mirror of
https://github.com/HeyPuter/puter.git
synced 2026-11-13 20:12:57 -10:00
remove-taskbar
7477
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Nariman Jelveh
|
76ad6cbc2e |
Keep dropped desktop icons fully on screen, and fill the phone popover
A desktop icon drop is accepted only where the whole item fits above the bottom edge. Phone popovers use the full viewport height. |
||
|
Nariman Jelveh
|
9251bfa30b |
Keep desktop backdrops above ordinary windows
A backdrop's z-index used to take the taskbar's as a floor, which kept modal dialogs on /desktop above every ordinary window, including ones focused after the dialog opened. Keep that floor on the desktop; the dashboard and fullpage mode stack as before. Also drops commented-out geometry that referenced window.taskbar_height, and a dashboard comment about the removed fullpage minimize rule. |
||
|
Nariman Jelveh
|
bf99c3c680 |
Remove the desktop taskbar
The desktop no longer has a taskbar. Windows on /desktop can't be minimized, since nothing could bring them back; the dashboard still minimizes into app tiles. The desktop and maximized windows use the full page height. Backend: POST /update-taskbar-items is removed, and /whoami and the login response no longer include taskbar_items. The user table's taskbar_items column stays until a migration drops it. puter.ui.createWindow() still accepts show_in_taskbar, which has no effect and is marked deprecated. |
||
|
Nariman Jelveh
|
72de6e16b2 |
Remove the desktop wallpaper (#4604)
The desktop no longer shows a wallpaper. It shows the page's plain background color: white, or #1e1e1e in dark mode. The sign-in dialogs and account picker that opened over the wallpaper now open over that color too. This removes the default wallpaper image and its credit, its preload in both page shells, the "Set as Desktop Background" item on images' right-click menu, the GUI's set_desktop_background and refresh_desktop_background, and the set_as_background i18n key. Desktop icon labels were white with a shadow to read on the wallpaper; they now use the same gray as labels inside windows, and a light gray in dark mode. The backend drops POST /set-desktop-bg, and /whoami no longer returns desktop_bg_url, desktop_bg_color or desktop_bg_fit. The user table's desktop_bg_* columns stay; dropping them needs a migration. |
||
|
Nariman Jelveh
|
234994d3af |
Remove the desktop toolbar and nine desktop features, and use puter.js's color picker on the desktop (#4602)
* Remove the desktop's QR login button The desktop toolbar no longer shows a QR code that signs another device into the current session. This removes the toolbar button, its click handler, the UIWindowQR window (its only caller), the qr.svg icon, the window's CSS, and the four i18n keys only that window used. UIQRCode and the qrcode library stay, since 2FA setup still uses them. The ?auth_token= handler in initgui also stays, because the Playwright e2e harness signs in through it. * Remove the desktop's My Websites window The user menu no longer has a My Websites item. This removes the UIWindowMyWebsites window, its menu item, its CSS, the plug.svg icon only it used, and the i18n keys only it used. When publishing a website or worker hits the subdomain limit, the error now shows only the server's message, without the "Manage your subdomains" link that opened the window. The trash handlers keep fading the website badge on a trashed folder and no longer touch the window's rows. * Remove the desktop's Task Manager window The user menu no longer has a Task Manager item. This removes the UIWindowTaskManager window, its menu item, its CSS, the cog.svg icon only it used, and the i18n keys only it used, including the process_type_* and process_status_* keys it built at runtime. The process model in definitions.js, including END_SOFT and END_HARD, stays: windows still register processes, and a process still forwards an end signal to its children. * Remove the desktop's Change Desktop Background window The desktop's context menu no longer has a "Change Desktop Background…" item, or the separator above it. This removes the UIWindowDesktopBGSettings window, its CSS, the palette.svg icon only it used, and the i18n keys only it used. Desktop backgrounds still work: the saved background loads at boot, and an image's "Set as Desktop Background" item still applies and saves it through /set-desktop-bg. * Remove the desktop's Start menu The taskbar no longer has a Start button, so it begins at Explorer. This removes the Start item and its app popover (recent and recommended apps, search, tile context menu, and drag-to-taskbar), along with: - The taskbar's startup /get-launch-apps request and the desktop's app.opened socket handler, which only kept the menu's lists current - The Start popover's search, click and keyboard handlers in UIDesktop.js, keyboard.js, initgui.js and UITaskbarItem.js - The taskbar's handling of items dropped from outside it, and the UITaskbarItem append_to_taskbar option only that path used - The Start CSS, the start.svg icon, and the i18n keys only the menu used The dashboard's recently used apps still load, since the dashboard fetches its own list and launchApp.js still records launches. UITaskbar.test.js now covers the taskbar's item order and that it doesn't fetch launch apps. * Remove the desktop's Search window The desktop toolbar no longer has a Search button, and Ctrl/Cmd+F on the desktop no longer opens the Search window, so it falls through to the browser's find as it already did on the dashboard. This removes UIWindowSearch, the toolbar button and its handler, the window's keyboard handling (arrow keys, Enter, Escape) and click-outside close, its CSS, the search.svg and magnifier-outline.svg icons only it used, and the i18n keys only it used. The backend /search endpoint is unchanged. * Remove the desktop toolbar The desktop no longer has the toolbar at the top of the screen, so its Puter logo, guest Save Account button, and account menu are gone from the desktop. Log out, account switching, language, settings, and contact all remain on the dashboard. Removed: - The toolbar markup, its auto-hide logic and mouse tracking, its right-click menu, and the account menu with its click handlers - The modify-user-options-menu GUI extension, which only added a Developer item to that menu - UIWindowFeedback, the desktop's Contact Us window, which only the menu opened; the dashboard keeps its own contact dialog - Toolbar hooks elsewhere: the hide_toolbar() call on window maximize, pointer-events toggles during window and item drags, the click guard in initgui, the account-button toggle in helpers.js, and the avatar sync for the toolbar's profile image in TabAccount - The toolbar and feedback CSS, the toolbar's two KV keys from the puter.js GUI read cache, and the i18n keys only these used window.toolbar_height stays: it was already 0, so window and desktop layout are unchanged. The welcome window keeps its backdrop stacking. * Remove the desktop's Share window The right-click menu on desktop and Explorer items, and on items in open and save file dialogs, no longer has a Share item. This removes UIWindowShare, that menu item, the share-outline.svg icon only it used, its CSS, and the share_with and share_row_team i18n keys only it used. The Dashboard keeps sharing through UIShareModal. generateFileContextMenu no longer falls back to the removed window, so it offers Share only when the caller passes onShare, which the Dashboard's Files tab does. The share dialog layout classes the Blocked Senders window uses, and the recipient suggestion styles the share modal uses, stay. * Remove the desktop's Welcome window New desktop users no longer see the Welcome window on their first visit. This removes UIWindowWelcome, the first-visit check in UIDesktop that opened it, its CSS, the welcome_* i18n keys only it used, and the UIWindow backdrop_covers_toolbar option only it passed. has_seen_welcome_window is also dropped from the puter.js GUI boot read cache. Values already saved under that key stay in KV, unread. * Replace the desktop's color picker with puter.js's picker puter.ui.showColorPicker() inside Puter now opens puter.js's own <puter-color-picker>, the one it already shows on websites outside Puter, instead of the desktop's iro-based window. Apps get the same answer everywhere: a lowercase 6-digit hex string, or null when the user cancels. Inside Puter it used to resolve to an 8-digit hex with alpha, or undefined. This removes UIWindowColorPicker, UIColorPickerWidget, iro.min.js and its lib-list entries, and the select_color i18n key only that window used. The GUI loads puter.js from js.puter.com, so the IPC handler doesn't rely on this branch's component: it drops the alpha from an 8-digit default, leaves out a default that isn't a 3- or 6-digit hex, and removes the picker once it answers. <puter-color-picker> drops the alpha from an 8-digit default instead of failing to open, opens on its own color when the default isn't valid, and removes itself when Escape closes it. showColorPicker()'s type and docs now give the 6-digit return value and null on cancel. * Remove the desktop's Publish Worker window The right-click menu on .js files on the desktop and in Explorer, and in open and save file dialogs, no longer has a Publish as Worker item. This removes UIWindowPublishWorker, that menu item, its CSS, and the pick_name_for_worker i18n key only it used. The Dashboard keeps publishing workers through its own dialog. generateFileContextMenu no longer falls back to the removed window, so it offers Publish as Worker only when the caller passes onPublishWorker, which the Dashboard's Files tab does. * Add a Language setting to the dashboard's Account tab The desktop toolbar's account menu was the only place to change Puter's language, so removing the toolbar left no way to change it. The Account tab now has a Language card that shows the current language and opens a dialog listing every supported language by its own name. Saving a new one stores it on the account and reloads the page in it. changeLanguage() now returns false when the language can't be saved, so the dialog can show an error instead of doing nothing. The change_language key comes back in every locale, and language_save_failed is new. |
||
|
Nariman Jelveh
|
eef2d089a8 |
Remove the dashboard's Open Desktop card and the unused theme dialog (#4601)
* Remove the unused theme dialog and its translations UIWindowThemeDialog has had no importers since the settings window was removed, and the reset_colors, ui_colors and change_ui_colors strings are referenced only by it or by nothing at all. * Remove the Open Desktop card from the dashboard Home tab Drops the card's markup, styles, color tokens, and the open_desktop and open_desktop_hint strings, which nothing else uses. |
||
|
Nariman Jelveh
|
711ece5800 |
feat(gui): let a first-party page frame the custom domain dialog (#4581)
* feat(gui): let a first-party page frame the custom domain dialog `/embed/attach-custom-domain` joins the framed popups. On a signed-in page one label under the Puter origin, `puter.hosting.attach()` now shows the custom domain dialog in a frame over the page instead of a popup window. Apps, the desktop and every other website keep their current behavior. The frame covers the page with a transparent GUI page, so the dialog floats over it with its own scrim as it does on the desktop. The GUI serves only the framing page's own user, with no account check waiting, and otherwise reports `unavailable`, which leaves the page to open the popup as before. It runs the popup's action unchanged: the framing page is the requester the dialog names, and gets the same `customDomainAttached` answer. Escape is left to the dialog, which doesn't close while a request is in flight, and the frame allows `clipboard-write` for the DNS record copy buttons. A call made while the frame shows resolves null without replacing it, as a second call does on the desktop. * Update RecommendedAppsService.ts * fix(gui): let the framed custom domain dialog finish closing before it answers The answer removes the frame from the page, so the dialog's exit transition never showed. The framed action waits for the overlay to leave first, with the wait the feedback embed already had, now one shared helper. |
||
|
Filip Kujundžić
|
40ea3686da |
Merge pull request #4594 from HeyPuter/fix/chat-served-tier-pricing
Price native service tiers and served premium capacity |
||
|
404oops
|
db7ca8382b | Price native service tiers and served premium capacity | ||
|
404oops
|
0f2c325598 | Meter Responses usage before validating empty output | ||
|
404oops
|
ffcfb85749 | Validate voice changer models against the price table | ||
|
Nariman Jelveh
|
44bf99f808 | Update recommended apps | ||
|
Nariman Jelveh
|
d392b6857d | fix(dashboard): drop the repeated add-on credits remainder from the Usage tab | ||
|
Daniel Salazar
|
d8c3e01dd9 |
fix(http): parse large JSON bodies in slices; store WebDAV uploads labeled as JSON (#4563)
JSON request bodies over 32 KiB are parsed in slices, with the event loop running between them, instead of in one JSON.parse call. Reading, limits, decompression, req.rawBody and the errors stay as express.json has them. Large bodies parse one at a time. Gemini TTS and video replies use the same parser, and their base64 is checked and decoded 1 MiB at a time. A profile picture is sized before its pattern runs, so one of several megabytes gets a 413. Body parsers skip the dav subdomain: a PUT labeled as JSON or form data was read by them and stored empty, or refused. puter.js sends auth_token as the first field of a driver call. A chat body over 50 MiB that opens with a valid token is accepted up to 128 MiB, as one with a header credential is. JSON in a charset other than UTF-8 is now limited to 1 MiB, and a body over 32 KiB nested deeper than 10,000 levels is refused. |
||
|
Nariman Jelveh
|
4bc679956f | fix(dashboard): label the Usage tab's credit bar "Monthly credits" | ||
|
Daniel Salazar
|
b751f75467 |
fix(fs): keep a file readable when two overwrites create the same path at once (#4579)
Two writers that both start before the row exists each upload under their own object key. The second one found the first writer's row and updated its bucket and size while keeping the first writer's uuid, so the row could name an object that was never written under that key. The store now leaves a row untouched when an overwrite arrives with a different object key, and the service moves the uploaded bytes onto the row's key before updating it. The last writer wins and the uuid is stable. |
||
|
Daniel Salazar
|
224b2f2367 |
fix(backend): null driver args, non-string chat model, and long app-stats uid lists no longer answer 500 (#4576)
- drivers: a null `args` in a driver call is treated as no arguments - ai-chat: a `model` that is not a string is answered as model not found (400) - apps: app stats split a long uid list across ClickHouse queries, which cap the size of one query parameter |
||
|
Nariman Jelveh
|
80bcc4ba14 |
feat(dashboard): show add-on credit as its own bar on the Usage tab (#4578)
The Usage tab told an account how much add-on credit it had left in a line of text under the monthly meter. It now gets a meter of its own there: a heading, how much of the credit bought has been spent, and a bar, with the line saying what is left and when it is used kept under it. An account that never had add-on credit sees the tab as before. |
||
|
Nariman Jelveh
|
f26201649a |
feat(gui): let a first-party page frame the deployment's top-up dialog (#4570)
* feat(gui): let a first-party page frame the deployment's top-up dialog
`/embed/top-up` joins the framed popups. Like the upgrade, it covers the
framing page with a transparent GUI page, serves only the page's own
user, and reports `unavailable` unless the deployment defines
`window.UITopUp` with `embeddable === true` and no account check is
waiting. It runs `new UITopUp({ onClose }).open()` and posts
`closed { toppedUp }` once the dialog closes. The frame's lifecycle is the
upgrade's, now shared by both.
`<puter-user-menu>` gets an Add credits item under Usage, shown only when
whoami reports `subscribed: true`. It frames the top-up on a page that can
frame the GUI, and otherwise opens the dashboard with `?topup=` in a new
tab, within the click. Hidden items are skipped by the menu's arrow keys.
`puter.ui.showTopUp_()` is internal; no public SDK method is added.
* fix(puter-js): show no usage-limit dialog over an open top-up
A call refused for funds while the framed top-up was open put the
usage-limit dialog in the top layer over it, covering the payment the
user was making to clear that refusal. The prompt now stays out of the
way while a top-up shows, as it does for the framed upgrade.
* fix(puter-js): leave Add credits out of the user menu for a team seat
whoami reports a seat as subscribed through its team's plan, so the menu
offered Add credits to an account that can't buy any: the dialog only
answers that the team pays. The item now stays hidden when whoami names a
team paying for the account, as the desktop's own menu already does.
* fix(puter-js): open the top-up tab on the page's own deployment
The tab the Add credits item falls back to went to puter.com whatever
GUI origin the page belongs to, so on another deployment it opened a
different one, signed in as whoever is signed in there. It now opens the
dashboard of the GUI origin, like the menu's Usage link beside it.
* fix(puter-js): return keyboard focus to the account button after Add credits
Choosing Add credits closed the menu with focus on the item it had just
hidden, and the frame restored focus to the menu's shadow host, which
can't take it, so a keyboard user was left on the page body once the
dialog closed. The menu now moves focus to its button first, and a
framed popup restores focus to the element inside a shadow root.
* docs(embed): say when the top-up dialog's open() resolves
It resolves after the account has loaded, not as soon as the dialog
shows.
* fix(puter-js): offer Add credits after an upgrade made on the page
The user menu showed Add credits by the whoami it loaded with the page.
A user who subscribed in the framed upgrade therefore found no Add
credits in the menu until a reload. A framed upgrade that reports a plan
now marks the page's cached whoami as subscribed, as a confirmed email
already is, and the menu reads it again each time it opens.
* fix(puter-js): let a top-up that failed to start be asked for again
showTopUp_ cleared its in-flight marker in a finally inside the async
function it stored. A failure before that function's first await, such
as building the dashboard address from an origin with no scheme, ran the
finally before the marker was set, so the marker kept the rejected
promise for good: every later call got the same rejection, and
topUpShowing_ went on suppressing the usage-limit dialog. The marker is
now cleared once the stored promise settles.
* fix(puter-js): keep requestUpgrade from framing the upgrade over an open top-up
The usage-limit dialog already stays away while the top-up shows, but a
page's own requestUpgrade() call, such as one in the handler of a call
refused mid-payment, still mounted the upgrade frame. Frames are single
per path, so it covered the top-up and the payment being typed in it,
and the two dialogs' own guard can't see across documents. The call now
waits for the top-up and resolves { upgraded: false } once it closes.
* fix(puter-js): offer Add credits after an upgrade when whoami was read again
The user menu keeps the whoami object it loaded and ignores a token set
again unchanged, but the SDK reads whoami into a new object each time a
token is set. A framed upgrade then marked the new object as subscribed
and the menu went on reading the old one, so Add credits stayed hidden
until a reload. The menu now reads the SDK's cached whoami when it is
the same account's.
* docs(embed): list the top-up tests among the checks to run
|
||
|
Nariman Jelveh
|
1550be358d |
fix(explorer): navigation, keyboard, drag-and-drop, realtime and layout fixes (#4569)
* fix(explorer): record typed address-bar paths in navigation history and canonicalize them Pressing Enter in the path input now pushes the destination onto the window's Back/Forward history like every other navigation, and resolves the entry first (trim, ~ and home-relative expansion, trailing or doubled slashes) so the window's path matches the form the rest of the GUI compares against. * fix(explorer): keep the address-bar input in step with the Shared view and the root The path input was only updated after a successful stat, so in views that are never statted it kept the previous folder's path and Enter navigated back there. * fix(explorer): drop the previous folder's identity when a folder fails to load A rejected stat was never handled, so the window kept the previous folder's uid, title and item count while showing the load error, and layout or sort changes were saved to the wrong folder. The window now clears them, and the failed request no longer surfaces as an unhandled rejection. * fix(explorer): release a window's selection listeners and history when it closes Each folder window left its rubber-band selection instance, a document mouseup handler and its navigation history behind after closing, so every later mouse press ran once per window ever opened. Windows that are not folders no longer bind the handler at all. * fix(explorer): anchor a Ctrl/Cmd rubber-band selection where the drag started The rectangle's origin was only recorded for unmodified drags, so adding to a selection drew it from the previous drag's start point or the top-left corner. * fix(explorer): keep arrow-key navigation on visible items and a valid anchor Arrow keys could land on a hidden dotfile and then stop moving, threw when the remembered anchor belonged to another window, and left the footer's selected count stale. * fix(explorer): ignore non-character keys in type-to-select Shift, arrows and Enter were appended to the search term by name, so typing a capital letter or typing right after navigating matched nothing. Hidden files are no longer matched, and the footer count follows the container the selection changed in. * fix(explorer): make the keyboard permanent-delete confirmation work in every language The confirmation compared the dialog's answer with the English button label, so in any other language confirming did nothing. * fix(explorer): paste once per Ctrl+V press The shortcut ran on both keydown and keyup, so releasing V before Ctrl pasted the clipboard twice. * fix(explorer): keep selection shortcuts working after navigating, and out of text fields Select All, Copy, Cut and Delete looked up the folder from the element last pressed, which is a removed item or a sidebar entry after navigating, so the shortcuts did nothing. Select All also skips hidden files, and Delete keys typed in a text field are left to the field. * fix(explorer): count only visible items in the footer and drop hidden files from the selection The item count included dotfiles that were not shown, and hiding hidden files left them selected, so a later Delete or Cut acted on files the user could not see. * fix(explorer): paste cut items after their folder is no longer displayed Paste resolved the cut paths to rows on screen, so cutting a file and then navigating the same window to the destination moved nothing and silently emptied the clipboard. Items without a row are now looked up and moved the same way. * fix(explorer): show a moved item once in its destination The tab that moves an item renders the row and also receives the move event, so the destination showed the item twice whenever the event arrived first. Both paths now replace any row the other already rendered. * fix(explorer): sort names the way the dashboard does, with a stable tie-break Folder windows and the desktop compared raw lowercase strings, so file10 came before file2 and accented names landed after z, and equal sizes, dates or types kept whatever order they arrived in. They now use the dashboard's comparator, so the same folder reads the same in both. * fix(explorer): keep the Trash window's states when Trash is emptied elsewhere Emptying Trash from another tab cleared the whole container, including its empty, error and loading elements, and left the item count stale. * fix(explorer): remove rows deleted elsewhere instead of hiding them A deletion from another tab or an app only faded the row out, so it still counted in the footer, in Select All and in keyboard actions. The row is now removed, and windows showing the deleted folder close even when its own row is not displayed anywhere. * fix(explorer): refresh size and date when a file is overwritten elsewhere An overwrite arrives as an update event, which only applied the name, icon and path, so the size and modified columns and sorting kept old values. * fix(explorer): download files whose names contain &, #, % or + The path went into the download URL unencoded, so the server received a truncated path and the download failed. * fix(explorer): allow moving into folders whose name starts with Trash The deleted-folder check matched any sibling of Trash sharing its prefix, so moving into a folder such as Trash-old was refused. * fix(explorer): end the extract operation when an archive is corrupt or has no files A corrupt zip threw before its error could be shown, and an archive with nothing to write or a failed upload never closed the progress window. A progress update arriving before the window existed also threw. * fix(explorer): follow renamed and moved folders in Back/Forward and on undo A window's navigation history kept the old path after a folder was renamed or moved, so Back led to a load error. Undoing a folder rename also left windows and items inside it on the renamed path, because the undo retargeted from the path it was restoring. * fix(explorer): keep one progress window per copy or move The progress timer is re-armed after every conflict dialog, and it opened a second window when one was already showing, leaving the first on screen for good. * fix(explorer): show file names once-escaped in move alerts The name was escaped before being passed to an alert that escapes its whole message, so names with &, quotes or angle brackets showed entity text. * fix(explorer): don't flash the empty-folder message while a folder refreshes Clearing the rows for a refresh showed the message until the listing came back, even for a folder full of items. * fix(explorer): accept drops into a window that covers a desktop folder A desktop folder hidden under a window still reacted to the drag and disabled the window as a drop target, so the drop was ignored. A drop that bailed out early also left every folder view disabled as a target until the next hover; targets are now restored when the drag ends. * fix(explorer): release each row's document click handler when the row is removed Every file row bound a click handler on document that was never unbound, so browsing folders grew the number of handlers run on every click and kept the removed rows alive. * fix(explorer): let Delete work on a file after its rename was cancelled Cancelling a rename with Escape, or leaving the editor without a change, left the item marked as being renamed, and the Delete shortcut skips such items. * fix(explorer): offer a download when no app can open a file The prompt called a translation import that is not a function, so opening a file with no suitable app threw and did nothing. * fix(explorer): use an item's current path and name in its context menu Cut, Copy, Download, Create Shortcut and the rename editor read the path and name captured when the row was created. After a rename made from another window or tab they acted on the old path, and closing the editor repainted the old name. * fix(explorer): offer Cut only where the item can be moved The item menu on the desktop and in folder windows offered Cut on trashed items and on shared items the user may not move, unlike the same menu built for the dashboard. * fix(explorer): give a folder named *.app a folder icon The app-shortcut branch ran before the directory branch, so such a folder was read as a file on every listing, failed, and showed the app icon. * fix(explorer): make New > JPEG Image create an actual JPEG The blank image was encoded with the canvas default, so the .jpg file held transparent PNG data. * fix(explorer): handle a drop onto a folder that is part of the dragged selection Dragging a selection onto one of its own selected folders also tried to move that folder into itself. On the desktop the drop also cleared the saved position of the target folder instead of the items that left the desktop. * fix(explorer): don't highlight a window as a drop target for its own items The check meant to skip the folder an item is already in compared the wrong path, so dragging inside a window outlined it although dropping there does nothing. * fix(explorer): keep desktop rearranging to the desktop itself Dropping an item from a window showing the Desktop folder onto the desktop background positioned the window's row absolutely and saved that position. * fix(explorer): empty Trash from its window in one request The Trash window's own Empty Trash sent one delete request per item and reported Trash as empty before any of them finished. It now runs the same single operation as the taskbar and desktop. * fix(explorer): label the root and Shared in the Back/Forward menus The long-press history menus showed an empty row for the root folder and a lowercase path segment for Shared, and the Forward menu's Home entry was not translated. * fix(explorer): keep sidebar labels translated and titled after reordering A reordered sidebar rendered the labels saved at the time of the drag, so they stayed in the old language, and every item's tooltip was empty. * fix(explorer): enable the Open dialog's button only for a selected file The button stayed enabled after navigating to another folder, and a rubber-band selection of folders alone enabled it, although clicking it then did nothing. * fix(explorer): show the slow-load message only for a load that is slow Once any folder took over a second to load, the spinner text switched to the slow-load message three seconds later even after the load finished, and every later load in that window opened with it. The text is also translated now. * fix(explorer): keep the current folder visible in a long breadcrumb A path too long for the bar was cut at its end, hiding the folder being viewed and its nearest parents. It is now cut at the root end. * fix(explorer): grey out the whole selected row in an unfocused details view Only the name lost its highlight when the window lost focus, leaving a grey pill inside a blue row. * fix(explorer): align the details header with its rows and mark it clickable The header ended 10px before the rows and the selection highlight, and its sortable column titles kept the default cursor. * fix(explorer): give the layout button a tooltip and a pointer cursor It was the only navbar control without either, so it did not read as clickable. * fix(explorer): remove the stray tooltip from the loading spinner The spinner's SVG carried an internal title that showed as a tooltip and was read out by screen readers. * fix(explorer): refuse uploads, copies and shortcuts into the Shared view Dropping files on Shared in the sidebar, or Ctrl/Alt-dropping items onto a window showing it, sent requests against a path that is not a directory and ended in an error or a stuck progress window. * fix(explorer): open an item's context menu where it was requested The menu is built after permission and app lookups, and it opened wherever the pointer had moved to by the time they finished. * fix(explorer): close a folder's window when the folder is deleted, however it was opened Windows opened by path, such as with Ctrl-click on a breadcrumb or sidebar entry, never received the marker used to find a deleted folder's windows, so they stayed open on a folder that no longer existed. |
||
|
Nariman Jelveh
|
8a15f09f48 |
Send one request, not four, after the account pick in the sign-in popup (#4564)
* Send one request, not four, after the account pick in the sign-in popup A sign-in popup exchanges for the opener's app token as soon as the user picks an account. postAuthActions now hands over that result when the opener origin and session token still match, and exchanges again otherwise. The relationship check is skipped when an account was picked, since the pick already decides both the second picker and consent. Signup in the popup is not a pick and still runs it. The /whoami read before the picker is reused only when the same user and session token are still in place, the exchange just accepted that session, no verification gate is pending, and the read is under a minute old. * Test picking a different account in the sign-in popup The popup has to read the picked account once and hand over a token for it, not for the account it opened with. The second-account helper moves to the shared e2e helpers so both specs that need one use the same copy. |
||
|
Daniel Salazar
|
2084587885 |
fix(apps): list only the caller's own apps (#4562)
The `puter-apps` `select` method returned every app that was not protected unless the caller sent `predicate: ['user-can-edit']`. It now always scopes to the caller's own apps. The predicate is still accepted and no longer changes the result. Apps owned by someone else stay reachable by name or uid through `read` and `/query/app`. `AppStore.count` drops `visibleToUserId`, which only the unscoped listing used. |
||
|
Daniel Salazar
|
222ffcfe39 | fix(dev-center): accept only a hostname for puter.domain and digits for puter.port; escape the saved app link (#4561) | ||
|
Nariman Jelveh
|
7494aa1cbc |
Reload a tab when another tab switches to a different account (#4560)
* Reload a tab when another tab switches to a different account Every tab shares one stored session token. A tab that sees a new token appear in storage adopted it whoever it was issued to, so after an account switch in one tab the others kept showing the previous account while sending requests as the new one. A tab now reads the user out of the stored token. A token for the account it already shows is adopted as before. A token for a different account reloads the tab, which comes back up as that account. A tab with no signed-in user, or a token whose user can't be read, behaves as before. * Store a new account's token only after its session cookie is set A tab that sees another account's token in storage reloads and signs in from the session cookie. update_auth_data() stored the token before it synced the cookie, so a tab that reloaded faster than the sync came back up as the previous account and stored that account's token again, which the switching tab then adopted under the new account. The token is now stored after the cookie sync, in the same task as the stored user. * Keep the new account's token when another tab stores one during the cookie sync update_auth_data() sets window.auth_token, then waits for the session cookie sync. A token another tab stored during that wait was adopted over it, so the tab finished the switch holding the previous account's token and saved it under the new account in logged_in_users. The token is set again once the sync has settled. * Create one visitor account for the account switch e2e tests Each test signed up its own visitor, and sign-ups are limited to 10 per 15 minutes, so a few runs in a row failed in setup. |
||
|
Nariman Jelveh
|
1adca8a794 |
Show a shared item once, with its strongest access, when it has more than one share (#4559)
* Show a shared item once, with its strongest access, when it has more than one share The Shared listing returns one row per grant, so an item shared by two people, or directly and through a team, appeared twice and took its actions from whichever grant was listed last. The GUI now merges the rows for an item and keeps the strongest mode. * Keep a shared item under each person who shared it in the people filter A merged row carried only the strongest grant's issuer, so filtering the Shared view to someone whose grant was the weaker one hid an item they shared, and their chip left it out of its count. A merged row now lists every issuer. The filter and its counts match any of them, Everyone counts the item once, and the Shared by tooltip names them all. * Keep an item listed after Remove from Shared when a team still shares it Leaving an item drops the grants made to the user directly. One a team also holds stays shared, but the desktop took its icon away until the next refresh and the dashboard removed the row before re-listing it. A merged row now records that a team holds the item too. The desktop re-lists the Shared folder so the item shows as the team share it has become, and the dashboard leaves the row in place for its refresh. * Show an item as shared by the person the Shared view is filtered to An item several people shared showed the strongest grant's issuer in the Shared by column even when the listing was filtered to one of the others. A filtered row now shows the person filtered to, which also keeps the Shared by sort in step with what the column displays. |
||
|
Nariman Jelveh
|
07b19888a4 |
Match desktop items and windows by their path value, not by a selector (#4558)
* Match desktop items and windows by their path value, not by a selector Path lookups on the desktop compare data-path values through one helper, so a name holding &, ' or " is found like any other. Explorer windows keep the raw path in data-path after navigating, the same as when they open. * Read data-path straight from the element in path lookups atPath() and underPath() built two jQuery objects for every element they looked at. On a desktop with 5,000 items a lookup took about 1.4 ms, against 0.08 ms for the selector it replaced. Reading the attribute from the element brings it to about 0.3 ms. * Match no element when a path lookup has no path atPath() with a missing path matched every element whose attribute is empty, which is every item that is not a shortcut and every app window. An item.moved event without old_path would point all of those items at the moved file. underPath() with an empty path matched every path. * Use atPath() to find the items a share badge belongs to mark_item_shared() had its own copy of the same lookup. * Keep the raw folder name in an explorer window's data-name update_window_path() and refresh_item_container() wrote the HTML-encoded name there, so after navigating into "R&D" the tab title and the publish dialog showed "R&D". A newly opened window already held the raw name. |
||
|
Nariman Jelveh
|
2394221745 |
Answer requestEmailConfirmation() once, and show it in a frame on first-party pages (#4551)
* Answer requestEmailConfirmation() once, and show it in a frame on first-party pages
puter.ui.requestEmailConfirmation() in an app opened a second code dialog
after the first: a confirmed user got a dialog they couldn't complete and
two answers, and an unconfirmed one entered the code and then got a second
dialog, whose result was the only answer. The desktop handler now runs one
walk-through and answers once with its result.
That walk-through is ensureConfirmedEmail: save a temporary account, then
ask an unconfirmed email for its code, each window at most once. Publishing
a website or worker uses it too, replacing two copies of the same steps.
The code window now resolves false when it closes without a confirmation,
so dismissing it answers the app instead of leaving it waiting, and it
marks window.user confirmed before resolving, so a caller that checks next
doesn't ask again before the refresh lands. A logout from its footer still
leaves it unsettled, so the boot gates don't reopen it. In the dashboard
the windows open above the app's window, which stays on top and covered
them.
On a signed-in page one label under the Puter origin, the call now frames
/embed/request-email-confirmation over the page, served like the upgrade
frame, and resolves { response }, the field an app reads from the
desktop's answer. The GUI shows it only for the framing page's own user
with no phone, card or password check waiting. It skips the boot's
non-closable email gate for this action, so the user gets one code window
they can close or Escape. An email already confirmed resolves true without
showing the frame. A frame that can't show it resolves { response: false }.
* Skip the email confirmation frame when the page knows the email is confirmed
A confirmed email never goes back to unconfirmed, so requestEmailConfirmation()
on a first-party page resolves { response: true } from the page's whoami
instead of booting the GUI in a frame behind a loading scrim.
* Close the framed email confirmation on Escape in the save-account window
A temporary account sees the save-account window first, where Escape did
nothing, while it closed the code window that follows.
* Let the email code window recover from a failed code check with no response body
A network failure has no JSON body, so reading its error threw, leaving the
window spinning with its inputs disabled. It now shows an unknown-error message
and lets the user try again.
* Answer an email confirmation asked for while one is showing with the windows already open
A second walk-through opened a second code window over the first, and for a
temporary account it never answered, since the save-account window opens once.
* Read the email code from the code window it was typed in
A second code window read the inputs of the first one on the page, so typing
in it never filled in the code or enabled its button.
* Keep the email code window's answer in step with a code check it was closed during
Closing the window while a code was being checked answered false, and the
check went on to confirm the email. A code not sent yet is no longer sent, and
the window waits for one already sent before it closes.
* Show why a new email code couldn't be sent
A failed re-send, such as one past the hourly limit or a network failure,
showed nothing, so the link seemed to do nothing.
* Skip the email confirmation frame on calls after the user confirmed in one
The page's cached whoami kept reading the email as unconfirmed, so each later
call framed the GUI again and flashed its loading scrim before resolving true.
* Leave the email code window unsettled when any logout closes it
Only a logout from its footer did. One from elsewhere, such as after a 401,
answered false, so the boot's email gate opened a new code window while the
page was navigating away.
* Hide the save-account window while its email code window shows
A save-account window with a backdrop stayed under the code window's own, so
the page behind was dimmed twice, and on a phone the window showed around the
code window's edge.
* Answer a save-account request made while the save-account window is open
The window opens once, so the second request got no window and never
answered, which left an email confirmation that asked for it waiting too.
* Answer a framed email confirmation closed with Escape with the code check it was closed during
Escape in the framed code or save-account window closes that window, and the window's answer closes the frame. A code already sent is waited for, as it is when the window's close button is used. Before, Escape closed the frame and answered false while the check went on to confirm the email.
|
||
|
Filip Kujundžić
|
ee2cdbfe1a |
Merge pull request #4552 from HeyPuter/feat/claude-fable-5-2
Add Claude Fable 5.2 with published pricing and fast mode |
||
|
404oops
|
9b6350beab | Remove redundant Fable model documentation | ||
|
404oops
|
b649d9ada7 | Apply published Fable 5.2 pricing and fast mode rates | ||
|
404oops
|
50b0639d02 | Add Claude Fable 5.2 with provisional Fable 5.1 pricing | ||
|
Filip Kujundžić
|
ab96702718 |
Merge pull request #4546 from HeyPuter/feat/chat-service-speed
Add service speed selection and fallbacks to AI chat |
||
|
404oops
|
47f9b0bdf3 | Use the common service speed rate shape for Claude | ||
|
404oops
|
8c4b0eb1fc | Keep chat service speed rates in provider model catalogs | ||
|
404oops
|
a88c1b9d65 | Fall back to standard Claude speed on fast capacity overload | ||
|
Daniel Salazar
|
9caaf7162c |
fix(fs): follow S3 region redirects (#4544)
A file row without a stored region is read with the server's configured region. When its bucket lives elsewhere, S3 answers 301 PermanentRedirect and the read failed with a 500. The SDK now retries once in the region the redirect names. |
||
|
404oops
|
0191f2bfec | Update chat.md | ||
|
404oops
|
7aadc48cca | Add service speed selection and billing to AI chat | ||
|
Daniel Salazar
|
6b06793750 |
fix(gui): send picker results only to the popup opener's origin (#4543)
File, directory and save pickers opened in a popup now post their results, cancellations and the save-data request to window.openerOrigin instead of '*', matching the token hand-off. A test checks that opener messages in the GUI only target '*' when the opener's origin is not yet known. |
||
|
Neal Shah
|
e441880f13 | add more data to user audit events (#4542) | ||
|
Nariman Jelveh
|
9a86803418 |
Show the upgrade in a frame on first-party pages (#4541)
* Show the upgrade in a frame on first-party pages
puter.ui.requestUpgrade() on a signed-in page one label under the Puter
origin now frames /embed/upgrade over the page and resolves { upgraded }
once it closes. The usage limit dialog's Upgrade button does the same on
those pages instead of opening the dashboard in a new tab. Apps, the
desktop and every other page keep their current behavior.
/embed/upgrade is served like the sign-in and picker frames: the GUI
shell with the same framing rules, query and exact-path redirects and
no-store. The GUI shows the deployment's upgrade dialog
(window.UIUpgradeAccount) only for the framing page's own user, with
nothing left to verify, and only when the dialog says it reports its
close (UIUpgradeAccount.embeddable). Otherwise it reports unavailable and
the page opens the dashboard upgrade in a tab, through a consent dialog
when the click has expired. The app it credits is resolved from the
framing page's origin, never read from the fragment.
The frame covers the page with a transparent GUI page so the dialog's own
scrim shows, allows payment, and leaves Escape to the dialog. A call made
while it shows settles with it. If every dialog and window in the frame
goes without a close being reported, the frame closes itself rather than
staying over the page.
* Open the framed upgrade only once the frame has a viewport
The page keeps a loading frame hidden, which Chromium and WebKit lay out at
0x0. The team-seat alert, a GUI window that centers itself when it opens,
landed at (-175, 0) with its message and OK button cut off. A hidden frame
now tells the page it's ready first, and opens the dialog on the resize that
follows, or after a second if none comes.
* Document when the framed upgrade posts ready
* Retry a framed popup's focus() that the frame ignored
Firefox and WebKit ignore focus() inside a frame for a moment after the
page shows it, and Firefox sends no focus event afterwards, so the framed
upgrade dialog and its team-seat alert opened with nothing focused there:
Enter didn't press OK and screen readers didn't land in the dialog. A
focus() that didn't take is now retried briefly, until the user presses a
key or the pointer.
* Keep the framed upgrade's GUI in the light color scheme
The transparent upgrade frame put `color-scheme: light dark` on body as
well as the root, so in dark mode form fields the GUI leaves at browser
defaults turned dark. The email confirmation code digits showed slate
text on a dark grey field inside a white window. Only the root needs to
match the frame's scheme to stay transparent; body now keeps the light
scheme the GUI uses everywhere else.
* Fall back to the upgrade tab when the framed dialog fails to open
If the deployment's upgrade dialog threw while opening, the frame reported
a close, so requestUpgrade() resolved { upgraded: false } and the user's
click did nothing. It now reports itself unavailable, and the page opens
the dashboard's upgrade page as it does for any frame that can't show it.
* Say which plan changes count as upgraded in UpgradeResult
The upgrade dialog sets `upgraded` only for a subscribe or an upgrade;
a downgrade, cancellation or resume closes with false. The type said any
plan change counted.
* Stop the page scrolling behind a framed GUI embed
Firefox and WebKit pass a wheel or touch scroll over a frame on to the
page behind it, whatever the dialog's overscroll-behavior, so scrolling
over the framed upgrade, sign-in or a picker scrolled the page under the
scrim. The page's root now stops scrolling while an embed shows, taking
a classic scrollbar's width as padding so its content doesn't shift, and
gets its own styles back once the last embed closes.
* Skip the usage limit dialog while the framed upgrade shows
A refused call while the upgrade shows in a frame over a first-party
page opened the usage limit dialog on top of it, which made the upgrade
dialog inert until the user closed it. The refusal still rejects.
* Restore the page's root styles after an embed the page removed
An embed dialog the page removed itself never unlocked the page scroll,
and the next embed read the locked styles as the page's own, so the
page stayed unscrollable once it closed. The page's styles now go back
before the next lock reads them.
* Open the upgrade tab when the page can no longer frame it
The usage limit dialog decided to frame the upgrade when it opened, so
an Upgrade click after the page signed out did nothing. onUpgrade now
returns false when the page can't frame it, and the dialog opens the
dashboard tab as it does without onUpgrade.
* Keep the upgrade showing until its tab consent is answered
When the framed upgrade fell back to a consent dialog, requestUpgrade
settled as soon as the dialog showed. A refusal meanwhile opened a usage
limit dialog over it, and a second call asked again. The upgrade now
counts as showing until the user answers, so both join it.
* Say where requestUpgrade never settles
Its JSDoc named only apps, though on any website that can't frame the
upgrade the promise doesn't settle either.
* Treat a GUI embed the page removes as dismissed
A page that re-renders its body took the embed's dialog with it, and the
embed's promise never settled. For the upgrade that left it counted as
showing for good: later requestUpgrade() calls joined the dead one, no
refused call opened the usage limit dialog again, and the page stayed
unscrollable.
* Let the framed upgrade credit the remembered prompt when it knows none
When the framing page's origin resolved to no app and the call named no
reason or method, the frame handed the dialog an empty attribution. The
dialog then remembered that as the latest prompt, erasing another app's
credit, and sent the purchase with no attribution at all. It now gets
null, as from every other entry point.
* Pad the page by the width its scrollbar gives back behind an embed
A page with scrollbar-gutter: stable keeps its gutter once the root stops
scrolling, so padding it by the scrollbar's width as well shifted its
content left while any GUI embed showed. The lock now measures how much
width the root actually gets back.
* Keep the page's scroll position behind an embed when its body scrolls it
A page whose body carries the viewport's overflow (html and body at 100%
height, body with overflow-x hidden) jumped to the top while an embed
showed, and stayed there after: hiding the root's overflow made the body
a scroller of its own. The lock now hides the overflow of whichever
element the viewport uses, and restores a single-axis inline overflow.
|
||
|
Nariman Jelveh
|
09c6ce6f46 |
Dashboard: fix 30 bugs, UX, a11y and perf issues from an adversarial review (#4540)
* fix(dashboard): middle-truncate long names in the default Files list view
In the list view's default auto-width name column, a long name was cut at
the end by CSS with no tooltip, so names that differ only near the end
("report … (1).txt", "report ….txt") looked identical and the extension
was hidden. The name is now cut in the middle to the room its cell has,
like a resized column and grid tiles already are, and the full name shows
on hover. The phone layout's two-row rows get the same treatment.
* fix(dashboard): toast the newest notifications of a catch-up burst
A burst of more than four notifications toasts three and folds the rest
into an "N new notifications" summary. The split kept the first three it
was given, assuming newest first, but the reconnect catch-up and the
events-feed replay hand notifications over oldest first, so after a tab
woke up the toasts showed the oldest three and hid the newest. The split
now sorts the burst itself.
* fix(dashboard): act on a regrouped notification's current content when its toast is clicked
When more shares from the same person fold into a notification that's
already toasted, the toast's text updates ("alice shared 3 items") but
its click still acted on the notification as first shown, so it selected
only the first file instead of opening Shared. The click now looks up the
notification's current content.
* fix(dashboard): show browsers on Puter's own Web Push as browsers in Your devices
A device registered through Puter's own Web Push client reports platform
"webpush", which the Notifications tab didn't know: it got the phone icon
and no "Web" label. It's now treated like the other browser platform.
* fix(dashboard): clear the push preference's load error once it loads
If the Puter notifications preference couldn't be read, its card's hint
was replaced with a load error. Coming back to the tab once the read
worked re-enabled the switch but left the error text in place. A
successful read now puts the hint back.
* fix(dashboard): keep push off for this browser when removing it half-fails
Removing "This browser" from Your devices turns its push off and then
deletes the server record. If the delete failed (a dropped connection),
the handler returned before saving the opt-out, so the card still read
"on" and the next dashboard load quietly turned push back on. The opt-out
is now saved as soon as push is off, and the card is redrawn on failure.
* fix(dashboard): don't let an older device or app listing redraw a removed row
The Notifications tab lists devices and apps each time it opens. If one
of those listings was still in flight when the user removed a device or
turned an app off, it landed afterwards and drew the removed row again.
Only the newest listing draws now, and a removal outdates any listing
already in flight, as the browser card already did.
* fix(dashboard): report the items that were shared when a large share fails partway
Sharing more than 50 items sends one request per 50. If a later request
failed (the daily share limit, say), the items earlier requests had
already shared were forgotten: the dialog showed a flat failure and none
of their rows got the shared badge until a reload. The dialog now says
"Shared with bob on 50 of 60 items" along with the error, badges those
rows, and refreshes the shared listing.
* fix(dashboard): drop the site address from files inside a disassociated folder
Disassociating a folder's website from its Properties cleared the
folder's own badge, but the files inside it kept their website-address
badge and URL, which now led to a site that no longer exists. Their
addresses are now worked out again without that site, so a file still
served by a site on a folder within keeps its address.
* fix(dashboard): keep an app's own "(N) " title prefix beside the unread badge
The dashboard puts the unread count in front of the page title and keeps
it there as app windows rewrite the title. It removed any leading
"(N) " before adding its own, so an app titled "(3) Inbox" lost its
count ("(1) Inbox"). Only the badge the dashboard itself put there is
replaced now ("(1) (3) Inbox").
* perf(dashboard): redraw the notification list once per burst of acks from other tabs
"Mark all read" in one tab sends the other open dashboards one ack per
notification, and each ack rebuilt the whole list. With 150 unread that
was about half a second of main-thread work in every other tab (more on
slower devices). Acks and removals from other tabs now redraw once per
50ms beat: 150 acks take about 5ms.
* fix(dashboard): let the keyboard reach "Also delete data" in the Uninstall dialog
The Apps tab's dialogs keep Tab inside the card, but the trap only
cycled buttons and text areas, so Tab and Shift+Tab bounced between
Cancel and Uninstall and the delete-data checkbox couldn't be reached
without a mouse. Inputs, selects and links are part of the cycle now.
* fix(dashboard): don't leave the app request form on an IME composition's Escape
In the "Request an app" form, Escape steps back to the options. While
typing with an input method (Chinese, Japanese, Korean), Escape is how
the composition is cancelled, and that Escape also left the form. It's
now ignored while composing, as the Apps grid and folder name already do.
* fix(dashboard): keep focus out of an Apps folder while it closes
A folder's card stays on screen for its 240ms close animation. During
that time its tiles could still take focus: an arrow key pressed right
after Escape moved into the closing card, and focus then fell to the
page when the card was removed, losing the user's place. The closing
card is now inert and the arrow keys skip it.
* fix(dashboard): save the Apps layout one write at a time
The app order and folders were saved with a write per change, without
waiting for the one before. Changes close together (ejecting an app from
a folder saves, and the drop right after saves again) put two writes of
the same key in flight, and if they landed out of order the older layout
was what the next load showed. Each key now has one write in flight at a
time, and the next carries only the newest layout.
* fix(dashboard): close an open dialog when browser Back switches tabs
Back and Forward between dashboard tabs closed the drawer, menus, Share
and Properties, but not the dashboard's dialogs (Edit Profile, Change
password, confirmations) or the photo crop. The tab changed underneath a
dialog that stayed up with focus inside it. They now close through their
own close buttons, like the rest.
* fix(dashboard): count the trial countdown in calendar days
The Home tab's trial badge rounded the time left up to whole 24-hour
blocks, so it disagreed with the date shown under it: a trial ending at
3pm today read "1 day left" beside today's date and never "Ends today",
and one ending tomorrow morning read "2 days left". It now counts
calendar days in the user's time zone.
* perf(gui): rewrite paths after a username change only on elements that carry one
Changing the username from the dashboard's Account tab rewrote paths on
every element in the document (the selector matched them all) and set
every username label once per element, which grows with the size of the
Files listing on screen. It now visits only elements with a path
attribute and sets the labels once. With no earlier username (signing
in) there's nothing to rewrite, which also stops it throwing then.
* fix(dashboard): make long resource names in the Usage table readable
Resource names in Usage details are cut off with an ellipsis, and on a
phone the resource column is the one that shrinks, so a key like
"openai:gpt-4o-mini-2024-07-18:prompt_tokens" read "openai:gpt-4o-mi…"
with no way to see the rest. The full name now shows on hover, and on
phones, which have no hover, the name wraps instead of being cut.
* fix(dashboard): show Usage units in the dashboard's language
In Usage details the Cost column followed the dashboard's language but
the Units column beside it always used English separators, so a German
row read "1,234,567 | 1,23 $", where the units look like 1.2. Units now
use the language's separators too ("1.234.567").
* fix(gui): translate the 2FA setup wizard's step labels and messages
The two-factor setup opened from the dashboard's Security tab had
English hardcoded in its progress steps (Scan, Backup, Verify, Done),
the "Enabling…" spinner, the success message and its Done button, the
copy-secret button's label, the "Copied!" confirmation and the printed
recovery codes' heading. They go through i18n now.
* fix(dashboard): leave Alt and Cmd arrow shortcuts to the browser in Files
Files took every arrow, Home/End and Page key to move the selection,
whatever modifier was held, so Alt+Left (Back) and Cmd+Up/Down moved the
selection instead of doing what the browser does with them. Arrow keys
with Alt or Cmd are left alone now.
* fix(dashboard): explain in the user's language why a Trash item can't be restored
An item moved into the Trash by an app or the API has no record of where
it came from. Choosing Restore on it showed "Cannot restore: original
path not found in metadata", in English and in internal terms. The
message now says which item it is and why, through i18n.
* perf(dashboard): delete Trash items permanently a few at a time
"Delete permanently" on a Trash selection deleted one item after another,
a round trip each: 60 items took about 8s at 100ms of latency, and a few
hundred took most of a minute. Six run at once now (60 items: about
1.3s). The bounded runner the notification center used for "Mark all
read" moves to a shared helper for both.
* fix(dashboard): don't leave a "folder is empty" notice over the next folder's rows
Opening a folder clears the pane while its listing loads. If something
finished in that time and found the pane empty (a Trash restore, a
failed new folder), it added the "This folder is empty" notice, and the
listing's rows were then drawn under it. The listing now clears a stale
notice before drawing its rows.
* fix(dashboard): restore create_file when two "New" creates overlap in Files
Each "New > Text Document" (or HTML, Web Link…) in Files swaps in its own
window.create_file while it runs and put back whatever it found when it
finished. When two overlapped and the first finished first, the second
put back the first's stand-in for good. Any later create that reached it
counted a create that never ended, and from then on files added by apps
or other tabs stopped showing in the listing until a reload. The stand-ins
are now tracked together, and the real function comes back once none is
left.
* fix(dashboard): don't let a slow "New" file pull the user back or land in another listing
After "New > Text Document" (or HTML, Web Link…) in Files, the new file's
row is drawn once its upload finishes. If the user opened another folder
meanwhile, then:
- if that folder was still loading, the row (with its rename box) was
drawn into the loading pane and the spinner removed, and the folder
then lost its "empty" notice;
- if it had loaded, the user was taken back to the folder the file was
made in.
The row is now drawn only if the folder is still on screen, and the user
is only taken to the folder whose menu made it if they haven't moved.
* fix(dashboard): keep an uninstalled app off the Apps grid until its uninstall lands
Uninstalling an app takes its tile away at once, but the server keeps
listing the app as installed until the revoke request finishes. A grid
refresh in that time (switching tabs, coming back to the browser tab)
put the tile back, and it stayed until the next refresh; clicking it
reinstalled the app. Refreshes now leave the app out until the revoke
settles, and ones started before it landed are discarded.
* fix(dashboard): keep keyboard focus when uninstalling an app from inside a folder
After uninstalling an app from the Apps grid, focus goes to the tile that
took its place. An app uninstalled from inside an open folder had no
place on the grid, so focus fell to the page, and a keyboard user had to
start over from the top. Focus now goes to the folder's next app, to the
folder itself, or, when only one app was left and the folder dissolved,
to that app.
* fix(gui): show sizes under 1 KB as whole bytes
The size formatter wrote a size under 1 KB with two decimals and a
mismatched unit: a new account's storage on the dashboard read "0 Byte
Used", and a small file "149.00 Bytes". Bytes are now whole, with the
unit in the right number: "0 Bytes", "1 Byte", "149 Bytes".
* fix(dashboard): show the bottom edge of the Files drop outline in list view
Dragging files over the Files listing outlines it with a dashed border,
but in list view the bottom edge was missing: the listing cleared the
footer with padding, so its box ran under the footer and the footer hid
the outline's bottom edge. It now clears the footer with a margin, as
the grid view already did, so the outline shows all the way round.
|
||
|
Nariman Jelveh
|
0fdf40b8da |
Fill the send-feedback popup with the feedback dialog; fix <puter-user-menu> arrow focus (#4539)
* Fill the send-feedback popup with the feedback dialog The popup opened by puter.ui.showFeedbackDialog() drew the floating modal over a scrim. It now fills the window like the custom domain popup, with the actions pinned to the bottom and the message box taking the spare height. The full-page styles move from .custom-domain-fullpage to a shared .app-feedback-fullpage on the modal shell. * Land the first ArrowDown on the first <puter-user-menu> item after a click Opening the menu with the pointer focused the first item without a visible focus ring, so ArrowDown appeared to skip it. A pointer open now focuses the menu itself; opening from the keyboard still focuses the first item. |
||
|
Nariman Jelveh
|
5b850113ff |
Show sign-in and file pickers in a frame on first-party pages (#4537)
* Show sign-in and file pickers in a frame on first-party pages
puter.auth.signIn(), showOpenFilePicker(), showSaveFilePicker() and
showDirectoryPicker() on a page one label under the Puter origin now
show the GUI popup in a frame over the page instead of a window. Every
other page, and any frame that can't serve the request, keeps the popup
exactly as before, so apps need no changes.
/embed/sign-in and /embed/show-{open-file,save-file,directory}-picker
render the normal GUI shell with the framing rules, query redirect and
no-store of /embed/apps, and name the framing page (read from the
referrer, pinned with frame-ancestors) as embed_host_origin. The GUI
runs the popup boot unchanged with that page as window.opener; close()
asks it to remove the frame. Popup parameters come from the fragment
(msg_id, options, request_auth, and user for a picker).
Sign-in has a close button that rejects with auth_window_closed, as
closing the popup does. A federated provider can't be framed, so
choosing one continues in the popup. attempt_temp_user_creation and
cross-origin isolated pages keep the popup.
Pickers frame only for a signed-in page whose user owns the GUI
session; otherwise the GUI reports unavailable and the page opens the
popup, through a consent dialog if the click has expired. The page
keeps its own token rather than adopting the one sent with the answer.
The feedback embed and the new frames share one loading/ready state
machine in guiEmbed.js.
* Close a framed picker when Escape cancels it
Escape closes only the picker window inside the frame, so the frame now
closes with it. The mismatched-user e2e test waits for sign-in's whoami
before naming another user, which it could otherwise overwrite.
* Close a framed sign-in on Escape
The sign-in shows as a page in the frame, which ignored Escape. Escape
now asks the framing page to close it, as its close button does, unless
a request is in flight.
* Focus a framed sign-in once the page focuses the frame
A cross-origin frame's focus() calls do nothing until the framing page
focuses it, so the sign-in opened with focus on the body: keys missed
the form and Escape never reached the dialog. The screen now takes
focus when the frame gains it, unless something already has it.
* Skip the frame on subdomains the server refuses to let frame
The SDK framed embeds from any page one label under the GUI origin, but
the server refuses its own subdomains (api, docs, apps, ...). On those,
sign-in and the pickers waited on a refused frame before opening the
popup, which Safari could then block for want of a recent click. They
open the popup straight away now, and the user menu hides Apps there,
as its docs say.
* Keep a framed picker on the framing page's user
With several saved accounts, a framed picker could still show the
account picker (no grant yet, or request_auth in its fragment). Picking
another account switched the session inside the frame, and the picker
then ran with the first user's details and the second user's token,
saving that token under the first account. A framed picker already
holds the framing page's user, so it no longer offers to switch, and
its user check no longer writes the boot's shared whoami.
* Take a save picker's file only from the page that asked
The save picker opened a dialog for every showSaveFilePickerPopup
message from any window. In a frame, a sibling frame of the framing
page can reach it, so it could supply the bytes the user then saved,
or stack extra dialogs. The picker now takes the file once, and only
from its opener.
* Reopen a framed embed that reloads itself into a refused frame
A reload or navigation the embed starts itself names the embed as its
referrer, so the server refuses the framing: logging out at an account
gate, a sign-out in another tab, or a reset session left a blank box.
The page now shows its spinner and opens the embed again itself, once
per ready, and falls back as for a refused frame if that fails too.
* Correct why a temporary-account sign-in keeps the popup
notes.puter.com and puter.com are the same site, so browsers don't
partition the frame's storage. The popup is kept because only it
creates a temporary account.
* Remove the picker's consent dialog once answered
The consent dialog a picker shows when its click has expired was
closed but left in the page after Continue or Cancel, one element per
fallback. It is removed now, as the other consent dialogs are.
* Name the embed dialog for assistive tech
The modal dialog around a framed embed had no accessible name, so
screen readers announced an unnamed dialog. It is labelled with the
frame's title.
* Expose an embed's loading status only while it shows
The spinner is faded out rather than removed, so assistive tech still
read a Loading status over a frame that was ready. The status is
hidden from it whenever the spinner isn't showing.
* Let a popup frame fill in texted codes
Signup and the account checks fill a texted code in through WebOTP,
which a cross-origin frame may only use when allowed. Popup frames now
allow otp-credentials, so the code fills in as it does in the popup.
* Close a popup frame on Escape from the page too
Once a popup frame was ready, Escape with focus on the page (after a
click on the scrim) only moved focus back into the frame, so it took a
second Escape to close, and none if the frame stopped responding. It
now closes the frame, as Escape inside it does. The feedback embed
still leaves dismissal to the embed.
* Keep scrolling over an embed's scrim from scrolling the page
A wheel or swipe over the scrim around a framed embed chained to the
page behind the modal. The dialog now contains its overscroll.
* Frame a GUI popup only at its exact path
Routes match case-insensitively and with a trailing slash, so another
spelling of /embed/<action> was served frameable while the shell booted
the desktop for it. Any other spelling now redirects to the exact path.
* Prefill a web save picker with the suggested name
The popup and framed save pickers ignored suggestedName and opened with
an empty filename, unlike the save picker an app gets in the desktop.
* Open a provider picked in a framed sign-in straight in the popup
Picking a provider in the framed sign-in fell back to the sign-in popup,
where the user had to pick the provider again. The frame now hands the
page the provider's start URL for its sign-in, and the page opens the
popup there after checking it is the GUI's OIDC start for that sign-in.
* Open the popup straight away for a page framed by another site
frame-ancestors on the embeds allows only the GUI and the framing page,
so a first-party page inside another site's frame waited about a second
on a refused frame before sign-in or a picker opened the popup, by which
time Safari asks for another click. Such a page opens the popup straight
away now, as it did before the frame.
* Close a framed sign-in on Escape at its account checks
Escape closed the framed sign-in on its auth screens but did nothing once
signup moved on to confirming the email, phone or card, which show as
windows. Escape there now closes the frame as well, as its close button
does.
* Leave Escape that cancels an IME conversion to the IME in sign-in
In a framed sign-in, Escape pressed to cancel an IME conversion in a
field also closed the sign-in, losing what was typed. The auth screens
and the account checks now leave an Escape mid-composition to the IME,
as the dashboard's text fields do.
* Fade in a popup frame's scrim and box
The scrim behind a framed sign-in or picker, and the box's white
background, appeared at full opacity in one frame while the GUI's content
faded in over them. Both now fade in briefly, unless the user prefers
reduced motion.
* Keep a page's own styles off a popup frame's dialog, frame and close button
The dialog, its frame and the close button live in the page's document, so
a page's global dialog, iframe and button rules reached them: a transform
that centers the page's own dialogs moved the overlay half off screen, an
iframe max-width shrank the frame inside its box, and button margins and
min sizes turned the close button into a pill. The dialog and frame now
reset those properties inline, and the close button starts from all:unset.
* Fall back to the popup when a reopened embed frame never loads
After a refused self-reload the page opens the embed again, but nothing
timed that second start: a stalled request left the loading spinner up
until the user dismissed it, which settled the request as closed instead
of opening the popup. The reopened frame now gets the same ready timeout
as the first start.
* Hand a save picker frame its file again after it reloads
The page answered a picker's sendMeFileData once and then stopped
listening. A framed save picker that reloads asks again, and without an
answer it never opened its dialog, so the page waited out the ready
timeout and fell back to the popup. A frame is now answered until it
closes; a popup is still answered once.
* Keep a popup frame's white backing off its rounded edge in dark mode
The box's white background shared the frame's anti-aliased corner, so a
light arc showed around the dark sign-in. The backing now stops 1px inside
the edge, which leaves the curve to the frame and the scrim.
* Center a popup frame's box with margins so it fills a phone edge to edge
On a phone with a fractional pixel ratio the translate that centered the
full-screen box left it a fraction of a pixel short of the top, so a line
of scrim showed above the sign-in. Margins snap to device pixels.
* Focus a framed save picker's file name as the popup does
A cross-origin frame's focus() does nothing until the page focuses it, and
the page focusing it again resets it, so the framed save picker opened with
nothing focused and typing went nowhere. A framed popup now gets its latest
focus() back whenever the frame gains focus with nothing focused, until the
user presses a key or the pointer in it.
* Replace a showing popup frame instead of stacking a second one
A double click on a page's picker button framed two GUIs, one over the
other under two scrims, and the user had to cancel twice. A popup reuses
its named window instead. Now a newer popup frame dismisses the one
showing, which settles it as closed.
* Share one framed sign-in between calls made while it's open
A double click on a page's sign-in button started a second framed
sign-in, which replaced the first and rejected it as closed while the
user was still signing in. A call made while a framed sign-in with the
same request_auth is open now settles with it.
* Close only a context menu on Escape over a file dialog
Escape to dismiss a right-click menu in a file dialog also closed the
dialog, which cancels a picker and, in a framed picker, removes the whole
frame. An open context menu now takes the Escape on its own.
* Document that one popup frame shows at a time
* Keep a save dialog's file name and buttons on a phone's screen
The save dialog's bottom bar couldn't shrink below the file name's own
width, so on a phone it spilled off both edges: the name's start and
the Save button were cut off. A framed save picker fills the phone, so it
always hit this. The name now shrinks to fit.
* Keep a file dialog's buttons on one line on a small phone
On a 320px-wide screen the open picker's Open button wrapped under
Cancel and ran into the screen's edge, and Upload wrapped under its
icon. The buttons now stay on one line, with less side padding up to
480px wide so the save dialog's file name keeps room to show.
* Say what a picker is for when its popup needs a click to open
When a framed picker falls back to the popup after the click expired,
the consent dialog said the page used Puter for AI and Cloud features,
not that it wanted a file or folder. It now names the picker, as the
push notification dialog does.
* Share a framed sign-in with a call that differs in request_auth
Implicit auth asks with request_auth, so an explicit signIn() made while
it was open replaced its frame and rejected every puter.* call waiting
on it. Any framed sign-in in progress is now joined.
* Keep a popup frame open when a frame for another popup shows
A sign-in replaced a showing picker frame, cancelling the picker, and
the other way round, though their popups have different window names and
stay open together. Only a frame for the same popup is replaced now.
* Reopen a refused embed frame in WebKit
WebKit took the refused URL as a fragment navigation of its error page
and loaded nothing, so a frame that reloaded itself fell back to the
popup. The frame is reopened through the server's query redirect, which
keeps the fragment.
* Go back to the save picker on Escape at its replace prompt
Escape closed the alert without an answer, so the save waited on it
forever behind the picker's busy mask. In a frame nothing could close
the picker after that. The alert closing now counts as Cancel.
* Leave Safari's IME-ending Escape alone at a framed sign-in's account checks
Safari sends the Escape that ends an IME conversion with keyCode 229 and
isComposing false, so it closed the framed sign-in. The auth screens
already check for it.
* Keep an open dialog's buttons whole on a small phone in German
At 320px, German's longer labels pushed the Open button past the screen
edge, since the upload label couldn't shrink and the buttons could. The
upload label now gives way, cut off with an ellipsis.
|
||
|
Nariman Jelveh
|
51bf8697a8 |
Drop the alert after a provider signup lands on an existing account (#4538)
Signing up with a provider whose account already exists signs the user in to it, then showed a blocking "You have been logged in to an existing account" alert. In a sign-in popup it held back the token until the user clicked OK, right before the popup closed. The sign-in now completes without it, and the callback no longer adds oidc_switched to the return URL. |
||
|
Nariman Jelveh
|
8c14e7de30 |
Add account links and Send feedback to <puter-user-menu> (#4536)
The signed-in menu now shows the user's picture, username and email (hidden when whoami leaves the email out), links to Manage account, Usage and Open Puter on the GUI origin in a new tab, and Send feedback, which calls puter.ui.showFeedbackDialog(). Each new item takes a label attribute like the existing ones. The menu opens on its first item, and the arrow, Home and End keys move between items. |
||
|
Filip Kujundžić
|
84faf5c40c | refactor(ai): rename convo API to realtime (#4524) | ||
|
Rasad Regmi
|
aba2666f26 | fix(gui): improve dark mode input visibility (#4450) | ||
|
tgarver-gdm
|
abe6882de9 | Import AGENTS.md from CLAUDE.md so Claude Code loads it (#4529) | ||
|
jelveh
|
770af49528 |
Show a loading scrim while the feedback embed checks the session
The framed feedback dialog stayed hidden until the embed had checked the GUI session, so on a slow network a click on Send feedback showed nothing for seconds, and a second click silently resolved false. A check that takes longer than 200ms now shows a scrim with a spinner over the page, matching the embed's own scrim, which takes its place once the dialog is ready. Escape or a click on it cancels, and a refused session still falls back to the popup. |