Merged
Conversation
…t and improve filename generation feat(api): enhance profile synchronization to allow media backfill for missing icons and thumbnails fix(ui): adjust mobile header and sidebar padding for safe area insets feat(ui): add remote execution support indicators in model cards and detail sheets style(ui): improve global CSS for iOS Tauri app compatibility and scroll containment refactor(oauth): streamline OAuth service to handle API proxying for web platforms and improve error handling
…APIs - Moved the "url" and "path" properties within their respective objects to improve clarity and structure in the desktop and macOS schemas. - Updated descriptions for "url" and "path" properties to maintain consistency. - Reintroduced the "ShellScopeEntryAllowedArgs" definition to ensure command argument validation is properly documented and structured.
… components - Changed sticky top positioning from var(--fl-safe-top) to 0 in PatManagementPage, layout, and runtime-vars page components for consistent behavior. - Adjusted padding in AppSidebar components to account for safe bottom variable.
- Updated AppSidebar to include safe area insets for mobile devices. - Modified getProfileBits method to include profile ID in the API call and handle cases where the profile ID is not available. - Added auth_method configuration to flow-like.config.json for better OAuth flexibility. - Implemented new route for retrieving profile bits in the API. - Enhanced OAuth token exchange to support both Basic JSON and Form POST methods based on provider configuration. - Introduced a new caching mechanism for profile bits retrieval to improve performance. - Updated UI components to handle new state management for bit selection and chat interfaces. - Improved styling and layout for mobile headers and sidebars to accommodate safe area insets. - Added support for Tauri in multiple Cargo.toml files across the project.
- Updated `write_cell.rs` and `write_cell_html.rs` to utilize a cached workbook approach for improved performance and reduced memory usage. - Implemented `flush_workbook` function to handle workbook saving more efficiently. - Enhanced `insert_db.rs` to support Arrow-based batch inserts from TDMS files, including new iterator structures for reading TDMS channel data. - Refined metadata handling in `metadata.rs` to align with the new TDMS library structure. - Added error handling improvements across ONNX nodes to provide clearer execution failure messages. - Introduced a safe conversion function in `markitdown.rs` to handle potential panics during document conversion. - Updated LanceDB integration to support record batch insertion, improving database interaction efficiency.
- Renamed Blog.css to blog.css for consistency. - Enhanced blog post layout with improved header and content sections. - Added responsive design adjustments for better viewing on various devices. - Updated structured data scripts to use inline attributes for better performance. - Improved accessibility by adding alt text to images. - Refined tag and RSS feed presentation for clarity and usability. - Fixed minor CSS issues to ensure consistent styling across blog components.
…ort across multiple components
…lt features feat: add loading state to TableView component in explore page feat: enhance package.json scripts for Android development chore: update @xyflow/react to version 12.10.0 across multiple packages chore: update blog post for new features and improvements fix: adjust Cargo.toml for various packages to use rustls variants fix: modify log aggregation state to include loading state management style: improve global CSS for safe area insets refactor: update IMAP and SMTP connections to use tokio-rustls
- Android App Setup - Fixed IOS App Save Spaces - Added Data Deletion Page on Website - Performance Improvements for Embedding, Chunking and Chat
…ot-working-with-old-already-existing-profiles Fix/493 profile sync on desktop not working with old already existing profiles
Updated README to reflect new features and changes.
| "Content-Type": file.type || "application/octet-stream", | ||
| }; | ||
|
|
||
| if (url.includes(".blob.core.windows.net")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, substring checks on URLs should be replaced with checks on parsed URL components, especially the host. For Azure Blob Storage, you want to confirm that the URL’s host is actually an Azure Blob endpoint (e.g., something.blob.core.windows.net), not that the string appears somewhere in the URL.
The best way to fix this instance without changing functionality is:
- Parse the URL with the standard
URLconstructor (available in browsers). - Extract the
hostname. - Check that the hostname ends with
.blob.core.windows.net(or equalsblob.core.windows.netif you want to include the root, though real blob hosts are usuallyaccount.blob.core.windows.net). - Optionally, ensure that there is a valid label before the suffix if you want to avoid accidental matches like
blob.core.windows.netwith no account name; but commonly anendsWithis enough.
Concretely, in apps/web/app/settings/profiles/page.tsx, within uploadToSignedUrl, replace the if (url.includes(".blob.core.windows.net")) block with logic that:
- Tries to construct
new URL(url), catching any error. - If parsing fails, do not set the Azure-specific header.
- If parsing succeeds, check
urlObj.hostname.endsWith(".blob.core.windows.net"). - Set
headers["x-ms-blob-type"] = "BlockBlob";only when the check passes.
No new external dependencies are required; the URL class is a standard Web API available in this client-side code.
Suggested changeset
1
apps/web/app/settings/profiles/page.tsx
| @@ -138,8 +138,13 @@ | ||
| "Content-Type": file.type || "application/octet-stream", | ||
| }; | ||
|
|
||
| if (url.includes(".blob.core.windows.net")) { | ||
| headers["x-ms-blob-type"] = "BlockBlob"; | ||
| try { | ||
| const parsedUrl = new URL(url); | ||
| if (parsedUrl.hostname.endsWith(".blob.core.windows.net")) { | ||
| headers["x-ms-blob-type"] = "BlockBlob"; | ||
| } | ||
| } catch { | ||
| // If the URL is invalid, fall through without setting Azure-specific headers. | ||
| } | ||
|
|
||
| const response = await fetch(url, { |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Summary of ChangesHello @felix-schultz, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly advances the project's cross-platform capabilities, particularly for mobile environments, by overhauling TLS dependencies and implementing platform-specific UI and deep-linking solutions. It also focuses on improving developer onboarding through updated documentation and refining the user interface with better loading states and chat interactions. Core engine improvements ensure more resilient data handling and expanded node functionality. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This is a substantial pull request that prepares for the v0.0.9 release, introducing significant improvements across the board. The migration from native-tls to rustls enhances security and cross-platform compatibility. There are major advancements in mobile support, particularly for iOS with robust handling of webview safe areas and deep linking, and the introduction of a full Android project. The developer documentation has been impressively rewritten for clarity. I've also noted several key reliability improvements, such as moving blocking operations to dedicated threads and adding better error handling for database operations on mobile. My review identifies a critical placeholder in the Android configuration that needs to be addressed, a potential breaking change in one of the nodes, and a couple of opportunities for code refinement.
Comment on lines
+1
to
+14
| [ | ||
| { | ||
| "relation": [ | ||
| "delegate_permission/common.handle_all_urls" | ||
| ], | ||
| "target": { | ||
| "namespace": "android_app", | ||
| "package_name": "com.flow-like.app", | ||
| "sha256_cert_fingerprints": [ | ||
| "REPLACE_WITH_RELEASE_CERT_SHA256_FINGERPRINT" | ||
| ] | ||
| } | ||
| } | ||
| ] |
There was a problem hiding this comment.
The sha256_cert_fingerprints contains a placeholder value. For Android App Links to function correctly in a production environment, this must be replaced with the actual SHA256 fingerprint of your release signing certificate. Without the correct fingerprint, the operating system will not be able to verify the association between your website and your Android app.
Comment on lines
+566
to
568
| let flat_results: Vec<DocumentPage> = all_results.into_iter().flatten().collect(); | ||
| context.set_pin_value("results", json!(flat_results)).await?; | ||
| context.activate_exec_pin("exec_out").await?; |
There was a problem hiding this comment.
This change flattens the list of document pages from Vec<Vec<DocumentPage>> to Vec<DocumentPage>. While this is a good improvement for usability, it represents a breaking change for the ExtractDocumentsNode. Any existing flows that use this node and expect a nested list structure for the results output pin will fail. Please ensure this change is clearly communicated in the release notes.
| ## 🔐 Security Issues | ||
|
|
||
| For sensitive security bugs, please **do not open a public issue**. Instead, report privately to \[[security@great-co.de](mailto:security@great-co.de)]. | ||
| For security vulnerabilities, please **do not open a public issue**. Report privately to [security@good-co.de](mailto:security@good-co.de). See [SECURITY.md](./SECURITY.md) for details. |
There was a problem hiding this comment.
There appears to be a typo in the security email address. The previous version used security@great-co.de, and this has been changed to security@good-co.de. Please verify and correct the email address to ensure security reports are routed correctly.
Comment on lines
+227
to
+241
| const isIosTauri = useMemo(() => { | ||
| if (typeof window === "undefined" || typeof navigator === "undefined") { | ||
| return false; | ||
| } | ||
|
|
||
| const isTauri = | ||
| "__TAURI__" in (window as any) || | ||
| "__TAURI_IPC__" in (window as any) || | ||
| "__TAURI_INTERNALS__" in (window as any); | ||
| const isIOS = | ||
| /iPad|iPhone|iPod/.test(navigator.userAgent) || | ||
| (navigator.platform === "MacIntel" && navigator.maxTouchPoints > 1); | ||
|
|
||
| return isTauri && isIOS; | ||
| }, []); |
There was a problem hiding this comment.
The logic to determine if the app is running in a Tauri environment on iOS is duplicated here and in apps/desktop/components/app-sidebar.tsx. To improve maintainability and avoid potential inconsistencies, consider extracting this logic into a shared custom hook, for example, useIsIosTauri().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements and fixes across the codebase, with a focus on enhancing the developer experience, improving mobile/iOS support, updating dependency configurations for better security and compatibility, and refining UI loading/error states. Notably, the
CONTRIBUTING.mdhas been rewritten for clarity and approachability, and several dependencies have been updated to preferrustlsovernative-tlsfor improved security and cross-platform support.Dependency and Security Updates
reqwest,lettre,sea-orm,sentry,markitdown, etc.) inCargo.tomlfiles across the project to userustls(a pure Rust TLS implementation) instead ofnative-tls, and disabled default features where appropriate for smaller, more secure builds. This also includes updating related features for packages likerig-coreandmarkitdown. [1] [2] [3] [4] [5] [6][profile.dev]and[profile.dev.package."*"]settings to optimize debug builds and reduce binary size, particularly for Android support.Developer Experience and Documentation
CONTRIBUTING.mdto provide a clearer, more actionable, and beginner-friendly guide. The new version includes a project structure overview, contribution areas, workflow steps, code guidelines for Rust and TypeScript, and improved instructions for bug reporting and feature suggestions.iOS/Tauri/Desktop App Enhancements
IOSWebviewHardeningcomponent and improved detection of iOS Tauri environments. Implemented right-edge swipe gesture support for opening the config menu on iOS desktop apps, and addeddata-desktop-app="true"attributes to the HTML/body for easier targeting. [1] [2] [3] [4] [5]UI/UX Improvements
TableViewLoadingStatecomponent, improved error messaging for table counts, and ensured loading indicators display appropriately while data is fetched. [1] [2] [3]These changes collectively improve security, cross-platform support, developer onboarding, and end-user experience.