Release v0.2.5-beta.72

OpenLoaf Desktop 0.2.5-beta.71

Retries the macOS arm64 build that broke in beta.70 (Apple notarisation 403). The CI pipeline also gains real fail-fast across all build jobs, plus scaffolding for future Windows/Linux arm64 builds.

🚀 Improvements

• CI fail-fast across every platform. The publish-desktop workflow now stops the entire run on the first build failure: each matrix is fail-fast: true, and each top-level build job ends with a gh run cancel step gated on if: failure(). Saves ~20 minutes of wasted runner time when one platform breaks.
• Multi-arch build scripts staged. apps/desktop/package.json now defines dist:win:arm64[:ci] and dist:linux:arm64[:ci]; artifactName for Linux / Windows now embeds ${arch}. The CI matrix still ships x64 only — these scripts are the building blocks for adding ARM64 to the publish matrix when ready.

🐛 Fixes

• macOS arm64 dmg restored. beta.70's macOS arm64 job hit Unexpected token 'E', "Error: HTT"... is not valid JSON from @electron/notarize because the Apple Developer Program License Agreement had to be re-accepted. After re-acceptance this release rebuilds and republishes the missing arm64 artefact, so download.json's mac-arm64 link points at a real dmg again.

ℹ️ Notes

• No app-side behaviour change.
• After this release lands, double-check https://openloaf-1329813561.cos.accelerate.myqcloud.com/download.json and confirm desktop.downloads.mac-arm64.url returns 200.

OpenLoaf Desktop 0.2.5-beta.70

Hotfix for the publish pipeline. Beta.69 installers + manifests reached COS / R2 fine, but the cleanup step at the end of publish-finalize failed against COS, which in turn skipped the GitHub Release. End users on download.json were unaffected; this release restores the GitHub Release path.

🐛 Fixes

• publish-finalize cleanup compatible with Tencent COS. The shared cleanupOldVersions helper used DeleteObjectsCommand (batch, up to 1000 keys per call) which works on R2 and native S3 but fails on COS with InvalidRequest: Missing required header for this request: Content-MD5. AWS SDK v3 dropped automatic Content-MD5 in favour of x-amz-sdk-checksum-algorithm; COS does not yet honour the new header. Switched to single-object DeleteObjectCommand calls with a small concurrency window — works against R2 / COS / S3 alike, and the runtime cost is a few extra seconds per release.

ℹ️ Notes

• Beta.69 itself is functional via the website / download.json / direct COS / R2 URLs. Only the GitHub Release page for desktop@0.2.5-beta.69 is missing; this release brings back the GitHub Release pipeline.
• No app-side behaviour change.

OpenLoaf Desktop 0.2.5-beta.68

Adds a website-friendly download-{channel}.json index so the official site can render the latest download buttons by fetching a single JSON. No app-side behaviour change for end users.

🚀 Improvements

• download-beta.json / download-stable.json published per release. The publish-finalize step in publish-update.mjs now writes a flat JSON containing the latest desktop version, per-platform installer URLs (dmg / exe / AppImage), R2 + COS mirror links, the GitHub Release tag URL, and the bundled web / server versions. Available at:
  • https://openloaf-1329813561.cos.accelerate.myqcloud.com/download-beta.json
  • https://openloaf-update.hexems.com/download-beta.json
  • …/download-stable.json once the next stable ships.
• The index is regenerated at every --manifest-only finalize, mirrored to both R2 and COS, and prefers COS in the default url field so mainland users hit the accelerate edge first.

ℹ️ Notes

• Schema is intentionally flat and includes raw mirrors.{cos,r2,github} so a static site can do fetch('/download-beta.json').then(r => r.json()) and bind URLs without bespoke parsing.
• sha256 for the user-facing dmg/exe/AppImage is currently null — electron-updater verifies via the side .blockmap / sha512 channel. If we need a sha256 for website integrity badges, capture it during the per-platform upload step.

OpenLoaf Desktop 0.2.5-beta.67

Cuts the auto-update default endpoint over to Tencent COS so fresh installs in mainland China get noticeably faster downloads. Cloudflare R2 keeps mirroring every release for older clients and overseas users.

🚀 Improvements

• Default update endpoint switched to Tencent COS. New installs now resolve https://openloaf-1329813561.cos.accelerate.myqcloud.com for both the Electron auto-updater and the in-app web UI. CI continues to dual-publish to R2 and COS, so the existing https://openloaf-update.hexems.com mirror stays current — clients pinned to it via OPENLOAF_UPDATE_URL keep working.
• @openloaf-saas/sdk bumped to ^0.3.9 across server, web and packages/api. Picks up upstream chat / media-task fixes; no API changes on the OpenLoaf side.

🐛 Fixes

• Stray branch-snapshot query on first paint. ChatCoreProvider / useChatBranchState now require a resolved sessionId before the branch snapshot tRPC query fires. Previously a request could sneak out before the session id was hydrated, hitting the server with an empty id and surfacing a noisy 400 in the network tab.

ℹ️ Notes

• Old installs (≤ 0.2.5-beta.65) still pull updates from R2 and will continue to receive every future release — the cutover is opt-in via reinstall, not forced.
• If you need to override the endpoint (corp proxy, staging, etc.), set OPENLOAF_UPDATE_URL either as an env var or in runtime.env. The override is honoured ahead of the new COS default.

OpenLoaf Desktop 0.2.5-beta.66

Infrastructure release. Auto-update artifacts now mirror to Tencent COS in addition to Cloudflare R2 so users in mainland China get noticeably faster downloads. Existing installs keep pulling from R2 — nothing changes for them in this version.

🚀 Improvements

• R2 → R2 + Tencent COS dual-publish. Server, web and desktop release pipelines now upload every artifact and manifest to both Cloudflare R2 (海外) and Tencent COS (国内, via global accelerate endpoint). When TENCENT_* secrets are absent the COS leg is skipped silently, so external forks keep working unchanged.
  • apps/server/scripts/publish-update.mjs and apps/web/scripts/publish-update.mjs gained uploadFileToAll / uploadJsonToAll wrappers and changelog dual-write, mirroring what desktop already had.
  • All three publish workflows (publish-server.yml, publish-web.yml, publish-desktop.yml) now inject TENCENT_COS_* / TENCENT_SECRET_* secrets next to the R2 ones.
• COS env var names aligned with OpenSpeech. Renamed COS_* to TENCENT_* in scripts/shared/publishUtils.mjs and scripts/sync-r2-to-cos.mjs so the Tencent credentials can be reused across repos. Local .env.prod files need the same rename — see Notes.

ℹ️ Notes

• No application code changes. The desktop binary is rebuilt only to pick up the new CI pipeline; this release is functionally identical to 0.2.5-beta.65.
• Default update endpoint is unchanged — https://openloaf-update.hexems.com (R2) — so old clients keep auto-updating. Switching new clients to the COS endpoint will land in a follow-up release once COS has been verified to receive a full set of artifacts.
• If you rely on node scripts/sync-r2-to-cos.mjs locally, rename the six COS_* keys in apps/desktop/.env.prod to TENCENT_* before running it again.

OpenLoaf Desktop 0.2.5-beta.65

Hotfix for 0.2.5-beta.64 — WeChat / SaaS login was broken on every platform (macOS / Windows / Linux) because of a CJS/ESM interop oversight when loading keytar. Upgrade strongly recommended.

🐛 Fixes

• WeChat / SaaS login restored. In 0.2.5-beta.64 the OAuth code exchange completed against the SaaS side but POST /auth/exchange then failed locally with keytar.setPassword is not a function, leaving the desktop app unable to persist the SaaS refresh token. The bug was platform-independent — Keychain (macOS) / Credential Manager (Windows) / libsecret (Linux) were never reached because the JS layer threw first.
  • Root cause: apps/server/src/modules/settings/openloafConfStore.ts did await import("keytar") against an ESM bundle. keytar is a CJS package, so the named exports landed under .default instead of being hoisted to the namespace, and keytar.setPassword resolved to undefined.
  • Fix: take m.default ?? m from the dynamic import so the same shape works in both CJS and ESM hosts. One-line change, no behaviour difference on the dev path.

ℹ️ Notes

• No schema or API changes. Bundled server / web binaries are rebuilt to pick up the fix.
• Users who already exchanged a code on 0.2.5-beta.64 do not need to do anything special — log in again and the refresh token will be written to the OS keychain on first success.

OpenLoaf Desktop 0.2.5-beta.64

Re-roll of 0.2.5-beta.63 — the previous tag failed CI because keytar's .node binary tripped esbuild and was not bundled into the desktop package. Both are fixed below.

🔒 Security

• SaaS refresh token now lives in the OS keychain. In production builds the refresh token is persisted via keytar (macOS Keychain / Windows Credential Manager / Linux libsecret) instead of auth.json. Dev builds keep using auth.dev.json for cross-process script convenience. Native binding loads lazily so the dev path never touches keytar.
• SaaS auth handshake carries client identity. Token exchange and refresh now send a clientInfo payload (appId: openloaf-server, platform, appVersion) so the SaaS side can attribute and rate-limit per client.

🚀 Improvements

• Cross-provider JSON output stabilised. auxiliaryInfer no longer relies on AI SDK Output.object (which encodes as response_format=json_schema). Dashscope requires the json keyword in messages, DeepSeek doesn't accept json_schema, and Kimi silently ignores it — behaviour was inconsistent. Now we generate plain text with an inline schema hint, extract the JSON ourselves, and validate with zod for uniform results across every provider.
• New jsonExtract module. Schema-aware JSON parser used by the auxiliary pipeline; ships with focused unit tests plus a Dashscope repro and an end-to-end auxiliary web-fetch test.

🔧 Refactor

• Token store fully async. applyTokenExchangeResult, setRefreshToken, getRefreshToken, clearAuthSession, and the auth route handlers are now async to accommodate keychain I/O. No behaviour change for existing callers beyond awaiting these calls.

🐛 Build fixes (vs 0.2.5-beta.63)

• keytar added to the server esbuild external list so the .node native binary is no longer pulled into the bundle.
• keytar added to the desktop forge.config.ts NATIVE_DEP_ROOTS so the package and its native binding are copied into the packaged app's node_modules.

📦 Dependencies

• @openloaf-saas/sdk 0.2.4 → 0.3.2 (server / web / packages/api / root).
• keytar ^7.9.0 added (server) — declared in root onlyBuiltDependencies so the native binding is built during install.
• pnpm-lock.yaml refreshed.

OpenLoaf Desktop 0.2.5-beta.62

✨ New

• macOS native control: per-window screenshot & enumeration. New list_windows and capture_window ops in the Swift helper let the model see every renderable window for a target app (not just the frontmost) and grab a pixel-accurate shot of any single window by windowID. observe now returns a windows[] payload by default and exposes axRichness / windowChildRoles so the model can reason about UI density before acting.
• WeChat channel agent end-to-end. qwen:OL-TX-008 (SaaS Fast Chat Model) is wired up as the channel-agent default for sub-3s ack-first SLO; new harness + identity + approval prompts ship per-language; SendWeChatMedia tool added for outbound image / video / file bubbles. MacosObserve / MacosAct are now reachable from the WeChat channel so users can remote-drive their Mac via IM.
• macOS intent layer. New macosIntentRegistry + macosIntentRouter resolve high-level user intents (MacosAct type="intent") into concrete strategies, plus a new MacosSurvey tool for the "understand first" step before acting.
• Notion MCP integration → deferred-load bundle. Notion is now advertised as a single notion-mcp bundle in the preface; the model pulls the full toolset via ToolSearch on demand. Probe switched from notion-get-self (not always available) to notion-get-users { user_id: "self" }. New integration-identity module persists workspace identity per-account.
• MCP mock infrastructure. New mcpMockStore + mcpMockRoutes plus mcpBundle registry support deterministic browser tests and dev-time exploration without hitting real MCP servers.

🚀 Improvements

• Late-registered MCP tools become visible mid-session. agentFactory now merges live MCP tool IDs into activeTools on every step, so a tool that lands in the registry after a ToolSearch bundle call (e.g. Notion connecting on demand) is immediately callable instead of being filtered out for the rest of the session.
• macosControlTools.ts decomposed. Split into macosCommon (i18n + perm plumbing), macosIntentRegistry, macosIntentRouter, macosSurveyTool, macosChromeGuard for clearer ownership and easier extension.
• Channel agent prompt restructured. Shared harness.{en,zh}.md extracted; identity / approval rewritten; new tool-description overrides keep IM tone consistent across providers.
• Cloud model mapper + provider adapters tightened. cloudModelMapper, providerAdapters, qwenAdapter, resolveChatModel updated for the Fast model class; modelRegistry cleanup.
• ToolSearch smarter. Bundle resolution + ranking improvements (~156 line diff) so MCP bundles surface before generic tools.
• WeChat AI bridge hardened (~900 line diff): improved debounce, abort-on-new, cold-start batching, ack-first behaviour.

💄 UI

• ConnectionAccountRow extracted as a reusable status row used by the WeChat connection dialog.
• Provider / Agent settings panels polished — clearer dialog sizing, model checkbox UX, agent detail layout.

🌐 i18n

• en-US / zh-CN / zh-TW / ja-JP synced for ai, connections, project, settings namespaces.

🐛 Fixes

• Chat.tsx no longer threads the obsolete canAttachAll prop.
• Removed stale requiredModelTags test; agent template types.ts cleanup.

🔧 Refactor

• tokenStore, authCallbackPage, integration OAuth routes/service consolidated for shared identity flows.
• auxiliaryInferenceService + auxiliaryMessageUtils simplified.
• Settings: auxiliaryModelConfStore, openloafConfStore, settingConfigTypes, settingsService aligned with new model class.

📦 Dependencies

• pnpm-lock.yaml refreshed.

What's Changed

✨ New Features

• WeChat integration: New channel adapter that bridges WeChat conversations into OpenLoaf ChatSession. Includes per-account poll worker, send/mock services, AI bridge, QR binding UI, and unified session rendering.
• macOS control: New MacosObserve / MacosAct tools with native Screenshot.swift implementation. Tool descriptions and skill docs refreshed; click is now preferred over ax_action for standard clicks.
• Context compression: Step-budget soft landing and truncated-output handling keep long multi-turn sessions coherent when they approach model limits.

🚀 Improvements

• Chat panel independence: The right-side AI chat panel no longer reacts to sidebar navigation. Chat state lives in a dedicated store keyed per scope (global / projectId), so switching sections keeps the stream alive and preserves panel widths and visibility as user preferences.
• PPTX viewer: Rewritten around canvas rendering with zoom controls, keyboard shortcuts, and better slide navigation / error handling.
• Tool registry: Project, docConvert, and macOS control tool descriptions sharpened so the model picks the right tool more reliably.
• Master prompt discipline: New regression test locks down harness behavior to avoid drift between prompt edits.

💄 UI

• Connections: Redesigned install dialog with clearer copy, icons, and per-integration setup flows.
• File viewers: Consistent lifecycle and save-as handling across Audio / Doc / Excel / Markdown / PDF / PPTX / Video viewers; FilePreviewDialog wires sessionId through props for stack viewers outside ChatSessionProvider.
• Layout: Sidebar, StackHeader, and LeftDock polish; navigation no longer forces leftWidthPercent or right-chat collapse.

🌐 i18n

• Refreshed en / zh-CN / zh-TW / ja-JP strings for AI, connections, and common namespaces.

🗄️ Database

• Migration 20260423000000_drop_chat_session_wechat_peer_id aligns the ChatSession schema with the new WeChat channel model.

🐛 Fixes

• Browser test 019-context-compression-large-text now reads msg.parts instead of the legacy msg.content field, unblocking pnpm check-types.