# Roadmap

## Planned

- [ ] **URL fetch/browse tool** — Add a `fetch_url` LLM tool alongside web search. Fetches a specific URL and returns the page content as plain text so the model can read it directly. Shares the same enable toggle as SearXNG web search.
- [ ] **Ollama backend abort** — Investigate stopping Ollama generation server-side when client disconnects. TCP disconnect does not propagate through Docker networking to the llama runner. UI stop works; backend keeps generating.

---

## Completed

### v1.1.9
- ✅ **Thinking toggle** — Server sends `think: true` to Ollama native `/api/chat`; reasoning streams from `message.thinking` chunks, synthesized into `<think>` tags server-side. Models that natively emit `<think>` tags (DeepSeek R1) parsed identically client-side. Collapsible purple section above response with scrollable max height. Stays open until manually collapsed. Global default (System tab) and per-chat override (Brain icon). Models that don't support thinking fall back silently. FAST category always excluded.
- ✅ **Ollama detection fix** — Health check probes `/api/tags` before `/v1/models` so Ollama is correctly identified and routed to native `/api/chat` instead of `/v1/chat/completions`.
- ✅ **Docker image size reduction** — Frontend/build packages moved to devDependencies, `npm prune --production` in builder stage, `node-fetch` removed. 127 MB → ~86 MB.
- ✅ **Community standards** — CONTRIBUTING.md, SECURITY.md, GitHub issue templates (bug report, feature request).

### v1.1.8
- ✅ **Copy code button** — Hover-to-reveal Copy button on code blocks with 2-second feedback.
- ✅ **FAST category routing fix** — Restricted to greetings and micro-interactions only.
- ✅ **Security hardening** — CORS, SSRF, security headers, rate limiting, session management, body limits, password complexity, cookie parsing, error leakage, API key decoupling.

### v1.1.7
- ✅ **Collapsible settings sections** — All Models tab sections collapse/expand with localStorage persistence.
- ✅ **Active tab persists on refresh** — `usePersistentTab` hook.
- ✅ **Discovered Models redesign** — Provider-grouped collapsible list with size-tiered colour coding.
- ✅ **Mixed content fix** — Removed hardcoded localhost from frontend bundle.

### v1.1.6
- ✅ **OpenAI-compat provider fixes** — Health check and model discovery now correctly probe `/v1/models` for providers whose base URL ends with `/v1` (e.g. llama-swap, LM Studio). Previous logic always appended `/api/models` causing 404s. Model display names (`m.name`) from llama-swap are shown in the UI while the routing key (`m.id`) is used in API requests. Model IDs are trimmed of whitespace. Long model names no longer overflow their grid cards (`overflow-hidden` + `min-w-0`).
- ✅ **Slow-loading provider timeout** — Per-attempt chat timeout raised from 60s to 300s (configurable via `CHAT_TIMEOUT_MS` env var). Overall request timeout is `4×` the per-attempt value. Loading-retry backoff changed from 3×5s to 5×30s (30s / 60s / 90s / 120s / 150s) to give llama-swap and similar providers time to swap models.

### v1.1.5
- ✅ **Multiple local providers** — Configure Ollama, llama-swap, llama.cpp, and any other OpenAI-compatible endpoints simultaneously. Model discovery aggregates across all providers and tags each model with its source. Category assignments store the provider URL alongside the model name so routing targets the correct endpoint. Fallback chains work across providers. Config shape: `localProviders: [{ url, key, name }]`. Existing `localUrl`/`localKey` configs migrate automatically on first load.

### v1.1.4
- ✅ **Web search sources display** — After a web search completes, a collapsible Sources section appears below the assistant response showing the SearXNG results used (title, URL, snippet). Server emits a `sources` SSE event after the search; frontend stores and renders it as a toggle per message.

### v1.1.3
- ✅ **SearXNG web search via tool calling** — LLM-driven `web_search` tool using OpenAI-compatible `tools` / `tool_calls` API. Configure SearXNG URL in Models tab. Always-on toggle or per-chat globe button in the chat input bar. Server handles the full agentic loop transparently and streams the final response. FAST category skips tool injection. Compatible with Ollama and any OpenAI-compatible provider supporting tool calls.

### v1.1.2
- ✅ **Request queuing** — Per-user FIFO queue for chat requests. Concurrent requests process in order rather than racing. Max 5 pending per user; excess returns 503. Client disconnects while queued are skipped automatically.

### v1.1.1
- ✅ **Session isolation fix** — Signing out fully clears all in-memory state (conversations, messages, projects, config). Login modal cannot be dismissed when authentication is required. Main UI hidden while logged out. Session expiry (401) triggers the same full state wipe as manual logout.

### v1.1.0
- ✅ **Multi-user support** — Per-user accounts with isolated config, conversations, and projects. Username/password login, session-based auth (httpOnly cookies), admin user management, optional public registration, per-user provider config, change password, user menu in header. Existing single-user installs migrate automatically.

### v1.0.9
- ✅ **Streaming chunk buffer** — SSE stream parsing carries a leftover buffer across reads. Fixes silent token/usage loss when JSON objects split across TCP reads.
- ✅ **Router cache persistence fix** — `routerCacheEnabled` was stripped by Zod validation before saving. Toggle now persists correctly across reloads.
- ✅ **Conversations export fix** — Export hits a dedicated endpoint reading all conversations with full messages from SQLite instead of the paginated in-memory list.

### v1.0.8
- ✅ **Error boundaries** — Each tab (Chat, Models, System) wrapped in a React error boundary. A crash in one tab shows a fallback card instead of blanking the entire UI.
- ✅ **Projects** — Organize conversations into named project folders. Collapse/expand, inline rename, right-click to assign conversations, delete with option to keep or remove chats.

### v1.0.7
- ✅ **Dockerfile fix** — Root-level TypeScript files copied with `*.ts` glob. Prevents missing module errors when new backend files are added.
- ✅ **Configuration guide** — Full configuration guide added to README covering all providers, router, and category mappings.
- ✅ **Chat timeout** — Per-attempt timeout raised from 15s to 60s for all categories. Fixes cold model load failures on first request to large models.

### v1.0.6
- ✅ **Conversation pagination** — Paginated API with lazy-loading sidebar. "Load More" button, messages fetched on demand.
- ✅ **Router result caching** — In-memory LRU cache (max 100 entries, 5-minute TTL), off by default, toggle in System tab.
- ✅ **FAST category** — Built-in category for trivial one-liner responses using small/fast models.
- ✅ **SECURITY category** — Dedicated category for security analysis, vulnerability assessment, threat modeling, CTF, and pentesting.

### v1.0.5
- ✅ **Input validation** — Zod schemas for all API endpoints.
- ✅ **Tests** — Vitest suite covering all validation schemas.
- ✅ **Rate limiting** — Login brute-force protection + API request throttling.

### v1.0.4
- ✅ **Model fallback** — Auto-fallback to next model in category pool when selected model is unavailable.
- ✅ **Chat input UX** — Auto-growing textarea, character/line count display.

### v1.0.3
- ✅ **SQLite migration** — Replaced JSON file storage with SQLite + WAL mode.
- ✅ **PORT env var** — Server port configurable via environment variable.

### v1.0.2
- ✅ **Category Mappings cloud filter** — Cloud provider warning when unconfigured, improved X button placement, hover tooltip.
- ✅ **Scrollbar fix** — Scrollbar sits at window edge; scroll works from anywhere on the page.
- ✅ **Sidebar navigation** — Clicking a conversation navigates back to Chat tab automatically.

### v1.0.1
- ✅ **Stop generation** — Cancel button aborts in-flight SSE stream, keeps partial response, resets loading state.
- ✅ **Ollama auto-detection** — Health check detects Ollama and uses native `/api/chat` endpoint automatically.

### v1.0.0
- ✅ **SSRF protection** — URL validation on config save, blocks non-http(s) schemes and cloud metadata endpoints.
- ✅ **CORS configuration** — Same-origin enforcement middleware.
- ✅ **Cookie-based auth** — httpOnly session cookies, timing-safe key comparison.
- ✅ **LaTeX rendering** — KaTeX support for math notation output from reasoning models.
- ✅ **Vision & document support** — Image and document attachments routed to correct model format automatically.
- ✅ **Structured logging** — Pino with JSON in production, pretty-printed in dev.
- ✅ **Component refactor** — Split monolithic App.tsx into modular component architecture.