Timothy Jaeryang Baek
797293c749
refac
2026-07-14 00:19:41 -04:00
Timothy Jaeryang Baek
7088d245bb
refac
2026-07-14 00:10:28 -04:00
Timothy Jaeryang Baek
af1c0eee89
refac
2026-06-30 20:20:15 -05:00
Timothy Jaeryang Baek
403392b41b
chore: format
2026-06-29 13:35:39 -05:00
Timothy Jaeryang Baek
c33fadc266
refac
2026-06-29 13:30:32 -05:00
Timothy Jaeryang Baek
0443ab3a61
refac
2026-06-29 13:30:28 -05:00
G30
964a098a4b
fix(chat): use code block language tag to detect Vega-Lite specs for rendering ( #25843 )
2026-06-29 02:07:11 -05:00
Algorithm5838
62b153749a
perf: skip re-sanitizing unchanged HTML tokens ( #26325 )
2026-06-29 00:43:54 -05:00
Timothy Jaeryang Baek
c7be66626f
refac
2026-06-28 22:53:47 -05:00
Algorithm5838
6729e64f30
perf: skip re-splitting unchanged text tokens ( #26326 )
2026-06-28 22:09:58 -05:00
G30
b2809e6293
perf(ui): hoist marked.use() to module scope to prevent extension stacking ( #25837 )
2026-06-17 03:09:09 +02:00
G30
9fe3a00dba
perf(chat): cache KaTeX rendered HTML in reactive statement to avoid redundant renders ( #25847 )
2026-06-17 03:06:56 +02:00
Algorithm5838
e031fadc35
perf: skip highlight.js auto-detection in read-only code blocks ( #25824 )
2026-06-17 02:57:02 +02:00
Timothy Jaeryang Baek
6fce92aa12
chore: format
2026-06-01 13:56:55 -07:00
Timothy Jaeryang Baek
e90a618f45
refac
2026-06-01 12:47:59 -07:00
G30
229e65b9f0
fix(ui): correct inverted high-contrast text colors for user message timestamp ( #25461 )
2026-06-01 09:26:18 -07:00
Timothy Jaeryang Baek
c951b4f262
chore: format
2026-05-11 02:29:13 +09:00
Timothy Jaeryang Baek
4a1064cefd
refac
2026-05-11 02:04:09 +09:00
Timothy Jaeryang Baek
3bba1c2270
feat: add IFRAME_CSP env var for srcdoc iframe content security policy
...
Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy
<meta> tag into all srcdoc iframes rendering untrusted content:
- Artifacts (LLM-generated HTML previews)
- FullHeightIframe (tool/embed output)
- FilePreview (user-uploaded HTML files)
- CitationModal (RAG document HTML)
Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe
attribute escaping. URL-based iframes (src=) are correctly excluded.
Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy
time, requires restart. Empty string (default) means no CSP restriction.
2026-05-11 01:56:02 +09:00
Timothy Jaeryang Baek
3fcad2f627
refac
2026-05-09 08:28:29 +09:00
Classic298
cfd2888545
fix:image url validation and signout post ( #24420 )
...
* refac(routers): reject external URLs in profile/model image handlers
* refac(ui): centralize image URL validation in safeImageUrl helper
* refac(auths): make signout POST-only
* refac: gate external profile image redirect behind ENABLE_PROFILE_IMAGE_URL_FORWARDING
Restore the 302 redirect for external http(s) profile image URLs in
the user and model profile-image endpoints, but gate it behind a new
ENABLE_PROFILE_IMAGE_URL_FORWARDING env flag (default: True).
Existing deployments that rely on external profile image forwarding
continue to work unchanged. Operators who want to suppress the
redirect (to prevent client-side IP/UA/Referer leaks) can set the
flag to False.
2026-05-09 07:33:31 +09:00
Timothy Jaeryang Baek
e1dce99147
refac
2026-05-09 07:13:36 +09:00
Timothy Jaeryang Baek
29f6c72e87
refac
2026-05-09 06:44:42 +09:00
Timothy Jaeryang Baek
064fdecb67
refac
2026-05-09 05:29:15 +09:00
Timothy Jaeryang Baek
7eeff2fdf9
refac
2026-05-09 05:09:20 +09:00
Timothy Jaeryang Baek
23ff9943a9
refac
2026-05-09 04:44:20 +09:00
Timothy Jaeryang Baek
8ff7ff459b
chore: format
2026-04-24 18:48:21 +09:00
Timothy Jaeryang Baek
3d1e355df7
refac
2026-04-24 18:20:10 +09:00
RomualdYT
b73538ece7
feat(ui): add citation source overflow badge ( #23918 )
2026-04-24 15:26:53 +09:00
Algorithm5838
83f3a9c543
fix: remove reactive label from onDestroy in Markdown
2026-04-23 22:26:11 +03:00
Timothy Jaeryang Baek
d56d74b387
refac
2026-04-23 19:39:06 +09:00
Algorithm5838
81383a7df1
fix: always rAF-throttle markdown parsing during streaming ( #23868 )
2026-04-21 13:29:33 +09:00
G30
4790faba73
fix(ui): add shift+click to bypass message deletion confirmation ( #23888 )
2026-04-21 13:21:48 +09:00
Timothy Jaeryang Baek and twheel
c3c857a3ec
refac
...
Co-Authored-By: twheel <100867139+whatisdata@users.noreply.github.com >
2026-04-20 08:59:30 +09:00
Algorithm5838
51cd43229c
perf: extend fast-deep-equal to remaining call sites ( #23845 )
2026-04-20 08:26:30 +09:00
Timothy Jaeryang Baek
37eba1c5a6
chore: format
2026-04-19 22:45:54 +09:00
Timothy Jaeryang Baek
5087492e25
refac
2026-04-19 15:49:42 +09:00
Algorithm5838
e5f31c2e14
perf: replace JSON.stringify equality with fast-deep-equal ( #23370 )
2026-04-17 14:22:06 +09:00
Timothy Jaeryang Baek
45e49d33e5
refac
2026-04-13 21:52:19 -05:00
Timothy Jaeryang Baek
15b89b9218
refac
2026-04-12 16:56:00 -05:00
G30
008f1dfbda
fix(ui): prevent user added action icons from being dragged ( #23412 )
2026-04-12 16:49:14 -05:00
Algorithm5838
bf49358185
refactor: use shared unescapeHtml in CodeBlock ( #23553 )
2026-04-11 15:00:33 -06:00
Timothy Jaeryang Baek
f66b67c8b8
refac
2026-04-02 17:17:01 -05:00
Timothy Jaeryang Baek
a71d927a0c
chore: format
2026-04-02 08:11:06 -05:00
Timothy Jaeryang Baek
1554be9da6
refac
2026-04-01 06:29:21 -05:00
Timothy Jaeryang Baek
7bfd9ac8ac
fix: expand details ui settings
2026-04-01 05:08:28 -05:00
Timothy Jaeryang Baek
c8ef5a4f38
chore: format
2026-04-01 04:36:02 -05:00
Algorithm5838
0d3d824274
Merge pull request #23257 from Algorithm5838/perf/text-token-css-animation
...
perf: replace JS transition with CSS animation in TextToken
2026-04-01 01:03:03 -05:00
Algorithm5838
5fd9db8739
perf: replace JS transition with CSS animation in CodespanToken ( #23258 )
2026-03-31 17:19:47 -05:00
Timothy Jaeryang Baek
4b35d70078
refac
2026-03-29 21:59:51 -05:00
Timothy Jaeryang Baek