📝 docs: explain resume request-failed cards
A background read can retry without a stack of cards. A failed save still shows one card.
📝 docs: troubleshoot GitHub OAuth unexpected iss
Explain the RFC 9207 callback rejection and that ChatHub pins issuer to https://github.com/login/oauth.
📝 docs(auth): clarify OAuth preflight fallback
📝 docs(auth): clarify OAuth guard establishment
Document that the callback guard is renewed after Auth.js creates the OAuth transaction, so preflight latency does not consume callback time.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(auth): document OAuth transition window
Clarify that background renewal remains paused for Auth.js's full callback lifetime and resumes only after callback, error, or stale-window completion.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(auth): document race-safe session renewal
Explain server-snapshot bootstrap, read-only account reconciliation, and serialized keep-alives that preserve sliding expiry without replacement-login races.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(auth): document cookie-neutral middleware
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(auth): explain read-only session reconciliation
Document identity-only polling and fresh-page bootstrap so operators understand why replacement sessions cannot be overwritten.
📝 docs(mobile): document hardened recovery boundaries
Explain non-destructive auth reconciliation and complete ownership gating for assistant creation and settings.
📝 docs(mobile): document final recovery safeguards
Explain account-bound session checks, synchronous Inbox cancellation, and guarded assistant creation during recovery.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(mobile): document review recovery behavior
Describe assistant bootstrap recovery, explicit Inbox cancellation, guarded settings, and bounded session polling.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(mobile): document hydration recovery
Explain mobile session resume, settings recovery, assistant selection, and Image Settings scrolling behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs(auth): clarify disabled OIDC behavior
Document that ENABLE_OIDC gates WebAPI token acceptance even when the signing JWKS remains configured.
📝 docs(auth): document WebAPI credential trust rules
Explain OIDC route authentication, server-owned OpenAI audio endpoints, and authenticated custom plugin proxy requests for protected deployments.
📝 docs(auth): document protected operational endpoints
Clarify authentication requirements for OpenAI audio, proxy, API Tester, and trace requests.
📝 docs(auth): document fail-closed WebAPI access
Clarify that configured sessions or bearer credentials are mandatory and always select the authoritative database owner.
📝 docs(auth): clarify trusted bearer identity
Document that API bearer identity comes from server configuration and that caller-supplied identity headers are ignored.
Co-authored-by: Cursor <cursoragent@cursor.com>
🔖 chore: rebrand wiki from LobeHub to ChatHub
- Rename all LobeHub references to ChatHub
- Update Docker image URLs to lqdflying/chathub
- Update GitHub repo/wiki URLs to lqdflying/chathub
- Reset version references from v4.x to v1.x
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs: add 5 missing wiki pages and link credentials login flow
- MCP-OAuth-2.1: auto-discovery, auth modes, providers, token refresh, 401 retry
- Docker-Deployment-and-Upgrades: full setup, env vars, volume mgmt, migration safety net
- Architecture-Overview: repo layout, store pattern, data flow, tRPC, CSS-in-JS
- Release-Workflow: canary/GA flow, tags, Docker build, gh release, branch cleanup
- MCP-Management: two-panel layout, MCP library, PluginDevModal key prop, OAuth UI
- Authentication: add link to credentials-login-flow.md mermaid diagram
Co-authored-by: Cursor <cursoragent@cursor.com>
📝 docs: initial wiki from README — 11 pages covering setup, auth, models, MCP OAuth, dev, release
Made-with: Cursor