* ✨ feat(docker): run self-hosted Compose chats in Gateway Mode by default
- Add the lobehub-gateway service to docker-compose and wire the lobe service
to it; AGENT_GATEWAY_INTERNAL_URL keeps server pushes on the Compose network
while browsers use AGENT_GATEWAY_URL.
- S3_INTERNAL_ENDPOINT routes the server's own S3 requests to rustfs:9000 while
presigned URLs keep the browser-facing S3_ENDPOINT, which local mode sets to
localhost and the container cannot reach.
- setup.sh generates a per-deployment JWKS_KEY and gateway token and writes the
gateway URL for each deploy mode; the .env template drops the public JWKS key.
- Warn loudly at container startup when an upgraded stack lacks the gateway
settings or still uses the public example JWKS_KEY, and document the upgrade.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* 🔒 fix(docker): pass only the public JWK to the gateway container
The gateway only needs the public half of JWKS_KEY to verify browser
sessions, but it received the full private key set, so anyone able to read
the gateway environment could sign tokens LobeHub trusts. setup.sh now also
writes JWKS_PUBLIC_KEY (the same key without d/p/q/dp/dq/qi), Compose passes
only that to the gateway, and the startup check warns when it is missing,
still contains private fields, or does not match JWKS_KEY.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* 🐛 fix(email): use || instead of ?? to handle empty string from Dockerfile
Dockerfile sets empty string defaults for email env vars (SMTP_FROM,
SMTP_HOST, etc). The ?? operator doesn't treat empty strings as nullish,
causing email sending to fail with "Mail Account:" being empty.
Fixes#11757
* ✨ feat(workflow): add Claude migration support workflow
Add automated support for migration feedback issues (#11757, #11707):
- Auto-respond to new comments on migration issues
- Check for sensitive information leaks and warn users
- Read latest docs before responding
- Validate required information from issue description
- Match issues against documented FAQ solutions
* 🐛 fix(auth): add APP_URL trailing slash check
Detect and warn when APP_URL ends with a trailing slash, which causes
double slashes in redirect URLs (e.g., https://example.com//).
* ✨ feat(workflow): add Claude migration support workflow
Add automated support for migration feedback issues (#11757, #11707):
- Auto-respond to new comments on migration issues
- Check for sensitive information leaks and warn users
- Read latest docs before responding
- Validate required information from issue description
- Match issues against documented FAQ solutions
- Minimize resolved/success feedback comments
* 📝 docs: add browser cache clearing guide and improve migration workflow
- Add troubleshooting section for clearing browser site data after migration
- Exclude maintainers (tjx666, arvinxx) from auto-reply workflow
- Add references to auth.mdx and checkDeprecatedAuth.js in workflow
* 📝 docs: add migration internals technical documentation
- Explain users table vs accounts table relationship
- Document simple vs full migration principles
- Add troubleshooting guide with SQL examples
- Link from migration guides to new doc
Arvin Xu