createMessageStream decoded each network chunk with a fresh TextDecoder and no
{ stream: true }, so a multi-byte UTF-8 rune (CJK, emoji) split across a chunk
boundary was corrupted into U+FFFD before the frame buffer ever saw it. Hoist a
single persistent decoder and decode with { stream: true } so pending bytes
carry across chunks.
- Upgrade SvelteKit to 2.70.2 for framework maintenance updates
- Upgrade Shiki to 4.4.1 across syntax highlighting packages
- Upgrade Vite to 8.2.0 and Rolldown to 1.2.1
- Synchronize npm and pnpm lockfiles with transitive dependencies
- Process PDF attachments through reusable pdf-inspector WASM worker
- Transfer ArrayBuffers and initialize WASM once per worker
- Reject pending conversions and recreate workers after crashes
- Parse attachments without triggering duplicate chat requests
- Surface OCR, encoding, and empty-content conversion errors
- Remove PDF.js pipeline and obsolete transitive dependencies
- Add tests for conversion results and chat boundaries
Prettier reflows these three files, which the branch adds or rewrites. The count
of files that prettier reports goes from 333 to 330. The rest of that count is
work that this branch does not touch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Upgrade Vite from 5.4.21 to 8.0.8 in web
- Bump @sveltejs/vite-plugin-svelte from 4.0.4 to 7.0.0
- Upgrade vite-plugin-tailwind-purgecss from 0.2.1 to 0.3.5
- Bump AWS SDK Go v2 modules to latest patches
- Update ollama client from 0.20.4 to 0.21.1
- Upgrade go-git from 5.17.2 to 5.18.0
- Bump hasura go-graphql-client from 0.15.1 to 0.16.0
- Update perplexity-go from 2.15.0 to 2.16.1
- Refresh google api, genai, and transitive Go modules
- add `maskAPIKey` to redact all but last 4 chars of API keys (CWE-200)
- add `isRedacted` guard to prevent writing masked values back to `.env`
- mask all provider API keys in `GET /config` response payload
- sanitize note filenames with `basename` and allowlist regex (CWE-78, CWE-22)
- replace `exec`/shell commands in obsidian route with native `fs` APIs
- remove `escapeShellArg` helper now that shell execution is fully eliminated
- add path-confinement double-check ensuring resolved paths stay within target dirs
- sanitize note filenames in notes route using `basename` to block path traversal (CWE-22)
- return `safeFilename` instead of raw user input in notes POST response
- Update Svelte to version 5.53.5
- Upgrade @sveltejs/vite-plugin-svelte to 4.0.0
- Update lucide-svelte to version 0.575.0
- Upgrade Rollup to version 4.59.0
- Remove custom npm and pnpm install scripts
- Add postinstall script for svelte-kit sync
- Fix self-closing tags in Svelte components
- Change transcript joining to use newlines
- Make cleanPatternOutput method public in ChatService
- Remove svelte-markdown dependency from package.json
- Add vendor selector dropdown to filter available models
- Introduce `selectedVendor` writable store for vendor selection
- Add `vendorNames` derived store with sorted unique vendor names
- Add `filteredModels` derived store filtered by selected vendor
- Fix model deduplication to use `vendor:name` composite key
- Sort models by vendor then name, case-insensitive
- Display vendor prefix in model option labels
- Append content to existing assistant messages instead of replacing
- Fix loading message removal to search by index, not position
- Refactor SSE buffer splitting to always retain incomplete segments
- Trim segments before parsing to handle whitespace edge cases
- Consolidate duplicate message update logic across chat components
- Process remaining buffer after stream completion more reliably
Bumps the npm_and_yarn group with 1 update in the /web directory: @isaacs/brace-expansion.
Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1
---
updated-dependencies:
- dependency-name: "@isaacs/brace-expansion"
dependency-version: 5.0.1
dependency-type: indirect
dependency-group: npm_and_yarn
...
Signed-off-by: dependabot[bot] <support@github.com>
Fix Dependabot alert #94 (LOW):
- @eslint/plugin-kit vulnerability: Regular Expression Denial of Service
through ConfigCommentParser
- Updated from 0.2.8 (vulnerable) to 0.5.1 via pnpm/npm overrides
Build verified successful. All tests pass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Fix Dependabot alert #76 (MEDIUM):
- esbuild vulnerability: allows any website to send requests to
development server and read responses
- Updated from 0.21.5 (vulnerable) to 0.27.2 via pnpm/npm overrides
Build verified successful. All tests pass.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Changes:
- Added npm "overrides" section to package.json alongside existing pnpm overrides
- Generated and tracked package-lock.json with security fixes applied
- Removed web/package-lock.json from .gitignore to support npm users
- Both npm and pnpm now enforce secure dependency versions
This enables developers to use either pnpm or npm while maintaining
consistent security posture across both package managers.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add greybeard_secure_prompt_engineer pattern to create secure system prompts
- Update pattern explanations and renumber existing entries
- Refactor build process to use npm hooks for copying JSON files
- Remove manual web static file copying from extract script
- Update .gitignore to exclude generated data and tmp directories
- Modify suggest_pattern categories to include new security pattern
- Delete redundant web static data file, rely on build hooks
- Use bind:value for proper two-way binding with Select component
- Handle empty input to clear session when user clears the field
- Skip session change if value unchanged to avoid redundant API calls
- Track previous session to restore when placeholder selected
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Extract session UI into dedicated SessionSelector.svelte component
- Use Select component instead of native <select>
- Add session message loading when selecting existing session
- Fix placeholder selection behavior to preserve current session
- Rename "Session ID" to "Session Name" for consistency
- Add proper error handling for session loading
- Simplify reactive statements with nullish coalescing
- Use ?? instead of || in ChatService.ts
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove reactive statement that was resetting input on each keystroke
- Initialize sessionInput only once in onMount
- Change layout to stack input and dropdown vertically for better display
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add session name parameter to GUI chat interface, enabling persistent
multi-turn conversations similar to CLI's --session flag.
Changes:
- Add SessionName field to PromptRequest in chat.go
- Add sessionName to ChatPrompt interface
- Include currentSession in ChatService requests
- Add Session ID input with existing sessions dropdown in DropdownGroup
Closes#680🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Extract positioning calculations into dedicated `positioning.ts` module
- Add reactive tooltip position updates on scroll/resize
- Improve accessibility with `aria-describedby` and unique IDs
- Add SSR safety with `isBrowser` flag check
- Replace inline position calculation with reactive statement
- Add window event listeners for position tracking
- Update unit tests to use extracted functions
- Add test coverage for style formatting function
- Replace 42MB favicon.png with proper 64x64 PNG (4.7KB)
- Replace 42MB fabric-logo.png with static PNG from first GIF frame (387KB)
- Optimize animated GIF from 42MB to 5.4MB (half resolution, 12fps, 128 colors)
- Update docs/images/fabric-logo-gif.gif with optimized version
Total reduction: ~168MB to ~11.2MB
Closes#1361
Signed-off-by: majiayu000 <majiayu000@users.noreply.github.com>
Use position: fixed and getBoundingClientRect() to calculate tooltip
position dynamically. This prevents tooltips from being clipped by
parent containers with overflow: hidden (such as slide transitions).
Closes#1790
Signed-off-by: majiayu000 <majiayu000@users.noreply.github.com>
- Upgrade `pdfjs-dist` to v5 with new engine requirement
- Dynamically import PDF.js to avoid SSR import-time crashes
- Configure PDF worker via CDN using runtime PDF.js version
- Update PDF conversion pipeline to use lazy initialization
- Guard chat message localStorage persistence behind browser checks
- Reformat ChatService with consistent imports and typings
- Bump `patch-package` and refresh pnpm lock dependency graph
- Add `skeletonlabs` to VSCode spellcheck dictionary
Use SvelteKit's browser constant instead of typeof localStorage check
to properly handle server-side rendering. Prevents 'localStorage.getItem
is not a function' error when running dev server.
- Rename pattern directory to fix spelling error
- Add new pattern to explanations documentation
- Update suggest_pattern system with concall_summary references
- Include concall_summary in ANALYSIS category mappings
- Add concall_summary to BUSINESS category listings
- Append concall_summary to SUMMARIZE category references
- Update pattern descriptions JSON with new entry
- Generate pattern extracts for concall_summary functionality
- Add user documentation for earnings call analysis
- Include changelog entry for PR #1833
- Update `--raw` flag description across all documentation files
- Clarify flag only affects OpenAI-compatible providers behavior
- Document Anthropic models use smart parameter selection
- Remove outdated reference to system/user role changes
- Update help text in CLI flags definition
- Translate updated description to all supported locales
- Update shell completion descriptions for zsh and fish
- chore: incoming 1836 changelog entry
### CHANGES
- Add `create_conceptmap` for HTML concept maps using Vis.js
- Introduce `fix_typos` for text proofreading and corrections
- Implement `model_as_sherlock_freud` for psychological modeling
- Add `predict_person_actions` for behavior prediction
- Include `recommend_yoga_practice` for personalized yoga guidance
- Credit pattern contribution to @FELIPEGUEDESBR
# CHANGES
- Add new WELLNESS category with four patterns
- Add `model_as_sherlock_freud` for psychological detective analysis
- Add `predict_person_actions` for behavioral response predictions
- Add `recommend_yoga_practice` for personalized wellness guidance
- Add `fix_typos` pattern for proofreading corrections
- Update ANALYSIS category to include new patterns
- Update SELF category with wellness-related patterns
- Tag existing patterns with WELLNESS classification
### CHANGES
- Add `extract_characters` to identify and describe characters
- Update business category to include `extract_characters`
- Include `extract_characters` in extract category
- Add `extract_characters` description in pattern descriptions JSON
- Update user documentation with `extract_characters` details
## CHANGES
- Add top-level project name to navigation hierarchy
- Nest all sections under main project heading
- Fix npm install script path extension
- Update localhost URL to use HTML format
- Add "Mdsvex" to VSCode spelling dictionary
- Include "details" and "summary" to HTML tags
- Remove trailing newline from web README
