read the primary, batch per user, and tombstone caches in every region - wisp relay tokens bound to the minting session; verify rechecks the account - hosted origins keep app identity with the site owner; deleted app uids recorded in deleted_apps - subdomain cache tombstoned on delete, update, reclaim and app/account cascades - email lookups require an exact address match after the SQL lookup - workers deploy only from files the deployer owns - share_app_data:false enforced at ACL time, plus copy/move/rename/share/recursive listing - kv remove returns no value without read; kv:expire op grant usable - fs errors name the entry instead of the owner's path - shared-by-me drops rows a delegate no longer has authority over - private apps can't move index_url onto another user's origin - GUI: default apps saved and launched by uid; save picker accepts only copy/move; permission dialog waits for focus; Publish as Worker hidden on others' files	2026-10-14 06:56:44 -07:00
Juan Fernando Castro	84aaf005ec	fix: give every route behind the user-protected gate a password budget (#4150) ... * fix: give every route behind the user-protected gate a password budget Five of the six routes behind the gate declare a per-user hourly bucket for the password check. The sixth, delete-own-user, declared none. The bucket moves into the gate itself, so it covers every route behind it and a new one cannot be added without one. It is charged by the outcome rather than by the request: a wrong answer spends one and a right answer spends nothing, so a caller who knows the password never meets the limit. * fix: the review's findings on the password budget Reading the budget and spending it on the outcome bounded rounds rather than attempts: everything already in flight read the same budget and was answered before any of it was spent. The charge lands before the comparison now, so a burst is bounded by the same number as a sequence. The key gained a route component. One bucket across all six meant ten mistyped passwords on one route closed the other five for the hour, including the one an account owing its team's 2FA has to reach.	2026-10-14 09:52:23 -04:00
Daniel Salazar	f6a1e54642	fix(fs): keep S3 read stream errors from crashing the process (#4227) ... getObjectStream now attaches an 'error' listener to every body it returns. A body that fails before its consumer attaches (socket timeout, reset, or a checksum mismatch on a truncated read) used to emit 'error' with no listener and exit the process, failing every in-flight request on the task. It now logs a warning; consumers that attach later still receive the error.	2026-10-13 17:42:28 -07:00
Filip Kujundžić	d211a25c6d	Merge pull request #4218 from HeyPuter/codex/put-1851-deepseek-peak ... Protect direct DeepSeek peak-only pricing	2026-10-14 00:54:11 +02:00
404oops	2e1bf86d2b	test(ai): protect direct DeepSeek peak-only pricing	2026-10-13 20:44:00 +02:00
404oops	8c31670453	Align ZAI modality metadata with source conventions	2026-10-13 20:43:58 +02:00
404oops	16d0ce8b3e	Advertise supported image input for ZAI Flash models	2026-10-13 20:43:58 +02:00