Every download in the dashboard fetches the file with the JWT, wraps it
in a `blob:` URL and clicks an `<a download>`. WeChat and similar chat-app
WebViews (WeCom, QQ, DingTalk, Feishu, Weibo, Alipay) refuse to save
`blob:` downloads and only say "可在浏览器打开此网页来下载文件", while the
system browser they point to has no Octop session for the API URL.
In those WebViews `saveBlobAsFile` now hands the bytes it already
fetched to `POST /api/downloads/link`, which keeps them in a temp file
behind a random token for 10 minutes, and shows the link with a copy
button. `GET /api/downloads/link/{token}` serves the file as an
attachment without login; the token is the only credential. Uploads are
capped at `max_upload_mb`, links of disabled users stop working, and
expired files are removed on the next create/get. Normal browsers and
the desktop shell are unchanged.
Improve team streaming visibility (live speakers, generating footer, IM
dispatch/wrap-up), relax ACP tool enable under sandbox while locking
runners, strip channel think tags per show_thinking, and clarify provider
CLI usage in the assistant skill. Includes self-update/UpdateConfig WIP
from the same working tree.
Co-authored-by: Cursor <cursoragent@cursor.com>
Apply the remaining working-tree changes: connectors empty-state layout,
plus the knowledge, HITL, captcha, workspace, user-cache, and SSRF
adjustments with matching tests.
Co-authored-by: Cursor <cursoragent@cursor.com>
Dictate with live partial results: the composer mic streams 16 kHz PCM over a
WebSocket to Octop, which signs and proxies the audio to Tencent's realtime ASR
V2 endpoint. Credentials never leave the server; the browser only learns a
`stt_realtime` boolean from `/api/voice/active`.
- settings: add a "realtime speech recognition" switch plus an AppID field to
the Tencent Cloud voice drawer. Both live in `voice_providers.extra_json`, so
no schema migration is needed.
- interaction: with realtime on, the mic becomes press-and-hold (start on
pointerdown, finish on release/leave/cancel) and stays available while a reply
is streaming, so dictation can be queued. With the switch off the previous
click-to-record one-shot upload path is unchanged.
- protocol: realtime ASR V2 answers with `result` (`slice_type`, `index`,
`voice_text_str`) while the docs describe `sentences`; both are normalized in
`infra/voice/realtime.py`.
- errors: new `VOICE_REALTIME_UNAVAILABLE` code plus localized copy for the
Tencent realtime error codes (4002-4009, 5000-5002).
Verified end-to-end against Tencent with real speech (edge-tts -> 16 kHz PCM
over the live WebSocket) and by `make all`.
_find_frontmatter() searched for the closing --> starting after the first
newline of the comment line, so a comment that closes on its own line
(<!-- agent-params -->) was reported as unterminated and the scan
returned None. parse_frontmatter() then treated the whole file as body
and is_agent_file() returned False, although the docstring promises
leading HTML comments are skipped. Search from the line start instead.
normalize_nav_url() prefixed any value without a "://" with "https://",
so a protocol-relative URL such as //baidu.com (the form pages expose when
you copy a link from source) became https:////baidu.com with an empty host.
Bare hosts keep the existing behaviour; a leading "//" now maps to
https://host/path.
Consolidate unreleased develop migrations 005–009 into one v5 file with
ensure/clamp paths for pre-squash local DBs; add HITL catalog picker,
shared runtime package install for ONNX/desktop, and short-id list UX for
knowledge bases and skill packages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add missing POST /api/search/{id}/test so Advanced Search key checks work,
fix Ant Design pageSize changers stuck at 10, clarify the new-chat icon,
slide-renew JWT for active sessions, tighten chat polish prompts, and harden
install.sh for python-dev / Playwright mirrors.
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: harden remote desktop setup on macOS and Linux
Show macOS TCC permission guidance when deps are ready but capture is blocked, and treat incomplete Linux installs (missing systemd units) as needs_install so install is retried instead of a broken start-only path.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: pin desktop icon size and prefer bundled wallpaper
Set xfdesktop icon-size to 48 so Ubuntu hosts match Docker defaults, and install the local wallpaper.png before falling back to remote download.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: force larger xfdesktop icons and clear stale xfce config
Bump default desktop icon-size to 72, apply it via a dedicated post-start script with verification/reload, and remove leftover xfce4 desktop config on uninstall/reinstall so Ubuntu hosts no longer keep tiny icons.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: fix tiny desktop icons via VNC DPI and icon themes
Headless TigerVNC without -dpi makes fonts and labels look normal while xfdesktop icons stay as fixed tiny pixels. Install Adwaita icons (skipped by --no-install-recommends), force -dpi 96, and hard-restart xfdesktop after applying size/theme.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: install SVG icon loader and materialize desktop launcher PNGs
Tiny desktop icons on Ubuntu came from missing librsvg2-common (Adwaita SVGs) plus xfconf applied without the session D-Bus. Install the pixbuf SVG loader, write static xsettings, render launcher icons to PNGs, and log apply-icon-size failures.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: restore normal desktop icons/panel and clarify terminal WS logs
Revert oversized letter-tile icon fallbacks to 48px theme icons, seed a default xfce4-panel with Applications menu, and add terminal websocket accept/close logging plus tolerant agent-id resolution.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: stabilize web terminal and polish remote desktop chrome
Fix macOS PTY spawn (setsid None), harden terminal reconnect/error handling,
move the XFCE start button to a top panel with the Octop logo, and replace
full-height edge rails with corner controls that no longer block desktop edges.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: put start menu on bottom panel and open appfinder for menu shortcut
Restore the XFCE panel to the bottom edge, bind Super/Alt-F1 to xfce4-appfinder
in openbox, and make the remote-desktop「开始菜单」action spawn appfinder
instead of relying on an unbound Alt+F1 chord.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: keep XFCE start button across desktop service restarts
Hard-reset xfconfd when seeding the panel so in-memory channel state cannot
override our launcher XML, keep a canonical panel layout under /opt, and stop
apply-icon-size from re-entering ensure-panel (which raced and dropped the
start button after restarts).
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor: trim remote-desktop dead weight without dropping fixes
Drop unused whiskermenu packaging and duplicate panel reseeds, narrow D-Bus
env parsing to session bus keys, prefer a single appfinder spawn for the menu
shortcut, and demote terminal happy-path logs back to info.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: ship Octop wallpaper.png as the default virtual desktop backdrop
Use the packaged asset next to install.sh (no COS download by default), avoid
center-cropping the lower-right brand mark, and keep a copy under /opt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: ship Octop wallpaper.png as the default virtual desktop backdrop
Use the packaged asset next to install.sh (no COS download by default), avoid
center-cropping the lower-right brand mark, and keep a copy under /opt.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: align remote browser with desktop HUD and safer Chromium lifecycle
Detect system Chrome/Chromium via find_chrome for env readiness and launch,
fall back to Playwright install when missing, and uninstall only Playwright
Chromium. Match StreamEdgeControls hover HUD and install/uninstall viewport
layout with remote desktop; clear stale profile locks before attach.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: make remote browser launch writable and show on virtual desktop
Force a private XDG_RUNTIME_DIR, recreate non-writable harness profiles,
and inject DISPLAY=:99 when Xvnc is up so Chrome starts headed on the
remote desktop instead of failing with ProcessSingleton exit 21.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: persist setup wizard UI locale on initial admin
Create the first admin with the wizard's current language (or
Accept-Language) instead of hard-coding zh, so Finish/login no longer
silently switches English browsers to Chinese after setup.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(ui): narrow stream HUD hover hotzone to HUD width
Only the centered top strip (~320px) captures hover so left/right
stream content stays click-through. Also reformat remote desktop and
terminal control pages.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(remote-browser): persist stream open/closed across page visits
Remember whether the user left the stream running, and only auto-
reconnect on enter when it was open (or deep-linked via ?thread=).
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(browser): relocate root profiles and bump harness-browser 0.7.4
Host agents can allow Python writes under /root but deny Chrome
SingletonLock creation. Proactively use /tmp profiles, pin
ProfileManager to the resolved base dir, require harness-browser
0.7.4 for launch-time XDG/env injection, and refresh the lockfile.
Co-authored-by: Cursor <cursoragent@cursor.com>
* style: format browser setup unit test for ruff
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): rename browser setup tests to avoid basename clash
pytest cannot collect both unit/browser/test_setup.py and
unit/desktop/test_setup.py under the same module name.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(typecheck): use posix_compat.chown for Windows mypy
os.chown is unavailable on Windows stubs; route ownership fixes through
the shared posix_compat helper like the rest of infra.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): expect catalog label for bootstrapped main agent
Setup now uses the general-assistant manifest name (小通 · 通用助手)
instead of a hard-coded 通用助手 string.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: honor macOS /private and tempfile paths in host guards
/etc resolves to /private/etc on macOS, so strip that prefix before
denied-prefix checks. Allow media previews from tempfile.gettempdir()
(/var/folders/…) in addition to /tmp.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(test): make browser binary verify fixture work on Windows
The fake Chrome was a shebang shell script, which Windows cannot
execute. Use a .bat stub on nt so --version verification succeeds.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: jubaoliang <jubaoliang@tencent.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
