Repository navigation
Conversation
…random The default server secret was generated with Math.random(), which is not a cryptographically secure source. Replace generatePassword() with generateSecretKey(): 32 bytes from globalThis.crypto.getRandomValues, hex-encoded to a 64-character (256-bit) secret. Web Crypto is available in the renderer, so the esbuild --platform=browser bundle builds without Node built-ins. Existing installs keep their stored secret; only first-run defaults change.
A 64-character hex secret has no break points, so at 20px monospace it rendered ~855px wide and overflowed the 360px modal on both sides. Allow breaking anywhere and cap the width at 16 characters per line, so a 64-char secret shows as four even rows at the existing font size. A 16-char legacy secret still renders on one line. Soft wraps do not change the copied text.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates how server secret keys are generated and displayed, improving both security and usability. The main changes include replacing the password generator with a secure, 256-bit hex-encoded secret, updating the default secret key generation, and enhancing the UI to better display long secrets.
Security improvements:
generatePasswordfunction with a newgenerateSecretKeyfunction that generates a 256-bit random authentication secret, hex-encoded for improved security. (src/services/user-settings-service.ts, src/services/user-settings-service.tsL1-R9)USER_SETTING_DEFAULTSto use the newgenerateSecretKeyforSERVER_SECRET_KEYinstead of the old password generator. (src/services/user-settings-service.ts, src/services/user-settings-service.tsL34-R40)UI improvements:
LLMServerPanel.tsxto wrap long secrets at 16 characters per line and set a maximum width, making long hex secrets easier to read and copy. (src/screens/LLMServerPanel.tsx, src/screens/LLMServerPanel.tsxR1666-R1669)