Skip to content

Portal 4.0.13

Choose a tag to compare

View all tags
@Robertmonkey Robertmonkey released this 10 Aug 05:13
· 6 commits to main since this release
v4.0.13
4037d57

Portal 4.0.13 is a feature release. Install or update from https://bridgesllm.ai — the Dashboard updater applies it in place with backup, migrations, health checks, and automatic rollback.

Added

  • Share links can enforce their own request throttle. Owner-selected request cap and window, enforced against the link itself rather than a visitor IP. Over the cap returns 429 with Retry-After; if the throttle cannot be evaluated the request is refused rather than waved through.
  • Embeddable origins are managed in one owner-controlled allowlist. A persisted, versioned policy for which external origins may be framed and which may be delegated camera or microphone access, replacing hand-maintained per-app CSP overrides.
  • Project deployments declare who owns the runtime. Portal-managed or external, with honest Refresh, Start, and Restart and visible in-progress state. Externally owned workloads are no longer silently adopted or sandboxed by a deploy.

Fixed

  • A gateway restart no longer destroys the Agent Chat turn you were watching. Live runs reattach instead of being abandoned until they finish; assistant identity is preserved through recovery and replayed history is de-duplicated. Activity that arrived through another channel reconciles into the timeline instead of staying invisible.
  • Mid-turn steering survives a tool call. A steer either visibly steers or visibly fails, rather than disappearing.
  • Stuck provider sign-ins can be recovered from the wizard. Pasting a Claude code no longer leaves a blank screen, a rejected save no longer parks the provider for fifteen minutes, and a retained lifecycle fence no longer disables a provider permanently. A refused login reports the real reason instead of a bare exit code.
  • Updating no longer trips over a native database engine, and several installer failures that only appeared on real upgrades are fixed.
  • Project Chat opens as a conversation instead of a provisioning screen, survives ambiguous sends and restarts without inventing a second turn, and stays usable when one workspace needs repair.

Security

  • Project Chat authority is bound to the signed-in actor and immutable project on every path.
  • Tenant branding values are validated and escaped at every rendering boundary.
  • A misconfigured App API target now fails closed instead of reading as "not configured".
  • Contained directory ownership changes are O_NOFOLLOW and dev/ino-verified, so a swapped symlink cannot redirect a privileged chown.
  • npm audit reports zero vulnerabilities for both packages.

Full notes: CHANGELOG.md

A note on tag history. This repository is a squashed source export, so a version that was not exported at the time it shipped cannot be tagged honestly afterwards — the commit that eventually carries it also carries later versions. Releases 4.0.4, 4.0.9, and 4.0.10 shipped to bridgesllm.ai without a matching tag here. Their code is present in the current tree; no backfilled tags have been created for them, because such a tag would name a build it never produced.

Assets 2
Loading