EvoScientist-WebUI/CHANGELOG.md

Changelog

All notable changes to EvoScientist WebUI are documented in this file.

Unreleased

Added

• Optional single-user WebUI authentication. Credentials are read from .env, pages and API routes are protected by a signed HTTP-only session cookie, and successful logins record their latest timestamp and counter in the local EvoScientist data directory.
• Added an authenticated change-password dialog. It verifies the current password, atomically updates .env, rotates the session signing key, and invalidates prior sessions.

Fixed

• Prevented React's Maximum update depth exceeded error during chat runs. Reading LangGraph SDK stream.values or stream.messages implicitly enabled high-frequency stream modes, allowing repeated external-store notifications to nest React updates.

Changed

• Chat runs now use updates-only streaming and refresh the persisted thread record when a run completes or pauses for approval. The UI keeps the optimistic user message and loading state during a run, then renders the complete saved conversation, tasks, files, and interrupt state after the server persists it.
• Removed SDK stream-object propagation into message and tool components so no downstream component can accidentally re-enable high-frequency value or message-tuple subscriptions.