Roadmap & Release History · v1.2.0 live
reader.cancel() tears down the socket mid-stream — verified). The runner keeps generating because
Ollama / llama.cpp does not check for a closed connection between tokens
(ollama#2876,
llama.cpp#24496).
No Nexus-side fix is possible; it resolves automatically once upstream honors the closed connection.
USER nexus
instruction breaks volume writes on first run. Requires an entrypoint script that chowns
the data directory before dropping privileges.
ENCRYPTION_SECRET is currently derived from ADMIN_API_KEY when not explicitly set.
Decoupling them requires a documented migration path for existing installs —
re-encrypting stored config and conversations without data loss during the transition.
fetch_url LLM tool added alongside web_search. Fetches a URL server-side, strips HTML to plain text
(scripts, styles, comments removed; entities decoded; block tags → newlines), returns up to 50 KB to the model.
Gated by the existing SearXNG globe toggle — no new UI required.
Tool-calling path refactored from a single-call branch to a multi-turn agentic loop
(up to 4 tool calls per turn): model can chain web_search → fetch_url on a result → answer.
Both Ollama-native and OpenAI-compat message shapes handled. SSRF-protected (cloud metadata blocked; LAN allowed).
15-second per-fetch timeout. New standalone module fetchUrl.ts with 26 unit tests.
server.ts, useConfig.ts, vite.config.ts,
useConnection.ts, useConversations.ts, ProviderConfig.tsx, and db.ts.
No behaviour changes.
whiteSpace: pre prevents line wrapping that previously hid overflow content.
CategoryModel.providerUrl not matching a known provider is rewritten to the first provider URL.
Fixes stale hostnames persisting in category pools after a provider is renamed — routing failures were intermittent
because the old URL still resolved on some requests.
express-rate-limit bumped to ^8.5.1 (GHSA-v2v4-37r5-5v8g — XSS via ip-address package).
overrides.postcss: ^8.5.10 added to patch transitive dependency (GHSA-qx2v-qp2m-jg93 — CSS stringify XSS).
npm audit reports 0 vulnerabilities.
web_search and fetch_url.
Configured per user in the Models tab (up to 10 servers). Tools prefixed <server>__<tool>.
5-minute TTL cache with manual refresh. Agentic loop cap raised 4 → 8.
SSRF blocking, header validation, bearer token redaction. 32 tests.
think: true to confirmed Ollama instances via native /api/chat.
message.thinking chunks synthesized into <think> tags server-side.
Models that natively emit <think> tags (DeepSeek R1) parsed identically client-side.
Collapsible purple section above the response, scrollable max height. Global default in System tab;
per-chat override via Brain icon. Models that reject think: true (400) retry silently without it.
FAST category always excluded.
/api/tags before /v1/models.
Previously Ollama's OpenAI-compatible endpoint responded first, causing misidentification as a generic provider
and routing to /v1/chat/completions instead of /api/chat — which meant think: true was never sent.
devDependencies.
npm prune --production added to Dockerfile builder stage.
Unused node-fetch dependency removed (Node 20 has native fetch).
Runtime dependencies reduced to 7 packages. Image size: 127 MB → ~86 MB.
CONTRIBUTING.md (getting started, project structure, commit format, PR guidelines, design principles),
SECURITY.md (supported versions, reporting via GitHub private advisories, scope definitions),
and GitHub issue templates (bug report, feature request; blank issues disabled).
trust proxy; admin settings Zod schema; password complexity; cookie npm package;
error leakage prevention; API key decoupled from admin password.
localhost URL from frontend bundle.
/v1/models correctly for /v1-suffixed base URLs (llama-swap, LM Studio).
Per-attempt chat timeout raised to 300s (CHAT_TIMEOUT_MS env var). Loading-retry backoff extended to 5 retries × 30–150s.
localProviders: [{ name, url, key }] replaces the single localUrl/localKey pair.
CategoryModel = { name, providerUrl } stores the provider URL at assignment time.
Existing configs migrate automatically on first load.
web_search tool. Configure SearXNG URL in Models tab. Always-on toggle or per-chat globe icon.
Server handles full agentic loop and streams the final response. FAST category skips tool injection.