Add a packaged-client runtime boundary so the shared UI can talk to local,
desktop, remote, and VS Code runtimes through the right transport instead of
assuming one same-origin web server.
Centralize OpenChamber-owned API access behind RuntimeAPIs, runtimeFetch, and
runtime URL helpers, while keeping official OpenCode traffic on the SDK path.
Support runtime switching, remote host selection, desktop client credentials,
and headless connection links for pairing packaged clients with remote
OpenChamber servers.
Harden the new auth model by moving long-lived client tokens out of browser
URLs, introducing short-lived scoped URL tokens for browser-owned transports,
restricting URL-token access to explicit readable/realtime routes, and making
client-token management session-scoped or self-scoped as appropriate.
Update browser-owned assets and preview proxy flows to work with the split
runtime model, including authenticated project icons, preview token propagation,
CSP-safe preview bridge injection, and preview proxy auth that survives
short-lived URL-token expiry.
Tighten Electron security boundaries for packaged clients by gating privileged
preload state to trusted origins and requiring explicit confirmation before
connect deep-links import or switch remote runtimes.
Also refresh agent guidance and project skills so future runtime/API, auth,
preview, UI, CLI, settings, locale, and drag-to-reorder work follows the new
architecture.
Add launch-at-startup support across the Electron desktop app and the web CLI.
Electron now supports macOS launch-at-login through the native login item API. Login launches start OpenChamber in the background without opening a window, while Dock activation, deep links, and second-instance launches still open or focus the normal app window. The desktop Settings UI now exposes a localized launch-at-login toggle in Desktop Network Access.
The web CLI now includes `openchamber startup status|enable|disable`, backed by native user services:
- macOS: launchd LaunchAgent
- Linux: systemd --user service
- Windows: Task Scheduler
Startup services run `openchamber serve --foreground` so the OS service manager owns process lifetime and restarts. Foreground service updates now defer restarts to the service manager instead of spawning duplicate CLI restarts.
Startup services snapshot useful environment variables by default so provider tokens, PATH, SSH agent settings, and OpenCode configuration survive login/reboot starts. The snapshot avoids shell/session-only state, uses systemd-compatible env quoting on Linux, and avoids unused env artifacts on macOS.
Also adds localized docs for startup services and environment variables.
* docs: add OpenChamber feature docs and translations
Add 30 new docs pages covering OpenChamber-specific workflows and setup:
OpenCode server, providers/models/agents, MCP, skills, commands & snippets,
usage, projects, context, notes/todos/plans, scheduled tasks, project actions,
preview, worktrees, multi-run, git & GitHub, magic prompts, git identities,
mobile/PWA, security, notifications, voice, project icons, remote instances,
desktop browser, updates, and three troubleshooting pages.
Rebuild sidebar into eight task-oriented sections and translate every new
page into all six supported locales (uk, zh-cn, es, pt-br, ko, pl).
* docs: surface new sections on homepage and cross-link tunnels
Add an Explore block to the docs homepage (all seven locales) linking to
the new section anchors, and cross-link the Tunnels page to Security and
PWA & Mobile.
Add a Voice & Style section to the docs authoring guide, then bring every
docs page in line with it: lead with the task, add success signals to
procedures, explain jargon on first use, keep bullet casing consistent,
and link out to Troubleshooting where steps can fail.
Applied across English source and all localized versions (uk, zh-cn, es,
pt-br, ko, pl).
The compression middleware filter runs before route handlers, so the
res.getHeader('Content-Type') check in shouldSkipCompression is always
undefined at decision time. SSE exclusion relied entirely on the Accept
header, which non-standard clients (curl, fetch) may omit.
Add deterministic path-based exclusion for all known SSE routes so
compression is skipped regardless of client behavior. Also add a Caddy
reverse proxy example and a CDN double-compression warning to docs.
Add a new tunnels page with verified, up-to-date CLI examples
Remove deprecated `--daemon` usage and clarify QR/password behavior
Add docs validation tooling and docs-source workflow for packaging and sync
Bohdan Triapitsyn