Repository navigation
Release: in-dashboard chat, Model card, Next 16.4.2 + Node 24.22.1 (#64, #65) - #66
Merged
Merged
Conversation
next 16.4.0 is in the range of a critical advisory (GHSA-2464-fhr4-w9xw, image optimizer RCE with SVGs) plus GHSA-673q-mjm6-r5xr and GHSA-p3m5-59mp-jv5r; 16.4.2 fixes all three. eslint-config-next moves with it. Node 24.22.1 is the Oct 21, 2026 security release (Brotli decoder RCE, TLS hostname-check bypasses). .nvmrc now names it, CI reads .nvmrc instead of the floating "24", and package.json "engines" says >=24.22.1 <25. @types/node moves from ^20 to ^24 to match the runtime. The deploy docs installed the control plane's Node from NodeSource setup_22.x; they now use setup_24.x, and deploy/README.md §6 says how to upgrade Node on an existing box. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…#65) In-dashboard chat - Each agent's AgentWebUI Lite chat opens in a window inside the dashboard: full screen or docked right, minimizable to a dock, kept open across pages (provider in the dashboard layout; up to four chats, restored minimized after a reload). Opened from the agent's page, the agents list (Chat), and by itself once a new agent finishes deploying (once per agent per browser). - POST /api/instances/[id]/chat-embed returns a one-time /embed sign-in link (Operator+, HTTPS only, only for the dashboard's own origins). Lite's env gets EMBED_SECRET (HMAC of INSTANCE_ENCRYPTION_KEY and the instance id) and FRAME_ANCESTORS (app origin + issued white-label domain) on every write. - Agents set up before this are configured on first open: the route probes /embed and the page's frame-ancestors, and if needed rewrites Lite's env (or upgrades Lite) and waits for it. Open WebUI agents are not migrated implicitly (that deletes chat history); they open in a new tab. - When a browser refuses the framed sign-in (Safari, private windows), Lite 0.2.1 says so over postMessage and the window offers a new tab. - Live support's bubble is hidden while a chat is open. Access - The agent page's Access card leads with Open chat / New tab and lists the hostname (or custom domain) and IP as direct links with copy buttons. - The agents list gets a Chat button and ⋯ → Open directly (hostname, IP). Model - Controls → Model is back, redesigned: the running model, a picker with tags and context sizes, and Apply & restart behind a confirmation. It rewrites the engine's env and Lite's, and restarts both. - Lite's LOCK_MODEL is always on: the dashboard is the one place the model changes. The chat window's header shows it with a Change model link. Pins agentwebui-lite 0.2.1 (SovereignML/AgentWebUI-Lite#7): partitioned framed cookie on HTTPS, plain cookie on HTTP so IP sign-in keeps working. Co-authored-by: Claude <noreply@anthropic.com>
Merged
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases
develop(2d345fa) tomain.agentwebui-lite==0.2.1(Framed sign-in that works on HTTP and with third-party cookies blocked (0.2.1) AgentWebUI-Lite#7, published to PyPI).next16.4.2 (critical GHSA-2464-fhr4-w9xw and two more) and Node pinned to 24.22.1.No schema or
.env.examplechange.Deploy checklist
node -v; upgrade to 24.22.1+ first if lower (Patch Next.js to 16.4.2 and pin Node 24.22.1 #64).KEEP_FAILED_VMS=falsein the prod.envif Release: Lite 0.2.0, OpenCode + Pi, universal warm pool, Open WebUI cleanup #57's checklist was never applied.git pull,npm ci,bash scripts/bootstrap-pg.sh,npm run build,pm2 restart redesigned-giggle.npm run chat-ui:migrate -- --apply(moves leftover Open WebUI agents and upgrades boxes to Lite 0.2.1).