Repository navigation
Oleafly v0.4.9 #373
prajwal-svm
announced in
Announcements
Oleafly v0.4.9
#373
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
What's new in 0.4.9
Added
Settings > General > Language, or leave the language on System default and
Oleafly follows your computer. The collaboration server, the browser
project page, the sign-in pages it serves and the file manager's
Open with Oleafly action are translated as well.
Dropbox (Google Cloud integration for cloud storage and sync #317). Choose one under Settings > Data storage > Cloud sync.
Google Drive keeps your projects in an Oleafly folder in My Drive. Files you
delete go to Google Drive's trash, and Oleafly checks Drive for changes from
your other computers once a minute. For S3 you enter the endpoint, the
bucket and your keys. Amazon S3, Google Cloud Storage with HMAC keys and
MinIO all work. Before it connects, Oleafly tries a few writes in the
bucket. A service that ignores conditional writes is turned down, because
without them two computers syncing at once could overwrite each other. When
two computers change the same file at the same moment, the one that syncs
second keeps both versions.
what takes the space. Below it, each part has its size: documents and code,
images, PDFs, Git history, build cache, the TeX distribution, tools Oleafly
downloaded such as Typst and Quarto, AI agents, research tasks, checkpoints
and the rest.
Formatting, inserting, and import and export each moved into a submenu, so
the menu is much shorter. In Markdown files, type
/tableor/equationto insert one, as LaTeX and Typst files already allowed. The Ask AI popup
also takes your own request next to the preset actions.
io.github.Oleafly/oleafly.Each release carries
oleafly.mcpb, which installs it in Claude Desktopwhen you open it. It runs the
oleaflycommand the app installs, so youneed the app with Settings > Integrations > Oleafly MCP turned on.
Suggesting and your edits become tracked changes: added text is
highlighted, and deleted text stays visible, struck through. Owners and
editors accept or reject each suggestion, or every suggestion in a file at
once, and whoever suggested a change can withdraw it. The Comments pane
lists suggestions next to the comments, and you can reply to one like a
comment.
AI edits and inserted citations made while suggesting become suggestions
too. A compile or export with suggestions waiting tells you how many. One
suggested deletion can be up to 20,000 characters. Delete more than that at
once and the text comes back, with a note that says why.
suggests changes, and every edit they make is a suggestion. A commenter
reads and comments. Both can use the chat. You can give these roles to
people you add, to guests and to the project's link. The server checks
every change a reviewer or commenter sends, so an edit their role doesn't
allow never reaches anyone.
but viewers can post, people can delete their own messages, and the owner can
clear the chat.
time and person. Open any version to read it, compare two versions, restore
one file or the whole project, or give a version a name such as "Sent to
the reviewers". Owners and editors restore and name versions. Restoring the
whole project brings back every file's text and the files deleted since.
Renamed files keep their new names, figures and files added later stay as
they are, and suggestions made after that version are dropped. A restore is
a new change, so the text it replaces stays in the history.
address field. Any other server's address still works as before.
collaboration server has browser access turned on. Without installing
Oleafly, they can edit as their role allows, comment, handle suggestions,
chat and read the latest PDF, and the project's web page gets an Open in
browser button. Whoever runs the server turns it on with
OLEAFLY_WEB=true, and the published server image already includes thebrowser app.
or editor's app uploads the PDF and its SyncTeX file to the server, at most
once a minute, so people reading the project in a browser see the newest
PDF and who compiled it. The uploaded SyncTeX file names files only by
their place in the project. A build that read files you keep out of the
shared project isn't uploaded.
it came from, or press Show in PDF (Ctrl+Shift+J, or Cmd+Shift+J on a Mac)
to find the line you're on in the PDF. It works with the PDF and SyncTeX
file the app uploads, whichever computer compiled them.
OLEAFLY_WEB_CONNECT_SRClists the other sites thebrowser app may connect to, by default
https://mirrors.oleafly.com.OLEAFLY_OPEN_SIGNUP=true,anyone who signs in with one of the server's sign-in options gets an
account, and each account gets 100 MB of storage, 50 shared projects and
300 uploads an hour.
OLEAFLY_ACCOUNT_STORAGE_MB,OLEAFLY_MAX_PROJECTS_PER_ACCOUNTandOLEAFLY_UPLOADS_PER_HOURchangethose limits, and also work without open sign-up. Compiled PDFs count
toward storage but not toward uploads.
.qmdand.Rmddocuments into aPDF, a web page or slides, and Calepin runs the code in a Typst document
and puts the results in the PDF. Oleafly uses the copy on your computer, or
downloads a pinned, checksum-verified one from Settings > Engines when you
ask. Code runs with your own R, Python or Julia, and only after you allow
code for that project in the Compile menu. Until then Quarto shows the code
without running it, and Calepin shows the results from its last run. New
templates: Quarto article, Quarto slides and Calepin report. Quarto's
working folders (
.quartoand a document's_filesfolder) stay out ofcloud sync, shared projects and checkpoints. Calepin's
.calepinfolder isshared and synced like any other, so co-authors who haven't allowed code
still see its stored results.
this computer can show, Oleafly says so and offers to download the free
font pack that covers it.
Kimi (Moonshot), Zhipu GLM, SiliconFlow and Volcengine Ark. Pick one and it
fills in the name and base URL, so you only add your API key.
offers eleven icons for the Dock or taskbar while Oleafly is open: classic,
pastel, blue, light, prism, iridescent, ocean, mint, aurora, sunset and
coral. Classic, the green quill, is still the default. The quill next to the
Oleafly name and the one on the startup screen take on the colours of the
icon you pick.
arguments in
[tool.oleafly]in a package'stypst.toml, or inoleafly-forms.tomlat the project root, and Visual mode shows each call asa card with labelled fields. Inside a paragraph, the call is a chip that
opens the same fields. Changing a field rewrites only that argument. A field
can hold text, Typst markup, a choice from a list, a number or an on/off
switch. Mistakes in
oleafly-forms.toml, or in thetypst.tomlof apackage vendored into the project, show as markers when you open the file.
Changed
such as
\q, or a\u{..}that names no character, stays as written.or a refused file request, now show in your interface language instead of
English, with the agent's own last output kept as it was.
reasoning and sends it back, which DeepSeek requires once tools are in use,
and the effort menu offers Off, Low, High and Max for DeepSeek models.
Chats saved before this change keep thinking off for tool runs.
peak rates, which are double the off-peak rates on weekdays from 01:00 to
04:00 and 06:00 to 10:00 UTC.
API keys and endpoints you set in your shell profile, such as
HTTPS_PROXY,ANTHROPIC_BASE_URLorDEEPSEEK_API_KEY. A value Oleaflyalready has wins, keys are hidden in transcripts and errors, and traffic to
Oleafly's own tool servers skips the proxy. Research tasks get the proxy
settings but not the keys.
settings from your
.npmrc. An unreachable registry fails within about aminute and the message names it, and large bridges get 15 minutes to
download.
DeepSeek or Z.ai key, using their Anthropic-compatible endpoints. Codex is
only offered your OpenAI key, the only kind it accepts.
bridge bundles, and starts in the mode you last picked.
diagram composer and most dialogs load the first time you open them. PDF
page rendering loads when something first needs it, and KaTeX when you
first open a LaTeX or Markdown file. Once you've finished the tours, the
library screen loads about 2 MB less. Mermaid diagrams in chat use the
app's KaTeX instead of bundling an older copy. Cloud sync only loads its
background code on a computer connected to Dropbox, Google Drive or an S3
bucket, or once you open Settings.
and Codeberg's in their own colours: in the add-account choices, in
Settings, in the remote menu, in the publish dialog and beside each
repository. The publish dialog's account picker moved to
the bottom left, beside the button.
signs out with an icon button. The server name shows only when it differs
from the badge.
Collaboration is there from the start, and the switch under Settings >
Experimentation is gone.
first in the provider list and is preselected until you set up a provider.
has a cursor icon and comes after Oleafly MCP, and the app picker shows
each app's icon.
only the apps and websites you list, and when you turn Computer Use on,
Oleafly first tells you that actions will run without asking. To approve
each click, keystroke, page change and script, turn on Ask before each
action in Settings > Integrations > Computer Use. If Computer Use was
already on when you updated, Ask before each action stays on until you turn
it off.
without a confirmation dialog.
Fixed
no longer crashes the app (Crash: Error: Minified React error #185; visit https://react.dev/errors/185 for the full message or use the non-minified dev environment for full errors and additional helpful warnings. #359). If a dialog or panel does run into an
error, only that part closes now and the details go to the log. Before, the
whole window switched to the crash screen.
summary service is down. Oleafly then gets the records from NCBI's
citation exporter. Before, Add citation and
oleaflyc citesaid PubMed hadno record for a real paper, and search showed no PubMed results.
you now. Oleafly refused to start every 0.38 driver, saying it wasn't
running with Oleafly's limits, because 0.38 words that check's answer
differently.
Driver 0.38 refuses to list every app or window, so agents saw nothing and
were told the app wasn't allowed. Oleafly now finds the allowed apps that
run and asks for their windows one app at a time.
it's asked to, so Oleafly now checks the app first.
them unless the call names the app's process, and agents usually name only
the window or element they saw, so you could approve an action and then
watch it fail. Oleafly now adds the process the driver reported for that
window.
in a tab only after it binds the browser's window, and agents had no way
to do that, so every page change was refused. Oleafly now connects to the
browser it opened, fills in the tab on later calls and passes the page's
text to the agent. A site that isn't on your list is turned down before
you're asked.
fails when a tool returns a picture, for example a Computer Use
screenshot. The provider turned the whole request down. Now the picture is
left out and the model works from the text.
or commands without asking you: Sublime Text, BBEdit, Nova, Xcode,
Antigravity, Kiro, MacVim and Emacs.
only once Cua Driver is installed and new enough, says when Cua Driver
hasn't checked them yet instead of "couldn't read", and shows the grant
command to copy when no project is open. After you run a step in the
terminal, Settings opens on Computer Use again, and the command in the
terminal's confirmation wraps instead of running off the edge. A Cua Driver
start that stops at its own permissions prompt says so.
and Finder on macOS 15 and earlier. The bundled icon now leaves the margin
macOS expects around an app icon.
restoring an earlier chat checkpoint and replacing an equation or diagram
file. The question never showed up in the app, so all of these went ahead
without asking. That included the permanent delete on a system with no
trash.
spelling of it. On Linux and macOS the other spelling held only the local
addresses, and agents that read it sent internal hosts through your proxy.
#setrule, orclearing one and setting another, could leave a broken rule such as
#set par(without its closing parenthesis. Clearing a value on the lineafter a
//comment, or in a rule written with its commas first, couldbreak the rule too.
the cell into plain text, and a cell that ended in
\broke the table. A$without its pair, as in a price like$5, a//or/*, or a lonebacktick broke the table too, and did the same to a figure caption. Now
only what has no pair is escaped. No borders also works when the table's
strokevalue comes after a comment.instead of your typing in the cell, and Ctrl+B or Ctrl+I added bold or
italic markup somewhere else in the text.
letters Typst allows, such as
@local/AcmeReport:1.0.0.or llama.cpp server, stopped working after the first save. Oleafly lost the
"no key needed" setting when it saved, so every request failed with "No API
key is set". It now keeps the setting and repairs providers saved by
earlier versions.
provider", and picking one of its models in the chat hid the message box.
what went wrong if that fails, for example that the server isn't running or
the key was refused. An address entered without /v1, like
http://localhost:13305, is saved ashttp://localhost:13305/v1when thatis where the models are. You can still add a provider that lists no models
and type the model names yourself.
?in it, and tells you to put the key in the API key field (fix: key-less custom providers, and tool calls local models write as text #344).
had set up, which could be a cloud one, without any sign. Now the assistant
says the provider needs a model.
was briefly unreachable, got marked as unable to use tools until you
checked it again. Now only the model's actual answer decides that. Local
and custom servers get two minutes to answer the check, and models that
were blocked this way get checked again.
tools. Before, Oleafly refused those too (fix: key-less custom providers, and tool calls local models write as text #344).
would be sent to the new one, but Oleafly removed it. The dialog now says
the key stays behind: enter it again, or leave it blank for a server that
needs no key.
and the Tools converters work with custom providers that need no key, and
Image to LaTeX works offline with one running on your computer.
that error instead of "The connection closed".
provider.
the reply as plain text, like
{"name": "ping", "arguments": {}} </tool_call>.Oleafly showed that text as the answer, and the tool check said the model
couldn't use tools. It now runs a call written this way when the call names
a tool Oleafly offered and has valid JSON arguments. Any other reply stays
text. A reply that starts like a tool call appears once it is finished
instead of word by word.
disconnected." It prints a log line on its output while a session starts,
and Oleafly closed the connection at the first line that wasn't a protocol
message. Oleafly now skips such lines and shows them with the agent's other
output if something goes wrong.
when
dshisn't on your PATH, and a missing or rejected DeepSeek key nowshows its sign-in steps.
second copy and left the first one running. Messages sent during a start
now wait for it.
shows Hermes's own message and its setup steps. Picking a model no longer
removes Oleafly's research tools from Hermes, a conversation from another
Hermes profile says so when you reopen it, and Settings shows the installed
Hermes version even when GitHub is slow or unreachable.
the provider's error, and any agent that ends a turn without replying says
so. Pi no longer shows two pickers with the same choices, and an older
pi-acpon your PATH isn't used.half a megabyte. The permission card now opens without the preview.
and DeepSeek Harness. It now starts again.
Claude Code to its default effort. Oleafly now restores the model, mode
and effort the conversation had, and remembers the model you pick.
config.tomlora rejected key from another provider. Oleafly now shows Codex's own error
or names the provider and its key variable. Failed Codex turns no longer
look like normal replies.
Anthropic, and the account line read "Signed in with Not logged in".
timeout, asked you to sign in when its error output happened to contain a
word like "OAuth" or "unauthorized", as file paths in a stack trace often
do. Oleafly now shows the crash, and asks you to sign in only when the
agent itself says so.
a request for a file outside the project is refused with a note naming it.
stalled tool server could hold up a start for minutes.
garbled, Node.js warnings could hide the real error, and a timed-out start
dropped the agent's last output.
codes.
retries or shows an error, and long tool calls are no longer cut off at
about 8,000 tokens. DeepSeek Flash is treated as reading images.
the request is turned down or the reply comes back empty, the error now
tells you what to try next. This works with every provider (fix: DeepSeek Harness sessions, DeepSeek thinking and CLI agent reliability #338).
build failed with nothing in the error list, and only the last line of the
log said the compiler had crashed. Tectonic 0.17 does this on some
documents instead of reporting the missing font. The error list now names
the font and the line Tectonic had reached, and suggests installing the
font or switching to XeLaTeX or LuaLaTeX. Other compiler crashes show an error
too, in the app and from the
oleaflycommand.exit code, and missed the error at the end. It now gets the exit code and
the start and end of the output, and an error printed after a long log is
kept.
another app changes them, as files in an opened folder already did. If you
have unsaved edits, a bar above the editor lets you compare both versions,
keep yours, or reload. When a save stops because the file changed on disk,
you get the same bar instead of a separate message (feat: sync to Google Drive and S3-compatible storage, a storage bar, and a tidier editor menu #339).
little off, because Oleafly didn't ship the extra files the PDF viewer
needs for them. It now includes the standard fonts for PDFs that don't
embed their own, decoders for the JPEG 2000 and JBIG2 images common in
scans, the character maps some Chinese, Japanese and Korean fonts rely on,
and the CMYK colour profile. The preview, presentation mode, PDF to
LaTeX and PDFs you attach in the assistant all use them.
\inputspelled a file's name with othercapitals than the file has, such as
\input{Chapters/Intro}forchapters/intro.tex, Show in PDF and clicks in the PDF did nothing forthat file, and its compile errors weren't marked in the editor. Oleafly now
falls back to a match that ignores case when only one file fits.
such as a render that timed out during a long compile, kept showing that
error until you changed the equation. It now tries again the next time the
equation is drawn.
bar buttons, the cards that open when you point at a label or command, and
the Visual mode table's toolbar and dialogs. Their text used to stay the
same size.
installed on your system or Pandoc, still inherited the AppImage's
library paths, which Git and the terminal stopped doing in 0.4.8. They now
start without them.
switched to another project, that project's preview showed the Pandoc
error instead of its own build.
account within a few minutes could let the old sync keep going. It could
bring back files you had deleted and add conflict copies, which the new
account then uploaded, and an error from it could mark the new account as
disconnected. Connecting now stops a running sync first, and a sync stops
when the account changes.
being applied started a second apply. It now applies once.
Security
9.1.3. Oleafly unpacks ZIP files you import and ones it downloads, such as
TinyTeX, language servers, agent bridges and projects from an online LaTeX
service. The update fixes several GitHub security advisories in zip. One is
critical: zip could read an archive differently from other ZIP tools.
Another, rated high, is about where a symbolic link in an archive points.
The updater, tauri-plugin-updater, moved from 2.11.0 to 2.14.1 so it uses
the new zip as well.
rest of the app uses. A Markdown math package still brought in KaTeX
0.16.47, which has a security advisory (GHSA-238p-pmpm-9mq7).
snapshots taken during agent turns, from 0.13.3 to 0.14.3. It fixes four
security advisories in how zstd handles memory (RUSTSEC-2026-0391,
RUSTSEC-2026-0398, RUSTSEC-2026-0403 and RUSTSEC-2026-0410).
oleafly lint, from 0.13.4 to 0.13.5 (fix: confirms that never asked, NO_PROXY for CLI agents, S3 and Drive transfers, CI time limits #348). It fixes a security advisorywhere a small Markdown file with crafted wiki links could use up all
memory (RUSTSEC-2026-0414).
system dialog that shows the command and names any environment variables
it sets. It asks again when you change the program, its arguments or its
environment. If you say no, the server isn't saved (Limit what a webview script can reach over IPC #336).
shown inside Oleafly can use none. Exports, imports, checkpoint archives,
skills, templates and other files outside a project only work with a file
or folder you picked in a file dialog, or on Linux one you just dropped on
the window. Saved connector keys, such as an alphaXiv key, no longer reach
the app window (Limit what a webview script can reach over IPC #336).
every YAML block,
_quarto.yml,_metadata.ymland any metadata filesthey name. If anything there could run a program, such as a Lua filter, a
pre- or post-render script, an unusual PDF engine, an engine option like
-shell-escapeor a shortcode Quarto doesn't ship, Oleafly doesn't buildand asks you to allow code. Inline R anywhere in the document or the files
it includes counts as code too. Included files and metadata files must be
inside the project.
commenters whatever app they use, not only in the browser. They can add
comments, replies and messages and change or delete their own, but they
can't delete other people's or clear the chat.
session cookie is now
__Host-oleafly_web, so a site on another subdomaincan't slip in a session of its own. If you already used the browser app on
such a server, you sign in again once. Behind a path prefix, a browser that
sends two different session cookies is treated as signed out.
and the page asks you to sign in again.
Downloads: grab your platform's installer below (macOS Apple Silicon
.dmg, Windows x86_64.msi/-setup.exe, Linux x86_64 or ARM64.AppImage/.deb/.rpm).This discussion was created from the release Oleafly v0.4.9.
All reactions