Release v1.0.5 by kylethedeveloper · Pull Request #6 · kylethedeveloper/OratioText

kylethedeveloper · 2026-04-12T14:53:17Z

What's Changed

Added option to manage and delete downloaded models in Settings
Added screenshots section and status badges to README.md

Copilot

Pull request overview

Releases v1.0.5 by adding a Settings UI to view/delete downloaded Whisper models, updating documentation visuals/badges, and bumping application version metadata.

Changes:

Added “Downloaded Models” manager in Settings (list, total size, delete flow).
Extended backend model listing to include on-disk file size and added a delete-model command.
Updated README with badges/screenshots and bumped versions to 1.0.5.

Reviewed changes

Copilot reviewed 9 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
TODO.md	Marks Linux build and downloaded-model management as completed.
src/styles.css	Adds styling for the Downloaded Models manager UI and delete confirmation state.
src/main.js	Implements rendering of downloaded models, size aggregation, and delete/confirm UI flow.
src/index.html	Adds the “Downloaded Models” section to the Settings page.
src-tauri/tauri.conf.json	Bumps app version to 1.0.5.
src-tauri/src/model_manager.rs	Adds delete-model and file-size lookup support in the model manager.
src-tauri/src/lib.rs	Exposes file size in `list_models` and adds the `delete_model` Tauri command.
src-tauri/Cargo.toml	Bumps crate version to 1.0.5.
src-tauri/Cargo.lock	Updates locked package version for `oratiotext`.
README.md	Adds release/license/platform/Tauri badges and a screenshots section.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-12T14:56:27Z

+    pub fn delete_model(&self, model_name: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        let path = self.models_dir.join(Self::model_filename(model_name));
+        if path.exists() {
+            std::fs::remove_file(&path)?;


delete_model builds a path from the unvalidated model_name via model_filename(). If a caller passes a name containing path separators (e.g. "../../..."), this can escape models_dir and delete arbitrary files. Restrict model_name to an allowlist of known model IDs (tiny/base/...) or reject names containing /, \\, or .. before joining/removing the file; consider also verifying the resolved path is under models_dir after canonicalization.

@copilot apply changes based on this feedback

Fixed in commit 9a941f3. The changes in src-tauri/src/model_manager.rs:

Added a VALID_MODEL_NAMES allowlist constant (tiny, base, small, medium, turbo, large).

Added a validate_model_name() helper that returns an error for any name not in the allowlist — called at the top of delete_model.

Canonicalize models_dir once at construction time in ModelManager::new() so the stored path is always resolved.

After joining, canonicalize() the target file path and verify it starts_with(&self.models_dir) before removing — blocking any symlink-based or residual traversal attempts.

Copilot · 2026-04-12T14:56:28Z

+    // Auto-reset after 3 s
+    setTimeout(() => {
+      if (deleteBtn.dataset.confirming === "true") {
+        deleteBtn.dataset.confirming = "false";
+        deleteBtn.textContent = "Delete";
+        deleteBtn.classList.remove("btn-danger-confirm");
+      }
+    }, 10000);


The comment says "Auto-reset after 3 s" but the timeout is set to 10,000 ms. Update the comment or the timeout value so they match.

@copilot apply changes based on this feedback. Update the comment.

Updated the comment from "Auto-reset after 3 s" to "Auto-reset after 10 s" to match the actual 10,000 ms timeout (commit 5be1202).

Copilot · 2026-04-12T14:56:28Z

+.model-delete-btn:hover:not(:disabled) {
+  opacity: 0.65;
+}
+


.model-delete-btn:hover:not(:disabled) sets opacity: 0.65, which is identical to the base .model-delete-btn opacity. Unless this is intentionally overriding a more specific rule elsewhere, the hover selector is redundant and can be removed (or changed to a different hover opacity if a visual cue is intended).

Suggested change

.model-delete-btn:hover:not(:disabled) {

opacity: 0.65;

}

Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/3874db65-2474-4f8d-b6a0-a9298358cb03 Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…calization Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/e301a6f4-adfa-4e78-9e51-80ff57268bfe Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 13 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-13T02:06:15Z

+    /// Returns an error if `model_name` is not in the allowlist of known model IDs.
+    fn validate_model_name(model_name: &str) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        if VALID_MODEL_NAMES.contains(&model_name) {
+            Ok(())
+        } else {
+            Err(format!("Unknown model '{}'", model_name).into())
+        }
+    }


validate_model_name() is only used by delete_model, but other model_name entry points (e.g., download_model, get_model_path, is_model_downloaded, get_model_file_size) still accept arbitrary strings and build paths/URLs via model_filename(). Because model_filename() does not sanitize separators/.., a compromised frontend could potentially trigger path traversal or read/write outside models_dir. Consider enforcing the allowlist for all public methods that accept model_name (either by validating at the start of each method, or by making model_filename() return a Result and requiring validation before constructing paths).

Copilot · 2026-04-13T02:06:15Z

+            <button id="open-models-dir-btn" class="btn btn-secondary btn-sm" style="padding: 2px 6px; display: flex; align-items: center; justify-content: center;" title="Open models directory in file manager">
+              <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon icon-tabler icons-tabler-outline icon-tabler-folder-open">
+                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                <path d="M5 19l2.757 -7.351a1 1 0 0 1 .936 -.649h12.307a1 1 0 0 1 .986 1.164l-.996 5.211a2 2 0 0 1 -1.964 1.625h-14.026a2 2 0 0 1 -2 -2v-11a2 2 0 0 1 2 -2h4l2 2h5a2 2 0 0 1 2 2v1" />
+              </svg>
+            </button>
+          </div>


The “open models directory” icon-only button relies on title, which is not a reliable accessible name for screen readers. Add an explicit accessible label (e.g., aria-label="Open models directory") and ensure it remains meaningful without the SVG.

@copilot apply changes based on this feedback

Added aria-label="Open models directory in file manager" to the button in commit 10ca1de. The button now has an explicit accessible name independent of the SVG icon, matching the existing title text.

Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/d48c3f10-a893-48c7-9fed-cd9d17ac2229 Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

kylethedeveloper added 2 commits April 12, 2026 10:32

docs: add screenshots to README.md

a4d300e

feat: add model management to settings page

0fb3671

kylethedeveloper requested a review from Copilot April 12, 2026 14:53

kylethedeveloper added the release New Release label Apr 12, 2026

Copilot started reviewing on behalf of kylethedeveloper April 12, 2026 14:53 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

Copilot started work on behalf of kylethedeveloper April 12, 2026 15:01 View session

fix: update auto-reset comment to match 10s timeout

5be1202

Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/3874db65-2474-4f8d-b6a0-a9298358cb03 Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

Copilot finished work on behalf of kylethedeveloper April 12, 2026 15:03

Update src/main.js

0b874b7

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of kylethedeveloper April 12, 2026 15:05 View session

fix: prevent path traversal in delete_model with allowlist and canoni…

9a941f3

…calization Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/e301a6f4-adfa-4e78-9e51-80ff57268bfe Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

Copilot finished work on behalf of kylethedeveloper April 12, 2026 15:12

feat: add button to open models directory in file manager

a0aa744

kylethedeveloper requested a review from Copilot April 13, 2026 02:02

Copilot started reviewing on behalf of kylethedeveloper April 13, 2026 02:02 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Copilot started work on behalf of kylethedeveloper April 13, 2026 02:07 View session

Copilot AI and others added 2 commits April 13, 2026 02:08

fix: add aria-label to open models directory button for accessibility

10ca1de

Agent-Logs-Url: https://github.com/kylethedeveloper/OratioText/sessions/d48c3f10-a893-48c7-9fed-cd9d17ac2229 Co-authored-by: kylethedeveloper <8023096+kylethedeveloper@users.noreply.github.com>

fix: model deletion errorText content change

8d3a9e3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot finished work on behalf of kylethedeveloper April 13, 2026 02:09

kylethedeveloper merged commit 3171d8f into master Apr 13, 2026
0 of 4 checks passed

Conversation

kylethedeveloper commented Apr 12, 2026

What's Changed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

kylethedeveloper Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

kylethedeveloper Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

kylethedeveloper Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants