v0.2.60

Downloads

Desktop App

Platform	Download	Size
Windows (x64)	CachiBot-Setup-0.2.60-win.exe	152.8 MB
macOS (Apple Silicon)	CachiBot-0.2.60-mac.dmg	212.8 MB
Linux (x64 AppImage)	CachiBot-0.2.60-linux.AppImage	205.2 MB
Linux (x64 .deb)	CachiBot-0.2.60-linux.deb	162.1 MB
Linux (x64 .rpm)	CachiBot-0.2.60-linux.rpm	172.8 MB

Python Package (pip)

pip install cachibot==0.2.60

---

Changes

Summary

This one's mostly about cleaning house. The WebSocket layer on the frontend was two files doing the exact same thing with different variable names — now there's one base class and two thin subclasses that actually make sense to read. On the backend, a bunch of .env read/write logic that was copy-pasted across routes got pulled into shared utilities, and the "does this record belong to this bot?" check that appeared in about 20 places is now a single function call. We also plugged a few real security gaps: CORS was wide open, some endpoints let you nuke the database without logging in, and search queries weren't escaping special characters. Oh, and every except: pass in the codebase now actually tells you what went wrong instead of silently pretending everything is fine.

Technical details

• Extract BaseWebSocketClient — shared connection lifecycle, reconnection with exponential backoff, event handlers. WebSocketClient and RoomWebSocketClient extend it. ~200 lines deleted.
• New api/env.py and api/env_utils.py replace duplicated .env helpers from providers.py and models.py
• require_bot_ownership() helper replaces ~20 inline if not record or record.bot_id != bot_id checks across six route files
• DELETE endpoints return 204 instead of {"status": "deleted"}; PUT endpoints get explicit response_model=dict
• Exception handlers stop leaking internals — f"Failed: {e}" replaced with generic messages + logger.exception() server-side
• CORS locked down from ["*"] to explicit method/header allowlists
• Legacy DB upgrade endpoints (/setup/upgrade/reset, /setup/upgrade/keep) now require auth when users exist
• _escape_like() prevents SQL injection via % and _ in LIKE queries (notes search, tag filtering)
• get_or_create_chat race condition fixed — creation moved inside the lookup session
• increment_run_count replaced read-then-write with atomic SQL expression
• syncPlatformChats guarded against concurrent calls for the same bot
• All bare except: pass blocks replaced with structured logging (exc_info=True)
• f-string log interpolation converted to lazy %s formatting
• Dialog component gets focus trap + ARIA attributes; mobile menu button gets aria-label
• useEffect missing dependency fix in ChatView ToolCallDisplay
• New Claude Code skills: code-review (8-agent parallel audit) and review-fix (plan + execute from review findings)
• _reconcile_schema DDL now quotes table/column names for reserved word safety

Details

• Version: v0.2.60
• PR: #61 by @jhd3197
• PR URL: #61