v0.11.34

Added

• 🌐 Path-based file serving — new GET /files/serve/{path} endpoint enables HTML files loaded in iframes to resolve relative CSS, JS, and image references to sibling files. Used by Open WebUI's FileNav to render multi-file websites.

v0.11.33

Fixed

• grep_search now defaults to regex mode, matching actual grep behaviour. Patterns like foo|bar and err.*timeout work as expected without needing to set regex=true explicitly.

v0.11.32

Changed

• 🗂️ Session-aware relative path resolution — all LLM-exposed file endpoints (list_files, read_file, write_file, display_file, replace_file_content, grep_search, glob_search) now read the X-Session-Id header and resolve relative paths (e.g. .) against the session's working directory instead of always defaulting to fs.home. Added an optional cwd parameter to UserFS.resolve_path() to support this. Absolute paths are unaffected.

v0.11.31

Changed

• 🗂️ Per-session working directory — replaced the process-global os.chdir() with an in-memory, session-aware dictionary keyed by X-Session-Id header. Multiple concurrent chat sessions now maintain independent working directories. GET/POST /files/cwd, POST /execute, and POST /api/terminals all read the header to resolve the correct cwd. Sessions without a header fall back to fs.home. Entries expire after 7 days of inactivity (sliding TTL), configurable via OPEN_TERMINAL_SESSION_CWD_TTL (or session_cwd_ttl in config.toml).

v0.11.30

Changed

• 🔑 Stronger auto-generated API keys — increased from 192-bit (32 chars) to 384-bit (64 chars) entropy, making brute-force attacks computationally infeasible.
• 🔒 API key required to start — the server now refuses to start without an API key configured. The CLI auto-generates one as before, but running via uvicorn directly without setting OPEN_TERMINAL_API_KEY is no longer allowed.
• 🛡️ Constant-time API key comparison — both HTTP and WebSocket authentication now use hmac.compare_digest() instead of !=, preventing timing-based key extraction.
• ⚠️ CORS default warning — a prominent yellow box is printed at startup when --cors-allowed-origins is left at the default *, warning operators to restrict it for production.

v0.11.29

Fixed

• 🔒 File save fails in multi-user mode — _chown() transferred file ownership to the provisioned user but didn't set group-write permission, leaving files at 644. The server process (a group member) could create new files but couldn't overwrite them on subsequent saves, returning PermissionError. Now sets chmod g+w after chown, matching the 2770 treatment already applied to directories. (#93)

v0.11.28

Added

• 📦 Compressed directory download (POST /files/archive) — bundle one or more files and directories into a ZIP archive for download. Cross-platform compatible (Windows, macOS, Linux). Multi-user access control enforced.

v0.11.27

Added

• 🧠 System prompt endpoint (GET /system) — returns a structured system prompt for LLM integration, grounding the model in the environment (OS, hostname, user, shell, Python version) with directives for tool usage. Gated by OPEN_TERMINAL_ENABLE_SYSTEM_PROMPT (default true); advertised via features.system in GET /api/config so consumers can check support before fetching.
• ⚙️ OPEN_TERMINAL_ENABLE_SYSTEM_PROMPT — environment variable (or enable_system_prompt in config.toml) to enable/disable the /system endpoint and feature flag. Defaults to true.
• ⚙️ OPEN_TERMINAL_SYSTEM_PROMPT — environment variable (or system_prompt in config.toml) to fully override the generated system prompt with custom content.

v0.11.26

Changed

• ♻️ utils/documents.py — extracted all document text extraction logic from read_file into a dedicated module with an EXTRACTORS registry. Adding a new format now requires only a single function and a one-line registry entry. No behaviour changes.

v0.11.24

Added

• 📄 Office document text extraction in read_file — .docx, .xlsx, and .pptx files are now automatically converted to text and returned in the standard JSON format, making them readable by LLMs. Word documents extract paragraphs and table contents, Excel spreadsheets render all sheets as tab-separated values, and PowerPoint presentations extract text from all slides. Supports start_line/end_line range selection.