After the API bridge moved to `net.fetch`, several main-process requests still used
Node's `fetch`, which ignores the app's proxy settings: the update manifest and policy,
the main-process API client, file downloads, text-to-speech, page fetching for the
reader, and the Eagle, qBittorrent and custom integration requests. They now go through
`net.fetch` as well. The readability package takes a `fetch` implementation for that;
downloads hand it to ky. Requests that manage cookies by hand pass
`credentials: "omit"`, so Chromium does not keep them too.
A failed CLI login sync used to be logged with the whole command line, token included.
The command is now described with the token redacted, and the command's output is
scrubbed the same way.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The main process sent the renderer's API requests with Node's `fetch`, which knows
nothing about the app's proxy settings: with only a system proxy configured, every API
request went out directly while images and pages went through the proxy. On networks
that need the proxy the API was unreachable.
`net.fetch` uses Chromium's network stack and therefore the session's proxy: the system
proxy, PAC files and SOCKS alike. Cookies stay attached by hand from the managed auth
cookies, so Chromium's own cookie handling is switched off for these requests. Verified
in a real main process: the proxy is resolved and used, a manual `Cookie` header is sent,
`Set-Cookie` is exposed through `getSetCookie()`, and `credentials: "omit"` leaves the
cookie store untouched.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
One request failing without a response proved little: an endpoint may be slow or
briefly broken while the API itself is fine, and the prompt appeared on every such
hiccup.
- a failed request now only schedules a probe, a cheap `/status/configs` request two
seconds later, repeated once; the API counts as unreachable when every probe fails
and no other request got an answer in the meantime
- while unreachable the probe repeats every fifteen seconds so the prompt goes as soon
as the API answers; any ordinary answer lifts it as well
- the desktop probe travels the same path as its requests, through the main process;
the mobile probe uses the app's fetch
- without a probe, three failures in a row are needed instead of one
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The staging desktop build showed "Unable to connect to the server" and a timeline that
never caught up.
- the main process hands API responses over as text, so a `204` such as the analytics
endpoint's arrived as an empty string; `Response` refuses a body for those statuses,
the throw looked like a failed connection, and the new prompt reported it
- a desktop window keeps its visibility when the user switches apps, so the sync engine
never saw a "return"; window focus now counts as one, and duplicate signals within a
few seconds share one pull
- views that received new entries during background pulls are remembered and their
lists brought up to date on the next return, even when that pull finds nothing new
- oldest-first lists receive new entries at their end: the empty page that marked the
end is dropped and the page after the last entry is requested again
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A launch of the web app made twelve API requests. Half of them fetched data the
sync engine can keep current, or fetched the same thing more than once.
- session: start-up fetches it through the query cache and `useSession` reuses
it for a minute, instead of three separate requests
- action rules and settings become sync models: they are loaded in full once per
account, stored locally, and afterwards follow the change log; unsaved rule
edits and queued setting changes are never replaced
- sync models outside the engine register through `sync/model-registry`, with a
one-time bootstrap and an apply step; a model whose actions went by unhandled
is bootstrapped again
- wallet: requested when the profile menu opens, which is the only place that
uses the answer
- web push: the token is registered again only when it changed or the change
log shows another browser took over the channel
- the new-user guide remembers accounts that already have settings, so the
entry list no longer requests `/settings`
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Requests that fail without any response (DNS failure, refused or reset
connection, offline device, timeout) previously failed silently. Track
them through the SDK interceptors and surface a single prompt per outage:
a persistent toast on desktop that is dismissed once the API answers
again, and a transient toast on mobile.
The connection state lives in an atom because the first requests can fail
before the toaster is mounted.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The sync engine added an incremental channel, but the app kept fetching full
snapshots next to it: both prefetch hooks, a recount after every pull, every
loaded page of the entry lists, and whole-list refetches after unsubscribing or
importing.
- unread counters keep confirmed counts under the local transactions; the change
log moves them by the flips and new unread rows the server reports, and an
acknowledged transaction drops its prediction once the engine reached its
sync id
- usePrefetchSubscription, usePrefetchUnread, pull to refresh, the refresh
button, OPML import, unsubscribe and the mobile background task go through the
engine and only fall back to the full requests when it cannot help
- snapshots remain as calibration: unread hourly, subscriptions daily, plus a
throttled recount when the list on screen disagrees after a delta pull
- new entries fetch only the first page of the lists on screen and merge it in
front of the loaded pages; a refresh trims the infinite query to one page
- mobile refreshes subscriptions through the delta feed after an OPML import
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Show a preferences button next to the login button when logged out, so
guests can open the settings modal without signing in. The modal already
supports guest mode and gates account-bound tabs behind login.
Also fix KbdCombined splitting the comma key in shortcuts like "$mod+,"
as if it were a separator between multiple shortcuts.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Follow up on the sync engine:
- Transaction kinds report the `lastSyncId` their mutation returned. The
queue releases an acknowledged transaction's overlays as soon as the sync
engine has applied that id, instead of always waiting out the 30 s window,
which stays as the upper bound for servers without sync ids.
- The engine applies the new `list`, `inbox` and `inbox_entry` actions and
inbox `N` hints, so list edits, inbox changes and new mail made elsewhere
show up without a full refetch.
- While the engine is active the unread mismatch heuristic stands down and
the desktop blanket invalidation skips the queries the delta feed already
keeps fresh. Both remain as the fallback for servers without `/sync`.
Also fix the Android build: `setup-android` installs the obsolete `tools`
package by default, which the SDK repository no longer serves.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Bump `@follow-app/client-sdk` to 0.3.96 (and `@folo-services/drizzle` to
0.1.48) and hand `followApi.sync` to the store instead of requesting the
`/sync` endpoints through `followClient.request`.
The new SDK no longer declares the frozen wallet and RSS3 writes. Keep the
existing screens and their runtime behaviour unchanged through a small
compatibility module: legacy withdraw fields and the `IS_RSS3_TESTNET`
flag get local types, and the removed `wallets.post()` is requested at the
same path with `followClient.request`. Drop an over-wide tuple annotation
in the mobile plan screen now that `PaymentFeature` keys are precise.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add `sync/sync-engine.ts`, which keeps the last applied sync id in a new
`sync_meta` SQLite table (migration 0039), bootstraps from `/sync/state`
plus the existing snapshot endpoints, and then pages through `/sync/delta`
on launch, foreground, reconnect, a 60 s interval and after the transaction
queue receives an acknowledgement. Subscription, collection and timeline
actions are applied to the stores and SQLite, pending local marks keep
precedence through the transaction queue overlays, and unread counts are
refreshed once per pull. A 404 from the sync endpoints keeps today's full
refetch behaviour for the session.
Both apps expose the endpoints through `followClient.request` until the
client SDK release with the `sync` module lands.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
On Linux, `Tray.destroy()` does not remove the icon from StatusNotifierItem
hosts (waybar, KDE Plasma), so toggling "Minimize to tray" off and on stacked a
dead icon every time. Keep the single Tray instance for the app's lifetime
instead; the window close handler reads `getTrayConfig()` live, so a tray icon
that outlives a disabled setting is inert.
The icon cannot be removed from a running process, so `setTrayConfig` reports
when a restart is needed and the renderer offers one via a new `app.relaunch`
IPC. That relaunch runs from `$APPIMAGE` where set (AppImage's `execPath` points
into a mount that is gone by then), drops `--start-in-tray` so it never comes
back hidden, and uses `app.quit()` so `before-quit` still persists the window
bounds and flushes cookies.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
