Masking with -webkit-text-security didn't help: Chrome on Android flags
those fields as custom passwords and still hides Copy. Key fields are
back to type=password with the type toggle, and each key label now has
an inline copy icon that copies the value straight from the field,
masked or not. The eye icon fix stays.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chrome keeps treating an input that was ever type=password as a password
field, so after tapping the eye the selection menu still hid Copy. Key
fields are now plain text inputs masked with -webkit-text-security, and
the eye toggles the mask instead of the type.
Also fixes the eye icon never switching: lucide swaps <i> for <svg>, so
querySelector('i') was null and the handler threw.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The provider is Anthropic; Claude is its model family. Models now take
the ant: prefix (e.g. ant:claude-opus-5-5), the provider value sent to
the proxy is "anthropic", and the key lives in anthropic_api_key /
USER.apiKeyAnthropic. No fallback for the old names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every page load fetched whatever these resolved to, so a bad or
compromised release would ship to all users with access to their keys.
Each pin serves byte-identical content to what the unpinned URL served.
- lucide@latest -> lucide@1.60.0
- cdn.tailwindcss.com -> 3.4.17
- cash-dom -> 8.1.5
- alpinejs -> 3.17.5
- markdown-it-mathjax3 (esm.sh) -> 5.2.0
- medv.io/codejar -> codejar@4.3.0 on jsDelivr (same file)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Thread Sync now shows Upload to GitHub / Download from GitHub in a popover,
like sunes sync, so it can be dismissed instead of forcing a choice. It
closes on an outside click, resize, the sidebar overlay, or picking an
option. The push and pull code is unchanged, and the readme's sync steps
now name the popover options.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both are converted to WebP in the browser like other non-WebP images, so
providers never see them. Browsers that can't decode JXL now get a readable
error instead of [object Event].
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Videos are compressed with Mediabunny to 360p at 4 fps (HEVC when the
device can encode it, H.264 otherwise) with mono 32 kbps AAC, then
stored as video_url data URLs. Frames are resized after the frame-rate
drop, and rotation is baked in during that same step, so phone videos
stay on the fast path.
The attach badge shows compression progress, sending waits for pending
compressions, and "Clear all attachments" cancels them. Messages show
video thumbnails that open a fullscreen player.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clicking the attach button or pasting files now appends instead of
resetting. Long-press (touch) or right-click opens a popover with
"Clear all attachments".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
multipleof4andClaude Opus 5.5
