linshenkx/prompt-optimizer v2.13.0

on GitHub

English

Summary

This stable release brings interactive HTML inside Markdown results to Web, Desktop and the browser extension, with a redesigned output pipeline for concurrent generation and large responses. It also improves backup integrity, adds import codes for selected cloud backups, preserves model selections and saved parameters, and refines image-editing and structured-input templates.

Highlights

• Interactive output in place: use Preview or Source to inspect results. Explicit HTML code blocks and supported HTML content render as isolated web pages alongside the surrounding Markdown. Multiple blocks can remain interactive at the same time.
• Interactive extension previews: fix the beta's extension script restriction so generated buttons, forms and canvases work inside results without opening another tab.
• Bounded streaming and rendering: generation uses a dedicated output document, virtualized source views and background Markdown parsing. Oversized or expensive content falls back to source.
• More reliable backups: validate data and image resources before restoration, protect existing images from eviction, and restore workspace snapshots only after preceding import steps succeed.
• Cloud backup import codes: transfer a selected WebDAV, S3-compatible or Cloudflare R2 snapshot using a code, link or QR code when its size permits.

Product Updates

Desktop

• Propagate cancellation from the interface through desktop IPC to model requests. Streaming completion now waits for asynchronous completion work.
• Use the shared Preview/Source output interface, inline HTML previews and backup import-code flow.

Web

• Render multiple HTML examples directly in Markdown results. Switching one result to Source leaves other results' previews intact.
• Keep in-progress responses in the source view; executable previews are created after generation completes.
• Allow HTML previews to request external data while retaining isolation from the application. Requests remain subject to browser CORS rules and the target service's authorization requirements.

Extension

• Display and run multiple HTML blocks inside results, including inline scripts, event handlers, external script libraries and modules.
• Allow external API requests while preventing preview pages from reading the main application, its storage or extension APIs. Keep the main extension pages' existing content security policy.
• Support Preview/Source switching, content replacement and fullscreen viewing. Release preview pages when their corresponding results are removed.

Core/Infra

• Separate streaming text from reactive workspace snapshots and publish final or interrupted results at explicit completion boundaries.
• Apply output-size, rendering and queue budgets, and cancel obsolete parsing work.
• Carry cancellation signals through OpenAI-compatible, Anthropic and Gemini streaming adapters.

Fixes

• Resolve extension content security policy restrictions that blocked preview scripts, and reject forged content updates from preview child pages.
• Preview standalone HTML controls such as buttons, and keep output-toolbar actions within narrow mobile comparison columns.
• Reject invalid backup sections, conflicting image resources and insufficient image-storage capacity before publishing new references. Report partial restoration and rollback failures explicitly.
• Preserve relevant settings and image references across export and import. Keep workspace restoration as the final import step.
• Preserve model selections when refreshing lists, including empty responses and fallback lists. Retain saved parameters when provider definitions change while validating edited values against applicable definitions.
• Clarify reference-image roles, edit scope and preservation requirements in image templates. Keep structured JSON fields, types, control values and placeholders intact.
• Update Zod, body-parser, qs and the build tooling's Undici 6 dependency to patched versions for previously identified security advisories.

Breaking Changes / Upgrade Notes

• This upgrade changes backup restoration and output processing. Export a backup of important workspaces before upgrading.
• Cloud backup import codes contain storage credentials; they are not restricted public sharing links. Give them only to trusted recipients. Google Drive backup import codes are not supported in this release.
• HTML scripts run in isolated iframes. Isolation protects the main document and restricts permissions, but does not impose hard CPU or memory quotas on arbitrary generated scripts. WebGPU availability still depends on the browser and device.
• Exceeding output or rendering budgets may stop generation or switch to source display. Interrupted and normally completed results remain distinct.
• The extension ZIP uses numeric version 2.13.0 without the beta display name. Replace manually installed 2.13.0-beta.1 packages manually. The release workflow does not automatically submit to browser extension stores.
• Stable Docker images use 2.13.0 and latest tags. The GitHub Release is published as stable and is available to the desktop stable update channel.
• The build-only deepmerge dependency still has an unpatched low-severity advisory; the identified path merges trusted Rollup configuration and is not part of the application runtime.

Developer Notes

• The output pipeline uses bounded documents, CodeMirror source views, a shared Markdown Worker and isolated iframes. See the output architecture.
• The extension uses a manifest-declared sandbox page as its preview host; Web and Desktop retain their existing srcdoc path.
• The daily browser gate now builds the real extension, scans for sensitive configuration and loads it with an isolated browser profile. Coverage includes multiple interactive blocks, external resources, permission isolation, source fidelity, concurrent producers and CPU throttling.
• CPU throttling is simulated. Extension tests use page freeze/resume and visibility events; these do not constitute complete acceptance on low-end hardware or under native background-tab throttling.
• The release workflow validates tags and application versions, runs test gates and packages Desktop and the extension. It publishes the stable Release only after validating multi-architecture Docker images and latest tags in both registries.

Installation guide: English | 中文
Source release notes (EN)

中文

概括

本正式版支持在 Web、桌面和浏览器扩展的 Markdown 结果中直接交互 HTML 网页，并重构输出链路，以应对并发生成和长内容。同步增强备份完整性，新增指定云备份的导入码，修复模型选择与已保存参数的保留问题，完善图片编辑和结构化输入模板。

亮点

• 网页就地交互：统一通过“预览 / 原文”查看结果，显式 HTML 代码块及支持的 HTML 内容会在周围 Markdown 之间显示为独立网页，多个块可同时交互。
• 扩展支持交互预览：修复 beta 中扩展无法运行 HTML 脚本的问题，可直接操作生成的按钮、表单和画布，无需另外打开标签页。
• 限制输出与渲染开销：生成过程使用独立输出文档、虚拟化原文视图和后台 Markdown 解析。内容过大或渲染过重时回退到原文显示。
• 更可靠的备份恢复：恢复前校验数据和图片资源，保护已有图片不被自动淘汰，并在前置导入步骤成功后才恢复工作区快照。
• 云备份导入码：为选定的 WebDAV、S3 兼容或 Cloudflare R2 备份生成导入码、链接，并在长度允许时生成二维码。

产品更新

Desktop

• 将取消生成从界面经桌面通信传递到模型请求，流式完成会等待异步收尾操作。
• 接入统一的“预览 / 原文”结果界面、就地 HTML 预览与备份导入码流程。

Web

• Markdown 中的多个 HTML 示例直接显示为网页。将某一列切到原文，不会重建其他列的预览。
• 生成期间显示原文，生成完成后才创建可执行的网页预览。
• 允许预览网页请求外部数据，同时保持与主应用隔离；请求仍受浏览器跨域规则和目标接口授权要求约束。

Extension

• 在结果中就地显示并运行多个 HTML 块，支持内联脚本、事件处理、外部脚本库和模块。
• 预览页面可请求外部接口，同时无法读取主应用页面、存储或扩展 API；主扩展页面继续使用原有内容安全策略。
• 支持预览与原文切换、内容替换和全屏查看，并在对应结果移除时释放预览页面。

Core/Infra

• 将逐片生成的文本与响应式工作区快照解耦，在明确的完成边界统一写入完整或中断结果。
• 对输出大小、渲染量和待处理队列设置预算，并取消过时的解析任务。
• 将取消信号贯穿 OpenAI 兼容、Anthropic 和 Gemini 流式适配器。

修复

• 修复浏览器扩展的内容安全策略拦截预览脚本的问题，并拒绝来自预览子页面的伪造内容更新。
• 支持单独输出的 HTML 按钮等控件进入网页预览，并修复手机窄列对比时工具栏按钮越界的问题。
• 在写入新的业务引用前，拒绝无效备份数据、图片资源冲突和图片存储容量不足的恢复操作；明确报告部分恢复与回滚失败。
• 完善设置和图片引用的导出与恢复，工作区恢复保持为最终导入步骤。
• 刷新模型列表时保留当前选择，包括返回空列表和使用回退列表的情况；模型参数定义更新时保留已保存的参数，并按适用定义校验修改后的值。
• 图片模板更明确地区分参考图作用、编辑范围和需要保留的内容；保留结构化 JSON 的字段、类型、控制值和占位符。
• 将 Zod、body-parser、qs 及构建工具使用的 Undici 6 更新至修补版本，处理此前发现的依赖安全告警。

破坏性变更 / 升级说明

• 升级涉及备份恢复和输出处理，建议先导出重要工作区的备份。
• 云备份导入码包含存储访问凭据，不是权限受限的公开分享链接，请只交给可信的接收者。本版本不支持为 Google Drive 导出备份导入码。
• HTML 脚本在独立 iframe 中运行。隔离可以保护主应用文档并限制权限，但不会为任意生成脚本设置 CPU 或内存硬配额。WebGPU 等能力还取决于浏览器和设备。
• 超出输出或渲染预算时，可能停止生成或改用原文显示；中断结果与正常完成结果会保持区分。
• 扩展 ZIP 使用数字版本 2.13.0，移除 beta 显示名称；从 2.13.0-beta.1 手动安装包升级时，请手动替换扩展包。现有发布流程不自动上传浏览器扩展商店。
• 正式 Docker 镜像使用 2.13.0 和 latest 标签；GitHub Release 按正式版发布，桌面稳定更新渠道可获取本版本。
• 仅供构建使用的 deepmerge 仍有一项上游尚未修补的低危告警；已确认的调用路径用于合并受信任的 Rollup 配置，不进入应用运行时。

开发者说明

• 输出链路使用有容量限制的文档、CodeMirror 原文视图、共享 Markdown Worker 和独立 iframe，设计见输出链路架构。
• 扩展通过 manifest 声明的隔离页面承载预览；Web 与桌面继续使用原有 srcdoc 路径。
• 日常浏览器测试增加真实扩展构建、敏感配置扫描和独立浏览器配置下的扩展加载测试，覆盖多块交互、外部资源、权限隔离、原文一致性、并发生成和 CPU 降速。
• CPU 降速属于模拟；扩展测试使用页面冻结/恢复和可见性事件，不等同于低性能硬件或真实后台标签页限速的完整验收。
• 发布流程校验标签和各端版本，执行测试门禁，构建桌面与扩展安装包，并在两个仓库的多架构 Docker 镜像及 latest 标签校验成功后公开正式 Release。

安装文档：English | 中文
仓库版本说明（中文）

macOS note: if macOS reports the app as damaged or cannot verify the developer, this is usually caused by the quarantine attribute on downloaded apps. See the installation guide, or remove it after installing with xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app; for a downloaded DMG, you can run the same command on ~/Downloads/PromptOptimizer-*.dmg before installing.
macOS 备注：如果 macOS 提示“已损坏”或“无法验证开发者”，通常是下载文件的隔离属性导致。请参考安装文档；也可以在安装后执行 xattr -rd com.apple.quarantine /Applications/PromptOptimizer.app，或在安装前对 ~/Downloads/PromptOptimizer-*.dmg 执行同类命令。