Skip to content

v1.0.5

Choose a tag to compare

View all tags
@nisconder nisconder released this 13 Aug 14:27
· 23 commits to main since this release
v1.0.5
480d14b

@npm-safe v1.0.5

Patch release with LLM token-configuration improvements plus the P0 connection fix and the undici security upgrade.

LLM improvements

  • Default max response tokens raised to 4096 (was 2000) — long JSON security reports are no longer truncated mid-stream for complex packages.
  • Configurable token limits — new CLI commands:
    • npm-safe llm set-max-tokens <n> (default 4096)
    • npm-safe llm set-max-input-chars <n> (default 12000)
  • GUI settings — the desktop LLM tab now exposes Max response tokens and Max input characters fields (applied on Save and used by Test Connection).
  • Bounded request input — the package manifest sent to the model is now capped, so large packages no longer blow past the input budget.
  • Connection test fixed — the OpenAI test-connection request previously sent max_tokens: 3, which truncated the probe response and made connection tests fail even with a valid key. It now uses the configured maximum.

Critical fix (P0)

  • Desktop GUI "Test Connection" now applies your form config before testing — entering a key and clicking 测试连接 works without a prior Save click.

Security

  • undici upgraded to 8.x — addresses known HTTP request/response smuggling and queue-poisoning CVEs in the 7.x line.
  • Neutralinojs CLI pinned in the release workflow.

Install

npm install -g @npm-safe/core@1.0.5

Desktop GUI: download the v1.0.5 ZIP from the Releases page, or auto-update from an earlier install.

Links

Assets 5
Loading