Skip to content

literouter v0.5.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Oct 10:03
· 3 commits to main since this release
v0.5.1
3c5edc2

Linux packaging correction (2026-10-26)

The initial Linux desktop archive mixed the runner system loader with the private
libc. The Linux assets and SHA-256 files have been replaced after deriving the
loader from ELF PT_INTERP and executing the staged tray. Core/application source
and the v0.5.1 tag are unchanged; Windows/macOS assets are unchanged. Re-download
the Linux archive and its checksum if downloaded before this correction.
The repaired archive passed clean Debian execution, private D-Bus gateway
ownership/autostart tests and 48 isolated CLI/integration checks.

中文：最初 Linux 桌面包的加载器与 libc 不匹配，现已修正并更新校验和；版本 tag、
核心源码、Windows/macOS 资产未变。此前下载的 Linux 包请重新下载并校验。

v0.5.1 — Safer routing and reliable desktop packaging

This patch repairs credential boundaries, configuration/state consistency and
desktop distribution. It remains a single-user local gateway: one
server.api_key protects model and management interfaces. There are no client
accounts, permission groups or quota distribution.

Security and reliability

  • Buffered, streamed and probe requests refuse automatic upstream redirects,
    including same-origin redirects. Credentials and prompts are never replayed
    to a Location target; configure the final Base URL. Streaming authentication
    failures stop the attempt instead of sending an unsigned request.
  • Invalid client authorities return errors instead of dereferencing an empty
    HTTP client. Configured port 0 discovers and verifies a matching instance
    through its state record; stale/ambiguous destinations fail, and a record
    cannot downgrade an HTTPS management credential to plaintext.
  • Real first startup creates a missing template. serve --check and
    --print-config remain read-only; corrupt files are not overwritten. Invalid
    manual or automatic reloads leave the active configuration intact.
  • Management status includes cache, model usage, cost and bucket fields. Costs
    survive telemetry restoration. Inline probes use the requested protocol, and
    pooled connections distinguish proxy ports. Telemetry lock boundaries and
    socket test shutdown races are corrected.
  • Windows socket cancellation is tracked explicitly across bounded poll slices:
    local shutdown otherwise leaves a reader blocked for the original timeout.
    The header deadline now returns 504 promptly without imposing that deadline
    on an already committed stream.
  • TLS reads PEM via native filesystem paths rather than lossy narrow filenames,
    while retaining chain and hostname checks and rejecting malformed chains.

Routing change: explicit model fallback

providers[].models is an advertised directory, not a replacement-model
chain. A failing request will not silently select an unrelated model from that
directory. If a replacement is acceptable, author it explicitly:

{
  "model": "my-model",
  "targets": [
    { "provider": "primary", "model": "preferred-model" },
    { "provider": "primary", "model": "accepted-replacement" },
    { "provider": "backup", "model": "preferred-model" }
  ]
}

The configuration schema is unchanged, but this behavior change is intentional.

Desktop and distribution

  • Desktop console URLs use the actual port and TLS scheme. A tray owns only the
    gateway it starts; exiting a tray attached to an existing gateway leaves that
    gateway alone. Linux without a StatusNotifierWatcher fails clearly rather
    than leaving an invisible resident process.
  • Linux archives ship a launcher and a matching private loader/libc plus shared
    runtime closure under lib/tray/. Keep the entire extracted directory.
    Runtime provenance, full license manifests and corresponding GNU/GLib source
    accompany distribution; shared components keep their own license terms.
  • Windows installers include the tray executable and icons. PATH edits follow
    the selected per-user/system installation and uninstall removes only entries
    it added. It does not kill arbitrary same-name programs, guess a shutdown port,
    or recursively erase untracked files in the application directory. Autostart
    initializes the COM apartment before creating shortcuts.
  • macOS bundles have numeric versions, assets/notices and a 14.0+ deployment
    minimum. Autostart addresses the bundle correctly and escapes XML paths.
    Ad-hoc or Developer ID signing alone is not notarization.
  • CI selects exact CLI targets, bounds smoke tests, and checks the web console.
    Release builds require passing core/CLI tests and desktop builds; a missing
    tray is no longer silently omitted. Vite/Vitest build-tool patches are updated.

Downloads and upgrade

Platform Desktop package
Linux x86-64 literouter-v0.5.1-linux-x86_64.tar.gz
macOS Apple Silicon, 14+ literouter-v0.5.1-macos-arm64-app.zip
Windows x86-64 literouter-v0.5.1-windows-x86_64-setup.exe

Standalone CLI files and per-file SHA-256 checksums remain available. Linux CLI
requires glibc 2.38+; Linux tray requires a StatusNotifierWatcher (for example
KDE or a compatible GNOME extension/panel). macOS Intel is not distributed.
The container image is built from the exact published Linux CLI.

Back up configuration, inspect any intentional redirect/model-fallback usage,
then switch versions in a maintenance window. This release does not update
or restart an already running installation. v0.5.0 assets remain historical.

Validation scope and limits

Local Linux checks cover the 15 core suites, CLI tests, 103 frontend tests,
isolated simulated requests, 21 real-browser console checks, clean-container
package execution, private D-Bus lifecycle tests, and selected sanitizer suites.
They are not live-provider benchmarks or a guarantee for every client extension.
The pre-release CI matrix
passed on Linux, macOS and Windows, including core/CLI tests, packaging helpers
and CLI first-run/dynamic-port/CRLF checks.
Platform CI exercises builds/tests and native packaging; visible desktop UI,
all installation scopes, and Gatekeeper approval still depend on the target
environment. See the packaging guide.

Matching-wire forwarding avoids protocol conversion, but routing/validation
still parses requests and streaming uses bounded queues. Costs are estimates
from configured prices and reported usage, not synchronized billing. Secret
references remain preserved on save; arbitrary text/custom headers and logs
are not covered by an absolute "zero-leak" promise.

中文升级摘要

  • 修复重定向凭据边界、端口 0 管理崩溃、坏配置重载、首次配置创建和费用/缓存状态恢复。
  • 模型目录不再隐式换模型；可接受的替代模型必须显式写入路由候选。依赖重定向的上游需改用最终地址。
  • 修复 Linux tray 运行库分发、Windows 安装器桌面产物与自启 COM、macOS 包版本/系统要求及自启路径。
  • Linux CLI 要求 glibc 2.38+，tray 保留整包并需要托盘面板；macOS Apple Silicon 要求 14+，签名不等于公证。
  • 原有配置 schema 不变，本版不会自动重启或升级正在运行的网关。升级前备份配置，并在维护窗口中切换。
Assets 26
Loading