sync: rebase flex onto upstream open-webui v0.11.3 - #33

…ch (open-webui#28943)

The DuckDuckGo search path catches RatelimitException from the ddgs library. That exception is defined by the library but never raised anywhere in it, checked against the pinned 9.14.4 and against 9.11.3, so the handler could never run. The two fallbacks around it were dead for the same reason: ddgs.text() returns a non-empty list or raises, so None and an empty list are not outcomes it can produce.

Removing all three leaves one call and changes nothing observable. A refused or rate limited search already came out as a failed search, with the error shown to the user and the traceback in the log, and it still does.

The backend argument is now passed as backend or 'auto' rather than conditionally omitted, because 'auto' is the library's own default for that parameter, so every configured value including unset and empty resolves exactly as before. Verified by running the old and the new function side by side against a stubbed library covering normal results, the domain filter, all four backend settings and a failing search, with identical results in every case.

…f 400 (open-webui#28942)

Any failure during a web search comes back to the client as a bare HTTP 500 with nothing in it. The handler tries to build a 400 whose detail is the caught exception object itself, FastAPI cannot serialise that into a response body, so rendering the error response fails and the request falls through to the generic 500 handler. In chat this surfaces as a web search that fails with no explanation at all, and the most common trigger is simply selecting a search engine without configuring its API key.

This routes the failure through the standard error formatter, which is what the sibling handler for content loading failures in the same function already does. Web search failures now return 400 with a readable message, and the exception itself keeps going to the server log exactly as before.

Passing str(e) into the response was the other option and was rejected: the rest of the backend deliberately keeps provider exception text out of client responses and in the log, and provider exceptions here can carry request details that should not be echoed back.

…#28948)

The web search error message was a lambda with a passthrough branch that returned whatever it was handed. Since open-webui#28942 both call sites pass no arguments, so that branch is unreachable, and it is the trap that let a caller drop a raw exception object into an HTTP response body and turn an intended 400 into an unserialisable 500.

A plain string constant removes the trap and lines the message up with every other fixed message in that file. Behaviour is unchanged: the response detail comes out byte for byte identical, because the enum already overrides __str__ to render members as their value. Verified on Python 3.11 and 3.12, both producing the same string and the same JSON body.

…n-webui#27671)

Task lists in Notes serialized to markdown as `- [ ] [ ]` with the item text pushed onto a separate line after a blank line, so previewing or downloading a note produced a broken checklist, and checking an item left the second `[ ]` behind as plain text.

TipTap renders each task item as a checkbox inside a label plus a block-wrapped body. The GFM turndown plugin matches that checkbox and emits its own `[ ]`, which landed next to the marker the task item rule already writes, and the block wrapper left blank lines around the text that the old leading-whitespace strip could not remove.

Register a rule that drops the checkbox so the task item rule is the only source of the marker, and trim the block wrapper while indenting continuation lines so nested lists and code fences stay inside the item.

Fixes open-webui#26067

The ComfyUI workflow.json Edit drawer (CodeEditorModal -> Drawer) used
z-999, while the admin Settings dialog (Modal) uses z-9999. Since both
are appended to <body>, the drawer rendered behind the settings dialog
and appeared to open 'in the background' (open-webui#27647).

Add an optional zIndexClass prop to Drawer (default z-999, preserving
existing behaviour for all other callers) and pass z-99999 from
CodeEditorModal so the editor surfaces above any enclosing modal.

…the id (open-webui#28950)

…ntent (open-webui#28840)

A stream filter function, or a provider that puts something other than a string in a delta, makes the streaming handler concatenate a string with a non-string. That raises TypeError, and the broad handler wrapped around the whole per-chunk block swallows it at debug level and moves on. The chunk's text never reaches the message the user sees, and nothing above debug level says why.

The content and reasoning fields are now coerced to text once, where they are read off the delta, ahead of every consumer. The coercion is guarded on truthiness, so falsy values such as an empty list still skip the block exactly as before, and the accumulated content receives byte for byte what it received previously.

Checked against 14 delta shapes covering strings, empty values, numbers, booleans, None, lists, dicts and a content array: the truthiness gate and the accumulated content are identical before and after.

…n-webui#28859)

`x in d` and `x in d.keys()` are identical for a plain dict, so the `.keys()` call builds a throwaway view and reads as if it were doing something. Both sites operate on a plain dict: `combined` in `merge_and_sort_query_results` is a local `dict()`, and `ui_settings` comes from `UserSettings.model_dump()` where `ui` is annotated `dict | None` and is already guarded against None on the preceding line.

No behaviour change, and no measurable speedup either, so this is a readability cleanup rather than a performance one.

Sites where `.keys()` is load-bearing are left alone: the `list(d.keys())` snapshots taken before mutating during iteration, and the places where `.keys()` is the iteration or comprehension source rather than a membership test.

75 entries in the French locale had an empty value. i18next falls back to the
key when a value is empty, so French users were shown raw English strings
across permission settings, empty states, form placeholders and error toasts.

- fill those 75 entries; no key is added, removed or reordered
- follow the conventions already present in the file: "Entrez ..." for input
  hints, "Échec de ..." for failures, Chat -> Conversation, Token left as is
- interpolation placeholders preserved; no existing translation modified

…open-webui#27663)

The timer scheduler polls once a second and cancels on every message send and chat open, the sidebar lists chats ordered by `updated_at`, and the folder badges count unread chats per folder. None of those could be served by an index, so each call read most of the `chat` table, and because `meta` sits after the chat payload column SQLite had to walk every row's overflow pages to get there. On a large history that stalls the sidebar, every chat switch and every send, and the idle poll alone burns about a quarter of a CPU core.

Timers now keep their due time in a dedicated `chat.timer_at` column behind a partial index, and the chat list, unread and unfinished-reply queries each get an index matching their filter and ordering. Existing pending timers are backfilled from their meta by the migration. Dropping the `internal` and `type` checks also makes a forked timer chat inert, where a fork used to copy `meta` verbatim and become a second claim target that could fire a duplicate timer.

Measured on SQLite, same rows returned:

| query | before | after |
|---|---|---|
| idle timer poll (2000 chats, 0.43 GB) | 170 ms | 0.04 ms |
| cancel on send and chat open (4000 chats, 377 MB) | 200 ms | 0.04 ms |
| sidebar chat list (15000 chats, 1.26 GB) | 157 ms | 1.8 ms |
| folder unread badges (15000 chats, 1.4 GB) | 54 ms | 0.2 ms |

PostgreSQL 17 serves all of them as index-only scans with no sort node. Exercised through fresh install, upgrade with seeded data, downgrade and re-upgrade on SQLite and PostgreSQL 17.

Fixes open-webui#27622

…streamed chunk (open-webui#28861)

Streamed responses are scanned for reasoning and code interpreter tags. To work out where the last complete tag ended, the scanner searched backwards from the start of the accumulated text on every chunk, once per tag set. Ordinary prose contains no angle bracket, so that search never stopped early and read the entire response back every time. The cost grows with the square of the response length, and this scanning is on unless a model turns it off.

The two positions are now carried forward as the text grows, so each chunk only scans the characters it added.

Measured on CPython 3.12, a 270 KB response streamed in 27000 chunks:

| response text | before | after |
|---|---|---|
| no newlines | 7690 ms | 40.6 ms |
| with newlines | 5695 ms | 41.7 ms |

The carried positions match a full rescan at every step of 36282 randomized replays, covering text with no markers, newlines only, dense markers, real tags and truncation part way through.

…ough (open-webui#27675)

* fix: use the pooled client timeout for the Anthropic Messages passthrough

The native `/api/v1/messages` passthrough still referenced `openai.AIOHTTP_CLIENT_TIMEOUT`, which stopped existing when `routers/openai.py` moved onto `session_pool.get_client_timeout()`. Every passthrough request therefore raised `AttributeError: module 'open_webui.routers.openai' has no attribute 'AIOHTTP_CLIENT_TIMEOUT'` before it was sent, and the surrounding handler turned that into a 502 "Open WebUI: Server Connection Error", so Anthropic-format clients such as Cline could not reach any model at all.

Use `get_client_timeout(stream=...)` like the OpenAI and Ollama proxies do, so the configured `AIOHTTP_CLIENT_TIMEOUT` applies and streaming requests additionally get the idle-read timeout.

Fixes open-webui#27595

* fix: authenticate native Anthropic requests with x-api-key

The Anthropic Messages passthrough and the token-count forwarding both build their upstream request through `get_anthropic_request_target`, which sends the connection key as `Authorization: Bearer <key>`. Anthropic's OpenAI-compatible `/chat/completions` endpoint accepts that, which is why the model works in the chat UI, but the native `/v1/messages` and `/v1/messages/count_tokens` endpoints do not: they require the key in `x-api-key` and reject a bearer token with 401 `Invalid bearer token` (and `jwt auth is not yet supported on count_tokens`). They also require an `anthropic-version` header, which was never sent.

For `api.anthropic.com` connections, send `anthropic-version` and move the key into `x-api-key`, dropping the bearer header. Connections using session, OAuth or Entra ID auth keep their token untouched, LiteLLM passthrough connections are unaffected, and admin-configured custom headers still win over both defaults.

Fixes open-webui#27695

Keeps the entries already on dev and merges in the two this branch carried, then
puts the section back into the shape the format asks for.

Added now holds the contrast accessibility mode gives the dropdown menus, their
submenus and the model picker, followed by the general improvements placeholder
and the translation entry in their reserved positions. The translation entry
moves out of Changed, takes the standard wording and drops its link, which that
entry never carries; Changed is left out, having nothing else in it.

Each entry is condensed to a single sentence, the backticked column name becomes
a quoted one, and the interface font entry gains the commit it came from, having
carried no reference at all. Fixed is ordered by reach, from the conversation
branches and the failed upgrade down to the font and the disconnect control.

0.11.3

…tion deployment

…ery-access@flexion.us

Manual workflow (workflow_dispatch only) that builds the Flexion-customized
Docker image for linux/arm64 and pushes it to AWS ECR under the chosen
environment's repository (open-webui-dev or open-webui-prod) with the
caller-supplied version tag.

Design notes:
- ARM-native runner (ubuntu-24.04-arm) matches the Fargate ARM deploy
  target — no QEMU overhead.
- Only linux/arm64 is built. Multi-arch would double build time for no
  current benefit; can be extended later if x86 deploys are needed.
- AWS auth via OIDC: assumes GitHubActionsOpenWebUIDev for environment=dev
  and GitHubActionsOpenWebUIProd for environment=prod. The prod role's
  trust policy was extended in flexion/flexion-open-webui-infra#461 to
  accept tokens from this repo's flex branch.
- Tag overwrite guard: refuses to push if the tag already exists in ECR.
  Prevents accidental republishes that would mask source-of-truth
  provenance. Operator must delete the existing tag manually to retag.
- ECR tag = upstream release tag verbatim (e.g. v0.9.5, not v9.5) — the
  0. prefix is preserved end-to-end through to the CDK pin in the infra
  repo.

….11.3-20260902-204900

…tching

Follow-up to the provider-icon restore. Four gaps in the icon matching,
all verified against the 104 model ids our OpenAI-compatible gateway
actually serves (102 now resolve; the 2 that don't are a Flexion custom
model and the built-in arena-model placeholder, neither of which should
have a provider icon).

- xAI / Grok: new provider key "xai" -> grok.png, plus a "grok-" alias so
  bare ids like 'grok-4-latest' resolve. The dotted Bedrock form
  'us.xai.grok-4-fast' resolves via the existing first-segment logic.
- GLM / ChatGLM: new provider key "glm" -> glm.png plus a "glm-" alias.
  The alias is REQUIRED, not cosmetic: 'glm-4.5' contains a literal dot
  in its version, so without the alias the dot-split fallback yields a
  bogus provider 'glm-4' and no icon. Also added "zai" -> glm.png, since
  the gateway serves GLM as 'zai.glm-4.7-flash' / 'zai.glm-5' rather than
  the bare form.
- Moonshot / Kimi: no new asset needed; wired the existing moonshot.png
  up via a "moonshotai." alias (the gateway's vendor segment is
  'moonshotai', not 'moonshot') and a "kimi-" alias for bare ids.
  'moonshotai.kimi-k2.5' previously fell through to the favicon.
- Anthropic: replaced anthropic.png with the orange Claude mark (it was a
  generic black Anthropic wordmark) and added a "claude-" alias so direct
  Anthropic API ids like 'claude-3-5-sonnet-20241022' — which have no
  'anthropic.' segment — resolve, closing the same gap the 'gpt-' alias
  closes for OpenAI.

New icons are sourced from lobehub/lobe-icons (simple-icons has no xAI or
GLM entry), normalized to 128x128 on white to match the existing set.
They are real PNGs rather than the JPEG-with-.png-extension the existing
16 assets use, which matches the endpoint's declared image/png.

providers.json gains _alias_note / _glm_note so the non-obvious aliases
are not deleted later as redundant.

….11.3-20260902-204900

Round 2: Grok/xAI + GLM providers, Kimi and Claude matching fixes,
orange Claude mark replacing the generic Anthropic wordmark.

The frontend build stage OOMs on our ARM CI runner ("FATAL ERROR:
Ineffective mark-compacts near heap limit" during `vite build`),
confirmed while publishing this branch to ECR for dev deployment.
Upstream ships this line commented out too (same in the real v0.11.3
tag) - just needed for our build environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Runner has 4 CPU/15.5GB RAM, plenty of headroom - the 4096MB V8
old-space ceiling was just too low for this bundle's actual memory
needs, not real system memory pressure.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…b1c2d3e4f5

Repoints upstream's first v0.11.x revision, 3c9b0ca343fd, from
'a0b1c2d3e4f5' to 'flex0001_dup_email_repair'.

Without this, merging both this sync and #35 leaves TWO ALEMBIC HEADS.
'a0b1c2d3e4f5' is the fork's current migration head, and it would be the
parent of both upstream's 3c9b0ca343fd and the fork's new
flex0001_dup_email_repair. backend/open_webui/config.py:74 calls
command.upgrade(cfg, 'head'), which does not tolerate that:

  CommandError: Multiple head revisions are present for given argument
  'head'; please specify a specific target revision, '<branchname>@Head'
  to narrow to a specific head, or 'heads' for all heads

That is a boot-time crash loop, not a degraded start, and it appears only
after both PRs have landed - the point at which everyone believes the work
is done. Reproduced against the real Alembic resolver, not reasoned about.

Chaining the v0.11.x series onto the repair instead linearises the graph
and puts the repair ahead of all 16 v0.11.x revisions rather than merely
ahead of the unique-email index. A database restored from a pre-2026-09-03
backup is stamped at a0b1c2d3e4f5, so the repair becomes the first
revision applied - before f0bd01a18a3d_add_unique_normalized_user_email_index,
the revision those duplicate rows would otherwise block.

ORDERING REQUIREMENT: #35 must merge to flex before this PR does.
flex0001_dup_email_repair exists only on fix/duplicate-user-email-repair-migration.
Until it lands on flex, this branch's chain references a revision that is
not present and Alembic raises KeyError: 'flex0001_dup_email_repair'.
That failure is deliberate and is the safer of the two: it names the
missing revision, so it points at the change that is absent, whereas
"multiple head revisions are present" names nothing. The repair migration
is deliberately NOT copied onto this branch - doing so would land a
destructive user/auth row merge through a PR titled "upstream sync",
bypassing the review #35 exists to receive.

Verified: with flex0001 present, `alembic heads` -> ['d4c1a8e37b62'],
exactly one head, 59 revisions; #35's test_single_head passes. With the
repoint reverted, that same test fails with two heads.

Refs #35
Refs flexion/flexion-open-webui-infra#580

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PLRr6UnzNNqtSQZPFKZjig