[pull] main from open-webui:main

.env.example

@@ -16,6 +16,9 @@ CORS_ALLOW_ORIGIN='*'
 # Set to false to keep memory tools enabled without adding memory context to the system context.
 ENABLE_MEMORY_SYSTEM_CONTEXT=true
 
+# Set to false to disable workspace Tools and Functions.
+ENABLE_PLUGINS=true
+
 # For production you should set this to match the proxy configuration (127.0.0.1)
 FORWARDED_ALLOW_IPS='*'
 

.github/workflows/docker.yaml

@@ -75,6 +75,17 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Prepare CI Dockerfile
+        run: |
+          awk '
+            /^FROM --platform=\$BUILDPLATFORM node:/ {
+              print
+              print "ENV NODE_OPTIONS=\"--max-old-space-size=12288\""
+              next
+            }
+            { print }
+          ' Dockerfile > "${RUNNER_TEMP}/Dockerfile"
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
         with:
@@ -115,6 +126,7 @@ jobs:
         id: build
         with:
           context: .
+          file: ${{ runner.temp }}/Dockerfile
           push: true
           platforms: ${{ matrix.platform.arch }}
           labels: ${{ steps.meta.outputs.labels }}

.github/workflows/frontend.yaml

@@ -43,6 +43,8 @@ jobs:
 
       - name: Production build
         run: npm run build
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
 
   # ── Vitest unit tests ────────────────────────────────────────────────────
   unit-tests:

.github/workflows/issue-label.yaml

@@ -0,0 +1,43 @@
+name: Issue Labeler
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  label-bug-reports:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add "bug" label to unlabeled bug reports
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const issue = context.payload.issue;
+
+            // Web-form submissions already carry the label from the issue template
+            if (issue.labels.some((label) => label.name === 'bug')) {
+              return;
+            }
+
+            const title = issue.title ?? '';
+            const body = issue.body ?? '';
+
+            // Freeform bug reports: "issue: ...", "bug: ...", "fix: ...", "[Bug] ...", "issue/UX: ..."
+            const bugLikeTitle = /^\s*\[?(bug|issue|fix)\]?\s*[:/\-]/i.test(title);
+
+            // API/CLI-created issues that reproduce the bug report form structure.
+            // Only headings distinctive to the bug form (both are required fields there) —
+            // generic headings like "Expected Behavior" also appear in freeform feature requests.
+            const bugFormBody = /###\s*(Installation Method|Open WebUI Version)/i.test(body);
+
+            if (bugLikeTitle || bugFormBody) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                labels: ['bug']
+              });
+            }

Dockerfile

@@ -184,6 +184,17 @@ COPY --chown=$UID:$GID --from=build /app/package.json /app/package.json
 # copy backend files
 COPY --chown=$UID:$GID ./backend .
 
+# The backend rewrites its bundled static assets (favicons, splash, manifest,
+# loader.js, ...) under open_webui/static at startup. Make that directory
+# writable by an arbitrary UID -- which under OpenShift's restricted SCC is
+# always a member of GID 0 -- so those writes don't fail with EACCES and crash
+# the boot log with "[Errno 13] Permission denied". `chmod -R g=u` mirrors the
+# owner bits onto the group (the Red Hat arbitrary-UID idiom). This is applied
+# unconditionally because it targets a directory the app writes on every start;
+# the broader, opt-in USE_PERMISSION_HARDENING below covers the rest of /app.
+RUN chgrp -R 0 /app/backend/open_webui/static && \
+    chmod -R g=u /app/backend/open_webui/static
+
 EXPOSE 8080
 
 HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq -ne 'input.status == true' || exit 1

README.md

@@ -93,11 +93,9 @@ Want to learn more about Open WebUI's features? Check out our [Open WebUI docume
 
 Open WebUI is the core, surrounded by companion apps and infrastructure that extend what your AI can do, where it can reach, and how you run it:
 
-- ⚡ **Open Terminal** ([open-webui/open-terminal](https://github.com/open-webui/open-terminal)): A self-hosted computing environment that plugs into Open WebUI, giving the AI a place to write code, run it, read output, fix errors, and iterate inside the chat.
+- 💻 **Open WebUI Computer** ([open-webui/computer](https://github.com/open-webui/computer)): A standalone, mobile-first computer and coding agent that runs on the machine you own. Files, terminal, and git in a browser tab, reachable from your phone. Connect it into Open WebUI as a model, or reach it from Telegram, WhatsApp, and more.
 
-- 🔒 **Terminals** · Enterprise ([open-webui/terminals](https://github.com/open-webui/terminals)): Per-user isolated containers with separate credentials, resource limits, and network rules. Automatic lifecycle management on Docker or Kubernetes.
-
-- 💻 **cptr** ([open-webui/computer](https://github.com/open-webui/computer)): A standalone, mobile-first computer and coding agent that runs on the machine you own. Files, terminal, and git in a browser tab, reachable from your phone. Connect it into Open WebUI as a model, or reach it from Telegram, WhatsApp, and more.
+- ⚡ **Open Terminal** and **Terminals (Enterprise)** ([open-webui/open-terminal](https://github.com/open-webui/open-terminal) & [open-webui/terminals](https://github.com/open-webui/terminals)): A self-hosted computing environment that plugs into Open WebUI, giving the AI a place to write code, run it, read output, fix errors, and iterate inside the chat. Terminals gives you per-user isolated containers with separate credentials, resource limits, and network rules. Automatic lifecycle management on Docker or Kubernetes.
 
 - 🔄 **oikb** ([open-webui/oikb](https://github.com/open-webui/oikb)): Feed your Knowledge Bases from 45+ sources (GitHub, Confluence, ServiceNow, Salesforce, Jira, Slack, SharePoint, Notion, and more), keeping the tools your team already uses continuously in sync.