Repository navigation
release: v1.16.4 — 配置部署与存储迁移 - #326
Merged
Merged
Conversation
Back-merge the completed v1.16.2 release and prepare the next cumulative development target.
落库前对 request_text / response_text / response_raw_text 各跑一遍截断器，达到门槛的 base64 载荷写入内容寻址 blob 库，正文替换为 [qq:blob sha256=<hex> bytes=<n>] 占位符，替换后报文仍是合法 JSON。 llm_http_traces 新增 media_truncation 列记录 splice 清单与全文哈希；旧行 NULL 视作原样存储。读路径默认返回占位符文本，新增按 sha 的 blob 下载端点与 restore 参数。 每日留存清理之后按剩余行的引用集合 mark-sweep 无引用 blob，24h 保守带规避「blob 已写入、引用行尚未提交」的并发窗口。 由 LLM_TRACE_MEDIA_MIN_BYTES 控制，未设置或为 0 时原样存储，回滚即关开关。 Closes #291
Merge the released Responses compatibility hotfix with its tests and documentation. Begin 1.16.4-dev.0 because the hotfix occupies 1.16.3.
chore: back-merge v1.16.3 into dev
- Resolve client IP by walking X-Forwarded-For right-to-left and taking the rightmost untrusted hop; client-supplied XFF values can no longer bypass login throttling or pin bans on arbitrary IPs - Replace prefix-string trusted-proxy check with ipaddress is_private/is_loopback so public ranges like 172.64.0.0/10 are no longer trusted (RFC1918 is 172.16.0.0/12) - Cap the login failure/ban trackers and sweep expired entries so forged source IPs cannot grow web process memory unboundedly - Add absolute session lifetime WEB_ADMIN_SESSION_MAX_AGE_HOURS (default 168h): sliding renewal can no longer extend a session past creation + max age; existing sessions are invalidated on upgrade - Store only the SHA-256 hash of session ids in web_admin_sessions.db; plaintext ids stay in the browser cookie - Keep the frontend authenticated state when the logout request fails, and tell the admin the session is still valid instead of showing a logged-out UI - docs/admin/web-admin.md: recommend overwrite semantics for X-Forwarded-For (proxy_set_header X-Forwarded-For $remote_addr) and add an nginx limit_req example for /ops/
- Serve CSP, X-Frame-Options, X-Content-Type-Options and Referrer-Policy on every Web Admin response (static pages and API) - Stop exposing /docs, /redoc and /openapi.json on the admin API; the public machine contract for llm-configuration keeps being exported in-process by scripts/ci/export_llm_configuration_openapi.py
- Tieba sync has real side effects (external fetching, pool rewrite), so it is now triggered with POST instead of GET, restoring the GET-has-no-side-effects assumption behind the same-origin check exemption; the frontend consumes the progress stream with fetch + AbortController (EventSource only supports GET) and aborts it when the page scope is disposed - Stop echoing internal exception text in 5xx responses of tieba peek and wordcloud rendering (may contain server paths); clients get a generic message while the real exception goes to the service log - Tieba thread links accept only http/https; any other scheme returned upstream falls back to the canonical thread URL
- Cap both login trackers at 4096 entries with oldest-key eviction: the fails table previously stopped tracking new sources at capacity (a throttling vacuum for brute force), and the bans table had no cap at all; comment now matches behavior - Treat a corrupted session created_at as expired (delete + 401) instead of fail-open - Log tieba peek 502 failures with logger.exception for traceback parity with the wordcloud routes - Drop the dead app.openapi enrich monkeypatch: no HTTP entry remains since the docs endpoints were hidden, and the in-process export path is unaffected - docs: configuration.md gains the WEB_ADMIN_SESSION_MAX_AGE_HOURS row; web-admin.md and the client_ip docstring now state the trusted-proxy assumption (a public front proxy such as a CDN/LB makes the limiter key the proxy egress; never bind the admin directly to an untrusted L2 network)
- Vite 5 to 8, @vitejs/plugin-vue 5 to 6; clears 7 known vulnerabilities in transitive build deps (vite, esbuild, postcss, nanoid, source-map-js); pnpm audit is now clean - Bump dompurify to 3.4.17, Vue to 3.5.44 (includes @vue/server-renderer security fix), marked to 18.1.1 - Migrate the icon library from lucide-vue-next to the officially maintained @lucide/vue; icon names and rendering stay unchanged - CI frontend job now audits production dependencies (pnpm audit --prod --audit-level=high) - vite.config.ts switches to vitest/config and registers the @ alias plus the tests/unit include glob, preparing the vitest stack - Login form gains autocomplete attributes (username / current-password) so password managers recognize it
- New tests/unit/ vitest stack (happy-dom) alongside the existing node --test *.test.cjs harness; pnpm test runs both - Covers the request helper, router/nav consistency, UiIcon mapping and the useAuth composable
- All routes except the home dashboard are now lazy route-level dynamic imports derived from nav.ts; datepicker styles load with the pages that need them. First-screen JS drops from ~858KB (gzip 291KB) to ~187KB (gzip 69KB), first-screen CSS from ~221KB to ~43KB - Pause background polling while the tab is hidden and resume on return: epochs 60s snapshot, llm-config 5s status poll, cron dashboard 30s refresh, status-bar heartbeat clock; a hidden tab no longer submits snapshot jobs or status requests to the bot process - Exponential backoff on consecutive poll failures: llm-config 5s doubling up to 30s, cron dashboard 30s up to 120s, diagnostic result reads 1s up to 10s; success resets the cadence - Epochs dashboard dedupes in-flight snapshot refreshes, and the timeline cursor moves through a lightweight incremental channel instead of resetting the whole chart option - Logs-live precomputes level colors at ingest; logs-trace keeps events ordered at insert instead of re-sorting per event - Load-more lists (conversations, quotes, tieba pool) stop at a 500-entry soft cap and point to keyword filtering - Remove the unused useAsyncData composable
- Page-header action groups wrap onto their own row on narrow screens, so save/create/install buttons stay reachable without horizontal scrolling; epochs, llm-usage and tieba pages no longer overflow sideways - Audit log switches from a squeezed table to per-entry cards on mobile, with full action/target badges and expandable before/after summaries - Persona list, group-LLM override list and the config file list no longer collapse into tiny inner scroll windows on phones; group selectors take a full row - Empty states and wording pass: selection hints for memory/quotes, cron dashboard distinguishes bot-not-reporting vs stale snapshot vs no tasks, diagnostics shows an explicit banner when the bot is offline, stats explains data provenance, logs-archive stops double prompting, logs-live reports connected-but-waiting, direction-neutral wording for personas/skills/tieba/logs-archive - Tieba sync-all asks for confirmation before firing multi-round external fetching - LLM config channel list becomes a native select on narrow screens (with protocol, model count and disabled marker); skill preset sync title no longer breaks mid-word - Light-theme warn badge text darkened to readable contrast (dark theme unchanged); niuniu text-mode select gains a placeholder - llm-config.test.cjs gains the polling backoff and hidden-tab cases pinning the store changes from the perf commit
- Summary reading view: the report body no longer gets squeezed into a small inner pane; toolbar and health cards hide while reading, the body card follows content height and the whole page scrolls; entering reading scrolls to top, returning restores the list scroll position - LLM config page scrolls at page level end to end: the viewport lock and per-section inner scroll panes are gone, the side nav and channel list stick to the viewport top instead, and the old 60vh patch chain is removed; raw-content caps (JSON preview, MCP tool list) stay - Remove the page-view-fill lock chain from config, skills, llm-about and conversations: left list panels become sticky, editors keep the agreed 55-60vh min height, and mobile breakpoints are unchanged. Skills desktop no longer crushes the file table to one line (48px) and the editor to a third of the screen when a file is open - App.vue: drop the now-consumer-less :has(> .page-view-fill) rule and register the __qqToggleTheme debug hook in dev builds only
- New frontend/README.md as the entry point for the Web Admin frontend module: stack, directory conventions, dev commands, the dual test stacks and the deployment shape - docs/dev/architecture.md documents the frontend/ engineering layer; docs/dev/style.md records the nav.ts single-source-of-truth and vitest-first testing conventions; docs/index.md links the new entry
- An aborted sync stream no longer fires onDone/onMessage: closing the old stream on re-entry or unmount previously let its async completion clobber the new stream's state (handle cleared, syncing reset, extra onSynced refresh) and fired callbacks after the component was gone - HTTP errors (401/403/405/500) now surface as a status line in the sync log instead of silently reporting completion
- Soft-cap notice no longer masks the end-of-list hint in tieba and conversations when the server actually has no more entries - Epochs dashboard: a manual snapshot click colliding with an in-flight auto refresh now shows loading feedback instead of being silently dropped - Cron dashboard: snapshot staleness now re-evaluates on every poll cycle while the page stays open, so the empty state flips to the stale variant when the bot dies mid-session - frontend README: views/ holds 29 routed pages plus the statically imported login gate, not 30
fix(security): Web Admin 登录限流、会话与 API 表面安全加固
fix(web-admin): 前端全面排查修复——移动端、阅读视图、性能与测试基建
Render historical triggers with stored identity, quotes and captions. Preserve independent signed Gemini stream parts and trace model paths.
Append stable historical expressions and rebuild on source, profile or budget changes while preserving complete Loop boundaries. Refresh activity around provider calls and advance affected epochs before retention cleanup.
Report request cache hits, reporting coverage, frozen history and model-specific epoch parameters. Document historical freezing, transient envelopes and complete Loop budget handling; synchronize bundled references.
fix(llm): 稳定纪元历史回放与缓存诊断
Add 18 historical ADRs, a 35-term glossary, and documentation navigation and contribution guidance. Validate ADR status and replacement metadata during self-docs synchronization, and cover indexed search and resource reads.
docs: introduce ADRs and project glossary
Coordinate blob writes and GC across processes, enforce attachment downloads, and preserve ordinary text with protocol-aware extraction. Validate restoration manifests, bound parser memory, clear orphan media, and cover storage and HTTP integration paths.
…dia-single-copy feat(llm): trace 报文内联 base64 媒体的单副本存储
Pin rollback revisions, repair start fences on retry, retain legacy service states, and install local staged drafts as their intended target. Validate candidate Compose before pausing, refresh overrides and container identities, and keep staged credentials available for deployment rollback. Avoid unchanged rule-switch shutdown writes.
Freeze the helper image and project identity before writes, establish maintenance ownership before recording preparation, and preserve unchanged rule configuration bytes. Exercise an interrupted environment write against real Docker in CI.
Keep the pending operation after worker persistence failures; preserve hybrid source mounts and the actual default Compose project name in frozen recovery context. Cover the real worker error envelope and an image without the sync module using mounted application code.
Let native startup acquire its real leases after brief status observations, and remove the redundant service-lock preflight that could mistake a probe for a running process. Add real subprocess regressions for both locks and expose startup logs on test failures.
Open control records with read/write/delete sharing so status polling permits atomic state publication on Windows. Exercise replacing a record while a reader retains the old version and preserve missing-file behavior.
Coordinate control-record reads and atomic publication with a short per-record lock, covering Windows target-file replacement semantics without platform-specific handle code. Route all supervisor and request writes through the same protocol and test the real reader/writer handoff.
feat(config): add directional qqsync deployment
Retry only Windows access/sharing denials for up to one second while publishing a control record, and keep target-file inspection inside its IO lock. Exercise OS replacement failures and five consecutive restarts per native role.
fix(config): tolerate transient Windows control I/O
Group deployment, monitoring and maintenance scripts by task; retain production configuration and private audit hooks separately. Update Docker builds, deployment recovery, platform clients, documentation and regression coverage together.
Build the PowerShell upload directory after reading connection defaults from the project environment.
Keep legacy Compose builds working from the tracked Dockerfile, update Windows packaging paths and bound private hook shutdown. Exercise staged pull configuration, forced hook termination, packaged Windows helpers and the legacy Docker build entrypoint.
Check the relocated maintenance script path in the existing release distribution regression test.
refactor(ops): 统一分发运维程序并整理目录
Ship the managed SearXNG configuration during bootstrap and preserve an existing server copy when synchronization is disabled. Exercise actual manifest archives and release transactions for both legacy configuration states.
fix(deploy): 保留首次升级的受管搜索配置
Use unbounded logarithmic rewards, half-loss PvP settlement and harmless draws; commit player lengths and records atomically. Ship an offline reset candidate tool with tests, packaging checks, configuration guidance and synchronized self-docs.
Copy the niuniu reset helper into the root Dockerfile used by releases and exercise it in both release and production images during PR CI.
Validate that stored floating-point lengths represent each intended change to 0.01 cm before reporting success or committing records and cooldowns. Cover swallowed and quantized rewards for PvP and bot duels with real SQLite regressions, and document the offline reset recovery.
Use logarithmic fencing rewards, atomic settlements and an offline reset tool. Independent CR and five-domain Deep-CR findings are resolved; final CI passed. The maintainer accepted the incomplete Bot review and approved head 34ac75d.
Advance the development checkpoint after merging niuniu PR #325.
Show the offline migration command after configuration initialization fails, retaining the explicit backup and stop steps.
Share candidate and tag builds, smoke extracted Windows ZIPs and Docker images, and exercise actual v1.16.3 storage through migration, failure recovery, rollback and restart without external accounts.
Document the breaking storage upgrade, configuration synchronization defaults and rollback steps for source, Windows and Docker installations. Refresh release notes and self-docs.
![khpilot[bot]](https://avatars.githubusercontent.com/u/178400596?s=60&v=4){kind=small}
There was a problem hiding this comment.
Bot Review — 💬 Comment
本次发布 PR 规模极大（447 文件、+24k/-3k），覆盖 qqconf/qqsync 配置同步、配置与运行时存储分离、部署脚本重构及大量文档/ADR。在有限输入预算内仅完成了整体 diff 定位与 web 认证/限流改动的详细审阅（auth.py 的登录限流有界化与会话最长有效期引入实现合理，未见缺陷），其余核心新增模块（config_sync、config_workspace、configuration 存储迁移、部署工作流、前端配置编辑）均未能逐行核对，无法给出 approve 或 request_changes 的可靠结论。
No findings reported.
Review provenance
- General reviewer: incomplete — agent session submitted a partial review (Input budget limited review coverage; earlier tool output may be truncated. Only auth.py/client_ip.py area reviewed in detail.)
- Style: included in the same agent review
- Coverage: incomplete — manifest=incomplete; general=incomplete(Input budget limited review coverage; earlier tool output may be truncated. Only auth.py/client_ip.py area reviewed in detail.); style=absent
- Reviewed head:
dbc3464(base98c20c5)
Automated review by @KHPilot. Reply with @KHPilot to ask follow-up questions.
Publish the accepted Docker image through a checksummed artifact and verify its image ID, revision and version. Reap timed-out stage process trees and named containers while preserving diagnostics.
Distinguish schema-3 flat upgrades from migrated installations and document configuration push defaults and the writable managed mount.
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.16.4 交付 qqconf/qqsync 配置编辑与部署、配置和运行存储分离，以及后台、历史回放、Trace 和牛牛结算改进。1.16.3 用户需要停服迁移；CHANGELOG 开头与存储迁移指南提供源码、Windows 包、本地 Docker、云端 Docker 的升级及反向转换步骤。
范围与基线
发布准备
Release CR
独立发布专项 CR、五个独立 Deep-CR 透镜以及修复增量复审完成。
验证
授权与发布门
维护者已提前授权本任务的提交、推送、创建PR和合并。最终候选全部CI成功且评审完成后，以merge commit合入main，不重复请求合并许可，不绕过分支保护。
创建和推送 v1.16.4 tag 需要维护者单独确认准确目标 SHA。 合并后再次核对main的CI与候选产物，再提交tag名、SHA和验收结果供确认。合并本PR不触发正式发行。
合并后验收
eec357e82b991472817ef5db5c0a68f8bcc46386，文件树与最终准备候选一致。v1.16.4tag。下一步为维护者确认此准确 SHA 后创建并推送 tag，正式发行后再回灌 dev、进入 1.16.5-dev 并清理已发布草稿。