After incremental import via Electron IPC, the sidebar session list
showed stale message counts. Three contributing gaps:
1. The chat:incrementalImport IPC handler did not notify the renderer
to refresh the session list (unlike the API route which calls
notifySessionListChanged). Added win.webContents.send('api:importCompleted')
to trigger the Sidebar's existing onImportCompleted listener.
2. The postImportHook in worker adapters was async (due to dynamic
import()) but the caller did not await it, causing a race condition
where loadSessions() could read stale overview cache before
computeAndSetOverviewCache() finished. Converted to static import
making the hook synchronous, and updated the type to void | Promise<void>
with await at call sites in both incremental-importer and
streaming-importer.
3. The @imported handlers on group-chat and private-chat pages only
refreshed local analysis data without calling sessionStore.loadSessions().
Added the call so the sidebar updates immediately on the client side.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add scripts/changelog-to-markdown.mjs that renders changelogs/{cn,en,tw,ja}.json
into readable Markdown files. Runs idempotently; output passes Prettier without
changes.
Wire the script into the sync-changelog skill (step 4, before the release commit)
and update commit_release_changelogs.sh to include the four .md files in the
release: v<version> commit, with a preflight guard that errors if the md files
are missing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Enable esbuild minification for main/preload (was renderer-only by default),
reducing main process bundle by ~55%. Extract cl100k_base BPE rank table out
of the synchronous startup path via dynamic import — it now lands in its own
chunk and is loaded on first agent run instead of at app startup.
Also fix Windows CI step to use PowerShell syntax for version injection.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
In edit mode the API key is intentionally not returned to the client,
causing both buttons to be disabled. Now the backend resolves the stored
key by configId when the client sends an empty key, and the frontend
passes configId for the reuse case so both buttons work without exposing
the key.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Migrate conversation/message CRUD and debug queries from IPC to HTTP
by having ElectronAIAdapter extend FetchAIAdapter. Remove 18 dead
handlers (14 CRUD + 3 debug + 1 compressContext) from ipc/ai.ts and
slim down preload AiApi to IPC-only methods (filtering, export, tool
testing, desensitize rules, native shell).
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify the merge workflow (parse/conflicts/execute/clear/export-for-merge)
across CLI, Electron, and web-serve into a single set of shared routes in
@openchatlab/http-routes.
Key changes:
- Move MergeSessionCache from CLI to node-runtime shared package
- Add dual-mode parse route (multipart upload for web, JSON filePath for Electron)
- Integrate merge routes into Electron internal API server with @fastify/multipart
- Create installMergeShims() with filePath-to-handle mapping for frontend
- Remove Electron merge IPC handlers, merger module, and preload bridges (~790 lines deleted)
- Address CodeX review: CHAT_DB_TABLES in openDatabase, no chatApi patching,
outputName sanitization, resp.ok checks, @fastify/multipart in desktop deps
Co-authored-by: Cursor <cursoragent@cursor.com>
Both shims were installed only in web-serve mode. Chart modules
already use useDataService() directly and NLP components use
HTTP helpers, so the window.chatApi.pluginQuery/pluginCompute/
getMemberActivity/getAvailableYears and window.nlpApi shims
have zero remaining callers.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove business IPC handlers/preload APIs that are now served by
Internal HTTP Server: preferences, NLP, data queries, message search,
analytics, members, SQL lab. Migrate chart modules from window.*Api
direct calls to useDataService() and NLP components to HTTP.
Make Internal Server a hard dependency, delete ElectronDataAdapter/
MessageAdapter/PreferencesAdapter and IPC fallback path. Retain IPC
only for native capabilities: file import, AI/LLM, session-index
summaries, agent streaming.
Co-authored-by: Cursor <cursoragent@cursor.com>
Improve auth hook security: restructure URL classification to fix
/_web/* bypass when requireAuth is active, use HMAC-SHA256 for constant-
time token comparison, remove dead webModeEnabled code.
Improve frontend auth flow: extract initializeApp() with watch-based
re-init after login, add getToken callback for real-time store reads,
unify SSE 401 handling via fetchWithAuth, switch default storage to
sessionStorage, add router guard consuming meta.public.
Add "Remember this device" checkbox on login page with dual
localStorage/sessionStorage strategy and safety warning.
Add 23 unit tests for auth hook matrix and http client.
Co-authored-by: Cursor <cursoragent@cursor.com>
Complete the frontend side of the --require-auth feature:
- Add configureHttpClient() with token injection and 401 handling
- Auto-inject Authorization header in all HTTP helpers and SSE
- Replace 32+ direct fetch('/_web/...') calls with fetchWithAuth
- Add login page for Server mode (token input + validation)
- Add auth store for token persistence (localStorage)
- Add logout button in Settings > About (Server mode only)
- Add i18n translations for login flow (zh-CN/en-US/zh-TW/ja-JP)
- Fix login redirect loop caused by concurrent 401 responses
Co-authored-by: Cursor <cursoragent@cursor.com>
When enabled, all /_web/* routes require Bearer token authentication,
same as /api/v1/*. This hardens security for server/headless/public
deployments where the same-origin assumption doesn't hold.
- Add `require_auth` field to config schema (default: false)
- Add `setRequireAuth()` to auth hook, conditionally enforce auth on /_web/*
- Support `--require-auth` in both `chatlab start` and `--daemon` mode
- Read from config.api.require_auth or CLI flag override
Co-authored-by: Cursor <cursoragent@cursor.com>
在 Web 生产模式（chatlab start）下，浏览器无法直连 chatlab.fun（CORS 限制），
导致首页底部社交链接（如小红书）及云端助手/技能预设拉取失败。
Vite dev proxy 已有对应配置，但生产 Fastify server 缺少该代理，现补全。
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
digua
CEQ151andClaude Opus 4.8
