Oryven v5.1.3

Oryven v5.1.3

Summary

Security hardening across desktop, backend, website, bot, and CI — plus smarter tool-call recovery and research-model downloads that don’t hijack your chat model.

Details

• Security: Shared public-URL SSRF guard on web_fetch (blocks private/metadata hosts and bad redirects); Electron only opens http(s) from window-open; filesystem tools enforce workspace/allowlist inside handlers; expanded shell deny-list; website CSP + security headers; GitHub Actions pinned to commit SHAs; Discord admin no longer matches spoofable role names; bot DB owner-only perms; aiohttp CVE pin; Ollama bootstrap downloads install script before running (no curl | sh).
• Agent: Recover tool calls narrated as pseudo-Python (web_search(query="…")) in addition to JSON tool text.
• Research models: Pull research-team models without switching the active chat model; Settings research pull UX with heavy-RAM confirm.
• Settings: Region/OS UI polish.

Downloads

• macOS: Oryven-macOS.dmg
• Windows: Oryven-Windows-Setup.exe
• Linux: Oryven-Linux.AppImage

---

First open

• macOS: Open the DMG → if prompted, choose Install to Applications (auto-clears Gatekeeper). Or drag to Applications and double-click Fix Gatekeeper, then open from Applications. Privacy → Allow if macOS asks once. Needs Python 3.10+ for the local API (first launch may take a few minutes).
• Windows: SmartScreen → More info → Run anyway (no Windows cert). Needs Python 3.10+.
• Linux: chmod +x Oryven-Linux.AppImage && ./Oryven-Linux.AppImage (or install the .deb). Needs Python 3.10+.

Legal

• Terms · Privacy · EULA · Install notes

Full changelog: https://github.com/1tsRajOwO/oryven/blob/main/CHANGELOG.md