diff --git a/.changeset/quiet-previews-scroll-controls.md b/.changeset/quiet-previews-scroll-controls.md deleted file mode 100644 index 9cc16bd44..000000000 --- a/.changeset/quiet-previews-scroll-controls.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@internal/server": patch -"@internal/node": patch -"@internal/docs": patch ---- - -Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page. - -Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families. - -A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server. - -Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping. - -Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions. diff --git a/.changeset/tidy-seroval-security.md b/.changeset/tidy-seroval-security.md deleted file mode 100644 index bb24554db..000000000 --- a/.changeset/tidy-seroval-security.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@internal/server": patch -"@internal/desktop-server": patch ---- - -Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities. diff --git a/apps/client/desktop/CHANGELOG.md b/apps/client/desktop/CHANGELOG.md index c629b706e..acc346360 100644 --- a/apps/client/desktop/CHANGELOG.md +++ b/apps/client/desktop/CHANGELOG.md @@ -1,5 +1,12 @@ # @internal/desktop-client +## 1.5.1 + +### Patch Changes + +- Updated dependencies [[`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c)]: + - @internal/node@3.1.1 + ## 1.5.0 ### Minor Changes diff --git a/apps/client/desktop/package.json b/apps/client/desktop/package.json index 3d1c4594f..3e60b8f0a 100644 --- a/apps/client/desktop/package.json +++ b/apps/client/desktop/package.json @@ -1,7 +1,7 @@ { "name": "@internal/desktop-client", "description": "Subshell Client: a Tauri shell that registers this machine as a subshell node and manages its node daemon", - "version": "1.5.0", + "version": "1.5.1", "license": "Apache-2.0", "type": "module", "private": true, diff --git a/apps/docs/CHANGELOG.md b/apps/docs/CHANGELOG.md index 4513d2b32..f22a7bf7d 100644 --- a/apps/docs/CHANGELOG.md +++ b/apps/docs/CHANGELOG.md @@ -1,5 +1,19 @@ # @internal/docs +## 0.11.3 + +### Patch Changes + +- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page. + + Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families. + + A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server. + + Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping. + + Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions. + ## 0.11.2 ### Patch Changes diff --git a/apps/docs/package.json b/apps/docs/package.json index 9f17d505b..5c78639de 100644 --- a/apps/docs/package.json +++ b/apps/docs/package.json @@ -1,7 +1,7 @@ { "name": "@internal/docs", "description": "Public documentation site for Subshell — Fumadocs, statically exported", - "version": "0.11.2", + "version": "0.11.3", "license": "Apache-2.0", "type": "module", "private": true, diff --git a/apps/node/agent/CHANGELOG.md b/apps/node/agent/CHANGELOG.md index e862455ab..7100abd51 100644 --- a/apps/node/agent/CHANGELOG.md +++ b/apps/node/agent/CHANGELOG.md @@ -1,5 +1,19 @@ # @internal/node +## 3.1.1 + +### Patch Changes + +- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page. + + Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families. + + A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server. + + Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping. + + Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions. + ## 3.0.1 ### Patch Changes diff --git a/apps/node/agent/package.json b/apps/node/agent/package.json index 440f4fe92..318c6d27b 100644 --- a/apps/node/agent/package.json +++ b/apps/node/agent/package.json @@ -1,7 +1,7 @@ { "name": "@internal/node", "description": "subshell — node daemon: enrolls with the control plane and executes signed commands", - "version": "3.1.0", + "version": "3.1.1", "license": "Apache-2.0", "type": "module", "private": true, diff --git a/apps/server/api/CHANGELOG.md b/apps/server/api/CHANGELOG.md index dd8533fc0..3da892b30 100644 --- a/apps/server/api/CHANGELOG.md +++ b/apps/server/api/CHANGELOG.md @@ -1,5 +1,21 @@ # @internal/server +## 3.0.4 + +### Patch Changes + +- [#467](https://github.com/subshell-ai/subshell/pull/467) [`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c) Thanks [@theogravity](https://github.com/theogravity)! - Fix web previews losing asset bytes during large responses and HTTP reader handoffs, and keep Next.js chunk loading working through rewritten URLs. A replaced Turbopack stylesheet now refreshes in a Chromium preview, so a CSS edit shows up without reloading the page. + + Discovery offers only the ports that answer with a website, and shows each page's title in the picker and its tab. A dev server is no longer hidden behind a pane full of idle sockets, or by an IPv4 that is not listening at all, or by a slow first compile, and an internal tool that ignores non-browser clients still appears because discovery now says what it is. What never answers at all stays out, which is what keeps a wedged database off the list. What gets offered is also what opens: a site on IPv6 stays out when IPv4 accepts and never answers, because the preview would hang on the stalled socket rather than reach it. A devtools endpoint bound to `::1` is now watched as well as listed, since discovery and the bridge both ask loopback's two families. + + A navigation that would hand a phone's whole screen to a file shows a closeable error page instead, and the dashboard says so in a toast. A desktop click keeps downloading the way it did before. The refused response's cookies still reach the preview's jar, so the app isn't quietly signed out, and anything a browser renders itself, plain text, an image, a clip, JSON or XML, is shown rather than blocked. A server answering `application/xhtml+xml` counts as a website again. Discovery travels on node protocol 26, so update each node alongside the server. + + Route alternate-screen history buttons to the running program, in the key form the app asked for. Use matching device and preview count badges, move ownership notices beside the action menu, and make their explanations available by tapping. + + Reject malformed CDP target lists without an unhandled failure, keep IPv6 browser discovery and localhost resolution consistent, and bound untrusted preview notifications. Full-screen terminal navigation controls now name the keys they send while preserving view-only and copy-mode restrictions. + +- [#468](https://github.com/subshell-ai/subshell/pull/468) [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9) Thanks [@theogravity](https://github.com/theogravity)! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities. + ## 3.0.3 ### Patch Changes diff --git a/apps/server/api/package.json b/apps/server/api/package.json index b8ac7c5d8..ed0267a38 100644 --- a/apps/server/api/package.json +++ b/apps/server/api/package.json @@ -1,7 +1,7 @@ { "name": "@internal/server", "description": "", - "version": "3.0.3", + "version": "3.0.4", "license": "AGPL-3.0-only", "type": "module", "private": true, diff --git a/apps/server/desktop/CHANGELOG.md b/apps/server/desktop/CHANGELOG.md index f5ac6b0fe..6d1e3cfe4 100644 --- a/apps/server/desktop/CHANGELOG.md +++ b/apps/server/desktop/CHANGELOG.md @@ -1,5 +1,13 @@ # @internal/desktop-server +## 1.7.1 + +### Patch Changes + +- [#468](https://github.com/subshell-ai/subshell/pull/468) [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9) Thanks [@theogravity](https://github.com/theogravity)! - Update the web interface's Seroval dependency to fix serialization injection and deserialization denial-of-service vulnerabilities. +- Updated dependencies [[`c43bbbe`](https://github.com/subshell-ai/subshell/commit/c43bbbea20d91c8150e3e9342931b3a5b784324c), [`433d012`](https://github.com/subshell-ai/subshell/commit/433d0121bc98daf96f89188e6516fa98260954e9)]: + - @internal/server@3.0.4 + ## 1.7.0 ### Minor Changes diff --git a/apps/server/desktop/package.json b/apps/server/desktop/package.json index 2923e13e6..cf85a970f 100644 --- a/apps/server/desktop/package.json +++ b/apps/server/desktop/package.json @@ -1,7 +1,7 @@ { "name": "@internal/desktop-server", "description": "Subshell Server — a Tauri shell that installs, runs and manages a local subshell-server", - "version": "1.7.0", + "version": "1.7.1", "license": "AGPL-3.0-only", "type": "module", "private": true, diff --git a/bun.lock b/bun.lock index d778443d0..38be4cd8f 100644 --- a/bun.lock +++ b/bun.lock @@ -31,7 +31,7 @@ }, "apps/client/desktop": { "name": "@internal/desktop-client", - "version": "1.5.0", + "version": "1.5.1", "dependencies": { "@base-ui/react": "1.7.0", "@internal/assistant": "workspace:*", @@ -105,7 +105,7 @@ }, "apps/docs": { "name": "@internal/docs", - "version": "0.11.2", + "version": "0.11.3", "dependencies": { "beautiful-mermaid": "1.1.3", "fumadocs-core": "16.15.11", @@ -128,7 +128,7 @@ }, "apps/node/agent": { "name": "@internal/node", - "version": "3.1.0", + "version": "3.1.1", "dependencies": { "@clack/prompts": "1.8.1", "@internal/backend-errors": "workspace:*", @@ -181,7 +181,7 @@ }, "apps/server/api": { "name": "@internal/server", - "version": "3.0.3", + "version": "3.0.4", "dependencies": { "@better-auth/api-key": "1.7.14", "@better-auth/passkey": "1.7.14", @@ -231,7 +231,7 @@ }, "apps/server/desktop": { "name": "@internal/desktop-server", - "version": "1.7.0", + "version": "1.7.1", "dependencies": { "@base-ui/react": "1.7.0", "@internal/assistant": "workspace:*",