@sriinnu/runic 2.13.1 → 2.13.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 2.13.4 — 2026-10-23
|
|
4
|
+
- Security: provider credentials stay on the endpoint they were meant for. Provider API, OAuth, browser-cookie and local-model requests no longer follow redirects, so a redirecting server can't carry your key or cookies to another host. A signed-out SiliconFlow or Ollama Cloud browser session is still recognized from the sign-in bounce and says so, and the MiniMax coding-plan page moved to `platform.minimax.io/console/plan`.
|
|
5
|
+
- Security: `runic otel-collect` listens on loopback only and prints a fresh bearer token at each start. OTLP exporters and `/events` clients must now send `Authorization: Bearer <token>`. Requests with a foreign Host or Origin, the wrong content type, or an oversized body are refused.
|
|
6
|
+
- Security: custom provider URLs must be HTTPS without a user name or password in them. The custom provider config, account diagnostics and the default telemetry ledger are readable by your user only.
|
|
7
|
+
- MCP plugins: newly discovered packages start disabled, and an enabled plugin gets only a small environment allowlist instead of your provider tokens. An enabled plugin is still a native program with your file and network access; only enable ones you trust.
|
|
8
|
+
- Team sync: encryption fails closed when its Keychain key can't be read or saved, instead of generating a replacement key.
|
|
9
|
+
|
|
10
|
+
## 2.13.3 — 2026-10-22
|
|
11
|
+
- Release: every build and every release tag is signed. `release.sh` signs the tag explicitly (`git tag --sign`) and verifies it before pushing, instead of relying on the global `tag.gpgSign` setting. Local packaging no longer falls back to ad-hoc or unsigned: `RUNIC_SIGNING=adhoc` and the lldb debug build sign with the "Runic Dev" cert, `build-macos.sh` and the screenshot script stop when no identity is found, and `package_app.sh` checks the finished bundle and rejects an ad-hoc seal.
|
|
12
|
+
- SiliconFlow (China): its "Balance from browser sign-in" switch never showed in the list layout of Settings → Providers, because the China account rows only rendered their key field. China-slot switches now render under the key field (Kimi, z.ai, MiniMax, Qwen and StepFun China gain any switches they define too). A China slot connected through the browser sign-in also counts as configured, so SiliconFlow (China) shows in the menu without a `.cn` API key.
|
|
13
|
+
|
|
14
|
+
## 2.13.2 — 2026-10-21
|
|
15
|
+
- SiliconFlow and Ollama Cloud: the browser sign-in never actually worked in 2.13.0/2.13.1. A background refresh is not allowed to show the "Chrome Safe Storage" Keychain dialog, so reading the browser's login failed silently every time and SiliconFlow fell back to "Key active". Both now have a switch in Settings → Providers ("Balance from browser sign-in" for SiliconFlow and SiliconFlow (China), "Usage from browser sign-in" for Ollama Cloud): turning it on reads your sign-in from the browser once (macOS may ask for your password), checks it works, and keeps a copy in Runic's own Keychain item, so refreshes never prompt. When the balance can't be read, the SiliconFlow key tile now says why ("No balance: …") instead of hiding it, and `diagnostics/siliconflow-console.json` records what was tried (never cookie values).
|
|
16
|
+
|
|
3
17
|
## 2.13.1 — 2026-10-21
|
|
4
18
|
- Settings → Providers has a search field: at the top of the sidebar in the sidebar layout, and in the Built-in providers header in the list layout. It matches the display name, CLI name and aliases (`sf`, `ollama-cloud`), ignores case and punctuation (`zai` finds z.ai), and `cn` / `china` finds the brands with a China account. ⌘F focuses it, Esc clears it; reordering is paused while a filter is on, so a drag never moves the wrong provider.
|
|
5
19
|
- opencode showed "not fetched yet / No usage yet": since early 2026 opencode writes messages to `~/.local/share/opencode/opencode.db` (SQLite) and the per-message JSON files Runic read stopped updating on January 1. Runic now reads the `message` table read-only (live WAL rows included) and still reads the old files for earlier history, counting a message present in both once.
|