Foreground server logo, chat stream trust, and hub edit/scroll polish - #280
Merged
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough本次变更更新服务器图标生命周期、路径 CLI、日志退出码、消息编辑器、滚动导航、流式信任渲染、HTML 清理、本地化结构、推理 Markdown 渲染和仓库描述自动更新。 Changes服务器与路径运行时
聊天界面与内容渲染
仓库描述自动更新
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing Touches✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 71 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 11
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@path/src/cmd/keepalive.ps1`:
- Line 31: 移除两个 keepalive 入口中的重复 debug 解析逻辑：在 path/src/cmd/keepalive.ps1 的 31-31
行对应入口中删除本地 debug_on 及参数剥离分支，直接将 $commandArguments 传给 run_server；在
path/src/cmd/keepalive.sh 的 18-18 行对应入口中删除本地 debug_on 及 shift 分支，直接将 "$@" 传给
run_server，使 debug 解析统一由 run_server 负责。
In `@src/public/locales/ar-SA.json`:
- Around line 2312-2315: Update both the title and aria-label values in the
upload translation object to use “رفع” instead of “تحميل المرفق”, matching the
existing upload wording in the locale file.
In `@src/public/locales/de-DE.json`:
- Line 2316: 统一 de-DE.json 中快捷键提示的按键名称：将该处的 “Strg+Enter” 与同语言环境另一处使用的
“Strg+Eingabe” 保持一致，并保留其余提示文案不变。
In `@src/public/locales/fr-FR.json`:
- Line 2316: Update the hint translation in the locale entry to use the
correctly accented “Échap” spelling and add “pour” so the shortcut actions are
expressed clearly, while preserving the existing Ctrl+Entrée and cancel
semantics.
In `@src/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjs`:
- Line 29: Update the escaping-behavior documentation near the reasoning
renderer to state that reasoning_summary and the正文 are both emitted unchanged,
including preserving markup such as <gamma>; remove the inaccurate claim that
only the summary text is HTML-escaped, while leaving the rendering
implementation unchanged.
In `@src/public/parts/shells/chat/public/hub/hashNav.mjs`:
- Line 46: Remove the unnecessary !channelId fallback from the sameChannel
comparison in src/public/parts/shells/chat/public/hub/hashNav.mjs:46-46,
comparing channelId directly with store.context.currentChannelId. Apply the same
direct comparison in
src/public/parts/shells/chat/public/hub/wiring/bootstrap.mjs:77-77.
In `@src/public/parts/shells/chat/public/src/ui/StreamRenderer.mjs`:
- Around line 111-113: 修正 StreamRenderer 的 HTML 写入逻辑，不要将 innerHTML 视为完整脚本隔离边界：在
src/public/parts/shells/chat/public/src/ui/StreamRenderer.mjs:111-113 的
renderMarkdownAsString/#allowDangerousHtml 路径中仅写入安全档，或为可信档接入完整的事件属性、SVG 事件及
javascript: URL 清洗；同步更新该文件 :3-10 的文件头和构造函数注释，以及
src/public/parts/shells/chat/public/hub/AGENTS.md:16 的相关安全说明。
In `@src/public/parts/shells/chat/test/pure/reasoning_markdown.test.mjs`:
- Line 10: Rename the test variable md to markdown at
src/public/parts/shells/chat/test/pure/reasoning_markdown.test.mjs lines 10-10,
25-25, and 44-44, updating all references at each site accordingly.
- Line 16: Update both CSS class assertions in reasoning_markdown.test.mjs at
lines 16-16 and 30-30 to expect bg-base-200/30 instead of bg-base-200/60,
matching the renderer output.
In `@src/server/index.mjs`:
- Around line 152-154: 在 showIcon 分支中仅当 result === 'started' 时调用
icon.dismiss()；result === 'already_running' 时保留已注册的 on_shutdown 路径，由其调用
icon.farewell()，不要取消进行中的 intro。
- Line 141: 在计算 showIcon 前先调用 server.mjs 的 init()，确保缺失的 starts 对象及 starts.Base
已按默认值补齐；然后复用 init() 产生的配置计算图标状态，使缺失 Base 时保持 true，并避免直接访问未定义的 starts。
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 690ae2fd-d141-46e7-a105-2cb7d740c76a
📒 Files selected for processing (55)
AGENTS.mddeno.jsonimgs/icon_anime/AGENTS.mdimgs/icon_anime/player.mjsimgs/icon_anime/session.mjspath/src/cmd/keepalive.ps1path/src/cmd/keepalive.shpath/src/cmd/server.ps1path/src/cmd/server.shpath/src/run.ps1path/src/run.shsrc/decl/locale_data.tssrc/log_viewer/index.mjssrc/log_viewer/interactive.mjssrc/public/locales/ar-SA.jsonsrc/public/locales/de-DE.jsonsrc/public/locales/emoji.jsonsrc/public/locales/en-UK.jsonsrc/public/locales/es-ES.jsonsrc/public/locales/fr-FR.jsonsrc/public/locales/hi-IN.jsonsrc/public/locales/is-IS.jsonsrc/public/locales/it-IT.jsonsrc/public/locales/ja-JP.jsonsrc/public/locales/ko-KR.jsonsrc/public/locales/lzh.jsonsrc/public/locales/nl-NL.jsonsrc/public/locales/pt-PT.jsonsrc/public/locales/ru-RU.jsonsrc/public/locales/uk-UA.jsonsrc/public/locales/vi-VN.jsonsrc/public/locales/zh-CN.jsonsrc/public/locales/zh-TW.jsonsrc/public/pages/scripts/i18n/index.mjssrc/public/parts/serviceGenerators/AI/atlascloud/main.mjssrc/public/parts/serviceGenerators/AI/evolink/main.mjssrc/public/parts/serviceGenerators/AI/proxy/main.mjssrc/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjssrc/public/parts/shells/chat/public/hub/AGENTS.mdsrc/public/parts/shells/chat/public/hub/hashNav.mjssrc/public/parts/shells/chat/public/hub/messages/actions/edit.mjssrc/public/parts/shells/chat/public/hub/messages/messageActionsUi.mjssrc/public/parts/shells/chat/public/hub/messages/messageScroll.mjssrc/public/parts/shells/chat/public/hub/stream/volatileSlots.mjssrc/public/parts/shells/chat/public/hub/widgets.csssrc/public/parts/shells/chat/public/hub/wiring/bootstrap.mjssrc/public/parts/shells/chat/public/src/MessagePipeline.mjssrc/public/parts/shells/chat/public/src/templates/hub/messages/edit_area.htmlsrc/public/parts/shells/chat/public/src/templates/hub/messages/edit_body.htmlsrc/public/parts/shells/chat/public/src/templates/hub/messages/edit_channel_body.htmlsrc/public/parts/shells/chat/public/src/templates/hub/messages/edit_user_body.htmlsrc/public/parts/shells/chat/public/src/ui/StreamRenderer.mjssrc/public/parts/shells/chat/src/streaming/toolBlocks.mjssrc/public/parts/shells/chat/test/pure/reasoning_markdown.test.mjssrc/server/index.mjs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
steve02081504/fount-p2p(manual)
💤 Files with no reviewable changes (3)
- src/public/parts/shells/chat/public/src/templates/hub/messages/edit_user_body.html
- src/public/parts/shells/chat/public/src/templates/hub/messages/edit_area.html
- src/public/parts/shells/chat/public/src/templates/hub/messages/edit_channel_body.html
| } | ||
| } | ||
|
|
||
| const showIcon = Boolean(fount_config.needs_output && fount_config.starts.Base) |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
先对齐 init() 的默认值，再计算 showIcon。
Line 141 在调用 init() 前直接读取 fount_config.starts.Base。当配置省略 starts 时，服务器会先抛出 TypeError。当 starts 存在但没有 Base 时，图标也会错误地被关闭。
init() 已将缺失的 starts.Base 默认设为 true。这里必须复用同一语义。
建议修正
-const showIcon = Boolean(fount_config.needs_output && fount_config.starts.Base)
+const showIcon = Boolean(fount_config.needs_output && (fount_config.starts?.Base ?? true))根据提供的上游合约，src/server/server.mjs:init() 会在缺失 starts 时补齐对象，并将 Base 默认设为 true。
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const showIcon = Boolean(fount_config.needs_output && fount_config.starts.Base) | |
| const showIcon = Boolean(fount_config.needs_output && (fount_config.starts?.Base ?? true)) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/server/index.mjs` at line 141, 在计算 showIcon 前先调用 server.mjs 的
init()，确保缺失的 starts 对象及 starts.Base 已按默认值补齐；然后复用 init() 产生的配置计算图标状态，使缺失 Base 时保持
true，并避免直接访问未定义的 starts。
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjs (1)
42-58: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win将推理正文转为 Markdown 再插入详情容器。
reasoningContent和reasoningSummary仍带原始 Markdown，例如代码围栏在渲染后会原样保留而不是变成代码块；reasoningRenderer.mjs/测试中应覆盖带围栏的渲染结果，或先渲染正文再拼回<div class="collapse-content">。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjs` around lines 42 - 58, Update the rendering flow around the reasoningContent body assembly and the collapse-content output so the combined reasoning text is converted from Markdown to HTML before insertion, preserving fenced code blocks as rendered code blocks. Use the existing Markdown renderer, and add or update reasoningRenderer.mjs tests to cover fenced-code rendering within the details container.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/public/pages/scripts/lib/sanitizeHtml.mjs`:
- Around line 79-80: Update collectDescendants() and the traversal used by
scrubHtmlActivePayload(root) and sanitizeHtmlTree(root) in
src/public/pages/scripts/lib/sanitizeHtml.mjs:79-80,116-119 to process root
itself before or while traversing all descendants through the same
attribute-sanitization flow. Add coverage in
src/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs:63-68 by
placing an onclick or dangerous URL on the host root and asserting the attribute
is removed after sanitization.
---
Outside diff comments:
In `@src/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjs`:
- Around line 42-58: Update the rendering flow around the reasoningContent body
assembly and the collapse-content output so the combined reasoning text is
converted from Markdown to HTML before insertion, preserving fenced code blocks
as rendered code blocks. Use the existing Markdown renderer, and add or update
reasoningRenderer.mjs tests to cover fenced-code rendering within the details
container.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 12889486-3596-49b3-9db3-6b442503f743
📒 Files selected for processing (15)
path/src/cmd/keepalive.ps1path/src/cmd/keepalive.shsrc/public/locales/ar-SA.jsonsrc/public/locales/de-DE.jsonsrc/public/locales/fr-FR.jsonsrc/public/pages/AGENTS.mdsrc/public/pages/scripts/lib/sanitizeHtml.mjssrc/public/parts/serviceGenerators/AI/proxy/src/reasoningRenderer.mjssrc/public/parts/shells/chat/public/hub/AGENTS.mdsrc/public/parts/shells/chat/public/hub/hashNav.mjssrc/public/parts/shells/chat/public/hub/wiring/bootstrap.mjssrc/public/parts/shells/chat/public/src/ui/StreamRenderer.mjssrc/public/parts/shells/chat/test/pure/reasoning_markdown.test.mjssrc/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjssrc/server/index.mjs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
steve02081504/fount-p2p(manual)
💤 Files with no reviewable changes (1)
- path/src/cmd/keepalive.sh
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/public/pages/scripts/lib/sanitizeHtml.mjs`:
- Around line 79-80: 在 collectDescendants() 的非元素根节点分支中，移除对 root.childNodes
的展开数组分配，直接使用 root.childNodes 进行只读遍历；保留元素节点分支及现有 walk(child) 处理逻辑不变。
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5985a2d9-b527-4fa4-bdb5-f31525dbecd3
📒 Files selected for processing (2)
src/public/pages/scripts/lib/sanitizeHtml.mjssrc/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
steve02081504/fount-p2p(manual)
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/public/pages/scripts/lib/sanitizeHtml.mjs (2)
127-136: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win在不可信 HTML 路径中移除
style属性。Line 127-136 只移除危险标签和活动属性。它不会清除
style中的 CSS。
sanitizePermissiveHtml()会处理displayName和subtitle，随后由src/public/parts/shells/chat/public/hub/mentionAutocomplete.mjs:64-94写入innerHTML。攻击者可以注入定位样式覆盖控件，也可以通过 CSSurl(...)发起外部请求。请在
sanitizeHtmlTree()的不可信路径中删除style，或只允许严格的 CSS 属性和值。不要把该规则无条件应用到允许可信 Markdown 的scrubHtmlActivePayload()。建议修改
- if (BLOCKED_HTML_TAGS.has(tagName)) + if (BLOCKED_HTML_TAGS.has(tagName)) { el.remove() + continue + } + el.removeAttribute('style')As per path instructions: 对富文本或用户控制内容使用共享清洗工具，并拒绝危险 URL scheme；不可信 CSS 内容也必须纳入清洗范围。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/public/pages/scripts/lib/sanitizeHtml.mjs` around lines 127 - 136, Update sanitizeHtmlTree to remove or strictly sanitize style attributes on every element in the untrusted HTML path, including CSS values that can trigger external requests or positioning attacks. Keep scrubHtmlActivePayload’s trusted Markdown behavior unchanged and continue using the shared sanitization flow.Source: Path instructions
92-105: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win使用完整变量名替代
el和attr。Line 92-105 使用缩写。安全清洗代码应直接使用
element和attribute，避免审计时产生歧义。建议修改
- const el = /** `@type` {Element} */ (node) - for (const attr of [...el.attributes]) { - const lowerName = attr.name.toLowerCase() + const element = /** `@type` {Element} */ (node) + for (const attribute of [...element.attributes]) { + const lowerName = attribute.name.toLowerCase() if (lowerName.startsWith('on')) { - el.removeAttribute(attr.name) + element.removeAttribute(attribute.name) continue } if (!URL_HTML_ATTRIBUTES.has(lowerName)) continue if (lowerName === 'srcset') { - el.removeAttribute(attr.name) + element.removeAttribute(attribute.name) continue } - if (!isSafeHtmlUrl(attr.value)) - el.removeAttribute(attr.name) + if (!isSafeHtmlUrl(attribute.value)) + element.removeAttribute(attribute.name)As per path instructions: 命名应使用可读的完整词，不使用难以理解的缩写。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/public/pages/scripts/lib/sanitizeHtml.mjs` around lines 92 - 105, 在节点属性清洗逻辑中，将变量名 el 和 attr 分别重命名为 element 和 attribute，并同步更新该循环内所有引用；保持现有 sanitizeHtml 清洗行为不变。Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/public/pages/scripts/lib/sanitizeHtml.mjs`:
- Around line 127-136: Update sanitizeHtmlTree to remove or strictly sanitize
style attributes on every element in the untrusted HTML path, including CSS
values that can trigger external requests or positioning attacks. Keep
scrubHtmlActivePayload’s trusted Markdown behavior unchanged and continue using
the shared sanitization flow.
- Around line 92-105: 在节点属性清洗逻辑中，将变量名 el 和 attr 分别重命名为 element 和
attribute，并同步更新该循环内所有引用；保持现有 sanitizeHtml 清洗行为不变。
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 44f5adac-ada1-425e-9e14-9d9830e9c4b0
📒 Files selected for processing (1)
src/public/pages/scripts/lib/sanitizeHtml.mjs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
steve02081504/fount-p2p(manual)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+21
to
+38
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - name: Update description | ||
| id: update | ||
| uses: ./.github/actions/update-repo-description | ||
| with: | ||
| token: ${{ secrets.GH_TOKEN }} | ||
| date: ${{ github.event.inputs.date || '' }} | ||
| - name: Summary | ||
| run: | | ||
| { | ||
| echo "### Repo description updated" | ||
| echo "" | ||
| echo "- **date:** \`${{ steps.update.outputs.date }}\`" | ||
| echo "- **holiday:** \`${{ steps.update.outputs.holiday || '(none)' }}\`" | ||
| echo "- **description:** ${{ steps.update.outputs.description }}" | ||
| } >> "$GITHUB_STEP_SUMMARY" |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/public/pages/scripts/lib/sanitizeHtml.mjs (1)
110-115: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win统一 HTML 清理契约。
实现会在 Line 100-102 无条件删除
srcset，并在 Line 136 删除style。当前两处 JSDoc 和AGENTS.md的说明不完整。
src/public/pages/scripts/lib/sanitizeHtml.mjs#L110-L115: 明确移除on*、所有srcset和不安全 URL，并保留style。src/public/pages/scripts/lib/sanitizeHtml.mjs#L1-L4: 补充sanitizePermissiveHtml会移除style。src/public/pages/AGENTS.md#L41-L41: 同步说明srcset会无条件移除。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/public/pages/scripts/lib/sanitizeHtml.mjs` around lines 110 - 115, 统一更新清理契约文档：在 src/public/pages/scripts/lib/sanitizeHtml.mjs 第110-115行的 JSDoc 中明确移除 on* 属性、所有 srcset 和不安全 URL，并保留 style；在同文件第1-4行补充 sanitizePermissiveHtml 会移除 style；在 src/public/pages/AGENTS.md 第41行同步说明 srcset 会被无条件移除。src/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs (1)
75-76: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win内联只使用一次的
returned。
returned只用于下一行比较。直接内联调用，减少无意义绑定。建议修改
- const returned = scrubHtmlActivePayload(host) - assertEquals(returned, host) + assertEquals(scrubHtmlActivePayload(host), host)As per path instructions，禁止只用一次的临时绑定，应直接内联到使用处。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs` around lines 75 - 76, 在 sanitize_display_html 测试中移除仅使用一次的 returned 变量，直接将 scrubHtmlActivePayload(host) 的调用内联到后续 assertEquals 比较中，保持断言对象与现有行为不变。Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/update-repo-description/pick.py:
- Line 100: Replace the abbreviated identifiers in the relevant file-handling
and argument-parsing code: rename the output file handle from f to output_file,
the configuration file handle from f to config_file, and argv to arguments.
Update all references consistently while preserving the existing behavior.
- Around line 28-40: Rename lunar_md to lunar_month_day and jieqi_name to
solar_term_name, updating every reference to these functions so their names
clearly express the returned domain values. Preserve their existing behavior and
signatures.
- Around line 76-80: 删除配置读取中的旧 descriptions 回退：在 extras 不是列表时不要再读取
config.get('descriptions')，仅基于当前 extras 配置处理并保留列表复制行为；同时确保不添加兼容逻辑、@deprecated
标记或重导出。
- Around line 43-61: 在 holiday_matches 中内联只使用一次的 md 和 iso，直接使用
today.strftime('%m-%d') 与 today.isoformat()；将生成器变量 d、lmd、jq 分别重命名为
date_value、lunar_date、solar_term。移除 yearday 的条件分支和末尾冗余 return，直接返回年内日比较结果。
In @.github/repo-descriptions.json:
- Around line 2-13: 删除配置中的 slogan 字段及其对应的品牌层级注释，保持 core、extras 和节日匹配键的现有配置不变；无需在
pick.py 中增加消费者或替代逻辑。
In @.github/workflows/update_repo_description.yaml:
- Around line 19-28: Update the update description workflow to tighten access
and prevent credential leakage: in
.github/workflows/update_repo_description.yaml, add a job-level permissions
block with contents: read and change the actions/checkout@v6 step to use a fixed
commit SHA with persist-credentials set to false; in
.github/actions/update-repo-description/action.yaml, replace any installation
flow that resolves latest/tagged package versions with locked dependency-file
based installs for json5 and sxtwl so the action does not parse or fetch mutable
tags.
In `@src/public/pages/scripts/lib/sanitizeHtml.mjs`:
- Around line 99-105: 更新 isSafeHtmlUrl()，将以“//”或“/\”开头的协议相对 URL
都判定为不安全，保留其他现有校验行为；并为反斜杠开头的协议相对 URL 补充回归测试，覆盖其在危险 URL 属性中会被移除。
---
Outside diff comments:
In `@src/public/pages/scripts/lib/sanitizeHtml.mjs`:
- Around line 110-115: 统一更新清理契约文档：在
src/public/pages/scripts/lib/sanitizeHtml.mjs 第110-115行的 JSDoc 中明确移除 on* 属性、所有
srcset 和不安全 URL，并保留 style；在同文件第1-4行补充 sanitizePermissiveHtml 会移除 style；在
src/public/pages/AGENTS.md 第41行同步说明 srcset 会被无条件移除。
In `@src/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs`:
- Around line 75-76: 在 sanitize_display_html 测试中移除仅使用一次的 returned 变量，直接将
scrubHtmlActivePayload(host) 的调用内联到后续 assertEquals 比较中，保持断言对象与现有行为不变。
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8ffd9530-4c1f-4c12-9bf3-6eea4a0e2a00
📒 Files selected for processing (7)
.github/actions/update-repo-description/action.yaml.github/actions/update-repo-description/pick.py.github/repo-descriptions.json.github/workflows/update_repo_description.yamlsrc/public/pages/AGENTS.mdsrc/public/pages/scripts/lib/sanitizeHtml.mjssrc/public/parts/shells/chat/test/pure/sanitize_display_html.test.mjs
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
steve02081504/fount-p2p(manual)
Comment on lines
+76
to
+80
| extras = config.get('extras') | ||
| if not isinstance(extras, list): | ||
| extras = list(config.get('descriptions') or ()) | ||
| else: | ||
| extras = list(extras) |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
删除旧 descriptions 配置回退。
当前配置定义 extras。descriptions 回退继续维护未声明的旧格式，并增加配置语义分支。
建议修改
- extras = config.get('extras')
- if not isinstance(extras, list):
- extras = list(config.get('descriptions') or ())
- else:
- extras = list(extras)
+ extras = list(config.get('extras') or ())As per path instructions: “不向后兼容；不做 @deprecated / 重导出；删就删干净。”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| extras = config.get('extras') | |
| if not isinstance(extras, list): | |
| extras = list(config.get('descriptions') or ()) | |
| else: | |
| extras = list(extras) | |
| extras = list(config.get('extras') or ()) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/actions/update-repo-description/pick.py around lines 76 - 80,
删除配置读取中的旧 descriptions 回退：在 extras 不是列表时不要再读取 config.get('descriptions')，仅基于当前
extras 配置处理并保留列表复制行为；同时确保不添加兼容逻辑、@deprecated 标记或重导出。
Source: Path instructions
Comment on lines
+19
to
+28
| jobs: | ||
| update: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - name: Update description | ||
| id: update | ||
| uses: ./.github/actions/update-repo-description | ||
| with: | ||
| token: ${{ secrets.GH_TOKEN }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Files matching workflow/action:\n'
git ls-files | rg '(^|/)\.github/(workflows|actions)'
printf '\nworkflow excerpt:\n'
if [ -f .github/workflows/update_repo_description.yaml ]; then
cat -n .github/workflows/update_repo_description.yaml | sed -n '1,80p'
fi
if [ -f .github/workflows/update-repo-description.yaml ]; then
cat -n .github/workflows/update-repo-description.yaml | sed -n '1,80p'
fi
printf '\naction excerpt:\n'
if [ -f .github/actions/update-repo-description/action.yaml ]; then
cat -n .github/actions/update-repo-description/action.yaml | sed -n '1,140p'
fi
printf '\nSearch for persist-credentials, permissions, checkout, pip install in repo:\n'
rg -n 'persist-credentials|permissions:|actions/checkout|pip install|json5|sxtwl|requirements|lock' .github || trueRepository: steve02081504/fount
Length of output: 12519
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
printf 'actions/checkout@v6 ref details:\n'
gh api repos/actions/checkout/git/refs/tags/v6 --jq '{ref, object_type:.object.type, object_sha:.object.sha}' || true
TAG_OBJECT_SHA=$(gh api repos/actions/checkout/git/refs/tags/v6 --jq '.object.sha')
TAG_OBJECT_TYPE=$(gh api repos/actions/checkout/git/refs/tags/v6 --jq '.object.type')
if [ "$TAG_OBJECT_TYPE" = "tag" ]; then
printf '\nAnnotated tag dereference:\n'
gh api repos/actions/checkout/git/tags/"$TAG_OBJECT_SHA" --jq '{object_type:.object.type, commit_sha:.object.sha, tag:.tag}' || true
fi
printf '\nGitHub checkout action v6 docs relevant inputs:\n'
curl -sSL 'https://raw.githubusercontent.com/actions/checkout/v6/action.yml' | sed -n '1,120p'
Length of output: 5453
移除 checkout 的持久化凭据并限制作业权限。
该 job 执行 actions/checkout@v6 后才运行 action，且没有显式 permissions；actions/checkout 默认把令牌写入 git config。未解析最新版本的 json5 / sxtwl 安装代码有机会读取该凭据。
- 在
update_repo_description.yaml中设置permissions: { contents: read }，且 checkout 使用固定 SHA、配置persist-credentials: false。 update-repo-description/action.yaml使用锁定依赖文件安装json5和sxtwl，不要解析临时标签。
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 23-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[info] 20-20: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
📍 Affects 2 files
.github/workflows/update_repo_description.yaml#L19-L28(this comment).github/actions/update-repo-description/action.yaml#L36-L38
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update_repo_description.yaml around lines 19 - 28, Update
the update description workflow to tighten access and prevent credential
leakage: in .github/workflows/update_repo_description.yaml, add a job-level
permissions block with contents: read and change the actions/checkout@v6 step to
use a fixed commit SHA with persist-credentials set to false; in
.github/actions/update-repo-description/action.yaml, replace any installation
flow that resolves latest/tagged package versions with locked dependency-file
based installs for json5 and sxtwl so the action does not parse or fetch mutable
tags.
Source: Linters/SAST tools
This was referenced Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
needs_output) runs the same icon_anime intro/dismiss/farewell session asfount log; path CLI renamesrun_server_with_updatestorun_with_updatesand adds arun_serverentry for debug + keepalive.isTrustedMarkdownAuthor(not blanket!isRemote); reasoning blocks render as Markdown<details>with CommonMark blank lines; addscrollToBottomIfPinnedand same-channel hash-nav short-circuit.edit_body, reject empty edits with i18n toast, and cover reasoning Markdown with a pure test.Test plan
fount servershows icon intro, dismisses after start, farewell on shutdown / Ctrl+C mid-intro<details>; untrusted/federated stream stays safe previeweventIdscrolls/highlights without full remountfount test --no-parallel shells/chat:pure:reasoning_markdown摘要
icon_anime会话，并拆分run_server与run_with_updates。<details>渲染、贴底滚动和重复导航抑制。edit_body，增加快捷键提示、空内容校验和国际化文案。0，并更新虚拟控制台依赖。原因
统一前台服务器与 TTY 动画行为。
降低流式渲染、内联 HTML、事件属性和危险 URL 的风险。
减少消息编辑模板重复，改善编辑体验和可访问性。
自动维护仓库描述，减少人工操作。
架构与审美风险
StreamRenderer的异步信任切换同时触发缓存清理和 DOM 重渲染，时序复杂。<details>交给 Markdown 管线，输出依赖下游的 HTML 和空行处理。run_server集中调试参数、前台启动和 keepalive 入口，职责更清晰，但入口层更集中。editBodyHtml。