v1.7.0
Fixed
formAJAX's loading indicator showed literal HTML ("<div class=..."), not a spinner — it passed raw markup toapp.messages.action, which HTML-escapes its message by design. Replaced with plain text.POST /api/user/(create) andPUT /api/user/passwordhad nomessagefield in their response, so the success notification rendered empty. Added messages matching every other route's convention.- The user landing on
/loginwith a?redirect=had no explanation why — happens whenever another app's "Log in with SSO" bounces an unauthenticated user through/oauth/authorize. Now shows a contextual banner explaining what's happening.
Changed
- Directory: tree view is now the only view (the list/tree toggle is gone) — simpler, one code path.
- Directory: clicking a resource's name opens its detail modal, not just the pencil/edit icon.
Found via a fresh production install's feedback — see the theta-env v1.13.0 release for the full cross-repo summary.