From bccef6258584c6c73655a812975328e0d91a4cfd Mon Sep 17 00:00:00 2001 From: Dorian Date: Wed, 18 Mar 2026 11:15:32 +0000 Subject: [PATCH] feat: external iframes, container startup UX, release notes modal - Add https: to CSP frame-src so external site iframes (BotFights, 484 Kitchen, etc.) load without being blocked by Content-Security-Policy - Show spinner + "Starting..." on marketplace cards for containers that are booting up, preventing users from re-installing running apps - Add spinner to transitional state badges (starting/stopping/installing) on installed app cards in Apps view - Add "What's New" button to Settings version card with release notes modal covering recent highlights in layman-friendly language Co-Authored-By: Claude Opus 4.6 (1M context) --- image-recipe/configs/nginx-archipelago.conf | 4 +- neode-ui/src/views/Apps.vue | 12 +++- neode-ui/src/views/Marketplace.vue | 68 +++++++++++++++------ neode-ui/src/views/Settings.vue | 53 +++++++++++++++- 4 files changed, 115 insertions(+), 22 deletions(-) diff --git a/image-recipe/configs/nginx-archipelago.conf b/image-recipe/configs/nginx-archipelago.conf index 04d10f47..c2795ae8 100644 --- a/image-recipe/configs/nginx-archipelago.conf +++ b/image-recipe/configs/nginx-archipelago.conf @@ -17,7 +17,7 @@ server { add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-DNS-Prefetch-Control "off" always; - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:*; frame-src 'self' http://$host:*; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:* https:; frame-src 'self' http://$host:* https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always; # AIUI SPA (Chat mode iframe) # Use =404 fallback instead of index.html to prevent serving HTML with wrong @@ -721,7 +721,7 @@ server { add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-DNS-Prefetch-Control "off" always; - add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:*; frame-src 'self' http://$host:*; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' ws: wss: http://$host:* https:; frame-src 'self' http://$host:* https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always; # AIUI SPA (Chat mode iframe) location /aiui/ { diff --git a/neode-ui/src/views/Apps.vue b/neode-ui/src/views/Apps.vue index b826d52b..ab1b91d6 100644 --- a/neode-ui/src/views/Apps.vue +++ b/neode-ui/src/views/Apps.vue @@ -118,9 +118,19 @@

+ + + + {{ pkg.state }} diff --git a/neode-ui/src/views/Marketplace.vue b/neode-ui/src/views/Marketplace.vue index 15d9d281..92b016b1 100644 --- a/neode-ui/src/views/Marketplace.vue +++ b/neode-ui/src/views/Marketplace.vue @@ -177,37 +177,49 @@

- + + + + + + {{ getInstalledState(app.id) === 'installing' ? 'Installing...' : 'Starting...' }} + + + - {{ t('marketplace.alreadyInstalled') }} - + > + {{ t('marketplace.alreadyInstalled') }} +
-

{{ version }}

+
+

{{ version }}

+ +
+ + + +
+
+
+
+

What's New in {{ version }}

+ +
+
+
+

Mesh Radio Connection

+

Your LoRa mesh radio now connects reliably every time. If the USB port changes, the system automatically finds the device. A new "Connect" button lets you pick which radio to use.

+
+
+

Rock-Solid Containers

+

Fixed crash loops that were causing apps to restart thousands of times. All containers now start cleanly and stay stable across reboots.

+
+
+

Smarter App Store

+

Apps that are still starting up now show their progress instead of appearing as available to install again. No more accidentally re-installing running apps.

+
+
+

Security Hardening

+

Backend services now run with strict sandboxing: read-only filesystem, restricted system calls, and least-privilege access. Your node is locked down by default.

+
+
+

Tor by Default

+

Bitcoin and Lightning now route through Tor automatically for maximum privacy. Your node's network traffic is protected out of the box.

+
+
+

Off-Grid Bitcoin

+

Receive Bitcoin block headers over mesh radio. A dead man's switch can broadcast your location to trusted contacts if you go silent. GPS sharing is opt-in only.

+
+
+ +
+
+ + +
@@ -965,6 +1015,7 @@ async function saveServerName() { } const version = computed(() => store.serverInfo?.version || '0.0.0') +const showReleaseNotes = ref(false) const serverTorAddressFromStore = computed(() => store.serverInfo?.['tor-address'] || null) const torAddressFromRpc = ref(null) const serverTorAddress = computed(() => serverTorAddressFromStore.value || torAddressFromRpc.value)