Skip to content

OpenDia v1.1.4 - DXT settings fixed, slimmer DXT, security hardening

Latest
Latest

Choose a tag to compare

View all tags
@aaronjmars aaronjmars released this 03 Oct 14:53
v1.1.4
457246a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenDia v1.1.4: DXT settings fixed, slimmer DXT, security hardening

This release covers everything since v1.1.1 (v1.1.2 and v1.1.3 were published to npm without a release page). Full detail in the CHANGELOG.

Downloads

  • opendia.dxt - Claude Desktop extension (MCP server only, now about 0.7 MB)
  • opendia-chrome-1.1.1.zip - browser extension for Chrome / Chromium
  • opendia-firefox-1.1.1.zip - browser extension for Firefox
  • npm: npx opendia@1.1.4

Breaking

  • --tunnel now requires a bearer token. /sse is authenticated whenever the server is reachable beyond this machine (--tunnel, or a non-loopback --http-host=). A token is generated at startup, or pin one with --token= / OPENDIA_TOKEN. Tunnel clients must send Authorization: Bearer <token>. Local setups (npx opendia, Claude Desktop over stdio, the browser extension) are unaffected. (#55)
  • The prompts/* workflow surface is removed. It was never reachable from spec-compliant clients. Tools are unaffected.

Fixed

  • DXT settings now reach the server. WebSocket Port, HTTP Port and Auto-Tunnel in Claude Desktop used to do nothing. The server now reads OPENDIA_WS_PORT, OPENDIA_HTTP_PORT, OPENDIA_ENABLE_TUNNEL and OPENDIA_TOKEN (CLI flags still win). The DXT adds an optional Tunnel Auth Token setting and drops its Safety Mode setting, which had no effect (Safety Mode stays in the extension popup). (#85, #86)
  • Custom HTTP port in the extension popup, tried first during server discovery, so the extension finds a server on a non-default port. (#86)
  • Tools no longer report failures to the model as success (get_history, get_selected_text, page_navigate).
  • A dropped connection no longer runs tools anyway; connections fail loudly instead of timing out after the side effect.
  • The server advertises its real package version. (#82)
  • get_page_links treats subdomains as internal. (#83)

Security

  • The extension control channel and the HTTP/SSE surface bind to loopback; page origins are refused. (#53, #55)
  • Empty --token= / --http-host= values are a startup error instead of failing open.
  • Vulnerable dev-only transitive dependencies patched or overridden. (#43, #56, #64)

Changed

  • opendia.dxt no longer bundles the browser extension: 36 MB down to about 0.7 MB. Install the extension from the zips above. The DXT now uses Express 5, like npx opendia. (#87)
  • notifications/tools/list_changed is sent when the extension connects.
  • Grok Build harness and plugin. (#65)
Assets 5
Loading