xiaoxue_admin
/
Folo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7,011 Commits 1 Branch 156 Tags 74 MiB
Commit Graph

1386 Commits

Author SHA1 Message Date
DIYgod dd2c933936 chore(ci): format integration URL scheme test 2026-07-28 13:52:45 +08:00
Sebastion bd91b015ee
fix(desktop/ipc): allowlist URL scheme protocols in openURLScheme (#5056) 
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.

Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.

Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
 2026-07-28 13:40:13 +08:00
DIYgod 52f587dacb fix(desktop): dismiss share popover after actions 2026-07-25 20:23:44 +08:00
DIYgod 3d65478fb6 fix(subscription): recover past-due Stripe checkout 2026-07-25 20:22:55 +08:00
DIYgod 22c8a667e6 fix(desktop): restore category chevron rotation 2026-07-25 20:18:50 +08:00
Tony c3e1c26194
fix(desktop): set referrerpolicy on youtube embed iframes (#5039) 2026-07-12 18:07:09 +08:00
DIYgod 1158281f59
chore(deps): update frontend dependencies (#5038) 
* chore(deps): update frontend dependencies

* fix(ci): format OTA verification commands
 2026-07-10 22:36:12 +08:00
DIYgod 72e289bb3e fix(tracker): sample PostHog events at five percent 2026-07-03 16:46:26 +08:00
DIYgod 43fb8f23a7 fix(desktop): avoid idle Spline AI indicator render 2026-06-22 11:38:31 +08:00
DIYgod 84f692ad35 fix(desktop): keep reading mode content when translated 
Refs RSSNext/Folo#5023.
 2026-06-22 10:43:34 +08:00
DIYgod 4ab06f42b4 fix(desktop): stabilize streaming tts scheduling 2026-06-22 10:41:54 +08:00
Tony c98f572cf8
fix: dedupe code blocks with nested line divs 
fix: dedupe code blocks with nested line divs
 2026-06-05 19:44:07 +08:00
DIYgod 73870a8170 fix(desktop): reset social timeline on view change 2026-06-05 11:42:37 +08:00
DIYgod 31c10ea635 fix(desktop): hide empty recent reader spacer 2026-06-02 10:38:16 +08:00
DIYgod 2ed4ac546b fix(timeline): guard mark read during scroll reset 2026-06-02 10:04:30 +08:00
DIYgod fe1fcff315 fix(timeline): scroll to top before refresh 2026-06-01 10:43:23 +08:00
DIYgod df8b8d0670 fix(actions): stabilize rule editor state 2026-05-29 14:00:19 +08:00
DIYgod 69202876ed fix(collection): paginate starred entries by collection time 2026-05-29 11:56:26 +08:00
DIYgod dc43e39711 fix: retry scroll mark-read after revisiting entries 2026-05-26 20:29:52 +08:00
DIYgod a52ff66fb3 fix(desktop): clear stale web context menu 2026-05-26 14:31:53 +08:00
DIYgod 07cbf35de7 fix: batch scroll mark-read requests 2026-05-26 11:55:09 +08:00
DIYgod 27b30e0d47 fix(desktop): pause scroll read on timeline changes 2026-05-22 14:15:49 +08:00
DIYgod 8557b9f158 fix(desktop): scroll timeline to top before refresh 2026-05-21 14:31:56 +08:00
DIYgod 431ab0e0be fix(desktop): preserve native image context menu 2026-05-14 18:55:17 +08:00
DIYgod 444f8e05a5 fix(desktop): prevent duplicate timeline page requests 2026-05-14 15:51:32 +08:00
DIYgod 9bfcfc805b fix(desktop): sanitize Obsidian file path separators 2026-05-14 14:45:50 +08:00
DIYgod a48123476d fix(desktop): improve Obsidian integration metadata 2026-05-14 13:58:30 +08:00
DIYgod 13cc719377 fix(desktop): add Eagle image context menu 2026-05-12 17:14:30 +08:00
DIYgod 4be035d37e fix(desktop): keep tray instance when refreshing menu 2026-05-12 16:43:44 +08:00
DIYgod 98fcb71734 fix(desktop): persist auth cookies with max age 2026-05-12 16:12:34 +08:00
DIYgod 425e8610a3 fix: stabilize scroll mark-read footer boundary 2026-05-07 21:55:30 +08:00
DIYgod 2fa23362c3 fix: allow final entries to scroll past 2026-05-07 21:05:59 +08:00
DIYgod 43186b7ffb fix(desktop): delay feed error indicator 2026-05-01 19:08:29 +08:00
DIYgod 8f56a51b93 fix(desktop): remove connection status indicator 2026-04-30 14:27:39 +08:00
DIYgod 963f3af397 fix(desktop): update desktop download link 2026-04-30 14:25:48 +08:00
DIYgod e1daec3013 feat(power): restrict power usage to wallet 2026-04-30 14:23:23 +08:00
DIYgod 88ad11a2ae fix(desktop): dedupe auth session cookies 2026-04-26 09:57:42 +08:00
DIYgod 18e7f76d61 fix(auth): refresh session cookies on clients 2026-04-24 20:37:32 +08:00
Kieran Cui 1ade942ea8
fix: enter and return via the "discover" route (#4984) 2026-04-24 19:07:16 +08:00
DIYgod d3aa46e358 fix: extend API request timeout 2026-04-24 12:51:05 +08:00
DIYgod 5aba30eb4f fix(desktop): derive MAS review state from OTA versions 2026-04-15 15:57:51 +08:00
DIYgod acfb054bdc fix(desktop): ignore stale cached renderer bundles 2026-04-15 10:10:00 +08:00
DIYgod bfbce383a2
release(desktop): Release v1.6.0 (#4970) 
* docs(mobile): prepare release changelog

* release(mobile): release v0.4.1

* fix(ssr): route dist-external assets (#4956)

* fix(cli): close login callback sockets (#4957)

* fix(ci): sync release branches to dev via pull request

* fix(mobile): increase ai summary font size

* fix(desktop): improve pdf export layout and branding

* fix(mobile): refresh social login state

* fix: correct French translation language detection

* build(deps): bump android-actions/setup-android from 3 to 4 (#4929)

Bumps [android-actions/setup-android](https://github.com/android-actions/setup-android) from 3 to 4.
- [Release notes](https://github.com/android-actions/setup-android/releases)
- [Commits](https://github.com/android-actions/setup-android/compare/v3...v4)

---
updated-dependencies:
- dependency-name: android-actions/setup-android
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(ai-chat): show reset date for future credits

* feat: refine spotlight settings and highlighting

* feat: add spotlight settings across desktop and mobile

* build(deps): bump actions/github-script from 8 to 9 (#4961)

Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v8...v9)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump signpath/github-action-submit-signing-request (#4960)

Bumps [signpath/github-action-submit-signing-request](https://github.com/signpath/github-action-submit-signing-request) from 2.0 to 2.1.
- [Release notes](https://github.com/signpath/github-action-submit-signing-request/releases)
- [Commits](https://github.com/signpath/github-action-submit-signing-request/compare/v2.0...v2.1)

---
updated-dependencies:
- dependency-name: signpath/github-action-submit-signing-request
  dependency-version: '2.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(mobile): avoid YouTube embed error on iOS close #4958

* fix(mobile): patch fmt for Xcode 26.4 builds

* build(deps): bump pnpm/action-setup from 4 to 5 (#4922)

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 5.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/v4...v5)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(desktop): migrate tts to folo service

* docs(ota): add OTA service design spec

* feat(ota): scaffold Cloudflare worker app

* fix(ota): align scaffold with task spec

* fix(ota): use standard worker types

* fix(ota): tighten scaffold schema and dev config

* fix(ota): require at least one platform

* fix(ota): use dev env for local wrangler

* docs(ota): add implementation plan and release scoping

* chore(ota): update lockfile for worker deps

* feat(ota): add release selection primitives

* test(ota): cover incompatible newer release selection

* fix(ota): tighten release compatibility checks

* fix(ota): reject empty platform payloads

* feat(ota): add kv helpers and policy logic

* fix(ota): enforce min binary store policy

* feat(ota): fetch OTA releases from GitHub

* fix(ota): return GitHub release etags

* feat(ota): mirror release payloads into R2

* fix(ota): stream mirrored archive extraction

* fix(ota): verify mirrored asset hashes

* feat(ota): serve manifests assets and policy

* fix(ota): harden manifest and policy routes

* fix(ota): validate route semver inputs

* fix(ota): verify manifest pointer version

* feat(ota): add sync orchestration routes

* fix(ota): dedupe concurrent sync passes

* feat(mobile): enable OTA background updates

* fix(mobile): restore OTA provider typecheck

* feat(mobile): add streaming tts playback

* fix(mobile): align OTA provider state

* feat(mobile): add ota policy client and debug controls

* fix(mobile): harden ota policy and debug controls

* test(mobile): cover ota provider helpers

* ci(desktop): automate Mac App Store pkg upload

* feat(ota): generate release assets from mobile export

* test(mobile): fix ota provider test typing

* test(mobile): discover ota script test via explicit config

* fix: tighten OTA release asset metadata handling

* fix: require OTA platform asset arrays

* ci(ota): publish releases and trigger sync

* fix(ci): harden ota publish workflow

* ci(ota): tighten trailer validation

* docs(ota): add rollout and rollback runbook

* feat(mobile): upgrade expo sdk 55 and rnfirebase

* fix(ota): emit expo-compatible update identifiers

* fix(ota): support private GitHub release assets

* fix(mobile): unblock ios archive on expo sdk 55

* build(deps): bump pnpm/action-setup from 5 to 6 (#4962)

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 5 to 6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](https://github.com/pnpm/action-setup/compare/v5...v6)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix(ci): restore ota typing and tailwind config compatibility

* test(mobile): fix ota provider test typing

* chore(ota): persist production cloudflare bindings

* fix(ci): restore semver types and ota test mocks

* feat(release): drive mobile release mode from config files

* fix(ota): sign manifests and pin runtime version

* fix(ci): disable frozen lockfile for local eas builds

* docs(spec): add desktop ota unification design

* feat(ota): unify desktop updates with ota service

* fix(ota): harden desktop sync and updater flow

* docs(skill): update desktop release workflow

* fix(release): repair ota and desktop update flows

* feat: cache storefront versions for ota policy

* feat: expose ota version badges

* feat: expose ota version badges

* fix: backfill github version badges

* fix: backfill github version badges

* docs(skills): align release modes with implementation

* fix: update Discord invite link in README.md

* fix: update macOS and Windows app store links in README.md

* fix: update GitHub badge labels in README.md

* build(deps): bump actions/download-artifact from 5 to 8 (#4969)

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 5 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v5...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* build(deps): bump softprops/action-gh-release from 2 to 3 (#4968)

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs(release): prepare desktop and mobile release metadata

* release(desktop): release v1.6.0

* fix(desktop): restore spotlight settings sync

* fix(desktop): apply spotlight highlights in entry rendering

* fix(desktop): extend spotlight highlight coverage

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-14 12:49:15 +08:00
Cocoon-Break b469f07029
fix: use >= for hour-format threshold in PlayerProgress (Closes #4965) (#4966) 
Signed-off-by: Cocoon-Break <54054995+kuishou68@users.noreply.github.com>
 2026-04-13 15:13:37 +08:00
DIYgod aea74f80a7 chore(sync): merge main into dev 
# Conflicts:
#	apps/desktop/layer/renderer/src/modules/settings/tabs/integration/index.tsx
 2026-04-03 13:28:15 +08:00
DIYgod 421d50fca8 fix(desktop): restore integration typecheck 2026-04-03 13:15:59 +08:00
wait 20cc43cf16 fix: resolve Obsidian EPERM on macOS by using native folder picker (#4242) (#4924) 
- Replace text input with native dialog.showOpenDialog for vault path selection
- Add path validity detection with three-state UI (unselected/valid/invalid)
- Fix YAML frontmatter parsing failure with Chinese/special characters
- Fix ENOENT error when vault subdirectory doesn't exist
- Add AI summary (description) to Obsidian frontmatter export
- Add author fallback to feed title when entry author is empty
- Increase filename truncation limit from 20 to 80 characters for CJK titles

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-03 12:41:59 +08:00
DIYgod b7ccf7b872 fix(desktop): repair auth and cli sync 2026-04-03 12:38:01 +08:00
DIYgod 4cb761a501 fix(desktop): persist two-factor challenge cookies 2026-04-03 11:24:49 +08:00
DIYgod 43b5052b06 fix(desktop): persist session token after 2fa 2026-04-02 22:19:36 +08:00