Skip to content

v2.7.0

Choose a tag to compare

View all tags
@RunhuaHuang RunhuaHuang released this 14 Aug 06:06
· 34 commits to main since this release
v2.7.0
8d1b9a7

What's Changed

🛡️ Welfare gateway endpoint privacy

  • The private welfare gateway endpoint is now stored as an XOR+Base64 cipher instead of plaintext, and its hostname in the capability registry is derived from that cipher.
  • All WebUI/API responses (presets, config GET/PUT, export) only ever expose the opaque builtin:welfare alias; the server resolves the alias back to the real endpoint for validation, persistence, and connection probes.
  • The welfare alias is restricted to MiniMax-M3 with a clear error for other models, so the private gateway cannot be reused for arbitrary model IDs.

🔧 WebUI hardening

  • Unified API-key preservation rules between PUT /api/config and /api/test-connection into one shared resolveApiKeyChoice helper.
  • Oversized request bodies now get the connection dropped after the 413 response instead of letting a peer stream indefinitely.
  • Fixed a WebUI foot-gun where editing (not changing) the masked API key could persist the display mask as the real credential on save.
  • Simplified WebUI routing; query string stripped once per request.
  • normalizeModelForKnownEndpoint now tolerates an unparsable Base URL.

Full Changelog: v2.6.1...v2.7.0

Assets 2
Loading