Pin down the checkUpdatePassword contract:
- changing a password requires the correct current password
- OAuth/passwordless accounts (empty password hash) cannot set a
password through the self-service endpoint and must use the password
reset flow instead
- setupLogin never writes back the password column
These guard against regressing the password-change path back into a
short-circuit that lets passwordless accounts set a password directly.
- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
startup validation: enabling Secure requires at least one trusted
HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files
Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.
- normalize emails (trim + lowercase) and enforce uniqueness across
registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
ambiguous or absent matches
- require an existing password before self-service password change and
reject login for accounts without a usable password
- rename Makefile variables and targets from backend to api for naming consistency.
- update dev command messages and reset setup restart flow to use api terminology.
- replace the Slack OAuth icon with FaSlack from react-icons/fa to avoid the missing SiSlack export.
- add a classic Rsbuild alias for date-fns so Semi resolves its compatible date-fns v2 dependency.
- replace per-model test text buttons with icon-only actions matching the channel list.
- let the action column shrink to its icon content to reduce table width.
- split model test status from result details so failures and latency no longer crowd one column.
- move batch progress into toast updates to keep the dialog height stable during tests.
- consolidate the channel title and model actions to reduce vertical churn.
- bump frontend runtime and tooling packages to latest available versions, including React, Rsbuild, TanStack, VisActor, and AI SDK.
- refresh workspace catalog versions and regenerate Bun lockfile to keep default package resolution aligned.
* feat: add graceful shutdown with configurable timeout
* fix: flush quota dashboard cache on graceful shutdown
Persist the in-memory CacheQuotaData aggregation to the quota_data table
before process exit, so a restart no longer drops up to one DataExportInterval
window of dashboard data (issue #5679).
AnimatedOutlet keyed its motion container by the full pathname, so
navigating between params of the same route (e.g. the dashboard tabs
under /dashboard/$section) changed the key and remounted the route
component, discarding its in-memory state. The most visible symptom:
the dashboard time range resets to the default every time you switch
sub-tabs (Model Analytics / Flow / User Analytics).
Key the transition by the matched route id instead, so param-only
navigation re-renders in place while real page-to-page navigation
still plays the enter animation. This also preserves state across the
other $section tab pages (usage logs, models, system settings).
- clone loaded application style nodes into the Shadow DOM for custom HTML rendering.
- keep HTML rendering isolated while restoring layout and typography that depend on app CSS.
- rename frontend make targets and variables to use the web terminology consistently.
- keep default and classic dev port overrides available under the updated names.
- simplify make dev-web to install default dependencies and start web/default only.
- keep dev-web-classic as the standalone classic entry and scope its install to classic.
* fix(openai): harden Chat-to-Responses compatibility
Add a shared Responses-to-Chat stream state machine and use it from the OpenAI relay path. Preserve assistant text alongside tool calls, bind tool argument deltas by output_index, map incomplete finish reasons, support reasoning/custom tool events, and buffer upstream SSE for non-stream Chat clients.
Add deterministic service tests and relay SSE tests for the conversion path.
Related to #5745.
* refactor: rename openaicompat to relayconvert for improved clarity
* feat(gemini): support responses request conversion
* feat: add responses to chat conversion support
* fix: harden responses chat conversion edge cases
Add a shared Responses-to-Chat stream state machine and use it from the OpenAI relay path. Preserve assistant text alongside tool calls, bind tool argument deltas by output_index, map incomplete finish reasons, support reasoning/custom tool events, and buffer upstream SSE for non-stream Chat clients.
Add deterministic service tests and relay SSE tests for the conversion path.
Related to #5745.
feitianbubu