5584 Commits

Include renames

Author	SHA1	Message	Date
Nariman Jelveh	7f93166560	fix(hosting): disconnect the directory when update gets a null root_dir (#4345) ... puter.hosting.update(name, null) sends root_dir: null, which the driver stringified into a lookup for a folder named "null" and rejected, so disassociating a website from a folder's properties always failed.	2026-10-25 23:28:45 -07:00
Nariman Jelveh	21846192d1	feat(dashboard): publish websites and workers from Files in dashboard dialogs (#4342) ... * feat(dashboard): publish websites and workers from Files in dashboard dialogs The Files tab's Publish as website and Publish as Worker actions open dashboard form dialogs instead of desktop windows: the address field shows the domain inline and shapes the typed name into a valid one, workers get a Sandboxed switch, and success shows the live address with copy and open. Published rows get their badges right away. The form dialog gains suffix and switch fields and a shared copy row, which the API token dialog now uses too. The save-account / confirm-email gate before publishing moves to one helper shared by both flows. * fix(gui): ask a just-saved account to confirm its email before publishing Saving a temporary account can leave its email unconfirmed when signup doesn't require confirmation. The publish gate returned right after the save, skipping the confirm-email step the old inline checks still ran. * fix(dashboard): link a published site to the address the server reports The success screen built https://<name>.<hosting domain>, which is wrong on a self-hosted instance serving sites over http. Use the address the create response carries, the one the rest of the GUI shows, and fall back to the built one only when it's missing. * fix(dashboard): dim a suffixed field as one box while the form submits Only the input inside it dimmed, leaving the domain after the name at full contrast while the field was locked. * fix(dashboard): point a taken or reserved publish name at the address field The server's reason showed in the status line, but the field stayed unmarked and focus stayed on Publish, so changing the name took an extra click. Mark the field invalid and focus it for the rejections that mean "pick another name". * fix(dashboard): type into a suffixed field when its suffix is pressed The domain after the name is drawn inside the field's box but was a plain span, so pressing it focused nothing. A press there now focuses the field with the caret at the end, and the suffix shows a text cursor. * chore(dashboard): drop a phone width rule the icon buttons never used The form dialog's phone flex rule sizes these buttons, so the width never applied; touch screens get 44px from the coarse-pointer min-width. * fix(dashboard): read an underscore in a website address as a word break A website name can't hold an underscore, so typing My_Cool Site gave mycool-site. Underscores now become a hyphen, as spaces do; a worker name keeps them. * fix(dashboard): keep the letter when an accented one is typed into a publish address Café became caf: an accented letter isn't a DNS character, so it was dropped whole. The accent comes off and the letter stays. * fix(dashboard): cap a website address at a hostname label's 63 characters The server takes a 64-character subdomain, but DNS caps a label at 63, so the site it publishes can't be reached. The field now stops at 63, as the worker one does. * fix(dashboard): let a publish address finish composing before shaping it The address was reshaped on every input, composing included: a dead key's accent turned into a hyphen before its letter arrived, and IME text was rewritten under the composition. Composed text is now shaped once it's in.	2026-10-25 21:34:39 -07:00
Nariman JelvehandClaude Opus 5.5	b9f0c8601d	fix(dashboard): eighth adversarial review of Files — bugs, UX, a11y, perf (#4330) ... * fix(dashboard): don't preview a file named after an image type, or a failed image Space on a file named "png" (no extension) opened the image preview over a broken image: the type was read from the last dot-separated part of the name, which for an extensionless name is the whole name. It's now read from the extension. A preview whose image URL couldn't be fetched left the previous image up under the newly selected row and raised an unhandled rejection. It now closes instead. * fix(dashboard): sort Files names by number, and break size/date ties by name Names were compared as plain text, so "file10" sorted before "file2" and "dir10" before "dir2". They now compare as a file manager does, with runs of digits by value. Sorting by size or date left rows with the same value (every folder, when sorting by size) in whatever order the server listed them, and a row added afterwards (a new folder, a rename) landed after its equals instead of where a fresh listing would put it. Ties now fall back to the name, in the full sort and in the single-row insert alike. The sort also parsed each trashed item's metadata on every comparison; it now reads each entry's sort key once. * fix(dashboard): ask about "this item" when permanently deleting one Trash item The Delete key and the phone selection bar's Delete Permanently asked "Are you sure you want to permanently delete these items?" for a single item too. One item now gets the single-item question, as from its own menu. The three copies of the confirm-and-delete step (Delete key, selection bar, multi-select menu) are now one. * fix(dashboard): don't let saved column widths squeeze out an auto-width name Saved widths too wide for the listing fall back to the defaults, but only when the Name column had a saved width too. Beside an auto-width name, a Size or Modified column widened on a large screen kept its width on a smaller one and squeezed the names to nothing, with the row scrolling sideways. The check now counts an auto-width name at its 100px minimum. * fix(dashboard): give Files names a phone's full row, not a desktop column width A narrow listing drops the columns for two-row rows, where each name has the row's width. Names were still cut to the Name column's saved width whenever the saved columns happened to fit, so a 120px column set on a desktop cut names to about 100px on a phone with 280px to spare. * fix(fs): refuse to replace a folder that contains the item being moved or copied Moving or copying an item onto a name taken by one of its own parent folders, with overwrite, removed that folder recursively first, and the item went with it. Cutting the inner "photos" out of photos/photos, pasting it next to the outer one and choosing Replace deleted both folders and everything in them. Such an overwrite is now refused before anything is removed. * fix(dashboard): keep the Files selection when an upload lands in another folder An upload into a folder other than the one on screen (a drop on a folder row, a sidebar folder or a crumb, or Upload from a folder's menu) still listed the folder on screen again when it finished. That cleared whatever was selected there and left an open menu acting on rows no longer on the page. Only an upload into the folder on screen refreshes it now. The Upload picker ran its own copy of the upload flow; it now goes through the same one as drops. * fix(dashboard): keep Files rows up while a refresh reads web link and app icons A refresh of the folder on screen keeps its rows until the new listing is in, so it doesn't flash blank. But it cleared them before reading the icons, and a web link's or .app's icon is read from the file over the network, so in such a folder every re-sort, upload or return to the tab blanked the pane for those reads. The icons are now read before the rows are swapped. * fix(dashboard): Ctrl/Cmd-drag a Files selection as a whole Pressing Ctrl (Cmd on a Mac) on a row that was already selected took it out of the selection at once, so a drag starting there collapsed the selection to that one row: a Ctrl-drag of three files to copy them copied one, under a ghost that still read "3". The row now leaves the selection when the button is released without a drag, as in a desktop file manager, and a drag carries the whole selection. * fix(dashboard): let Enter open the row the arrow keys moved to in Files Clicking a sidebar folder, crumb or toolbar button leaves it focused, and the arrow keys and type-to-select still move the row selection from there. Enter, Space and the menu key then went to that focused control: after clicking Documents and pressing Down twice, Enter opened Documents again and dropped the selection instead of opening the highlighted row. The listing now takes the focus when these keys move the selection, so the keys after them act on the rows, and Shift+Tab goes back to the toolbar. * fix(dashboard): let Files' image preview be cancelled while it loads, and close it with the tab The preview only counted as open once its image URL had come back (two round-trips), so nothing could cancel it before then: Escape cleared the selection and the image popped up anyway, a second Space opened it instead of closing it, and opening a folder left the old image to appear over the new one. It now counts as open from the start, so each of those cancels it. Browser Back/Forward to another dashboard tab left the preview floating over that tab, where Escape and Space no longer reach it. A route change away from Files now closes it, as it does Share and Properties. * fix(dashboard): keep Files keys off a new folder until the server has made it A new folder's row goes up with the name editor open before mkdir answers. Clicks and menus already wait on it, but the keyboard didn't: pressing Escape and then Delete on a slow connection sent a move for the row's placeholder and showed "Moving New Folder: Subject does not exist", and Enter opened the predicted path before it existed. Enter, Delete, Ctrl/Cmd+C and Ctrl/Cmd+X now skip such a row, as do Cut and Delete in the multi-select menu and the phone's selection bar. * fix(dashboard): explain a Files action that fails on the network A request that fails at the network level is rejected with no message. New Folder then took its row back with no alert at all, and Restore and the New menu's files showed "[object XMLHttpRequest]". A failed move from the clipboard named the item and nothing else. Each now falls back to "An unknown error occurred." * fix(dashboard): don't offer Trash folders, or view-only shares' crumbs, as Files drop targets Inside the Trash a folder row lit up as a drop target and then refused the drop with an untranslated "Cannot move items into a deleted folder.", and a crumb inside the Trash took the move, though only Restore may take an item out of the Trash. A crumb of a folder shared with the user to view only lit up too, and the drop ended in one refusal per item from the server. Such folders no longer light up, and a drop on one goes back, as a drop on a view-only folder row already did. A view-only crumb still opens on a dwell. * fix(dashboard): count a new folder, not the old selection, in the Files footer New Folder selects the new row, but the footer was updated before that and kept describing what was selected before ("3 items selected"), as did the phone's selection bar, whose buttons by then acted on the new folder. A Shift+click also still extended from the old anchor. The footer now follows the new selection, and the new row is the anchor. * fix(dashboard): update the Files footer when Enter ends a rename Ending a rename with Enter selects the row, and then called the desktop Explorer's footer update, which finds no footer in the dashboard. Renaming a row from its menu while another was selected left the footer at "1 item selected" with two rows selected. * fix(dashboard): stop Files' image preview from running out of read URLs The preview fetched a read URL for every image it showed, and read URLs share the access-token allowance of 20 an hour. Stepping through a folder of images with the arrow keys spent it in seconds, after which the preview (and any app asking for a read URL) failed for the rest of the hour. The preview now reads the image directly and shows it from memory, freed when it closes or moves on, and a held arrow key loads only the image it stops on. * fix(dashboard): don't offer to publish a folder the user may not share from Files' folder menus The background, crumb and sidebar menus offered Publish as Website for any folder, so in a folder shared with the user to view or edit it opened the publish dialog only for the server to refuse. Publishing takes the right sharing does; the item now stays disabled without it, as on a folder row's own menu. * fix(dashboard): open a Files folder under its new name when it's opened mid-rename Double-clicking a folder right after typing its new name (the first click sends the rename) opened it under the old path, which the rename then took away: the view sat in a folder that no longer existed, with crumbs and Back/Forward disagreeing about its name, and New Folder or Upload there failed. Opening a row (double-click, tap, Enter, or Open from its menu) now waits for a rename still on its way, and goes by one path. * fix(dashboard): keep Files' Back/Forward in step with folders moved or trashed Back and Forward kept a folder's old path after it was moved or deleted, here or from elsewhere: going into a folder, back out, and dragging it somewhere else (or deleting it) left Forward leading to "This folder couldn't be opened", with New Folder and Upload gone. History entries now follow a moved folder and what is inside it, and a trashed or deleted one's entries are dropped. * fix(dashboard): keep screen readers from reading Files' icon file names The crumbs' separators, the folder sidebar's icons and every row's icon were images with no alt text, so a screen reader announced each one, by file name in some ("triangle-right.svg"), between every crumb and before every name. They are decorative beside the text they sit next to and are now marked so. The crumb of the folder on screen is marked as the current page. * fix(dashboard): make double-click on a Files column divider fit the column Double-clicking a column divider measured the text in system-ui, but the listing renders in Inter, and took the cells' padding as 8px a side where Size and Modified have 10. Right after "fit to content", the longest name was still cut in the middle and every Modified cell ended in an ellipsis ("40 minutes a…"). Each column is now measured in its cells' own font and padding. * fix(dashboard): keep a renamed item among its sharer's in Files → Shared With Shared sorted by "Shared by", renaming an item shared with the user to edit placed its row by name alone, so it could land among another person's items until the listing was loaded again. A row put back in place now goes by its sharer first there, as the listing does. * fix(dashboard): keep every item, and empty folders' places, in a downloaded zip Downloading several items as one zip keyed each by its name, so two items with the same name (in Files → Shared, two people can each share a "Notes.txt") came out as one file, the other silently gone. Such names now get " (1)" and so on in the zip, as a folder does for a duplicate. Empty folders were put at the top of the zip by their own name, not where they sat: zipping a folder holding x/y gave "y/" next to "x/". They now keep their place. dedupedName moves to helpers/, now that the zip uses it as well. * fix(dashboard): give Files grid tiles both lines of their name A tile has room for two lines of name, but names were cut to fit one: "Quarterly financial report final version.pdf" showed as "Quarterl…l version.pdf" over an empty second line. A name now shows whole when it wraps into the two lines, and is cut in the middle, keeping its extension, only as far as it has to be to fit them. Where the browser wraps a name can't be told from text widths alone, so the tiles are written and read back together, one layout a round rather than one a tile. * fix(dashboard): keep the Files listing when a refresh can't reach the server A refresh of the folder on screen that failed for any reason replaced the listing with "This folder couldn't be opened." and took New Folder and Upload away. Returning to the tab triggers one, so opening a laptop before its Wi-Fi reconnected, or a moment's lost connection during a re-sort, left a folder that was fine looking broken until it was opened again. A refresh that doesn't reach the server now leaves the rows as they are; one the server answers with an error (the folder is gone) still says so. * fix(dashboard): don't drop files added to a Files folder while a new folder is made While New Folder (or New › file) waited for the server, every item added to the folder on screen was dropped, not only the one being made, so a file uploaded from another tab or device in that moment didn't show up until the folder was listed again. Such items are now held until the create is done and added then; the create's own comes through as an update of the row already drawn for it. * perf(dashboard): refresh Files on return to the browser tab only when Files is showing Coming back to the browser tab listed the Files folder again even with another dashboard tab in front, and in Files → Shared that meant every share all over again. The refresh now waits until Files is next shown. * fix(dashboard): move the keyboard focus off a Files arrow that disables itself Pressing Enter on Back to reach the first folder disables Back while it has the focus, and a disabled arrow is drawn at 10% opacity, focus ring included, so the keyboard user lost track of where they were. The focus now moves on to an arrow that still works, or to the listing. * fix(dashboard): show "can't drop here" when dragging files from the computer where Files takes none Files dragged in from the computer showed the copy pointer everywhere in Files, then dropping on the Trash, in Shared, on a folder shared to view only, or while a folder was loading did nothing. The pointer now shows the drop isn't possible there. * fix(dashboard): let Files' type-to-select find names with "i" in a Turkish browser Typed letters were lower-cased for the browser's language and the names they're matched against without one. In Turkish, "I" lower-cases to "ı", so typing it never reached "Invoices". Both are now lower-cased alike. * fix(dashboard): bring Files' Back/Forward along when a folder rename is undone Renaming a folder points Back and Forward at its new name, but undoing the rename left them there: Forward then led to "This folder couldn't be opened" for a name the folder no longer had. Undo now takes them back to the old name too. * fix(dashboard): don't shrink Files → Shared's name column when it's dragged wider In a narrow Shared listing, "Shared by" is laid out narrower beside a name column with no set width. Dragging the name's divider gave it a width, at which "Shared by" sprang back to its own and pushed the name narrower than it started: dragging right made it 30px smaller, and there it stuck. Sizing the name now keeps "Shared by" at the width it had on screen. * docs(fs): note that move and copy never overwrite a folder holding the source * fix(dashboard): keep the Files drop zone after files dragged in cross a folder row Leaving a folder row while dragging files in from the computer also took the highlight off the listing around it, as the row's notice bubbled up to the listing's own. With the "can't drop here" pointer going by that highlight, a drop on the listing after crossing a folder row was refused. The row's notices stay with the row, and the listing goes by whether the folder takes uploads. * fix(dashboard): don't let a Files folder wait for ever on a rename to open Opening a row waits for a rename on its way, which settles in the last step of the rename's handling. A failure after the rename itself (such as refreshing the folder's websites) never got there, and the folder then wouldn't open until it was listed again. Opening waits five seconds at most. * docs(fs): drop the note on overwriting a folder that holds the source The refusal is an edge case, and its error message already explains it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-25 18:59:24 -07:00
Daniel Salazar	24aac2f6d2	fix: app token (#4338)	2026-10-25 11:50:25 -07:00
Daniel Salazar	1eb4e36cf4	fix: add beta flag to kv share docs to match kvhandle beta status (#4337)	2026-10-25 09:17:12 -07:00
Daniel Salazar	3160b99f11	chore: bump ver (#4335)	2026-10-25 08:24:40 -07:00
Daniel Salazar	589a98b12c	feat(kv): share KV prefixes with other users at watch/read/write, and bound what apps can be granted (#4331) ... * feat(kv): share key-value prefixes with other users, and bound what apps can be granted - KV share handles move out of Events into KvShareService, served at /kv/shares (the /events/kv-handles routes stay as an alias). - Shares have watch, read and write levels, encoded in the permission root (kv-share, kv-share-read, kv-share-write) with write implying read and watch. - Every puter.kv method takes optConfig.handle; keys are relative to the shared prefix, cursors are sealed, and private entries stay hidden. - New puter.kv.share, unshare, listShared and listSharedByMe; optional label; kv.share.received notice in the app's mailbox only; recipient blocks apply. - puter.kv.set gains onlyIfAbsent. - fs and kv events gain viaWorker, and kv events report self from the writer. - /auth/grant-user-app only accepts canonical permissions from a fixed set of families; the consent dialog, puter.perms and docs follow. - Migrations: kv_share_handles gains revoked_by, label, and grantee and app indexes (mysql_mig_49, postgres_mig_38, sqlite 0095). * fix(kv): never name a private key in a cross-app or handle cursor, and bound flat-permission scans - Listings of another namespace (cross-app or through a handle) resume after the last entry they returned, and their cursors are sealed, bound to the namespace or handle, and padded to one length. Old plain cross-app cursors are still read when they name the target namespace; other namespaces get 400. - PermissionStore scans flat permissions a few roots at a time and skips roots nested under another root in the same call.	2026-10-25 08:16:19 -07:00
Toshit ChawdaandReynaldi Chernando	ec3ad1cb2f	docs: easy/medium/hard networking recipes (#4040) ... * add net category + http request recipes * add tcp/tls socket recipes * add complex recipes * minor refine --------- Co-authored-by: Reynaldi Chernando <reynaldichernando@gmail.com>	2026-10-25 19:22:45 +07:00
Reynaldi ChernandoandDaniel Salazar	c7cc64e45c	docs: medium events recipes (PUT-1971) (#4333) ... * docs: easy events recipe (PUT-1961) * docs: catch-up-on-notifications events recipe (PUT-1961) * docs: events recipe corrections from a run against a live server (PUT-1961) * docs: medium events recipes (PUT-1971) * docs: simpler wording in medium events recipes (PUT-1971) * refine --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-25 19:18:55 +07:00
Nariman Jelveh	0c67499dc2	fix(dashboard): serve stale profile pictures to every caller, skip detached roots ... While a picture refreshed after its TTL, only the first caller got the stale answer; every later one waited on the network, so in Files → Shared one row showed the picture at once and the rest fell back to initials. paintAvatars now also folds a frame's roots into one pass and skips roots re-rendered away before the frame, so they fire no lookups.	2026-10-24 19:05:54 -07:00
Nariman Jelveh	34d74d36bd	feat(dashboard): show profile pictures on people avatars (#4328) ... * feat(dashboard): show profile pictures on people avatars Avatars that name a person now show that person's profile picture once it loads, and keep the initial-and-color avatar when there is none: - Files → Shared: the "Shared by" cell and the people filter chips. - Share dialog: the owner row and each person with access. Teams, invited emails and link shares keep their initial. - Properties: a new Owner row with avatar for items someone else owns, and avatars beside each version's author. Lookups go through one cache: each person is looked up once and shared by every avatar of theirs, answers (including "no picture") are kept for five minutes, at most 100 are kept, and at most four run at once. Calls made while a listing renders row by row fold into one pass per frame. The signed-in user's own picture is read from their loaded profile, so it takes no request and follows changes in the Account tab. The picture is set as an image's src property, never through markup. * fix(dashboard): profile picture review — stale refresh, picker avatars, limiter - Serve a stale picture while a fresh one loads, so a listing re-rendered after the cache expires no longer drops everyone back to initials. - Show pictures on people in the share recipient suggestions, matching the rows of the dialog they open from. - Free a lookup slot when a lookup throws before returning a promise. - Move profilePictures.js to helpers/, now that a shared helper uses it.	2026-10-24 19:01:05 -07:00
Nariman Jelveh	0bdc2197b0	feat(dashboard): show who shared each item in Files → Shared (#4327) ... * feat(dashboard): show who shared each item in the Files tab's Shared view The Shared view now names the person behind every item: - List view gets a sortable, resizable "Shared by" column with the share modal's initial-and-color avatar. The tooltip names the owner too when someone else re-shared the item. - Grid tiles show the sharer under the item name. - Narrow listings lead each row's second line with the sharer. - A people filter above the listing (one chip per sharer, with counts) narrows the view to one person. It shows once two or more people have shared something, and scrolls sideways on small screens. Sorting by "Shared by" applies only in the Shared view; other folders keep sorting by name while it is the saved sort. * fix(dashboard): keep the name column readable beside "Shared by" In a listing between the phone layout and about 700px wide, the fixed 160px "Shared by" column squeezed an auto-width name down to a few characters. Beside an auto-width name, "Shared by" now takes at most 40% of the room the two split, and resizing it stops at the same width. * fix(dashboard): keep the "Shared by" header on one line Narrowed, its two-word label wrapped onto a second line that spilled out of the 32px header row. It now stays on one line and ends in an ellipsis, as longer translations need too. * fix(dashboard): fit "Shared by" to its longest name on double-click Auto-fitting the column measured names in a font the cell doesn't use and left out part of its padding, so the longest name still ended in an ellipsis. It now reads the font, padding, avatar and gap off a rendered cell. * fix(dashboard): keep the people filter on coming back to Shared Opening a folder from a filtered Shared view and going Back reset the filter to Everyone, so going through one person's folders meant picking them again each time. The filter now lasts while the user browses what was shared with them, and clears once they go back to their own files. * fix(dashboard): update Shared after Remove from Shared Remove from Shared only took the row away, leaving the people filter counting the item. Removing the last item of the person filtered to left a blank pane under a chip that still claimed one. Shared is now listed again afterwards, which updates the filter, the empty notice and the footer. * fix(dashboard): show a notified share past the people filter Opening a "shared with you" notification, or a share link, while Shared was filtered to someone else picked out nothing: the item was filtered away. The filter now gives way to everyone's when it hides an item the notification or link names. * fix(dashboard): truncate a long sharer name on phone-width rows In the two-line row layout, a long username grew the details line past the row, pushing the date off screen and under the ⋯ button. The name now ends in an ellipsis, and the line keeps clear of the button as the name line does. * perf(dashboard): sort the Shared view by sharer with one collator Each sharer comparison called localeCompare with options, which builds a collator per call: sorting 2,000 rows took about 25ms in Chrome. One shared Intl.Collator orders them the same in under 1ms. * fix(dashboard): make share avatar initials readable for every name The initial-and-color avatar drew its letter at too little contrast for nearly half the hues a username can map to: yellows and greens came out near 3:1 in light mode, and lower still on a selected row. The letter is now darker in light mode and lighter in dark mode, reaching 4.5:1 for every hue on the page, selected rows and the share suggestions' hover row. The share dialog and the Shared listing change together, so a person keeps one look. * fix(dashboard): show every folder when a drag springs into Shared Dragging an item out of a shared folder and holding it over Up, Back or the Shared crumb opens Shared to drop into a folder there. The people filter, which now lasts while browsing shared items, could hide those folders, and its chips can't be pressed mid-drag. A drag arriving in Shared now sees everyone's folders. * fix(dashboard): keep filtering Shared when it can't be listed again A chip click lists Shared again so its rows are current. When that request failed, the listing was replaced with "This folder couldn't be opened" and the chips disappeared, though only a filter had changed. A filter change now applies to the rows already loaded when the listing can't be fetched. * fix(dashboard): return a drag let go over Shared to where it began A drag that springs into Shared and is let go over the listing rather than a folder tried to move the items into Shared itself, which is a query and not a folder: nothing moved, nothing said so, and the user was left in Shared. Let go over a listing that takes no items, the drag now goes back to the folder it started in, as the cancel zone does. * fix(dashboard): don't offer read-only shared folders as drop targets Folders shared read-only lit up under a drag and took the drop, which the server then refused with "Forbidden". They no longer light up, and a drop on one sends the drag back where it began; they still open on a dwell. * fix(dashboard): slide a drag back when a read-only folder refuses it A drop a read-only shared folder refused left the drag chip to vanish where it was let go, as if something had happened. It now slides back to where the drag began, as any drop that doesn't land does.	2026-10-24 18:10:27 -07:00
Nariman Jelveh	7759f7afe9	fix(dashboard): seventh adversarial review — bugs, UX, a11y, perf (#4326) ... * fix(dashboard): show notification times in Brazilian Portuguese, Ukrainian and Traditional Chinese The notification panel and toasts handed Puter's language code straight to Intl, and a few of those codes aren't BCP 47 tags. Brazilian Portuguese (`br`) is Breton to Intl, so times read "5 munut zo"; Ukrainian (`ua`) fell back to the browser's default language; and `zhtw` threw, so Taiwan users got English. Those codes are now mapped to pt-BR, uk and zh-TW before formatting. * fix(dashboard): count "yesterday" and "N days ago" in calendar days Notification times rounded the elapsed hours to whole days, so at 23:30 something from 00:45 the same day read "yesterday", and on Wednesday morning something from Monday night (34 hours earlier) read "yesterday" too. Days are now counted from midnight to midnight in the reader's time zone; anything from today stays in hours. * fix(dashboard): don't let deploy results crowd notifications out of the panel The panel listed the 30 newest notification rows and then dropped the ones it never shows, a worker's deploy results among them. A developer with 30 deploys since their last share saw "No notifications" and no badge while the share sat behind them. The listing now asks for up to 200 rows and keeps the newest 30 the panel shows. * fix(dashboard): keep every unread notification in the panel The socket replays up to 200 unread notifications on connect, but the panel's listing held only the 30 newest, and the first refresh after that dropped the rest: 45 unread read "45" until the panel was opened, then "30", and "Mark all as read" left the other 15 unread on the server for the next visit. The panel now keeps unread notifications past the newest 30, up to the 200 a listing returns. * fix(dashboard): let Undo take back a new Files folder or file The Files tab creates folders and New › files itself rather than through the desktop's helpers, and never recorded them for Undo. Undo then reversed whatever came before: upload notes.txt, create a folder, press Ctrl+Z, and notes.txt was deleted for good (undoing an upload deletes it outright, not to Trash) while the new folder stayed. Both now record themselves, so Undo removes what was just created, as on the desktop. * fix(dashboard): let Undo take back a Files cut and paste Pasting cut items in the Files tab moves them itself rather than through the desktop's move_items, and recorded nothing for Undo. Undo after a paste reversed the action before it instead, which deletes an upload for good. The paste now records the move as move_items does, so Undo puts the items back where they were cut from. * fix(dashboard): don't drop a Files selection onto one of its own folders With folders A and B selected, dragging A onto B moved A into B and then stopped on "Cannot move a directory into itself" for B. Hovering B also sprang it open mid-drag. A folder row that is part of the drag is no longer a drop target, so the drag reverts as it does over any other non-target. A drop elsewhere (a sidebar folder, say) also leaves out the target folder itself and any folder that holds it. * fix(dashboard): don't drop a Files refresh asked for during another A refresh of the folder on screen was ignored while another refresh of it was loading. Drop two files: when the second finished during the first's refresh, its own refresh was dropped, the earlier listing (read before the file existed) was drawn, and the file's item.added was ignored meanwhile too, so it stayed missing until a manual refresh. Paste, Refresh and returning to the browser tab could lose items the same way. A refresh now takes over from one in flight, as opening another folder already did; a navigation in progress still holds. * fix(dashboard): keep the phone selection bar after cancelling a delete In select mode on a phone, tapping Delete permanently and then Cancel left every item selected but hid the floating action bar, the only way to act on the selection, until the selection next changed. The same happened when nothing in the selection could be moved to Trash. The bar now goes away only once something is actually deleted or trashed. * fix(dashboard): show the phone selection bar when Select starts with a selection Uploaded or pasted items arrive selected. Tapping Select on a phone then turned select mode on with them selected but no floating action bar, until a row was toggled. Entering select mode now brings the bar up for the selection it starts with. * fix(dashboard): give Files footer sizes in the rows' format The footer used the desktop's byte formatter while the rows use their own, so a 5-byte file read "5 B" in its row and "5.00 Bytes" below it, 1.5 KB read "1.50 KB", and a folder of folders read "0 Byte". The footer now formats sizes as the rows do. * fix(dashboard): title a trashed folder's Properties with its name Properties from the breadcrumb of a folder opened inside Trash was titled with the folder's uid, the last segment of its trashed path, while the crumb itself showed the original name. It now uses that name. * fix(dashboard): show delete and log-out confirmations without entities The Files tab's "delete these items permanently?" confirmation and the dashboard's "close your apps and log out?" one passed HTML-encoded i18n strings to UIAlert, which encodes its message and button labels again. In Igbo both questions read "Ị ji n&#039;aka …". These alerts, and the Files tab's name-conflict and folder-depth ones, now pass plain strings. * fix(gui): read the Trash's state fresh when updating its icon refresh_trash_state stats the Trash to pick the empty or full icon, and its comment calls for a strong read, but it asked for an eventual one. Once a listing of Home had cached the Trash entry (without `is_empty`), the stat came back without it: permanently deleting the last items from Trash in Files left the full-Trash icon up, and other tabs were told the same. The stat is now strong, as intended. * fix(dashboard): don't add a Files row to a folder opened meanwhile A file added from elsewhere (an upload, another tab, an app) is checked against the folder on screen and then drawn once its icon resolves. A web link's or app's icon is read from the file, and opening another folder during that read put the row into the new folder's listing, where it stayed and opened the file from the old one. The checks now run again once the icon is in. * fix(dashboard): let a focused folder or crumb take the Menu key The Files tab answered the Menu key and Shift+F10 with the selection's menu wherever focus was. With a file selected and a sidebar folder, a breadcrumb or Home's Shared row focused, the key opened the file's menu; with nothing selected it cancelled the browser's contextmenu, so the focused element opened none. A focused control now gets the browser's contextmenu event, and its own menu, as with a right-click. * fix(dashboard): don't drop New Folder during a Files refresh New Folder did nothing while the folder on screen was refreshing (after an upload or paste, or on returning to the browser tab). A refresh keeps the rows up with no spinner, so the click just looked ignored. It now takes over the refresh and makes the folder once the listing is in; during a navigation to another folder it is still dropped, as before. * fix(dashboard): step through Files names on a repeated letter Type-to-select meant to move past the selected row to the next name with the same start, but returned early whenever the selected row matched, so the stepping never ran: with readme, report-a and report-b, pressing "r" again stayed on readme, and "rr" matched nothing. A repeated letter now steps through the names it starts, wrapping around, as file managers do; a longer prefix still stays on a selected row it matches. * fix(dashboard): open one touch menu per long-press A long-press on Android fires both contextmenu and taphold. The Files rows already ignore the second, but a breadcrumb, a sidebar folder, Home's Shared and Trash rows and the listing's empty space each opened a second sheet over the first; picking an item or tapping the backdrop then left the other one up. The touch menu now doesn't open while another is on screen. * fix(dashboard): treat Ctrl+click on a Mac as a right-click in Files On a Mac, Ctrl+click opens the context menu, but the Files rows read it as a Ctrl-toggle first: Ctrl+clicking one of three selected files deselected it and the menu then acted on that file alone, and on an unselected file it was added to the selection. On a Mac it now leaves the selection alone, as a right-click does; Cmd+click still toggles. * fix(dashboard): keep arrow keys in the open phone drawer on Apps With the drawer open over the Apps tab, an arrow key moved focus out of it to the first app tile behind the scrim, and the next Tab then walked the page behind it. The open drawer now keeps the arrow keys, as the notifications panel and dialogs already do. * fix(dashboard): act once on a held Enter or Space in Apps Holding Enter on an Apps folder opened it, moved focus to its first app, and the key's repeats then launched that app; held on the "+" tile, the repeats picked "Browse the App Center" in the dialog it opened, and held in the search box they launched the first match again and again. Key repeats now do nothing on a tile, in the search box or on the add-app dialog's options. * fix(dashboard): don't blank the Apps grid when it re-flows on resize When a resize changed how many columns or rows fit (resizing the window, collapsing the sidebar, zooming, an Android keyboard), the grid was rebuilt behind the first load's fade, which waits on page one's icons. With an icon host that was slow or unreachable the grid went blank for up to 1.5s each time. A grid already on screen now re-flows at once; one still loading keeps its fade. * fix(dashboard): open an app from the add-app dialog at once during a search "Browse the App Center" and "Build with AI" play an intro from the app's tile, and wait up to 3s for that tile to appear. With a search that leaves the app out (the case the "+" tile stays for: a search that found nothing), the tile never appears, so the app opened only after the full 3s. The intro now gives up as soon as the search is what hides the tile, and the app opens straight away. * fix(dashboard): make the Apps search's clear control a button The "×" that clears the Apps search was a bare SVG with a click handler: Tab couldn't reach it, screen readers had nothing to announce, and on a phone it was a 16px target inside the field. It is now a labelled button after the field in the Tab order, with a focus ring, and on touch it hit-tests at 44x44 while keeping its look. * fix(dashboard): tell screen readers when an Apps search finds nothing Typing in the Apps search re-renders the grid silently, and the "No apps match your search" line is drawn into it fresh each time, which screen readers don't announce. A search that matched nothing gave no feedback at all. A persistent status region now says so. * fix(dashboard): keep keyboard focus on an Apps tile across a re-render The grid is rebuilt wholesale whenever its data or size changes: the refresh that follows opening the tab, a resize or zoom that changes how many columns fit, an uninstall that fails. A keyboard user who had arrowed onto a tile lost focus to <body>, so Enter did nothing and the next arrow started over from the first tile. Focus now moves to the same app's or folder's new tile. * fix(dashboard): don't offer Change username to a temporary account A temporary account's Account tab offered Change username, whose dialog asks for an account password the account doesn't have: left empty it said "All fields are required", and anything typed got a 403 from the server, which refuses temporary accounts. The button is now left out until the account is saved, as the Password card already is; saving it re-renders the tab with the button. * fix(dashboard): don't offer Change email to a team seat A team seat's Account tab offered Change email, and after the user filled in the new address and their password the server refused it: "Your team set this address. Ask a team admin to change it." The Email card now shows that note in place of the button, as the Username card already does for seats. * fix(dashboard): don't let a slow picture removal undo a newer picture Saving a profile picture is ordered so an older save can't put its picture back over a newer one, but Remove picture stood outside that order. Clicking Remove on a slow connection and then saving a new photo before the removal answered left the default avatar on screen, and Remove hidden, while the account had the new photo. A removal now yields to a picture saved after it. * fix(dashboard): show placeholders in the Usage headers until they load The Storage and Resources headers started out as " · used of " with the numbers left blank, and stayed that way when reading the storage space or the month's usage failed. They now start at "--% · -- used of --", as Home's cards start at "--", and keep that if the read fails. * fix(dashboard): write Home's trial dates in the dashboard's language The free-trial note on Home formats its dates with the browser's language, not the one chosen in Puter, so with Puter in French and the browser in English it read "…le Mar 5", and the other way round "First charge on 5 mars". The dates now follow the dashboard's language. The notification panel's mapping of Puter's language codes to Intl tags (Brazilian Portuguese, Ukrainian, Traditional Chinese) moves to i18n/intlLocale.js so both use it. * fix(dashboard): write credit and dollar amounts in the dashboard's language Credits were always formatted with English separators and dollar amounts with "$" and English separators, so in German Home read "5,000 monatliche Credits", which a German reader takes as five, and Usage showed "2.5" and "$1,234.50". Both now use the dashboard's language ("5.000", "2,5", "1.234,50 $"); English is unchanged. * fix(dashboard): say why Create token is off where everyone can read it When the account's email isn't confirmed, Create token is disabled and the reason ("Verify your email address to create an API token.") lived only in a hover tooltip: a disabled button isn't reachable by Tab, a phone has no hover, and screen readers don't read a plain span's title, so those users met a dead button with no explanation. The reason now replaces the card's description while the button is off. The tooltip, which encoded the already-encoded text again, now uses it as is. * fix(dashboard): announce that a new API token is shown only once After a token was created, focus moved to Done and a screen reader read "Done, button" and nothing else: the done state arrives already filled in a status region, which isn't announced, and Done is described by the message only for plain-text results. The token dialog's warning ("Copy this token now — it won't be shown again…") now describes Done, so it is read out when focus lands there. * fix(dashboard): show an email change confirmed in another tab Confirming a change of email from its link sets the new address and marks it confirmed, but sends no socket event, unlike confirming a code. Back in the dashboard the user was re-read on returning to the browser tab, yet nothing redrew: Account kept the old address under the username, Create token stayed disabled and Security had no 2FA card until a reload. Account and Security now redraw after that re-read when the address or its confirmation changed. * fix(dashboard): close the share dialog after leaving a share Someone the owner let share could remove their own row in the share dialog to leave. The removal went through, but the dialog then reloaded its access list with the access just given up: the server refused it, the success line gave way to "Subject does not exist" over an empty list, and the item stayed in the Shared view until a reload. Leaving now closes the dialog and refreshes the folder on screen, which drops the item, as "Remove from Shared" does. * fix(dashboard): say the access list couldn't load, not that sharing failed When the share dialog couldn't read who has access (a network error, which carries no message of its own), it said "Could not share this item." though nothing had been shared or attempted. It now says "Could not load who has access." * fix(dashboard): don't pull focus back after a share change saves When a change in the share dialog finished saving (a level change, Add to all, a removal, a share), focus was put back on that row's control or the add field, wherever the user had gone meanwhile. Someone who changed a person's level and then started typing a name had the next keystrokes land on that person's level select, where a matching letter picked another level and granted it. Focus now goes back only when the save took it away; focus the user moved elsewhere stays there. * refactor(gui): move the localized time formatting to i18n/formatTime.js formatRelativeTime and formatAbsoluteTime lived in the notification center's module; Files and Properties are about to use them too. * fix(dashboard): write Files and Properties dates in the dashboard's language The Files tab's Modified column and Properties' Modified, Created and version times came from timeago, which has no language but English registered, so a German dashboard read "3 hours ago" beside "Geändert". They now use the same localized formatter as the notification panel ("vor 3 Stunden"), which also gives a date past a week rather than "3 weeks ago". Its formatters are now made once per language, since a listing formats one date per row. * fix(dashboard): style the Usage table's Show less button in dark mode The button's dark variant was written for an `html.dark-mode` class that nothing sets, so in dark mode it kept its light look: grey text at 3.4:1 on the dark card, a light border, and a light chip on hover. Its rules move under prefers-color-scheme, as the table's fade overlay already did. * fix(dashboard): show the Files breadcrumb separators in dark mode The chevrons between breadcrumbs are a black stroke at 20% opacity, which vanishes on the dark header: a nested folder read "Home Documents Work" with nothing between the names. In dark mode they are now inverted, like the toolbar's icons. * fix(dashboard): show the website-link badge on dark Files tiles In grid view a file inside a published folder carries a link badge: a black glyph on a disc of the page's background color. In dark mode that is black on near-black and can't be seen. The badge now gets the white disc the shortcut and worker badges already have. * fix(dashboard): skip disabled Back, Forward and Up when tabbing in Files The Files header's arrows stayed in the Tab order while disabled, drawn at 10% opacity, which takes their focus ring with them. Tabbing into Files, the first two stops (Back and Forward, disabled on arrival) looked like nothing had focus. A disabled arrow now leaves the Tab order, as a disabled button does, and returns once it can be used. * fix(dashboard): give the Delete account button an AA-contrast red The Account tab's Delete account button used the desktop's danger red (#f00808), which puts its white label at 4.4:1, under the 4.5:1 that WCAG AA asks of text. It now uses the dashboard dialogs' danger red (#d90707, 5.3:1) and their darker hover, so the two match. * fix(dashboard): label collapsed sidebar items for keyboard users too With the sidebar collapsed, each item shows only its icon, and its name appeared in a tooltip on mouse hover alone. Tabbing through the sidebar showed a row of icons with no names. The tooltip now also shows while an item has keyboard focus. * fix(dashboard): keep Share and Properties inside the visible screen Both dialogs capped their height at 85vh (88vh as phone sheets), and vh is the viewport with the browser's bars hidden. With the bars showing, on a phone in landscape say, the card plus the overlay's padding was taller than the screen, and the overlay centers without scrolling: the title and the buttons were cut off with no way to reach them. Each card is now also held within its overlay, as the dashboard's dialogs are, and its body scrolls instead. * fix(dashboard): outline the off state of the 2FA switch Off, the switch was a light grey track (#e0e0e0) with a white thumb, 1.3:1 against a white card and 1.2:1 against the amber card the 2FA toggle sits on while 2FA is off, so the control could barely be seen where it matters most. WCAG asks 3:1 for a control's boundary. The off track now carries a 1px slate outline (4.3:1 on the amber card); the on state is unchanged. * fix(dashboard): make the keyboard focus ring visible on sidebar, tiles and lists The sidebar items, the Files folders, crumbs and arrows, the app tiles, Home's cards and recent apps, the notification rows and the Usage sort buttons show keyboard focus with a 2px outline and nothing else, drawn in --select-ring: the selection color at 40% (50% dark), about 1.6:1 against the surfaces it sits on. Keyboard users could hardly tell where focus was; a focus indicator needs 3:1. Those outlines now use the solid selection color (3.7:1 on white), as the switch and pager dots already do. Field halos, which come with a colored border, are unchanged. * fix(dashboard): bring text in the selection blue up to AA contrast The selection blue is 3.7:1 against white, and a few places set text in it or white text on it, under the 4.5:1 that text needs: the active folder in the Files sidebar, the share dialog's "Add to all" link, the add-app dialog's Send button, the notification count badge, the drag count badge, and a breadcrumb whose menu is open. They now use the same hue darkened to 45% (5.3:1; a lighter one for text in dark mode), from two new tokens, --select-text and --select-fill. * fix(dashboard): give the Apps page dots a 24px touch target The Apps pager's dots, and a folder's, are 17px buttons side by side, under the 24px a target needs when it has neighbors, so on a phone or tablet a tap meant for one page often opened the next. On a touch screen each dot is now 24px around the same 7px dot; mouse layouts are unchanged. * fix(dashboard): return from a drag-opened folder while it is still loading Hovering a dragged file over a folder springs it open. Cancelling the drag (Escape, the Cancel zone, or a drop outside the listing) is meant to go back where the drag started, but while the sprung folder was still loading the return was dropped like any navigation during another, and the user was left in the folder they had backed out of. The return now takes over from that load. * fix(dashboard): drop into a drag-opened folder while it is still loading When a dragged file springs a folder open, the drop anywhere in the listing moves it into the folder now shown. Until that folder's listing arrived, though, the Files tab still counted the folder the drag left as the one on screen, so a drop in that time was taken as a move to where the file already was and did nothing. It now goes to the folder being opened. * fix(dashboard): say "Incorrect password" when the account password is wrong The account dialogs showed the server's message as is. A wrong current password in Change password read "Password mismatch", in English in every language, beside a dialog that says "New Password and Confirm New Password do not match" when those two differ, so users corrected the wrong fields. A wrong code read "Incorrect code." and too many attempts "Too many requests.", also always in English. These now show the translated messages the GUI already has, and a wrong password puts the status on the password field, focused for retyping. * fix(dashboard): don't send an account change to the value it already has Change username with the account's own name got "This username is already taken." and used up one of the hour's password attempts. Change email with the current address was accepted: it mailed a confirmation and a change notice to the same inbox, and following the link unlinked any sign-in provider. Change password to the current password signed out every other session and mailed a "password changed" notice. Each dialog now says the value is already the account's and sends nothing. * fix(dashboard): ask for the new password after a provider-only account sets one An account that signs in only through a linked provider can set a password with Change password, after which the server treats it as a password account. This session's copy still said provider-only, so Change username, Change email and Delete account went on hiding the password field and sending the user through the provider's popup until a reload. The copy now changes with the password. * fix(dashboard): let Escape cancel a session rename without closing Manage sessions In Manage sessions (Security), Escape in a session's rename field cancelled the rename and then closed the whole modal, and Escape in the search box closed it too, search and all. Escape now cancels the rename or empties the search, and only an Escape with neither closes the modal. * fix(dashboard): show the server's message when a session can't be revoked Manage sessions put a refused request's raw response body in its alert, so revoking a session already signed out from another tab read {"message":"Session not found","code":"not_found"}, and the stale row stayed listed; a failed rename and "Revoke all other sessions" did the same. The alerts now show the message itself, and a session found gone reloads the list. * fix(dashboard): show 2FA as it is when its dialog closes without success The Security tab's 2FA toggle assumed nothing had changed whenever its dialog closed without success. With 2FA turned on in another tab, the setup here refused ("2FA is already enabled."), the toggle went back to off, and every retry got the same refusal, with Disable never offered; a code accepted just as the user closed the setup dialog left the same state. The tab now re-reads the account and shows its real 2FA state. * fix(gui): leave Ctrl/Cmd+Z to the text field being typed in Ctrl/Cmd+Z ran the file Undo wherever focus was, and cancelled the field's own text undo. Typing a new name (F2) or anything in another field and pressing it undid the last file action instead; when that was an upload, the uploaded file was deleted for good. Undo now leaves text fields alone. * fix(gui): let Escape on a context menu close only the menu Escape removed any open context menu and then went on to the Files tab's own Escape handling, which, finding no menu left, cleared the selection and closed the image preview. Select three files, open their menu, press Escape: the menu closed and the selection was gone. When Escape closes a menu, nothing else now acts on it; a second Escape clears the selection as before. * fix(dashboard): close the Files image preview when an app opens over it The image preview sits above every window, and only a double-click closed it on the way to an app. Opening the image with Enter, or with Open or Open With from its menu, started the app underneath the preview, which went on covering it while keyboard focus moved into the app, so Space and Escape no longer reached the preview. It now closes whenever an app window comes on screen. * fix(dashboard): close the Files image preview when its file goes away Deleting the previewed image (the Delete key, the menu, the phone selection bar), moving it, or having it removed from another tab took its row out of the listing but left the preview up, still showing the image. The preview now closes with its row; a refresh of the folder, which redraws the row, keeps it. * fix(dashboard): download one selected file as itself from the phone selection bar In select mode, the floating bar's Download zipped whatever was selected, so a single photo arrived as "photo.jpg.zip" where its own menu's Download gives "photo.jpg". One selected file now downloads as itself; folders and several items are still zipped. * fix(dashboard): don't offer New Folder, Upload or Paste in a view-only share Inside a folder shared with the user to view only, the Files tab still showed New Folder and Upload, offered New and Paste in its menu, and took files dropped on the listing or on a folder in it; each then failed: an upload window ending in an error, or a new folder row with its name field open, then taken back with a Forbidden alert. Those are now left out there, as in Trash. A share whose level isn't known yet stays as before, the server deciding. * fix(dashboard): move through Files with Home, End, Page Up and Page Down The Files listing took the arrow keys but not Home, End, Page Up or Page Down, and as the listing itself never has focus the browser didn't scroll it on them either: in a folder of hundreds of items the keyboard could only step through them one row at a time. Home and End now select the first and last item, Page Up and Page Down move a screenful, and Shift extends the selection as with the arrows. With a menu open they are left to it, as the arrows are. * fix(dashboard): apply the hidden-files setting to a renamed Files row With Show hidden off, renaming notes.txt to .notes.txt left the row in the listing until the folder was next loaded, and with it on the row wasn't dimmed as other dot-files are; renaming .env to env left it dimmed. A rename made in another tab did the same. A renamed row now follows the setting as listing the folder would. * fix(dashboard): open a recent app once on a double-click Double-clicking an app under Home's "Recently used" opened it in two new browser tabs, one per click. The second click of a double-click is now ignored, as on the Apps tab's tiles. * fix(dashboard): don't say "No recent apps yet" before Home's list has loaded Home's "Recently used" card was drawn from the list as it stood when the page opened, which is empty until the request answers: every visit first read "No recent apps yet / Apps you use will appear here" and then swapped in the apps, and if the request failed the card kept saying there were none. It now stays blank until the list arrives, and a first load that fails says the apps couldn't be loaded; a list already shown stays when a later refresh fails. * fix(dashboard): drop "Save session" when the account was saved in another tab A temporary account saved in one browser tab stayed temporary-looking in its other dashboard tabs: Home kept its "Save session" button, which opened Save Account for an account already saved, and Account and Security kept their temporary-account layout. Coming back to such a tab re-reads the account; that now removes the button and redraws the two tabs when the account is no longer temporary. * fix(dashboard): let go of the phone drawer when the window widens With the sidebar open as a drawer below 768px, widening the window past it (an iPad turned to landscape) drew the sidebar as the desktop one but left it marked open: Tab stayed trapped in it, so the content couldn't be reached by keyboard, and the Apps grid ignored the arrow keys, until an Escape or a click in the content. The drawer now closes when the window widens, leaving focus where it is. * fix(dashboard): don't let a #files/<path> link pull Files back to its folder Files doesn't keep the folder on screen in the URL, but a link like /dashboard#files/alice/Documents stayed in the address bar once opened. After the user moved on to Pictures, went to Home and pressed Back, the browser returned to that link and Files jumped back to Documents; a reload did the same, and Files' own Back/Forward lost track, as the jump wasn't recorded in it. The link's path is now consumed once opened, as a share link's is, and a folder opened from such a link is a step in Files' history. * fix(dashboard): close the drawer and Files' dialogs on browser Back and Forward Browser Back or Forward switched tabs but left whatever was open on screen: on a phone, Android's Back changed the tab under the open menu drawer and left it open; in Files, the Share or Properties dialog stayed up over Home, still acting on Files rows; an open context menu stayed too. These now close with the tab, as with a sidebar click. * fix(dashboard): fill Home's storage and usage meters without waiting on the plan Home read the plan first and only then asked for storage and the month's usage, so every visit paid for one more round-trip before either meter filled in. The plan request had no timeout either: one that never answered kept both meters at "--" and, as later loads wait for the one in flight, held every later refresh of the cards for the rest of the session. The three now load side by side, and the plan read gives up after 15 seconds. * fix(dashboard): link Home's card headers to their tabs The headers of Home's cards (Recently used, Usage, Your Plan, Your Storage, Resources) linked to "#", so opening one in a new browser tab (middle-click, the browser's menu) showed Apps rather than the tab it names, and Cmd/Ctrl+click switched tabs in place. They now link to the tab they open, and a modified click is left to the browser, as on the sidebar. * fix(dashboard): prefill the username when saving a session from Home Home's "Save session" button opened Save Account with an empty username, so a temporary user had to make one up, while the same action in the user menu fills in the account's current name and starts at the email field. Both now open it the same way. * fix(dashboard): measure Home's storage meter by the amount it shows On a self-hosted install the storage card names the disk's use (Puter's files and everything else on it) but filled its meter, and gave its percentage, from Puter's files alone, so it could read "93 GB used · 0% of 466 GB". The meter and percentage now come from the same amount the card shows. * fix(dashboard): refresh Home's recently used apps on returning to the tab Recent apps open in a new browser tab, and coming back to the dashboard refreshed the usage cards but not "Recently used", whose comment said it followed the same triggers: the app just opened only moved up the list after switching away from Home and back. Returning to the tab now re-reads the list too. * fix(dashboard): leave IME keystrokes to the IME in Apps Typing Japanese or Chinese in the Apps search or a folder's name, the keys that drive the input method reached the tab's own handlers: ArrowDown to pick a candidate moved focus to the first tile and cut the conversion short, Enter to confirm one named the folder half-written or launched the first match, and Escape put the old name back. The search box's Enter meant to skip composition, but read isComposing off jQuery's event, which never carries it. Keys during composition are now left to the IME. * fix(dashboard): leave IME keystrokes to the IME in the share recipient field With a Japanese or Chinese input method on, even a Latin username is composed, and the share dialog's recipient field took the keys that drive it: the arrows moved through its suggestions instead of the IME's candidates, and Enter to confirm the text picked a suggestion instead. Keys during composition are now left to the IME. * fix(dashboard): re-read the Apps layout on returning to its browser tab The Apps tab read its order and folders only when it was opened, and saves write its whole copy of them. With the dashboard open in two browser tabs, a folder made in one was wiped as soon as the other, showing Apps since before, changed anything (a reorder, a new folder, a rename), as was the order arranged in the first. The tab now reads the layout again when its browser tab comes back into view. * fix(dashboard): undo a drag out of an Apps folder when the drag is cancelled Dragging an app past the edge of an open folder takes it out, closes the folder and carries the drag on over the grid, and the removal was saved right then. Pressing Escape, or the window losing focus, cancels the drag but left the app out; out of a two-app folder that dissolved the folder for good, its name with it (dragging the app back made a new "Folder"). A cancelled drag now puts the folder and the order back. * fix(gui): show the 2FA setup's confirmations without entities The 2FA setup window, which the dashboard's Security tab opens, encoded already-encoded translations for its labels, so in French the two checkboxes before enabling read "J&apos;ai enregistré mes codes…" and "Je suis prêt à activer l&apos;A2F". The labels, and the window's other translated text set the same way, are now encoded once. * fix(gui): don't leave the 2FA dialogs stuck when a request can't be sent Turning 2FA on or off from the dashboard's Security tab while offline, or on a dropped connection, left the dialog busy for good: enabling kept its spinner up with the code boxes disabled, and disabling kept its button and password field disabled, with nothing said either way. A request that gets no answer is now reported like a refused one, and the dialog can be tried again. * fix(gui): stop disabling 2FA when the provider sign-in doesn't happen For an account that signs in through a linked provider, turning 2FA off opens the provider's sign-in popup. When the popup was closed or blocked, the dialog showed why for a moment and then sent the request anyway, whose refusal ("OIDC revalidation required") replaced the reason. It now stops at the popup's error.	2026-10-24 15:05:56 -07:00
Filip KujundžićandClaude Fable 5.1	bbb780eb31	feat(ai): MiniMax video generation (H3 and Hailuo) (#4309) ... * feat(ai): MiniMax video generation (H3 and Hailuo) Adds a minimax-video-generation provider to the video driver. H3 models go through MiniMax's v2 task API and are billed per second of output; Hailuo models go through the v1 API, exchange a file id for a download URL, and are billed per clip. The shared `minimax` chat key is reused, with the chat block's `/v1` base URL reduced to its host. WIDTHxHEIGHT sizes now map onto tiers for catalogs that include a 2k or 4k tier. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(ai): validate MiniMax video inputs and resolution tiers --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-10-24 13:49:21 -07:00
Nariman Jelveh	8a55debdae	fix(dashboard): sixth adversarial review — bugs, UX, a11y, perf (#4314) ... * fix(dashboard): render in the user's saved language The dashboard never read the account's preferences: only the desktop did, on boot. Everyone saw it in English whatever language they had chosen, until the Files tab's Show hidden toggle switched a running session over, to the browser's language when none was saved, since that was the fallback the toggle wrote back. The desktop's preference loading moves into load_user_preferences, which the dashboard now runs in the background. The first paint uses the language this browser last loaded, so nothing waits on the read; a saved language that differs reloads into it, and a changed Show hidden setting refreshes the open folder. The tab names are read when the sidebar is drawn rather than when the modules load. A failed read keeps the cached preferences instead of resetting them to English. * fix(dashboard): label credit amounts with a key meant for them Home's allowance and the Usage tab's total and Credits column used the `credits` key, which the translations render in its acknowledgments sense: "5,000 Mitwirkende" (contributors) in German, "Авторы" in Russian, "特别鸣谢" in Chinese. They now use `usage_credits`, which falls back to English until it is translated, as `monthly_credits` already does. * fix(dashboard): enable the token and 2FA cards once the email is confirmed The dashboard had no handler for the `user.email_confirmed` socket event, and Account and Security pick the token button's state and whether to offer 2FA when they render. A user who confirmed their email in another tab, or in this one through the confirmation prompt, kept a disabled "Create token" and no 2FA card until a reload. The dashboard now refreshes the user on that event and renders both tabs again, as it already does after a temporary account is saved. * fix(dashboard): save only the profile fields that were edited Edit profile sent both the display name and the bio on every save, taken from this session's copy of the profile. That copy comes from the cached user and can be stale (the profile changed on another device) or empty (the profile read failed), so changing only the bio wrote the old display name back, and a save from an empty prefill erased the bio. The dialog now sends just the fields whose value changed from what it opened with, and closes without a request when nothing did. * fix(dashboard): don't show storage as 100% while there is room left Home and Usage rounded the storage share to a whole percent, so an account at 99.5% or more read "100%" while uploads still fit. The usage meter already holds at 99% until the allowance is spent; that rule moves into meterPercent and the storage meters use it too. * fix(dashboard): keep keyboard focus inside the open phone drawer Below 768px the sidebar is a modal drawer over a scrim, but opening it left focus on the menu button, and Tab past its last entry walked into the dimmed content behind the scrim. Opening it now focuses the current page's entry, and Tab and Shift+Tab cycle within it while it is open. * fix(dashboard): tapping into a Files name field edits the name On a phone or tablet, tapping the name field of a new folder or a rename (which iOS needs before it shows the keyboard) reached the row's tap handler, which opened the folder or launched the file and threw the edit away. A long-press in the field opened the touch sheet instead of selecting text, and on desktop a right-click in it showed the file menu instead of the browser's Cut/Copy/Paste. The row's tap and menu handlers now leave the name field alone. * fix(dashboard): don't offer Cut on items the user can't move A file's menu offered Cut on anything that wasn't immutable, and Shared rows aren't marked immutable. Cutting a file someone shared with you, or anything inside a read-only shared folder, then pasting it, ended in a "Forbidden" alert and an emptied clipboard. Cut now needs the same permission as Delete in that menu, as Ctrl+X and the selection's Cut already do. * fix(dashboard): don't paste or upload into the folder being left Opening a folder clears the listing at once but only moves currentPath when the new listing arrives. Ctrl+V, a file dropped from the computer onto the pane, or Paste from the background menu during that wait went into the folder the user had just left, and since the refresh then showed the new one, the items seemed to vanish. Those three now refuse while another folder is loading, as New Folder already did. * fix(dashboard): clear the drop highlight when Escape cancels a drag Escape ends a Files drag with a synthetic mouseup, which jQuery UI treats as a release outside every target: it fires no `out`, so the folder row under the pointer kept its dashed drop outline and tint (and a sidebar folder or breadcrumb its highlight) after the drag was gone. The Escape branch now takes those off. * fix(gui): show the "can't rename in Trash" alert without entities Pressing F2 on a trashed item (on the desktop or in the dashboard's Files tab) showed "This item can&apos;t be renamed because it&apos;s in the trash": the message was encoded by i18n and then again by UIAlert. * fix(gui): show the failed-upload title without entities The upload progress window writes its error title with innerText, but was handed the HTML-encoded i18n string, so French showed "Échec de l&apos;importation des fichiers". The Files tab's two upload paths and the desktop's now pass the plain string. * feat(dashboard): open a Files row's menu with the Menu key or Shift+F10 Share, Download, Open With and Properties were reachable only by pointer: the ⋯ button isn't focusable, and the keyboard's menu keys fired a contextmenu on <body>, which the listing ignores. Both keys now open the selection's menu at its row's ⋯ button, where arrow keys and Enter already work. * fix(dashboard): let Shift+Arrow shrink a Files selection Shift+Arrow only ever added the next row, so after Shift+Down twice, Shift+Up left all three rows selected instead of going back to two. A run of Shift+Arrows now selects the range from the row it started on to the cursor, on top of whatever was selected before the run, so moving back shrinks it. A click or a plain arrow starts a new run. * fix(dashboard): name folders in the Back/Forward history menus as the crumbs do Holding Back or Forward listed each folder by its path's basename: `/` was a blank entry, the Shared view read "shared", Trash stayed in English, and a trashed folder showed its uid. The menus now use the same names the breadcrumbs show. * fix(dashboard): show a shortened Files name in full on hover Grid tiles and a resized Name column shorten long names in the middle ("Quarterl…draft v2.xlsx"), and nothing showed the rest short of opening Rename or Properties. A shortened name now carries the full one as its tooltip. * fix(dashboard): keep keyboard focus on the Files breadcrumbs Every listing rebuilds the breadcrumbs, which took a keyboard-focused crumb with it: pressing Enter on one, or any refresh of the folder while a crumb had focus, left focus on <body>, and the next Tab started over from the top of the page. Focus now moves to the same folder's crumb, or to the one for the folder just opened. * fix(dashboard): reach Home's Shared and Trash rows from the keyboard At 480px wide or less (a phone, or a desktop browser zoomed in) the folder sidebar is hidden and Home lists Shared and Trash as rows instead. Those rows only had a click handler, so a keyboard user couldn't get to either. They are now focusable links that open on Enter or Space, with the sidebar's focus ring. * fix(dashboard): keep the Files selection across a sort or view change Sorting by a column, switching between list and grid, or toggling Show hidden lists the folder again, and the rebuild dropped the selection and the shift anchor: select three files, sort by Size, and nothing was selected. Only the refresh on returning to the browser tab carried them across. That logic is now refreshKeepingSelection, and those three use it too. * fix(dashboard): don't drop a folder open during a Files refresh A refresh of the folder on screen (after an upload or paste, Refresh, a sort, or returning to the browser tab) set the same "already rendering" flag that a navigation sets, so double-clicking a folder, a sidebar folder, a crumb or Back during that round-trip did nothing, with no spinner to explain it. Opening another folder now takes over from a refresh in flight; the refresh notices it was superseded and drops its result. A navigation during another navigation is still ignored, as before. * fix(dashboard): keep the Files marquee when an item arrives mid-drag Adding a row clears the empty-folder notice by removing every non-row child of the listing, and the selection marquee is one. A file added from elsewhere (an upload, another tab, an app) while the user was drawing a selection made the rectangle vanish under the pointer. * perf(dashboard): don't rewrite unchanged Files names while resizing Every width change (a window resize, collapsing the sidebar) re-fits the item names, at most once a frame, and wrote each name's text back even when it came out the same. Each write invalidated layout for the whole list. With 300 rows that took ~6.4ms a frame in list view and ~4.9ms in grid; skipping the unchanged writes brings it to ~0.7ms and ~3.2ms. * fix(dashboard): tell assistive tech the Files Select toggle's state The Select button only toggled a class, so a screen reader announced a plain button with no state; it now carries aria-pressed. Sort and View open menus and now say so with aria-haspopup. * fix(dashboard): show a person's strongest grant in the share list When someone held two grants on one item (the owner gave them view access, and someone the owner let share gave them edit), the share dialog showed whichever grant the listing returned first, so their row could read "Can view" while they could edit. A second grant on the same item now counts toward the row with the stronger of the two levels. * fix(dashboard): only offer share controls on grants the user can change The backend lets an item's owner change or withdraw any share of it, and anyone else only the grants they issued (or their own access). The share dialog offered the level select and Remove on every row. Someone the owner let share who removed a person the owner had added got "Removed bob" while nothing changed, and lowering their level added a second grant that changed nothing either. The access list now records who issued each row's grants. A user who doesn't own the selection gets the controls only on rows whose grants they issued all of, plus Remove on their own row to leave; other rows show their level as a tag. * fix(dashboard): update Files' shared markers after the share dialog closes The share dialog marks the Files rows it covers as shared or not from the listings it reloads after each change, and skipped that whole reload once it was closed. Closing it while a share or removal was still saving left the row without its shared marker (or with a stale one) until the folder was reloaded. The markers are now updated either way; only the dialog's own list is skipped once it's gone. * fix(dashboard): mark rows shared after sharing more than 50 at once The share dialog updates the Files rows' shared markers from the share listings it reloads after a change, and doesn't reload them for more than 50 items. Sharing such a selection, with a person or by link, reported "Shared with bob on 55 items" while no row showed the marker until the folder was reloaded. Those grants now mark their rows directly. * fix(gui): unbind each context menu's mousemove handler with the menu The submenu-aim code bound a mousemove handler on the document for every menu and submenu and never removed it. Each one kept its closed menu and items alive and ran on every mouse move for the rest of the session; ten right-clicks in Files left five such handlers behind. The handler now comes off when its menu is removed. Moving diagonally into a submenu still keeps it open. * fix(gui): ignore clicks on a context menu's dividers A divider is an <li> like the items, so a click on one (they're 11px tall, easy to hit between two items) ran the item handler with no action behind it and threw "Cannot read properties of undefined". The item handler now skips dividers; the menu stays open, as a native menu's separator does. * fix(dashboard): warn that removing a team removes everyone in it Removing a team from a single item's share dialog asked "Remove Design's access to this item?", the wording used for one person. The desktop's share window adds "Everyone in the team loses it."; the dashboard now uses that confirmation for teams too. * fix(dashboard): count folders, not items, in "via N folders" A person who reaches a multi-item selection through more than one shared ancestor gets a "via N folders" note in the share dialog, and N was the number of items reached that way: five files under two shared folders read "via 5 folders". It is now the number of distinct folders. * fix(dashboard): don't treat a long tail after a dot as a file extension Files middle-truncates long names and keeps everything after the last dot whole as the extension. For "Report v1.2 final draft for the board meeting" that kept ".2 final draft for the board meeting", so the tile read "….2 final draft for the board meeting" and lost the start of the name. Only a short tail without spaces now counts as an extension; this one shortens to "Report v1.…d meeting". * fix(dashboard): keep Tab inside the touch context menu The touch menu sheet is modal, but Tab and Shift+Tab left it for the page behind the backdrop while it stayed open; closing it then no longer returned focus, since focus was elsewhere. Tab and Shift+Tab now move between its items like the arrow keys, wrapping at the ends. * fix(dashboard): say "the other item" when one item is missing a grant The share dialog's "Add to all" link told screen readers "Give bob access to the other 1 items" when the person was missing from a single item of the selection. That case now has its own singular string. * fix(dashboard): announce a failed Properties load, on both tabs When Properties couldn't read the item, the General list showed the error but stayed aria-busy, so screen readers kept it unannounced, and the Versions tab stayed blank. The list is no longer busy once the error shows, and Versions shows the same error. * perf(dashboard): launch the add-app modal's apps without reloading the grid "Browse the App Center" and "Build with AI" go through the same intro as a deep link, which first awaited loadApps(). With the grid already loaded that started a fresh fetch of every app list and the saved layout, and the launch waited on it: with an 800ms connection, ~1.35s before anything opened instead of ~0.1s. The intro now uses the grid already loaded, and only joins or starts a load when there is none. * fix(dashboard): don't hide the Apps grid on every search keystroke Search re-rendered the grid behind the first load's fade-in, which waits for page one's icons. Each keystroke made fresh <img> elements, so an icon that was slow or failing (an unreachable icon host) blanked the whole grid until it settled, about a second per keystroke with a 1s icon and up to 1.5s if it never answers. Search, its clear button and entering reorder mode now render the results at once. * fix(dashboard): stop the Apps pager's dots jumping back mid-flip A page arrow, a dot, or the wheel starts a smooth scroll and marks the target page at once, but the scroll handler then read the pages passed over on the way as the current one. The active dot went forward, back to the old page, and forward again, and a second click on the arrow added to the stale page: two quick clicks showed 0 → 1 → 0 → 2 → 1 → 2. While such a scroll is on its way, the pager (and the open folder's) now ignores the positions in between, until it arrives or a second has passed. The user's own scrolling still moves the dots. * fix(dashboard): keep paging while a dragged app is held at the edge Holding a dragged tile still at the Apps grid's edge (or an open folder's) turned one page and stopped: the next dwell only started on another pointer move, so a mouse held steady stayed on the second page of three. Once a flip settles, the dwell starts again if the pointer is still in the edge zone. * fix(dashboard): don't turn Apps pages on a trackpad pinch A pinch on a trackpad reaches the page as wheel events with ctrlKey set, and the Apps grid (and an open folder) read them as a wheel flick and turned the page while the user zoomed. Those events are now left alone. The handlers also called preventDefault() from a listener the app makes passive, which does nothing and logged a console warning on every wheel tick; that call is gone, as the scroller has no vertical scroll to stop. * feat(dashboard): open the first Apps search result on Enter Typing in the Apps search and pressing Enter did nothing; reaching a result took ArrowDown and then Enter. Enter in a non-empty search now opens the first match (or a folder that matches), as launchers do. It does nothing while an IME composition is open, or when nothing matches. * fix(dashboard): include an open folder's page dots in its Tab cycle The open folder keeps Tab inside it, but its list of stops left out the page dots, which are buttons. Tab never reached them, and once one had focus (clicking it focuses it) the next Tab walked out of the modal folder to the page behind. The dots are now part of the cycle. * feat(dashboard): open an app tile's menu with the Menu key or Shift+F10 An app or folder tile's menu (Open in New Tab, Copy Link, Uninstall, Remove from Folder; a folder's Rename and Ungroup) opened only on a right-click or long-press, and browsers don't all turn the keyboard's menu keys into a contextmenu event (macOS has none). The Menu key and Shift+F10 on a focused tile now open its menu at the tile, where arrow keys and Enter work. * fix(dashboard): keep keyboard focus on the grid after Ungroup Ungrouping a folder from its menu re-rendered the grid without the folder's tile, so a keyboard user who had it focused was left on <body> and the next Tab started from the top of the page. Focus now moves to the folder's first app, which takes the folder's place. * fix(dashboard): give links AA contrast in the light theme Link-colored text (Home's "View more" and "Upgrade", the notification panel's "Mark all read" and "Retry", Properties' website links, the token dialog's sessions link) used #5271ff, 4.07:1 on white and 3.97:1 on the content background, under the 4.5:1 AA minimum for text that size. The light theme's link is now #3d5bd9 (5.7:1), with a darker hover. Dark mode already passed. * fix(dashboard): give success text AA contrast in the light theme Success text (the 2FA "enabled" line, Home's active-plan badge, the share dialog's confirmations) used #03933a: 4.01:1 on white and 3.80:1 on its green tint, under the 4.5:1 minimum. It is now #15803d (5.02:1 and 4.75:1); the success check icons that share the token darken with it. Dark mode already passed. * fix(dashboard): give danger buttons and error text AA contrast White text on the red fills fell short of 4.5:1: the Apps uninstall confirm (#e53935, 4.23:1), the delete-account button (#f00808, 4.43:1) and the Files drag "Cancel" zone (#ef4444, 3.76:1). So did light-theme danger text on its pink tint (#dc2626 on #fef2f2, 4.41:1), used for form, share, crop and notification errors and the past-due badge. The fills are now #d32f2f, #d90707 and #dc2626 (4.8:1 to 5.3:1), each with a darker hover, and danger text is #b91c1c (5.9:1 on the tint). * fix(dashboard): give the app feedback dialog's Send button AA contrast The feedback dialog's primary button (Send, and Close once sent) put white text on a light-blue gradient, 2.66:1 at the top and 3.42:1 at the bottom. It now uses the dashboard's primary button colors, which meet 4.5:1 in both themes, like the dialogs around it. * fix(dashboard): show the drop outline and dwell fill on grid folders Dragging files over a folder in grid view only tinted it like a selection: the grid's own border, hover and selected rules out-ranked the shared drop-target and spring-load rules, and the hover rule's background shorthand wiped the dwell fill. The folder then opened after 700ms with no sign it was about to. Grid and compact-grid folders now get the list's dashed outline and filling dwell, with the padding trimmed to match so the tile doesn't shift. * fix(dashboard): keep the Files preview and drag ghost above the window The Space-bar image preview (z-index 9999) and the drag ghost (10000) are appended to <body>, beside the dashboard window. On a touch-only tablet with a keyboard every window is pinned to 9999999, so the preview opened invisibly behind it from the first press; on desktop the window's z-index climbs with each click and overtakes both in a long session. Both now sit in the band the sidebar tooltip and the toasts already use. * fix(dashboard): give small dashboard controls 44px touch targets Several controls a phone or tablet user taps were under the 44px minimum touch size, with nothing enlarging them on a coarse pointer: the Files toolbar buttons (32px), the touch menu's rows (36px tall), the drawer's close button (32px), the notifications close (30px), the Properties close (32px), the feedback dialog's ✕ (30px), the add-app Back arrow (26px), the Apps modal buttons (34px tall) and the share dialog's Copy link (38px tall). Following the earlier touch fixes, the icon buttons keep their look and get a 44x44 hit area, and the text buttons and menu rows grow to 44px. Mouse and trackpad layouts are unchanged. * fix(dashboard): keep a landscape phone's notch clear of the dashboard A phone held sideways and wider than 768px (an iPhone Pro Max, a large Android) gets the desktop layout, and the page asks for the full screen with viewport-fit=cover. Nothing in that layout read the side safe-area insets, so with the notch on the left the sidebar's icons sat under it (x=24 against a 47px inset), and with it on the right the content's edge and the toasts did. The sidebar (open or collapsed) now adds the left inset, and the content area, including Apps and Files, and the toasts add the right one. The insets are 0 everywhere else, so other layouts don't change. * fix(dashboard): size the touch menu and bottom sheets to the visible height The touch context menu, the app feedback dialog and the profile-photo crop sheet capped their height in vh. On phones 100vh is the viewport with the browser bars hidden, so while they show these could be taller than the screen. The touch menu, which ContextMenu.js keeps inside the visible height, then ran its last rows off the bottom on a landscape phone, and the bottom sheets could push their header off the top. They now cap in dvh, as style.css already does. * fix(gui): move keyboard focus into the Manage sessions dialog The sessions dialog is modal but never took focus: opening it from the keyboard left focus on the button behind the backdrop, and Tab walked the page underneath instead of the session list. It now focuses its close button on open, keeps Tab inside, and hands focus back to the control that opened it when it closes. * fix(dashboard): return focus after the Security tab's dialogs close Closing Blocked people, or the 2FA setup or disable dialog opened from the switch, left keyboard focus on <body>, so the next Tab started at the top of the page. The 2FA switch also disables itself while its dialog is up, which drops focus even before then. Focus now goes back to the button or switch that opened the dialog once it has gone.	2026-10-24 08:30:57 -07:00
Daniel SalazarandReynaldi Chernando	f3e8539eaf	docs: easy events recipe (PUT-1961) (#3998) ... * docs: easy events recipe (PUT-1961) * docs: catch-up-on-notifications events recipe (PUT-1961) * docs: notification examples use notif:app-user, which apps can read * docs: events recipe corrections from a run against a live server (PUT-1961) * refine and update agents md --------- Co-authored-by: Reynaldi Chernando <reynaldichernando@gmail.com>	2026-10-24 15:26:07 +07:00
Nariman Jelveh	b3b02b1ebb	Fix/dashboard fifth review (#4313) ... * fix(dashboard): close the Apps modals and folders only on a press that starts on the backdrop The uninstall and add-app modals and the open folder closed on any click whose target was their backdrop. Drag-selecting text in the app request box and releasing outside the card lands that click on the backdrop, so the modal and the typed request were thrown away. The backdrop logic the dashboard dialogs already use moves into bindBackdropDismiss, and the three Apps overlays use it too. * fix(dashboard): double-clicking "Add an app" no longer opens App Center The add-app modal opens under the pointer, so the second click of a double-click on the "+" tile landed on its first option and launched App Center (or the AI builder, depending on where the tile sat) without the user choosing anything. An option now ignores the second click of a double-click. * fix(dashboard): act on an app tile once per double-click A tile acted on every click, so a double-click opened an external app's site in two browser tabs. Double-clicking an option in the add-app modal also launched whichever tile sat under the pointer once the modal had closed (App Center and Recorder together, say). A tile now ignores the second click of a double-click; the first already launched, focused or opened what was asked for. * fix(gui): show app launch refusals in a Puter alert, translated launchApp reported "You don't have access to …" and "Couldn't open …" through window.UIAlert, which nothing defines, so both fell through to the browser's native alert(): a blocking, unstyled, English-only dialog over the dashboard or desktop. They now use UIAlert directly, with the text in en.js, and pass the app title unencoded since UIAlert encodes its message itself. * fix(dashboard): clicking a toast with nothing to open keeps apps on screen A toast click brings the dashboard forward before acting on the notification, hiding every app window. Only share notifications lead anywhere, so clicking an "events subscription ended" toast (or any other type) to dismiss it minimized the app the user was working in and showed a dashboard with nothing to look at. Those toasts now just mark the notification read. * fix(dashboard): show an emptied Trash as empty Emptying the Trash from the Files tab took its rows away but left the footer on "N items · X MB" and the pane blank, without the empty-folder notice; the selection bar kept offering actions on rows that were gone. Emptied from another tab, the listing was cleared with .empty(), which also dropped the loading overlay and likewise never updated the footer. Both paths now finish with the empty notice and a fresh footer. * fix(dashboard): say a folder is empty when its last item goes elsewhere When another tab, device or app deleted or moved away the last item in the folder Files was showing, its row faded out and left a blank pane: the item.removed and item.moved handlers updated the footer but never put the "folder is empty" notice up. They now do, for rows that were in the Files listing. * fix(dashboard): list failed drag-and-drop uploads one per line The upload-button path was fixed to put each failed item on its own line, but files dropped onto the listing still joined them with "\n", which UIAlert's HTML collapses into spaces: every failure ran together on one line. Both paths now build the message in failedUploadsMessage. * fix(dashboard): dropping items back into their own folder does nothing Dropping a selection on the sidebar entry for the folder it came from, or spring-loading into a folder and coming back to release in the listing, asked move_items to move every item where it already was, and each one stopped on a "Cannot move item to its current location" alert in turn. The breadcrumbs already ignore such a drop; moveDraggedRows now leaves those rows out too, and a drop with nothing left to move does nothing. * fix(dashboard): a Ctrl- or Alt-drop on the Trash trashes the items Ctrl-dragging a file onto the sidebar Trash (or a Trash breadcrumb) copied it into the Trash: the original stayed put, and the copy carried no original path, so it was offered Restore and Restore failed. Alt-drops made shortcuts there the same way. The four drop handlers' copy/shortcut/move choice moves into dropRowsInto, which only ever trashes what lands on the Trash. * fix(dashboard): the first row click after a marquee released outside Files counts A marquee sets a flag so the click that ends it doesn't clear the new selection; the listing's click handlers consume it. Released over the sidebar or outside the window, that click lands elsewhere, the flag stayed set, and it swallowed the user's next click on a row. The flag now lapses once the release's own click has had its turn. * fix(dashboard): Back and Forward follow a folder the user renamed Open a folder, go back, rename it, then press Forward: history still held the old path, so Files showed "This folder couldn't be opened", and the Back/Forward long-press menus listed the old name. A folder renamed in Files now rebases the history entries in and under it, using the same path rebase the username-change handler does. * fix(dashboard): a folder that can't be opened becomes the current folder When a folder failed to list (deleted elsewhere, share revoked, offline), Files said "This folder couldn't be opened" but stayed on the previous folder underneath: history had moved on while the breadcrumbs, sidebar highlight and New Folder/Upload/Paste still pointed at the old folder, so a new folder or upload landed somewhere other than where the user seemed to be. The tab now moves to the folder it was asked for before showing the message, and creates nothing in it until it lists again. * fix(dashboard): double-clicking Save in the photo crop uploads it once Save closes the crop dialog, but the dialog stays in the page for its 200ms fade-out with its handlers live, so the second click of a double-click ran Save again and sent the profile picture to the server twice. Save does nothing once the dialog has closed.	2026-10-23 19:04:36 -07:00
Toshit ChawdaandClaude Opus 5	bdc9aa9e93	Revamp networking api with epoxy try 2 (#3476) ... * revamp networking api with epoxy * update to new epoxy build * force wisp auth * emit Error objects from socket 'error' events main tightened the socket error contract to pass an Error (see types/modules/networking.d.ts, which documents the reason as `error.message`); the epoxy rewrite still emitted a bare string, matching the older `(reason: string)` declaration. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test: cover the epoxy-based networking client Replaces the coverage lost when the wisp implementation was removed: PSocket.test.js and PWispHandler.test.js were bound to PWispHandler, parsers.js, and wispInfo, none of which survive the epoxy rewrite. PSocket.test.js - connect/retry, inbound data, write normalisation, close, and the TLS event remapping. Driven through real ReadableStream/WritableStream pairs so reader locking, cancel, and abort behave as they do in the browser. index.test.js - relay-token exchange (auth header, 401 re-auth and retry, malformed responses) and the epoxy client cache (keying, refresh, in-flight sharing). requests.test.js - pFetch delegation, cache invalidation, and the api call logger's request description. epoxy.test.js - the hand-packed wisp password extension payload. The wasm runtime loader is left to integration coverage; it needs a network fetch and a browser. createPuterPasswordBuilder is exported so the byte layout can be tested against an injected fake runtime. One skipped test records a pre-existing defect: on a failed write, #readLoop's normal-termination path races #closeStreams and emits close(false) after an error. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix: report socket close flags and epoxy init failures accurately PSocket #readLoop raced the teardown it was being torn down by. A failed write sets #closing and hands the close event to #closeStreams, which has to await reader.cancel() and writer.close() before emitting close(true). That cancel resolves the loop's pending read with {done: true}, so the loop broke, reached its own #emitClose(false), and set #closed first -- callers were told the socket shut down cleanly right after an error. The loop now defers the close event whenever a teardown is under way, in both its normal and its throwing path, and #closeStreams always emits. getEpoxyClient swallowed every init failure and resolved undefined, so a dead relay reached callers as "cannot read properties of undefined (reading 'connect')" instead of its cause. It now re-throws, still without caching the failed attempt. A socket reports "wasm unavailable" or "Failed to create relay token (HTTP 503 ...)" and closes with the error flag set. Two related cache faults fell out of that rewrite: the in-flight early-return ignored `refresh`, handing a caller the very attempt it asked to replace, and it ignored the cache key, so an attempt started before a token change satisfied a request made after it. Reuse is now conditional on both. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * restore the public API surface dropped in the epoxy revamp The epoxy rewrite kept the shape of the old networking client but lost three things callers depend on: - JSDoc on the exposed methods. Re-added on PSocket (constructor, on, addListener, write, close), PTLSSocket and pFetch, along with the SocketEvent typedef and a Networking type on netAPI. `on` carries the TLS event aliasing docs that used to live on PTLSSocket, since that behaviour moved here. - socket.write's error message, which lost its trailing '!!'. Apps match on the message, so it is restored verbatim. - pFetch's client-side validation. Epoxy reports a bad request as an opaque wasm value from deep inside the transport, so the scheme check, the Content-Length/body check and the malformed-request TypeError are made before a relay is dialled, rejecting with exactly what they rejected with before. Validation builds its Request from a clone, or it would consume the body epoxy is about to send. The latter two are what the net API suite asserts on node, browser and workerd, and it has been failing on all three since the revamp. addListener takes named parameters so it can be typed, and three unit tests that pinned pFetch's habit of forwarding unvalidatable input were updated to the documented behaviour. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * update epoxy client to 04e4930 connectionPrefs changed shape: the handshake and its required extension list are one object now rather than a tuple, and handing the new build the old form throws part way through the handshake. The bump is not optional. The previous build cannot reach the current relay at all: it enforces the required puter password extension even when a relay answers with a v1 CONTINUE, and fails with "Protocol extensions not supported" -- which is what puter.cafe answers with today. Verified against a local relay: fetch, POST bodies, https, raw sockets and TLS sockets, the last exercising connectTls, whose third parameter became an options object in this build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * bump epoxy * dont require ext * chore(puter.js): update Epoxy runtime to 68c6904 * chore(puter.js): update Epoxy runtime to affd9f5 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-23 16:57:25 -07:00
Nariman Jelveh	21c1e4142e	fix(dashboard): fourth adversarial review — bugs, UX, a11y, perf (#4312) ... * fix(dashboard): keep Escape working when two share or properties dialogs are open Each share and properties dialog bound its document keydown under one fixed namespace, so closing either instance unbound every instance's Escape. Double-clicking Share… or Properties in the context menu opens two; after the top one closed, Escape no longer closed the one left behind. Each dialog now binds under its own namespace. * fix(dashboard): don't close Properties when a text selection ends on the backdrop Drag-selecting the path or UID in the properties dialog and releasing over the dimmed backdrop closed the dialog: the click lands on the overlay when press and release are on different elements. The backdrop now closes it only when the press started there, as the share dialog already does. * fix(dashboard): keep focus in Properties after disassociating one of several websites With more than one website on an item, disassociating one removed the focused button and returned early before refocusing the dialog, so focus fell to the page and the next Tab landed in the dashboard behind the modal. The dialog takes focus back as soon as the entry is removed. * fix(dashboard): handle the Properties stat failure instead of leaving it unhandled puter.fs.stat both calls the error callback and rejects. The properties dialog rendered the error from the callback but dropped the promise, so opening it on a deleted item or offline logged an unhandled rejection. * fix(dashboard): don't double-encode the "anyone" and withheld-invite share rows The share dialog encodes row names when it renders them, but these two labels came from i18n() already HTML-encoded, so a translation containing an apostrophe or ampersand would show its entity text. They're now taken unencoded like every other row name. * fix(dashboard): make the touch context menu reachable by assistive tech and keyboard The touch action sheet had no roles and never took focus: it was appended at the end of the page, so a screen reader announced nothing on open and focus stayed on the page behind it. It's now a menu of menuitems (with separators and submenu popups marked), takes focus on open, gives it back on close, moves between enabled items with the arrow keys and Home/End, and shows an inset focus ring for keyboard use. Taps draw no ring. * fix(dashboard): keep Apps folders and order when a settings read fails The Apps tab read the saved order, folders and uninstalled-apps list with `.catch(() => null)`, so a failed read looked like a user who had never saved any. One flaky request emptied the folders and reset the grid to the default order, and the next drag or folder edit wrote that loss back to kv for good. A failed read now keeps what the session already has (the last uninstalled-apps list included). Until a read of the order or folders has succeeded, saves stay in memory instead of overwriting the stored value. * fix(dashboard): drop the Apps tile a failed deep-link launch drew Landing on /app/<name> (or choosing an option in the add-app modal) adds the app's tile before the launch runs, because the launch is what installs it. When the launch failed — no access, no app token, a thrown error — the tile stayed for the rest of the session, survived refreshes, and every click on it failed again. The launch outcome is now passed to settleDeepLinkLaunch, which takes a tile it drew back out (and restores a previous uninstall record) when nothing was launched. * fix(dashboard): put a re-installed app back in its saved slot Uninstall keeps the app's name in the saved order so a re-install returns it to its place, but a deep-link landing appended the tile at the end of the grid. The install animation played on the last page and the tile then jumped back to its saved slot on the next refresh. The landing now places the tile through reconcileAppOrder like every other load. * fix(dashboard): don't double-encode the add-app launch failure alert UIAlert encodes its message, so passing it the already-encoded i18n string showed entities on screen in languages with an apostrophe (French read "s&apos;est mal passé"). * fix(dashboard): say so when an app tile fails to launch A tile click whose launch rejected (for example the app lookup failing) only logged to the console: the icon flourish played, settled, and nothing opened. It now shows the same alert the add-app modal shows for that failure. * fix(dashboard): keep focus inside the Apps modals and return it on close The uninstall and add-app modals are aria-modal but had no Tab trap, so Tab walked into the search box and tiles behind the scrim, where typing filtered the grid under the modal. Closing the add-app modal, and confirming an uninstall, dropped focus to the page body. Tab now cycles inside both cards; closing the add-app modal returns focus to the add tile, and an uninstall leaves focus on the tile that takes the removed app's slot. * fix(dashboard): upload from a folder's menu into that folder Upload in a sidebar or breadcrumb folder's menu opened the shared file picker, whose handler always uploaded into the folder on screen: files picked for Pictures while viewing Documents landed in Documents. The menu now hands its folder to the picker. * fix(dashboard): no New, Upload or Paste where nothing can be created New Folder, Upload, the New/Paste/Upload menu items and file drops were only refused in the Trash itself and the Shared view. Inside a trashed folder they created items without the metadata Restore needs, and at / every create failed (an upload there threw before its progress window existed and showed nothing). One check now covers the Trash, folders in it, the Shared view and /. * fix(dashboard): make Paste Into Folder work after a cut The row menu's Paste Into Folder handed a cut to the desktop's move_clipboard_items, which finds items by their on-screen elements and plain-string paths. The Files tab's cut stores {path, uid} objects, so nothing moved and the clipboard was emptied. The menu now takes a paste handler, and Paste, Ctrl+V and Paste Into Folder share one. * fix(dashboard): don't cut or copy trashed items out of the Trash The single-item menu still offered Cut on trashed items, and Ctrl+C copied them; pasted elsewhere, they kept their raw name in the Trash, a uid. Trashed items leave through Restore, which puts the original name back. * fix(dashboard): Delete Permanently works in every language The confirmation compared the clicked button's label with 'Delete', so in any other locale confirming did nothing. The buttons carry values now. * fix(dashboard): refresh Files on return after a cancelled rename Escape, or keeping a name unchanged, hid the rename editor but left its -active class, and the refresh on returning to the browser tab takes that class for an open editor: the listing stopped refreshing until the next navigation. * fix(dashboard): clear a drop target's highlight after the drop jQuery UI fires no `out` on drop, so the folder row a selection was dropped on stayed selected (and went to the Trash with the next Delete), a sidebar folder stayed highlighted as the current one, and a breadcrumb kept its drop outline. * fix(dashboard): listing drops keep working after a drop on a folder row Dropping files from the computer onto a folder row stopped the native event before the listing's dragster saw it, leaving its enter state stuck: later drags didn't highlight the listing, and drops on its background uploaded nothing. * fix(dashboard): offer Restore only for items Restore can handle Selecting files inside a trashed folder offered Restore in the multi-select menu and the selection bar, which then failed once per item: only direct children of Trash carry restore metadata. The trashed multi-select menu also drew two separators in a row. * fix(dashboard): show names as typed in conflict and move-failure alerts These alerts html-encoded the file name before UIAlert encoded the message again, so "R&D.txt" read "R&amp;D.txt". "already exists." is translatable now too. * fix(dashboard): list failed uploads one per line The failed-upload list was joined with newlines, which the alert collapses onto a single line. * fix(dashboard): translate the shortcut badge's tooltip * fix(dashboard): select mode toggles rows with any pointer In select mode, a stylus or mouse tap on a phone or tablet toggled the row in pointerdown and again in click, leaving it as it was; in a narrow desktop window a click replaced the selection and the selection bar never showed. Select mode now toggles in click for every pointer and shows its bar whenever it is on. * fix(dashboard): show items added elsewhere while New › Web Link prompts The New menu's create wrapper suppressed item.added for as long as it ran, which for Web Link includes its URL prompt, so files added to the folder meanwhile never appeared. It now counts only from the actual create. A create that fails now says so instead of failing silently. * fix(dashboard): keep the Files spinner under the mobile drawer The loading overlay sat at the maximum z-index, so on phones it drew over the open drawer and its scrim and took their taps while a folder loaded. It only needs to sit above the rows. * fix(dashboard): don't show a failed usage request as zero usage getMonthlyUsage() resolves with the error body when the request fails, and Usage and Home read it as a month with nothing used: $0.00 of $0.00, 0%, and on Usage an empty table replacing the one already on screen. A body without a usage report is treated as the failure it is, so the last good numbers stay and a first load shows the "unavailable" note. * fix(dashboard): draw Files select-mode accents in the selection color The checked checkbox, the active Select button and the Done button were filled with --primary-color, the desktop's text color rather than an accent: charcoal by default, and white (on white text and ticks) for anyone whose desktop theme uses light text. They use --select-color, the accent the rest of the selection already uses. * fix(dashboard): stop the mobile drawer animating under reduced motion The reduced-motion override for the drawer, its scrim and the menu button came before the drawer rules it was meant to cancel, and the open drawer's rule outranked it too, so the drawer still slid and the scrim still faded. The override now follows those rules and covers the open state. * fix(dashboard): make the toast close button readable in dark mode Dark mode gave the close button the card color and then inverted the whole element, which turned the disc light grey and the cross white: about 1.4:1. Without the background the invert gives the light-mode button's mirror, a dark disc with a white cross. * fix(dashboard): leave the temporary-account state once the account is saved Saving a temporary account from the user menu promoted the user in place without a reload, but Home kept its Save session warning (reopening the save dialog for a saved account) and Account and Security stayed without their password and email cards until the page was reloaded. The dashboard now reacts to account-saved, which fires after the user is updated. * fix(dashboard): give the API token field 16px text on touch screens The coarse-pointer rule that sets the token field to 16px, as the other dialog inputs are, came before the field's own 13px rule of the same specificity, so the 13px won and iOS zoomed the page when the field was focused. The touch rule now follows it. * fix(dashboard): lighten the General access dropdown arrows in dark mode The dark-mode chevron override covered the share modal's recipient selects but not the two General access ones, which kept the darker light-theme stroke on the dark card. * fix(dashboard): don't leave the sidebar collapse button shaded after a tap Its hover style was the sidebar's only one not limited to devices that hover, so on a wide touch screen (an iPad in landscape) the button kept its hover shade after being tapped. * fix(dashboard): refresh the Usage tab when the subscription changes An upgrade from the Usage tab's own button, or a return from the billing portal, refreshed Home behind it while the Usage meter and plan button kept the old allowance until the user left the tab and came back. Usage now handles puter:subscription:changed while it is showing. * perf(dashboard): load usage and storage once when the dashboard opens Home and Usage both load the monthly usage and the storage space when the dashboard opens, whichever tab it opens on, so every open sent /metering/usage and /df twice. Overlapping loads now share one request. Nothing is cached: a load after the shared one settles fetches again. * fix(dashboard): keep keyboard focus on the Usage table's Show more/less The table redraws without the button that was pressed, so focus fell back to the page and the next Tab started from the top. Focus now moves to the button that replaces it, as the sort headers already do. * fix(dashboard): give primary buttons readable contrast The dialogs' primary buttons, the share modal's Share and the photo crop's Save were filled with the link color under white text: 4.07:1 in light mode, 3.08:1 in dark, where hover lightened it further to 2.38:1. They take their own fill now, #4a67f5 (4.62:1) darkening to #3d5bd9 (5.68:1) on hover in both themes; links keep their color. * fix(dashboard): keep collapsed-sidebar labels above the dashboard The hover label is attached to body at z-index 1000, while the dashboard window's z-index climbs with every click (focusWindow raises it). Over a long session the window passed 1000 and the labels rendered behind it, so hovering the collapsed sidebar showed nothing. * fix(dashboard): bring muted and tertiary text up to AA contrast The muted and tertiary greys carry real information (form hints, file dates and sizes, share "via" lines, the sidebar's team name, notification text and times) but fell short of 4.5:1: 2.56:1 and 3.54:1 on white, 3.18:1 and 3.13:1 on dark cards. They now clear it on the cards and the sidebar in both themes (light #5f6b7d / #707070, dark #8b95a5 / #94949c). Disabled buttons keep the fainter grey through their own token, so they still read as disabled. * fix(dashboard): name the plan on self-hosted installs instead of "--" A self-hosted install has no /marketplace/subscriptions/current route, and Home treated its 404 like any failed read, leaving "Your Plan" at "--" for good. A 404 now shows the plan every account starts on. The upgrade badge and link, which have nothing to reach there, go too, unless the hosted upgrade dialog is loaded. * fix(dashboard): make hover and press feedback visible in dark mode Dark mode's hover color, #2a2a2a, was 1.05:1 against the #262626 cards and #252525 sidebar, so hovering a notification or sidebar item and pressing a touch-menu or drawer item showed next to nothing. #333 sits as far off them as light mode's hover sits off white, and stays below the selected item's #3d3d3d. * fix(dashboard): follow a username change in the Files tab Changing the username, or saving a temporary account under a chosen name, moves the home folder. The GUI rewrote data-path attributes and the path globals, but the Files tab kept its current folder, back/forward history, clipboard and drawn rows on the old path, so sorting, New Folder, Upload, Up, Back and the breadcrumbs all failed with "This folder couldn't be opened" until a reload. update_username_in_gui now announces the change, and the Files tab moves its paths over and redraws. * perf(dashboard): lay out only the new row when an item is added to Files Every item added to the open folder from elsewhere (another tab, an upload, a move into it) restyled and re-truncated every row in the listing, so a burst of adds was quadratic in the folder's size: 100 adds into a 300-item folder took ~800ms of main-thread work. The added row now takes the listing's column layout on its own (~130ms for the same burst). * fix(dashboard): open the Sort and View menus at their buttons from the keyboard Enter or Space on either button fires a click with no coordinates, so the menu opened at the top-left corner of the screen, far from the button. A keyboard press now opens it below the button; a pointer click still opens it at the pointer. * fix(dashboard): open a breadcrumb's long-press menu as the touch sheet A breadcrumb's long-press opened the desktop context menu at the event's pointer position, which a long-press doesn't have, so on tablets the menu landed wherever an unset position put it. Breadcrumbs now open the same touch sheet, anchored to the crumb, as the sidebar folders and rows do. * fix(dashboard): don't drag-move items the user can't move Delete, Cut and their buttons already leave out shared roots and items in a read-only share, but dropping them on a folder, a sidebar entry or a breadcrumb still sent the moves, and each came back as a "Forbidden" alert. Drag moves now leave those rows out too; copying them still works. * fix(dashboard): clear "1 item selected" when a double-click opens a file Opening a file by double-click deselects its row, but the footer kept saying "1 item selected" with nothing selected. * fix(dashboard): only the Trash gets the Trash label in breadcrumbs Any folder named "Trash" was shown with the translated Trash label in the breadcrumbs, so in German ~/Documents/Trash read as "Papierkorb". The label now goes on the user's Trash folder only. * fix(dashboard): name a trashed folder by its old name in the breadcrumbs A trashed item's name on disk is its uid, so opening a trashed folder showed a crumb like "ffaff8cb-dcaf-44f7-…" while its row in the Trash read "Old project". The crumb now uses the name the row shows. * fix(dashboard): show why Delete Permanently failed and keep the item delete_item fades the item out before the request; when the request failed it left the item hidden, as if deleted, and passed the alert the undefined `responseText` of a puter.js error, which threw. The item now comes back and the alert shows the error's message. * fix(dashboard): translate the New menu's Web Link and templates strings "Web Link", its URL prompt, validation and failure messages, the "User templates" submenu, and the account prompt before publishing a worker were hardcoded English in the Files New and item menus. * fix(gui): stop leaking a document click handler per context menu Every context menu bound its item-click handler on document, delegated to its own id, and never unbound it. Each menu opened therefore left a handler that ran on every later click in the page and kept the menu's items alive, rows and fs entries included. The handler is now bound on the menu itself and goes with it. It still returns false, so item clicks keep not reaching document-level click handlers, as before. * fix(gui): run a context menu item once on a double-click The menu stays clickable during its 200ms fade-out, so the second click of a double-click ran the item again: double-clicking Share… or Properties in the dashboard opened two stacked dialogs. A menu that has started closing now ignores item clicks. * fix(dashboard): drag a select-mode selection from its own rows Select mode returned from pointerdown before recording whether the pressed row was already selected, so a drag started from that stale value: dragging selected rows didn't move them, and a stale "selected" could let a drag from an unselected row clear the selection. The value is recorded first now. * fix(dashboard): leave Files select mode when the window widens past 480px Select mode's Select and Done buttons only show up to 480px, so turning it on in a narrow window and widening it left every click toggling rows, with no way out short of narrowing the window again.	2026-10-23 15:24:02 -07:00
Neal Shah	03e483e372	PUT-2252 (#4311)	2026-10-23 17:33:59 -04:00
Nariman Jelveh	9c90c7afde	fix(dashboard): third adversarial review — bugs, UX, a11y, perf (#4310) ... * chore(dashboard): add the standard file header where it was missing * fix(dashboard): rename editor keeps entity-like names; rows follow remote renames The name editor decoded its already-decoded value a second time, so opening it on a file such as "R&amp;D.txt" and clicking away renamed it to "R&D.txt". A rename or update from another tab only patched a row's attributes, while its open/copy/share handlers kept using the entry they were rendered with; the row now keeps that entry current and refits its name. * fix(dashboard): Files selection, preview and Trash/Shared edge cases - A marquee drag without modifiers now replaces a selection made by click, Ctrl+A or the arrow keys instead of adding to it. - With the image preview open, clicking another image switches to it, and moving onto a non-image closes it instead of keeping the old image up. - Cut (Ctrl+X, multi-select menu) skips trashed items, which leave the Trash through Restore; Ctrl+V refuses the Trash and the Shared view like the Paste menu item does. - Drops on the Shared sidebar entry or breadcrumb are refused (the drag snaps back) instead of sending writes to a path that isn't a folder. - The Trash selection bar shows Delete permanently again after a selection elsewhere had hidden it. * fix(dashboard): keep an open rename across refreshes; re-sort renamed rows A same-folder refresh (an upload or paste finishing, a sort change) rebuilt every row and silently dropped a rename in progress; the editor now comes back on the same item with the text and caret the user left. A renamed row whose new name sorts last stayed where its old name was. * fix(dashboard): Files columns follow the room the listing has - Resizing a column past the listing's width clamps it instead of resetting every column to the defaults; a window too narrow for the saved widths lays out at the defaults but keeps the saved widths for when it widens. - Columns and grid names re-fit when the window or sidebar resizes the listing, not only on the next navigation, and grid names hidden behind another tab are fitted when the Files tab is shown. - Names are measured in the font they render in (the compact grid's is smaller), and a column drag relayouts at most once a frame. * fix(dashboard): Files keyboard and touch edge cases - The marquee selects file rows only, not the Shared/Trash place rows Home shows on narrow screens. - Row shortcuts stand aside while the touch action sheet is open. - Breadcrumb long-press opens its menu on iPadOS too. - A folder rendered before the saved view preferences load uses the defaults instead of throwing and blocking navigation. * fix(dashboard): share and properties modals — focus, Escape, link state Share modal: - Escape pressed in a window opened over the modal (a verification or upgrade gate) no longer closes the modal underneath. - Turning the link on or off for a selection too large to list now shows the result instead of leaving the control on its old state. - Opening the link up starts at view access; it no longer reuses a hidden mode left over from earlier, which could hand out edit access. - Focus returns to the select the user changed. Properties modal: - Takes focus when it opens, keeps Tab inside, gives focus back on close, and leaves Escape to a window opened over it. - Shows a loading state, and opening Versions on a folder before its details load no longer leaves an empty body. - Disassociate is a real button, ignores repeat clicks while pending, reports a failure, and keeps the website badge while other sites remain. - Tabs carry tab/tabpanel roles; transitions respect reduced motion. * fix(dashboard): account dialogs, avatar saves and usage figures - A form dialog ignores Escape and backdrop clicks while its request runs, so the outcome isn't lost behind a closed dialog; the close button still works. - A new API token, shown only once, survives a stray click outside the card. - Copy token works on origins without navigator.clipboard (plain-http self-hosts) instead of throwing, falling back to a selected field. - Saving one profile picture and then another before the first finished can no longer leave the first one's picture or failure on screen. - The storage host bar is clamped to the room left beside Puter's share and hides its label when there is no host figure. - Sub-cent dollar costs read "<$0.01" rather than "$0.00", and the usage meter reads 99% until the allowance is actually spent. * fix(dashboard): Apps folder drag, search, keys and loading - A drag inside an open folder that is cancelled (Escape, blur) or dropped back in place puts the tiles back in their saved order; the cached panel markup used to skip the rebuild, and the next drag then saved the cancelled move too. - Search no longer matches substrings of generated app ids, so "app" or a single hex letter stops returning every website shortcut. - Arrow keys and Enter stay with the notifications panel, an account dialog or the touch action sheet while one is open over the grid. - The grid shows after 1.5s even if an icon host never answers. - Refreshing a grid already on screen keeps the page and skips the fade. - Rename from a folder's menu focuses the name on touch devices too, and the folder dialog's label follows renames and counts the apps shown. - i18n inserts %% values literally, so a name containing $& or $' no longer comes out mangled. * fix(dashboard): shell navigation, a11y and notification sync - Missed notifications replayed on load toast as one burst (a few, then a summary) instead of one toast each. - A notification read in another tab while this tab's first listing is in flight is no longer shown as unread when that listing lands. - Focus stays in the notifications panel when Mark all read or Retry hides the button that had it. - The active sidebar tab carries aria-current, and the account button is named by the username even while the collapsed sidebar hides it. - Landing with ?ref= replaces the history entry, so one Back leaves. - Ctrl/Cmd/Shift-click on a sidebar tab opens it in a new browser tab. - Recently used keeps the newest list when refreshes overlap, and app names are URL-encoded in the links it opens. * fix(dashboard): focus rings, dark-mode contrast and reduced motion - App tiles show a focus ring, not only the hover enlargement; Home card headers get an inset ring the card's rounded clip can't cut off; the Delete account button gets the settings cards' ring. - Pager arrows are mouse-only (the dots page by keyboard), so invisible arrows are no longer Tab stops, and an arrow with no page leaves the accessibility tree. - Dark mode: the Files toolbar's action icons match the nav arrows and stay readable on the hover chip, hovered breadcrumbs keep their contrast, and the shared-item dot's ring follows the row background. - The row '⋯' button is visible at rest on touch screens. - A long username or email wraps inside the profile card. - The touch action sheet, the Files selection bar and the app feedback modal stop scaling/sliding under reduced motion. * fix(gui): desktop rows store remote renames raw; column resize stays in bounds - The desktop's item.renamed/item.updated handlers wrote HTML-escaped names into data-name, the title and the name editor (and titled windows by an undefined uid). They store the raw name now, as rename_file does, so the editor shows the real name now that it no longer decodes a second time. - Resizing a Files column while saved widths are too wide for the listing starts from the widths on screen, and a width is held at its column's minimum, so a drag or auto-fit can't save a negative width. - Double-clicking a row closes the image preview, which would otherwise float above the app window it opens.	2026-10-23 12:32:33 -07:00
Rasad RegmiandDaniel Salazar	acd3df8c1b	fix(puter-js): replay the request after a successful token_auth_failed reauth (#3954) ... * fix(puter-js): replay the request after a token_auth_failed reauth A 401 carrying the legacy `token_auth_failed` code opened the sign-in prompt and then dropped the re-authenticated token on the floor: `resolveReauth()` fell through to `return null` instead of returning `{ action: 'replay' }`, so the original call was never re-issued and rejected with `Unauthorized` even though the new session was valid. Return the replay verdict the `reauth_required` branch already returns. Both replay paths stay one-shot (`ctx.done.add('reauth')`, `spec._replayed`), and the auth gate rejects before the route handler runs, so a replay has no side effects. Closes #3953 * fix(puter-js): sign in once when a replayed XHR is refused again handle_resp ran the reauth flow on the replay's own 401, so a token_auth_failed that survived the replay reset the fresh token and opened a second sign-in before rejecting. Treat a replay's 401 as final, as the 403 verification-gate branch already does. --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-23 00:07:56 -07:00
Daniel Salazar	4729d733bb	feat(aws): DynamoDB, Polly and Textract can use the default credential chain (#4307) ... `useCredentialChain: true` in `dynamo.aws`, `providers['aws-polly']` or `providers['aws-textract']` takes credentials from the default AWS chain instead of static keys, as `s3.s3Config` already does. One provider is shared and refreshes temporary credentials itself.	2026-10-22 21:31:23 -07:00
Nariman Jelveh	26d843778e	feat(dashboard): account dialogs as dashboard modals instead of windows (#4305) ... * feat(dashboard): account dialogs as dashboard modals instead of windows Edit profile, change username, change password, change email, create API token, and delete account in the Account tab (and change password in the Security tab) now open as dashboard overlay cards, like the share, properties, and confirm dialogs, instead of desktop UIWindows. They are centered cards on desktop and tablet and bottom sheets on phones. - dashboardOverlay.js: the overlay shell UIDashboardDialog already had (reveal, Esc/backdrop/close dismissal, focus trap, focus return), pulled out so the new form dialog shares it. It also pins the overlay to the visual viewport so iOS's keyboard can't cover a sheet's fields, and leaves Esc to a modal opened on top of it. - UIDashboardFormDialog.js: labelled fields, password show/hide, an aria-live status line that marks and focuses the offending field, a busy submit button, and a done state. - postUserProtected.js: the cookie-retry / provider re-sign-in / reauth flow the four account windows each carried, in one place. - Deleting an account is one dialog now (warning plus confirmation) rather than two stacked windows. - Touch: 44px controls, 16px inputs (no iOS focus zoom), no autofocus that pops the keyboard mid-animation, form buttons side by side on phones, safe-area padding dropped while the keyboard is up. - The replaced windows had no other callers and are removed with their tests, which are ported to the new modules. * fix(dashboard): a double-click that opens a dialog no longer dismisses it The second press of the double-click lands on the freshly mounted backdrop and closed the dialog straight away. Backdrop presses with a click count above one no longer count toward dismissal. * fix(dashboard): a failed form submit keeps focus in the dialog Locking the fields disabled the focused control, which drops focus to the page, so after an error Enter no longer retried and screen readers lost their place. The control that had focus gets it back once the fields unlock, unless the handler moved focus elsewhere in the dialog. * fix(dashboard): a form error keeps the field it names in view The status line scrolled the dialog body to the bottom, which on a short screen (a phone with its keyboard up) left the field being focused and marked invalid scrolled off the top. The body now scrolls back up just far enough to show that field. * fix(gui): a blocked re-sign-in popup fails instead of waiting forever openRevalidatePopup polled a popup that was never opened, so when the browser blocked it the account dialog stayed busy indefinitely. It now rejects straight away and the dialog says the sign-in didn't finish. * fix(dashboard): password show/hide reads as one action, not a pressed toggle The button flipped its label between Show and Hide password and also set aria-pressed, so assistive tech announced "Hide password, pressed" while the password was showing. It keeps the action label and drops aria-pressed. * fix(dashboard): screen readers hear a form dialog's success message The done state arrives as a new status region that already holds its text, which screen readers don't announce, so after a change succeeded they only heard "Done, button". The Done button that takes focus is now described by the message. * fix(dashboard): requesting an email change no longer sets the cached email The server only stages the new address until the emailed link is followed, but the dialog wrote it into window.user.email straight away. That cached a wrong address for the session and kept refresh_user_data from updating the Account tab once the change was confirmed, since the two already matched. * fix(dashboard): form dialog labels drop the global label shadow style.css's bare `label` rule gave the field labels a white text-shadow, which ghosted them on the dark theme, and an extra 3px under each label. * fix(dashboard): dialog inputs keep a 1px border when focused style.css's global input :focus rule still set a 2px border width, so a dialog field's text shifted by a pixel each time it took focus. The focus ring is the box-shadow; the border stays 1px. * fix(dashboard): phone dialog inputs stay 16px instead of jumping on focus On phones style.css's .device-phone input rule outranked the dialog's 16px size at rest, so fields drew at 17px and shrank to 16px the moment they took focus. * fix(dashboard): temporary accounts can delete themselves again The server reports oidc_only for every passwordless account, temporary ones included, so the shared user-protected helper sent a temporary account into the linked-provider sign-in, which has no URL for it, and the deletion never went out. Temporary accounts post directly, as the route admits them without credentials.	2026-10-22 17:13:50 -07:00
Daniel Salazar	80a9cd85ee	fix(ai): chat requests run to their upstream usage report after the caller disconnects (#4302) ... - Providers send upstream calls with a driver-owned `upstreamSignal` instead of the caller's `abortSignal`. A disconnect detaches the chat stream: output stops, the provider keeps reading until the upstream reports usage, and that usage is metered. - A detached stream gets SDK_TIMEOUT_MS to finish. After that the driver aborts the upstream, and the stream is metered like any other stream that ends without usage. - The disconnect check also runs right before dispatch. - The OpenAI stream handlers report usage that arrived before an abort. - Docs: stopping a stream stops the output, and a request that reached the model is billed in full. Detached streams get 10 more minutes.	2026-10-22 16:08:05 -07:00
Nariman Jelveh	63370fcfa5	fix(dashboard): mobile and tablet review — layout, touch, safe areas (#4303) ... * fix(dashboard): give narrow Files listings the two-row layout The two-row rows (name, then size and date) were keyed to a phone-width viewport, so between 481px and ~930px, where the sidebar and folder column take their share, the fixed size and modified columns squeezed names to a few characters. The layout now switches on the listing's own width with a container query, which phones still meet and wide listings never do. * fix(dashboard): wrap the Files toolbar onto two rows in narrow listings On tablets the nav buttons, crumbs and actions sat on one row wider than the listing, so the sort, view, new-folder and upload buttons ran off the right edge. Narrow listings now use the phone's two-row toolbar (crumbs above, buttons below); only the menu-button clearance stays phone-only. * fix(dashboard): keep a deep folder path on one row with the current folder in view A long path wrapped the crumbs over several lines on top of the column headers and pushed the toolbar actions off-screen; where the crumbs already scrolled (phones), the row opened at the root, hiding the current folder. The crumbs now scroll within their row and are scrolled to their end on render and when the tab is shown. * fix(dashboard): end clipped file names in the list with an ellipsis With the name column auto-sized, which is always the case on phones and tablets, a long name was cut off mid-letter with no sign it continued. * fix(dashboard): keep the Files selection bar under the drawer and sheets The bar's visible state set z-index 99999999999999999 (clamped to the maximum), so in phone select mode it drew over the open navigation drawer, covering the account button, and over the share sheet it opens. Its base z-index already clears the rows and the footer. * fix(dashboard): let the last Files rows scroll clear of the phone selection bar In phone select mode the list's bottom padding only cleared the footer, so the last row stayed behind the floating action bar even fully scrolled. * fix(dashboard): keep the phone Files footer and selection bar above the home indicator The installed app runs edge to edge, so the footer's item count sat under the iPhone home indicator. The footer now grows by the bottom safe-area inset, and the list padding and floating action bar move up with it, as the Apps tab and the dashboard's bottom sheets already do. * fix(dashboard): clear the home indicator in the item properties sheet On phones the sheet sits flush with the bottom edge, and unlike the share sheet it mirrors, its body didn't pad for the bottom safe-area inset, so the last details scrolled under the iPhone home indicator. * fix(dashboard): keep the app feedback sheet's buttons above the home indicator As a phone bottom sheet it sits flush with the bottom edge, so Cancel and Send ended under the iPhone home indicator. * fix(dashboard): size the touch context menu as a card on tablets The touch menu took 90% of the viewport, which on an iPad meant a ~920px strip with its labels far from the row they belong to. It now stops at 400px, which every phone stays under. Its height is also measured after the width is set, so the clamp to the viewport uses the real height. * fix(dashboard): let the Apps modals scroll in a short viewport The Add-an-app and uninstall cards had no height cap and their overlay centers without scrolling, so on a landscape phone with the keyboard up (the viewport resizes for it) the request form's title and buttons sat off-screen with no way to reach them. * fix(dashboard): align Account and Security with the other tabs on phones Below 768px their wrapper added a 16px gutter inside the content area's own, so both tabs sat 32px in while Home, Apps and Usage (and the menu button above them) sit at 16px. The extra padding stays for Apps, whose content area has none. * fix(dashboard): keep Home's recent apps inside their card on tablets Each recent app was a fixed 200px inside 1fr columns, whose minimum is that width, so in the half-width card on a landscape iPad the second column ran past the card's edge and its name was cut off with the ellipsis out of view. The rows now shrink with their column. * fix(dashboard): keep every Files folder reachable in a short viewport Trash was fixed to the bottom of the viewport, so in a landscape phone or a short window it sat on top of Public and Videos, while Shared ran below the column with no way to scroll to it. The folder column now scrolls, and Trash sits at its foot in the flow: in the same spot when there is room, after Shared when there isn't. * fix(dashboard): don't leave Account and Security buttons highlighted after a tap Their hover background wasn't limited to hover-capable pointers like the rest of the dashboard's hover styles, so on touch devices a tapped button (Change Password, Manage Sessions, ...) stayed shaded after its dialog closed. * fix(dashboard): give the Files row menu button a full-size touch target On phones the row's '⋯' is 40x23, right beside a row whose tap opens the item, so a slightly-off tap opened the file or folder instead of its menu. In the two-row layout it now has a 44px square hit area on touch screens. * fix(dashboard): enlarge the Files back, forward and up touch targets They were 28px squares on touch screens. On coarse pointers they now take 36px with a matching negative margin, so the toolbar layout is unchanged. * fix(dashboard): size Home's recent apps card to its apps on phones Its 310px minimum height matches the square welcome card beside it on wider screens. In the single-column layout the welcome card drops its square shape but the minimum stayed, leaving a block of empty card under a short list of recent apps. * fix(dashboard): stop clipping app names' descenders on phones and small tablets Below 768px the tile height budgeted 52px icon + 10px margin + 12px for a label line that is 15.6px tall, so the bottoms of g, p and y were cut off in every app name. The tile now has the full line (78px) and the row gap gives back the 4px, so tiles sit exactly where they did. * fix(dashboard): show Usage amounts in full on phones Every Usage table cell ellipsized, numbers included, so on a phone a token count like 12,345,678 read as "12,345...". Below 480px the units and cost columns now keep their full width and the resource name is the one that truncates. Wider layouts are unchanged. * fix(dashboard): stack Home's recent apps when their card is narrow In the two-column Home on a portrait tablet (iPad Air and Pro 11 at 820-834px, or 769px windows) the Apps card is about 200px wide, and two columns of recent apps cut every name to a letter or two. The list now switches to one column on the card's own width; 1024px and wider keep two. * fix(dashboard): fit two grid tiles a row in narrow Files listings Grid view's 170px column minimum left one 330px tile per row on 360px phones (and in a tablet's narrow listing), so barely two files fit on screen. Narrow listings now use two equal columns, and the tile's icon box shrinks with the tile instead of keeping its fixed 150px. * fix(dashboard): align the Shared and Trash rows' menu button on phones Item rows get position: relative from jQuery UI draggable, but the Shared and Trash rows above Home's folders aren't draggable, so their '⋯' was positioned against the whole list and sat 3px off from every other row's.	2026-10-22 15:39:47 -07:00
Daniel Salazar	631b264c1c	test(ai): every AI driver holds and meters at the AI cost factor (#4304) ... Image, video, TTS, speech-to-text and voice-changer driver tests run one request at factor 1 and again with every `ai.cost.factor.*` hook set to 2, and check that both the credit hold and the recorded cost double. Chat and OCR already had this coverage. A driver that hands a provider the raw metering service instead of its factored view now fails its test. `withAiCostFactorHook` in integrationTestUtil keeps the hook in place for a callback, since providers record their usage unawaited.	2026-10-22 15:31:15 -07:00
Filip KujundžićandClaude Opus 5.5	809c303117	fix(ai): treat a gateway 4xx with no upstream error body as a route failure (#4301) ... Infron (a new-api gateway) answers "bad response status code N" with the upstream's status when the upstream replied without a JSON error, e.g. a model the upstream no longer serves. That 4xx was classified as the caller's bad request, so the request skipped fallback, the dead route stayed in rotation, and the caller got upstream_bad_request. It now counts as an upstream failure: fallback runs, the route is marked unhealthy, and an exhausted chain reports upstream_provider_unavailable. A gateway error that carries the vendor's own message still stays request-level. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 15:14:28 -07:00
VonypetandCursor	afad53d3f4	feat(gui): add Filipino and restore the language menu (#4263) ... The desktop built the language list and never placed it on the user menu, so a saved locale could not be chosen. Register Filipino and show that list. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-22 15:13:43 -07:00
Daniel Salazar	8b8dd19eae	fix(teams): refuse to boot when teams_enabled has nothing registering Teams (#4300) ... * fix(teams): refuse to boot when teams_enabled has nothing registering Teams Core's seat checks (team 2FA, seat password reset, email and username changes, self-delete, the signup placeholder claim) read the team store and skip when it is absent. With `teams_enabled` on and no extension registering the store and service, the server now fails at boot instead of serving without those checks. - whoami no longer string-matches the extension proxy's "missing property" error: with the flag on, the store is always there. - Tests that turned the flag on without Teams drop it; the puter.js harness sets it only under the `teams` capability. - Drop a stale services/index.ts comment. * refactor(gui): drop the Teams console styles, which ship with the console now	2026-10-22 15:11:36 -07:00
Juan Fernando Castro	1fdde02f6a	feat(metering): free and no-allowance plan traits, provisional resolver answers (#4284) ... * feat(metering): let registered plans declare free and no-allowance traits A policy passed to registerPolicy can now set `free: true`, so isFreeSubscription and everything that reads it count the plan as free. It can also set `noAllowance: true`: the plan grants no monthly allowance, so only purchased credit can be spent, and the cached credit check refuses an actor that has none. A non-positive allowance without the trait still means the plan is not metered. getActorSubscriptionStatus returns the plan along with whether it was paid for and whether the answer is provisional (a lookup behind it failed, or the actor lacks a field resolvers key on), so callers can tell a fallback from a resolved plan. getActorSubscription is unchanged. * feat(metering): provisional resolver answers, and tighter no-allowance accounting A subscription resolver can answer { id, provisional: true }. The answer wins like any id but is cached only for the fallback window. On a no-allowance plan, the month record now records allowanceUsed = 0, so spend that purchased credit paid for is not counted again against an allowance the actor gets later in the month. An actor that never had budget raises no credit-state event. setMonthAllowance refuses plans whose allowance an override never applies to. * fix(metering): keep resolved plans clean when a default fails, and announce moves onto no budget A failed or provisional default resolver now marks the answer provisional only when the default is what applied; an explicit plan that won is cached for the full window. A provisional answer with no id still marks the result provisional. A plan or credit change now re-arms an actor's credit alert instead of forgetting it, so an actor moving onto a plan with no budget hears 'exhausted' once. An actor never seen with budget still hears nothing. * chore(metering): let a provisional answer carry no id, and fix two resolver docs * chore: one-line comments	2026-10-22 15:47:01 -04:00
Juan Fernando Castro	1627650abc	refactor: make teams an optional feature (#4248) ... * refactor: let core run without a teams registration Teams becomes optional: `services.team` and `stores.team` may be absent, and core stops assuming either is there. Seventeen call sites across share, signup, account deletion and the homepage now degrade instead of throwing: a team recipient that cannot be resolved is "no such recipient" rather than a fault, a group share folds in nothing, and account deletion stops asking what a seat was charged for. This generalises the pattern `gates.ts` and `SocketService` already used. Teams' own files take a private handle to their store and service, so the feature's code stays free of optionality that only core needs. No behaviour changes where Teams is registered. * refactor: put a contract between core and teams `core/teams.ts` holds the shapes core reads and the calls it makes, and the registries declare the pair as provided rather than built in. The service, store and controller are registered by whatever runs the feature. Typing them properly turned up eight AuthController call sites the previous commit could not see: the controller reads its stores from the built-in registry, so an absent `team` fell to an index signature and typed as `unknown` instead of erroring. They now go through the same optional path as the rest. The feature's own tests move with it. The cases in core suites that build a team to exercise a core rule still need relocating, so those suites are red here. * test: stub core's seat rules, rehome the rest with the feature A core suite can no longer build a team, so the rules that refuse a seat get `testFixtures/seatStub.ts` instead: it answers the contract, which is all those rules read, and puts the registry back when the test ends. Seventeen cases move that way. Four could not: group shares and a seat's 2FA enrolment over HTTP need the real feature and the `/teams` route, so they go with it, as does the whole of `GroupGrants.test.ts`. Two whoami cases asserted a seat's team through `extension.import`, which resolves the registry rather than the stores object. They now assert the absent case, and the behaviour they covered is asserted against `buildUserDetails`, which takes its stores as an argument. Suite: 12252 passed, 38 skipped. * refactor: take the teams console out of the built-in tabs `TabTeams`, `teamsConsole` and `teamActionIcons` are no longer built in. The dashboard already invites a tab through its `dashboard-will-open` event, so whatever provides Teams contributes the console the same way. Its 113 strings go with it and register into the shipped English dictionary at load, so `i18n('teams_*')` resolves as it did. Only `en.js` ever carried them, so no translation is lost. Three modules stay, because things other than the console use them: `teamBadge` (the dashboard shell), `orgSeat` (Home, Account, Security) and `shareTeams` (the share picker). They already render nothing when the account has no team. `teams_account_of` stays with `teamBadge` for the same reason, and the `share_*` and `plan_team_*` strings stay with their callers. The GUI builds clean with no console at all, and builds it in when the tab is contributed. * docs: seats past the owner's current limit get no allowance	2026-10-22 15:32:39 -04:00
Daniel Salazar	4968a69d45	fix(s3): keep credential-chain credentials an hour from expiry when signing (#4299) ... Presigned URLs die with the credentials that signed them, and the SDK only refreshes temporary credentials five minutes before expiry, so a URL signed late in a credential's life could expire long before its requested lifetime (up to an hour). The chain provider now reports expiry an hour early and force-refreshes credentials that are already inside that window.	2026-10-22 00:47:48 -07:00
Juan Fernando Castro	aa47dcd3e5	feat(workers): internal teardown that takes the script down before the row, and destroy reports Cloudflare refusals (PUT-2219) (#4297)	2026-10-21 18:50:54 -07:00
Daniel Salazar	c8424f6775	fix(fetch): raise HTTP/2 receive windows for plain fetch (#4296) ... Node 26's bundled undici negotiates HTTP/2 by default with a 256 KB per-stream receive window, which capped large downloads at about window / RTT (8.6 MB/s vs 46 MB/s over HTTP/1.1 at 23 ms). The guard swaps in an Agent of the same class with 4 MB stream / 16 MB connection windows.	2026-10-21 13:54:31 -07:00
Daniel Salazar	b3c85c86e9	feat(puter.js): open the upgrade page with what was refused (#4294) ... The web upgrade dialog's button opens the dashboard with the refusal reason, the app the call ran as, and the refused method as query params, so the dashboard can open its upgrade flow with that context.	2026-10-21 13:09:02 -07:00
Daniel Salazar	d22d419c4d	chore: move to Node 26 (#4295) ... * chore: move to Node 26 Docker image and CI run on Node 26 (bookworm-slim, same Debian base as before). Node 26's bundled undici reads the global dispatcher from the `undici.globalDispatcher.2` slot, so the guard's 10-minute timeout wrap on `.1` no longer reached plain fetch() and provider calls fell back to the 5-minute headers timeout. The guard now wraps every present slot and tracks wrapped dispatchers in a set, since compose() can return a Proxy that writes a marker property through to the original dispatcher. * test(puter-js): disable Node's web storage in test workers Node 26 defines its own localStorage global, undefined without a storage file, and vitest's jsdom environment doesn't replace globals that already exist, so jsdom tests saw localStorage as undefined.	2026-10-21 13:04:23 -07:00
Daniel Salazar	0760530d0c	feat(gui): edit display name and bio from the Account tab (#4293)	2026-10-21 12:57:15 -07:00
Juan Fernando CastroandDaniel Salazar	e18a5c2b54	fix(apps): refuse claimed subdomains as app index_url hosts (PUT-2110) (#4267) ... index_url may not point at a system host: the origin, the api host, or a subdomain an extension has claimed. App create and update now apply the same refusal to `<claimed>.<domain>` (any case, any port) that they apply to the origin and api hosts. The host-to-claim match is a new exported `subdomainLabelOf` in hostRedirects, also used by the claim dispatch middleware, so both decide the same way. Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-21 13:19:31 -04:00
Kailasnath TandDaniel Salazar	75385501a7	fix(fs): support offset and byte_count in read operations (#4266) ... * fix(fs): support offset and byte_count in read operations Allow partial content reads via offset and byte_count parameters in puter.fs.read and backend FS controllers. - In puter.js read operation, check options.offset and options.byte_count against null/undefined so offset: 0 is preserved in query params. - In handle_resp, accept any 2xx status code so 206 Partial Content responses resolve successfully. - In backend FS controllers (LegacyFSController and FSController), derive the HTTP byte range from query offset/byte_count parameters when an explicit Range header is not present. - Add unit and integration tests across controllers and SDK test suites. * fix(fs): strict range params, 416 past EOF, drop format churn - resolveReadRange accepts only decimal digit strings and safe integers - readContent maps S3 InvalidRange to 416 instead of a 500 - revert unrelated union-type reformatting, restore truncated test comment --------- Co-authored-by: Daniel Salazar <daniel.salazar@puter.com>	2026-10-20 21:20:51 -07:00
Daniel Salazar	5b0205f2bf	fix(hosting): apps publish with write again (#4291) ... Reverts the hosting part of #4290. manage stays a user-to-user grant; an app with write on its user's directory can publish and keep serving it.	2026-10-20 17:36:36 -07:00
Daniel Salazar	3bce3b056e	misc: hardening (#4290)	2026-10-20 17:12:13 -07:00
dependabot[bot]	356e7b2b94	chore(deps): bump follow-redirects in /src/puter-js (#4288) ... Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.16.0 to 1.16.1. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.0...v1.16.1) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 16:29:27 -07:00
jelveh	f02b4a6b73	feat: tell apps when a launched item is a folder; Open with AI above Open With ... A folder opened with an app (Open With, Open with AI) reached puter.js as a file: the GUI never forwarded the signature's fsentry_is_dir, so the launched FSItem always had isDirectory false. The GUI now appends puter.item.is_dir, and puter.js reads it in onLaunchedWithItems and the onItemsOpened launch replay. Both now share one URL-to-FSItem builder. "Open with AI" moves directly under Open, above Open With, in the desktop and dashboard file menus.	2026-10-20 16:16:20 -07:00
Nariman Jelveh	66093e78f3	feat(gui): "Open with AI" in the dashboard Files menu, opening like Open With (#4289) ... "Open with AI" now launches the `ai` app with the item the same way Open With launches any app: launch_app with file_path/file_uid, so the app gets a signed launch item via puter.ui.onLaunchedWithItems. It replaces the custom `ai:openFsEntries` postMessage, which went to an existing AI window. - The helper moved from UIItem into helpers/openWithAI.js, shared by the desktop item menu and the dashboard Files menu (generate_file_context_menu). - A shortcut opens its target. - Dropped from multi-select menus, since a launch opens a single item. - Renamed open_in_ai -> open_with_ai ("Open with AI") and removed the unused ai_app_unavailable string.	2026-10-20 15:33:12 -07:00
dependabot[bot]	ed531e3992	chore(deps): bump undici from 7.30.0 to 7.30.1 (#4280) ... Bumps [undici](https://github.com/nodejs/undici) from 7.30.0 to 7.30.1. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.30.0...v7.30.1) --- updated-dependencies: - dependency-name: undici dependency-version: 7.30.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:27:17 -07:00
dependabot[bot]	53e27f3d41	chore(deps): bump mysql2 from 3.24.5 to 3.24.6 (#4279) ... Bumps [mysql2](https://github.com/sidorares/node-mysql2) from 3.24.5 to 3.24.6. - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](https://github.com/sidorares/node-mysql2/compare/v3.24.5...v3.24.6) --- updated-dependencies: - dependency-name: mysql2 dependency-version: 3.24.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:25:23 -07:00
Nariman Jelveh	53e6e3179b	refactor(gui): remove the AI side panel and its desktop button (#4286) ... The desktop no longer launches the `ai` app at boot. This removes the `is_panel` window mode, which existed only for that launch, and the toolbar/taskbar/window/popover offsets tied to it. It also removes the desktop sparkles button that showed the panel, and the `silent_on_failure` launch option, whose only caller was the boot launch. "Open in AI" in the item context menu still launches the app as a normal window.	2026-10-20 15:21:21 -07:00
dependabot[bot]	73624bf1d0	chore(deps): bump smtp-server from 3.19.21 to 3.19.23 (#4276) ... Bumps [smtp-server](https://github.com/nodemailer/smtp-server) from 3.19.21 to 3.19.23. - [Release notes](https://github.com/nodemailer/smtp-server/releases) - [Changelog](https://github.com/nodemailer/smtp-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodemailer/smtp-server/compare/v3.19.21...v3.19.23) --- updated-dependencies: - dependency-name: smtp-server dependency-version: 3.19.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-20 15:19:00 -07:00
Nariman Jelveh	1a9e43f5e5	fix(dashboard): adversarial review — bugs, a11y, perf, i18n (#4285) ... * fix(dashboard): size the Notifications sidebar row like its neighbors The bell button's font: inherit overrode the sidebar item's font-size (16px instead of 14px, 15px in the drawer), and its icon wrapper stayed 18px while the drawer grows nav icons to 20px. * test(dashboard): scope the directory-note assertion to the directory row The 2FA row reuses .teams-directory-note, so the unscoped selector read both notes and the test failed. * fix(dashboard): only treat a picked file as a new avatar while the avatar picker is open The Account tab listened for every file_opened on the dashboard window, so choosing an image for a web link's Change Icon in the Files tab opened the profile-picture crop modal, and saving it replaced the avatar. * fix(dashboard): let dialogs over the Files tab keep their keyboard The Files keydown handler ran under an open confirm, so pressing Enter on the focused Delete button of the permanent-delete prompt opened the trashed item instead (stacking a second alert), and arrows or Delete acted on the rows behind the dialog. * fix(dashboard): keep Apps grid keys away from an open context menu Choosing a tile's menu item with Enter (e.g. Open in new tab) also launched the focused app in place, and arrows moved tile focus while they walked the menu. * fix(dashboard): Escape on a menu or modal inside an app folder keeps the folder open The menu's and the uninstall modal's Escape handlers removed them before the folder's listener ran, so it saw nothing above it and closed the folder with the same keystroke. * fix(dashboard): a tap on the drawer or sheet scrim only dismisses it Outside-press handlers closed the mobile drawer and the notifications sheet on touchstart/pointerdown, which took away the scrim's hit area before the click, so the tap also landed on the app tile or file row underneath. * fix(dashboard): let the sidebar nav scroll on short viewports The nav clipped its overflow, so in a landscape phone's drawer (or a short desktop window) Usage, Account, and Security fell below the fold with no way to reach them. * fix(dashboard): keep the mobile drawer full width when the desktop sidebar is collapsed The remembered collapse outranked the drawer's width rule, so below the drawer breakpoint it opened as an unlabeled 50px icon strip, and the toggle that would undo it is hidden there. * perf(dashboard): stop refetching account data each time focus leaves an app Home's window focus listener fired whenever focus came back from an app's iframe, so every click from an app to the dashboard re-pulled whoami, subscription, storage, and usage (5 requests), on any tab. It now only refreshes after the page itself lost focus to another window. * fix(dashboard): show a seat's team name unescaped in the plan card i18n escapes its arguments for HTML, but the note is set with .text(), so a team called "Bob's & Co" read "Managed by Bob&apos;s &amp; Co". * fix(dashboard): stop double-escaping app names in uninstall alerts UIAlert escapes its message, so an app titled "Tom & Jerry" read "Tom &amp; Jerry" in the uninstall-failed and sessions-not-ended alerts. * fix(dashboard): roll back an uninstall whose revoke failed puter.perms.revokeApp resolves with error set instead of rejecting, so a failed revoke still removed the tile, marked the app removed for later sessions, and ended its sign-in, while the app kept its permissions and the rollback and error alert never ran. * fix(dashboard): read a team account's suspension when its name matches an Object member The per-account state map was a plain object, so a username such as constructor or toString was already "in" it, its audit entries were skipped, and a suspended account showed as active with no Delete. * fix(dashboard): update the profile card and sidebar name after a username change Neither carried the .username class that the rename refreshes, so both kept showing the old name until reload. * fix(dashboard): ask how to restore a trashed item whose name is taken Restore moved without overwrite or dedupe, so when the original location already had an item of that name the move 409'd and nothing happened: an uncaught error from the item menu, a console line from the others. All three restore entry points now share one path that offers the Replace / Keep Both prompt the paste flow uses, alerts on other errors, and updates the footer and empty notice once the rows are gone. * fix(dashboard): refresh a renamed row's name, icon, and position in the Files tab The Files tab passed rename_file a callback it never accepted, so a renamed row kept the desktop's 20-character truncation even in a wide column, kept its old type icon, and stayed out of sort order. rename_file now takes an optional onDone (carried through undo), which the Files tab uses to fit the name to its column, refresh the icon and type, and move the row into place. A cancelled rename no longer truncates the name either. * fix(dashboard): drop Publish and Properties from the Shared view's menu The Shared view is a query, not a folder, so both acted on the virtual shared path: Properties showed an unknown error and Publish opened a dialog for a path that doesn't exist. * fix(dashboard): close the Files image preview on Escape and when leaving the folder Escape cleared the selection but left the Space preview open with nothing selected, the preview stayed over a different folder after navigating, and a preview whose URL arrived after it was dismissed or replaced still opened. * fix(dashboard): don't move Files history for a navigation that's dropped renderDirectory ignores a navigation while another folder is loading, but every caller had already pushed or stepped history, so after a click during a load the listing and history disagreed and the next Back or Forward seemed to do nothing. History now only moves when the render will run; back/forward steps share one helper. * fix(dashboard): reopening the current folder adds no Files history entry Clicking the folder already on screen (e.g. Home in the sidebar) pushed a duplicate entry, so the next Back reloaded the same folder. * fix(dashboard): show installed apps when the recommended list fails to load get-launch-apps sat in the same Promise.all as the installed apps and its body was parsed without a status check, so a network error or a proxy's HTML error page replaced the whole grid with "Failed to load apps". A failed list now falls back to the last one that loaded. * fix(dashboard): fit the app uninstall dialog on narrow phones The card is mounted outside the dashboard's border-box rule, so its 320px min-width plus padding came to 370px and was clipped on 360px screens; a long unbroken app title also overflowed it. Desktop sizing is unchanged. * fix(dashboard): keep a new team account's one-time password on screen until dismissed The credential box lived only in the DOM inside the panel that every refresh repaints, so revisiting the Teams tab or any later action wiped a password that can't be retrieved again. It is now kept in state, for the team it belongs to, and drawn with the panel. * fix(dashboard): reload the Teams tab after a change made while it was loading refresh() handed back any load already in flight, so an action or team switch made during a revisit's background load awaited data read before the change: a toggled setting snapped back, and a team switch could paint one team's roster next to another's record. A change during a load now queues one more load, the stale one skips its paint, and revisiting the tab doesn't start a second load while init's is still running. * fix(dashboard): send one re-enable request for a double click in Teams Re-enable has no confirm dialog to absorb a second click, and nothing held the action while it ran, so a double click enabled the account twice (two audit entries). A suspend or re-enable already in flight for an account now ignores further clicks. * fix(dashboard): revert the avatar and say so when saving a new photo fails The crop's Save showed the new picture everywhere and revealed Remove without waiting for the upload, and update_profile swallows failures, so a failed save looked saved until reload. The save is now awaited: a failure puts the previous picture back with an error hint, and Remove waits for the upload so it can't race it. * fix(dashboard): hide the Usage tab's plan button for team seats A seat's plan belongs to its team, so Home already hides its upgrade link; the Usage tab still offered Upgrade, which only reaches a refusal. * fix(dashboard): don't drop Home's forced usage refresh during a running load loadUsageData handed any caller the load already in flight before looking at force, so a subscription change (or a return from the billing portal) during a routine load was answered with data read before the change, and the plan card stayed stale until the next refresh. A forced call now runs once more after the running load. * fix(dashboard): activate Apps when the URL names an unknown tab An unknown hash rendered Apps as the active tab but skipped its activation, so the grid kept the generic content padding and Apps' onActivate never ran. * fix(dashboard): make the sidebar user menu reachable from the keyboard The user button was a div with no tabindex, so Log Out, account switching, and Contact Us were out of reach without a pointer. It is now a button (rendering unchanged), with aria-haspopup. * fix(dashboard): name the sidebar's collapse and drawer buttons for assistive tech The collapse toggle held only two unlabeled images, so screen readers announced an unnamed button; it now carries a translated label and aria-expanded that follow its state. The drawer's open/close labels were hardcoded English and now go through i18n. * fix(dashboard): make Home's recent apps reachable from the keyboard Each recent app was a click-only div, so keyboard users couldn't open one. They are now buttons with a focus ring; the icon is decorative since the title names the button. * fix(dashboard): name the Security tab's 2FA switch for assistive tech The checkbox sat in a text-less label, so screen readers announced an unnamed checkbox. It now carries the translated Two Factor Authentication label, as the Teams switches do. * fix(dashboard): sort the Usage table from the keyboard The sortable headers were click-only th cells. Each now holds a button, carries aria-sort, and keeps focus across the re-render a sort causes. The Resource/Units/Cost headers go through i18n. * fix(dashboard): don't rebuild the Files listing under an open menu Returning to the browser tab re-rendered the folder even with a context menu or action sheet open, so its actions then targeted detached rows: Rename did nothing, Restore faded a row that was already gone. The refresh now waits while a menu is up, as it does for a rename. * fix(dashboard): point the Files sidebar's Documents at the current home The entry read window.documents_path, which globals.js sets once from the cached user and nothing updates; login and username changes keep window.docs_path current instead. After a username change, Documents pointed at the old home and showed "This folder couldn't be opened", even after reloading. * fix(dashboard): let only the newest share listing render in the share dialog Each action ends in a refresh, and refreshes from overlapping actions (or the opening load) could finish out of order, so an older listing landed last and undid what the user just did, e.g. the link control snapped back to restricted after turning the link on. Older refreshes now drop their result. * perf(dashboard): load a team's record, roster, and plan in parallel loadSelected awaited the audit log (every page of it), then the members, then the plan, on every visit to the Teams tab. They don't depend on each other, so they are now fetched together. * fix(dashboard): keep keyboard focus on the Teams control that was used Every Teams action repaints the whole panel, which dropped focus to <body>: a keyboard user toggling a switch or suspending an account was sent back to the top of the page. The repaint now refocuses the same control, or the same account's new action when the old one is gone. * fix(dashboard): give the app uninstall prompt dialog semantics and focus The prompt had no dialog role or label and never took focus, so keyboard and screen-reader users stayed on the inert grid behind it. It is now a labelled modal dialog that focuses Cancel on open and returns focus to the app's tile when dismissed. * fix(dashboard): keep the add-an-app tile when there are no apps With no apps at all, the empty state replaced the whole grid, add tile included, so a new user on an instance with no recommended apps had nothing to act on. The empty line now sits above a grid that keeps the tile, as a search with no matches already does. * fix(dashboard): don't rebuild the Apps grid under an active drag An uninstall finishing (or a failed one rolling back) re-rendered the grid even while another tile was being dragged, replacing the dragged tile with a fresh copy: the copy showed under the ghost and the drop was lost. Renders asked for mid-drag now wait for the one the drop does; the folder eject, which rebuilds the grid as part of the drag, still can. * fix(dashboard): return focus to the drawer toggle when the mobile drawer closes Closing the drawer (Escape, the close button, a tab pick) left focus on controls that had just become hidden, so it fell to <body>; closing the notifications sheet opened from the drawer tried to refocus the bell inside the closed drawer. Both now land on the drawer toggle. * fix(dashboard): truncate Files names between graphemes, with a binary search The middle truncation sliced UTF-16 code units, so at many widths a long name with emoji showed a half surrogate (rendered as a replacement character) or a broken joined emoji. It also measured one more character per step, a measureText call per character of every long name on each render and column resize. The cut now falls between graphemes and is found by binary search; output for other names is unchanged. * fix(dashboard): translate the Home tab's hardcoded English The tab label, the recent-apps empty state, card subtitles, the plan badge and trial wording, the upgrade/manage links, and the usage cards' "Used" / "of" lines were English literals. They now go through i18n, with placeholders where values are interpolated. * fix(dashboard): translate the sidebar's remaining English The Apps, Files, and Usage tab labels, the user button's fallback name, and the user menu's Developers item were English literals; they now use i18n keys like the other tabs. * fix(dashboard): translate the Usage tab's hardcoded English The subtitle, the "used of" meter lines (now the existing used_of key), Usage Details, the plan button, Show more/less, and the details error were English literals. * fix(dashboard): translate the Account and Security tabs' hardcoded English Both subtitles, the delete-account description, the sessions hint, the username fallback, and the avatar picker's window title were English literals. * fix(dashboard): translate the Apps tab's hardcoded English The uninstall prompt and its failure alert, empty and no-match notices, pager and folder-dot labels, the search placeholder, the edit toggle, and the tile menu's Open in New Tab / Quit / Uninstall were English literals. * fix(dashboard): translate the Files tab's hardcoded English The folder sidebar, footer counts (now the existing item-count keys), sort and view menus, upload status and errors, the empty and can't-open notices, the reserved-name alerts, the move error, and the loading text were English literals. * fix(dashboard): translate the action sheet's Back row and match delete in any language The touch action sheet styled an item red when its label contained the English word "delete", so Delete lost its danger styling in every other language; it now compares against the translated Delete labels. Its submenu Back row and the properties panel's Directory/disassociate labels were English literals. * fix(dashboard): make the Files sidebar, crumbs, and nav arrows keyboard-operable The folder sidebar, the breadcrumbs, and the back/forward/up arrows were click-only li/span/img elements, out of the tab order. They now take focus, carry button/link roles (the arrows with labels and aria-disabled), answer Enter and Space, and show a focus ring. The rows' Enter/Space shortcuts also no longer swallow those keys from a focused control: with rows selected, Enter on Upload opened the selection. * perf(dashboard): read grid name widths before writing any in the Files tab fitItemNames read each tile's name width right after writing the previous name, forcing a layout per row. Reading them all first, then writing, cuts switching 400 files into grid view from about 300ms to 170ms; the rendered names are identical.	2026-10-20 13:44:42 -07:00