* fix: use timing-safe comparison for CLI API token validation
Replace direct string comparison (===) with constant-time comparison
using crypto.timingSafeEqual to prevent timing attacks that could
leak information about the token character by character.
Affected locations:
- server/src/web/routes/auth.ts (accessToken validation)
- server/src/web/routes/cli.ts (bearer token middleware)
- server/src/socket/server.ts (socket.io /cli namespace auth)
* Update server/src/utils/crypto.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Consolidate process lifecycle management (kill, check alive) into a new
utility module with proper Windows/Unix handling, replacing scattered
process.kill() calls with consistent async APIs.
Add comprehensive support for handling reasoning blocks throughout the chat pipeline, including normalization, reconciliation, type definitions, and UI rendering. Implements collapsible reasoning group component with auto-expand during streaming and shimmer indicator.
- Add shared isBunCompiled() function for consistent runtime detection
- Support Windows virtual filesystem paths (/~BUN/) alongside Linux/macOS (/$bunfs/)
- Use Bun.main for reliable detection instead of process.argv[1]
- Remove redundant $bunfs checks from cli/src/index.ts
- Update cli/src/utils/bunRuntime.ts to use shared detection function
- Create server/src/utils/bunCompiled.ts for server-side compilation check
Migrate to Tailwind CSS v4 with new @tailwindcss/postcss plugin, upgrade xterm.js to v6, vite to v7, and other core dependencies for improved performance and compatibility.
Updates ModelContextProtocol SDK and multiple dependent libraries to latest versions. Refactors TypeScript schemas to avoid instantiation depth issues by widening Zod types and using explicit type parameters.
Removes dev dependencies no longer needed after migrating from tsx to bun as TypeScript runtime and removing linting toolchain. Moves workbox-window to web package dependencies where it's actually used.
Remove tsx dependency and update all dev scripts and documentation to use bun
as the primary TypeScript runtime for development. Consolidate process detection
logic in daemon.ts to check for dev mode via src/index.ts regardless of runtime.
- Add CLI-side terminal management via Bun.Terminal with TerminalManager
- Implement server-side Socket.IO proxy for terminal I/O between web and CLI
- Create web terminal UI component with xterm.js and support for resize/reconnect
- Add terminal route and navigation button in session chat
- Include comprehensive terminal implementation plan and architecture docs
Apply safe area insets to sticky/fixed headers (using top inset) and bottom-fixed elements (using bottom inset), rather than to scroll containers. This ensures proper spacing on devices with notches and home indicators (e.g., iPhone).
- Sessions List page: Move header outside scroll container with sticky positioning and pt-[env(safe-area-inset-top)]
- SessionList component: Add renderHeader prop to optionally hide internal header when parent renders it
- HappyComposer: Change bottom padding to pb-[calc(0.75rem+env(safe-area-inset-bottom))] for proper iPhone home indicator spacing
Adds support for hosting the web UI separately from the hapi server on static hosts (GitHub Pages, Cloudflare Pages). Users can now set a custom server origin via a dialog on the login screen, with the ability to return to same-origin behavior.
Changes include:
- New useServerUrl hook for managing server URL configuration and storage
- Updated API client to support baseUrl parameter for all requests
- Enhanced login UI with server picker dialog (top-right button)
- Auth system now keys tokens per baseUrl to support multiple servers
- SSE connection updated to use configured baseUrl
- Documentation updates for standalone hosting setup
- Add macOS quarantine fix instructions for prebuilt binaries
- Document Access Token location (~/.hapi/settings.json)
- Show how to view and set custom token
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
When CLI_API_TOKEN is provided via environment variable, persist it to settings.json
if not already saved. This prevents token regeneration if the env var fails to load
on subsequent startups, ensuring token consistency across server restarts.
Bun.isCompiled does not exist and always returns undefined, causing
embeddedAssetMap to be null. This makes the server fall back to looking
for web/dist directory, which doesn't exist when running the compiled
binary from a different location.
The correct way to detect a compiled Bun binary is to check if Bun.main
starts with '/$bunfs' (the virtual filesystem path used by compiled binaries).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Add hasBootstrappedRef to track component initialization and prevent
counting messages during the initial render. This fixes the new message
counter behavior when messages load on component mount and ensures
accurate message tracking when autoScroll is disabled.
Add comprehensive WHY_NOT_HAPPY.md documenting the architectural
differences between HAPI's local-first design and Happy's cloud-first
approach. Update README with clearer project description and link to
new documentation.
Add validation checks before releasing:
- Ensure we're on the main branch to prevent accidental releases from feature branches
- Verify npm authentication to prevent failed publish attempts
This prevents common release mistakes and improves release workflow reliability.
Configuration now loads with priority: environment variable > settings.json > default value.
When values are read from environment variables and not present in settings.json, they are automatically saved for future use. This eliminates the need to repeatedly set environment variables.
- New serverSettings.ts module handles loading/saving with persistence logic
- Async createConfiguration() factory for proper initialization ordering
- Configuration sources tracked and displayed in startup logs
- Exported Settings interface and read/write functions from cliApiToken.ts
- Updated index.ts to display configuration sources in log output
Consolidate version bumping, building, npm publishing, and git operations into a single release script that handles platform packages first. This solves the issue where optionalDependencies needed platform packages published before bun install could generate complete lockfile hashes.
Changes:
- Created cli/scripts/release-all.ts with support for --dry-run, --publish-npm, and --skip-build flags
- Removed release-it dependency and old release/publish-npm scripts
- Simplified GitHub Actions release workflow to always use --generate-notes
- Deleted obsolete release configuration files (.release-it.json, .release-it.notes.js, publish-npm.ts)
- Update CLI version to 0.1.0
- Change bin script extension from .js to .cjs for ES module compatibility
- Add release-it as dev dependency for version management
- Update all platform-specific binary package versions to 0.1.0
- Enhance release workflow to support custom RELEASE_NOTES.md
The package.json has "type": "module" but bin/hapi.js uses CommonJS
require() syntax. Renaming to .cjs forces Node.js to treat it as
CommonJS regardless of the package type setting.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update CI workflow to package release artifacts with correct naming (hapi-* prefix)
- Generate SHA256 checksums for all artifacts
- Auto-update homebrew-tap repository on release
- Add Installation section to README with Homebrew, npm, and binary options
- Simplify .release-it.json config as CI now handles release process
- Add update-homebrew-formula script to update formula in homebrew-tap
- Add release-artifacts directory to .gitignore
Users can now install via: brew install tiann/tap/hapi
Update documentation to promote npm package usage over binary downloads:
- Changed primary quickstart command to use npx @twsxtd/hapi
- Moved binary download to alternative option with link to releases
- Updated Multi-agent support section to use npx commands
- Simplified Quickstart section title
- Adjusted step numbering to reflect changes
- Add publish-npm and publish-npm:dry-run scripts to root package.json (forwarding to cli)
- Remove Windows ARM64 (bun-windows-arm64) from DEFAULT_TARGETS in build-executable.ts
- Remove Windows ARM64 check from getPlatformDir in build-executable.ts
- Remove HAPI_TARGET_WIN32_ARM64 from bunBundle.d.ts type definitions
- Remove Windows ARM64 check from embeddedAssets.bun.ts
- Centered button using mx-auto w-fit wrapper (matches SystemMessage pattern)
- Changed variant from secondary to outline for subtler appearance
- Reduced visual weight with text-xs opacity-80 hover:opacity-100
- Added ↑ arrow icon before the text
- Adjusted spacing to py-1 mb-2 and gap-1.5
Fixes alignment issues where button wasn't centered with content below and improves visual consistency with page design.
weishu