Skip to content

ChatWalaʻau v0.104.0

Choose a tag to compare

View all tags
@motojinc25 motojinc25 released this 11 Jul 15:19
v0.104.0
c786593

This release adds three improvements to ChatWalaʻau: 「Durable sign-in sessions, non-destructive re-authentication, and never losing a message you typed」.

Highlights

Durable sign-in sessions (v0.104.0)

  • Restarting the backend -- a deploy, a crash, a dev-server relaunch -- no longer sends every browser back to the login page. Signing in now survives a process restart.
  • Only the SHA-256 digest of each session token is written to disk (AUTH_SESSION_STORE_PATH, default .auth/session_tokens.json). The token itself is never stored, so a leaked store file cannot be replayed as a cookie and there is nothing in it to encrypt. The file is written atomically, is 0600 on POSIX, and is git-ignored.
  • Sessions still expire on AUTH_SESSION_TTL_SECONDS and are still revoked on sign-out. Nothing is read or written when browser sign-in is not configured (AUTH_USERNAME unset).
  • Breaking behavior: restarting the process is no longer a "sign everyone out" lever. Use one of: delete the store file, rotate AUTH_PASSWORD_HASH (a credential fingerprint invalidates every persisted session), or set AUTH_SESSION_PERSIST=false to restore the previous behavior byte-for-byte.

Re-authentication that does not throw away your work (v0.104.0)

  • When a session does expire, the app opens a sign-in dialog over your intact chat instead of reloading to the login page. Your typed message, attachments, model selection, and conversation are all still there; sign in and carry on exactly where you were.
  • Breaking behavior: a 401 received after you have signed in no longer navigates to /login. First-load sign-in, explicit sign-out, and the API-key-only lane are unchanged.
  • After signing in again, requests that change data are never replayed automatically -- a request the server had already accepted would otherwise run twice.

Nothing you typed is lost (v0.104.0)

  • Previously, pressing Send while the backend was down emptied the input box before any error appeared, so the text was gone with no chance to copy it. Now the message is returned to the input box (never overwriting anything you typed in the meantime), and the failed turn shows an inline "could not reach the server" error with a Retry button. Retrying is safe: the message never reached the agent, so it cannot run twice.
  • This applies in every mode, including plain localhost development with no authentication configured.
  • A brief "Connection recovered" notice appears once the server answers again. There is deliberately no "server is down" banner or heartbeat: liveness guessed from a socket produces false alarms (laptop sleep, Wi-Fi roaming, proxy idle timeouts), so connectivity is reported by the request that actually failed, at the moment it fails.

Included in this release

This release includes implementation work from:

  • v0.104.0 through v0.104.0

Notes

  • Internal design management content and architecture control artifacts are intentionally omitted from this release note.

Installation

See the repository README for setup and usage instructions.

Version

  • Release version: 0.104.0
  • Previous release: 0.103.0
Assets 2
Loading