Skip to main content

TideCloak 0.14.25

Summary​

TideCloak 0.14.25 rolls together everything since 0.14.20 — the 0.14.23 cut is folded in; 0.14.21, 0.14.22, and 0.14.24 were staging or npm-bump-only releases. The headline is a SWE Enclave error-UX overhaul: inline auth errors, friendly per-code messages with codes hidden, a redesigned support-report flow, and anti-enumeration on sign-in. It also patches GHSA-m93f-wj8c-rp8p, bumps nanoid, adds a ~400 ms active-ORK lookup speedup, and fixes a tide-js custom-model detection prefix that was preventing the approval enclave from resolving custom models.

Key Features​

SWE Enclave Error Handling Overhaul : Errors on sign-in, account creation, passwordless, and mobile QR authentication now stay inline on the relevant card instead of redirecting to a full-page error screen. Technical details are collapsed by default, empty fields hidden, and raw error codes are removed from the main message — surfaced only in the per-error report page and toast. A compact report icon opens the error detail (with a fix for orphaned icons after users navigate back). Friendly per-code i18n across English and Simplified Chinese for first-screen errors, invalid account states, throttling, and threshold-related tide-js errors.

Report-Email Flow Improvements : The support report email flow prefills support@tide.org, renames the action to Compose email, uses an ASCII-safe mailto subject, and matches the generated email body with the What will be sent preview.

Anti-Enumeration on Sign-In : A non-existent user now receives the same Invalid username or password message as an incorrect password, and the surface returns a clean 404 instead of a 500. The sign-in error surface no longer distinguishes "user does not exist" from "wrong credentials".

Security Updates : Patches GHSA-m93f-wj8c-rp8p, plus a nanoid version bump.

Active-ORK Lookup Performance : Roughly 400 ms faster active-ORK lookup.

tide-js Custom-Model Detection Fix : The custom-model detection prefix has been changed from Custom<X> to BasicCustom<X> to match the actual registered model type. Custom was never a registered model, so anything emitted with the old prefix would fail immediately — which meant the approval enclave could never resolve a model starting with Custom. With BasicCustom<X> the approval enclave now finds the model as intended.

Release-Pipeline Tooling : PushRelease now skips unchanged NPM packages, avoiding no-op version bumps in the release workflow.

Enclave SRI : sha256-OkLyIvyiyzjTIt/T3bC8pIpdriC23C9LzL8W1YAS1Rk=

Upgrade Notes (0.14.20 → 0.14.25)​

  • No breaking changes. The tide-js custom-model prefix change is a bug fix — the old Custom<X> prefix never resolved, so no working consumer relied on it.
  • 0.14.21, 0.14.22, and 0.14.24 were staging or npm-bump-only releases; 0.14.23 was an internal cut folded into 0.14.25.

Detailed changelog​

For a granular per-repository breakdown of changes, see the detailed changelog.