Test - #4527
Conversation
This reverts commit 6012953.
WalkthroughThis pull request updates the branding from "New API" to "GQ API" across the codebase, adds CI/CD automation including a GitHub Actions workflow and PowerShell build scripts, configures Docker mirror URLs, creates a VERSION file (v0.13.2), and adds frontend documentation and configuration changes including proxy target updates and a new Docs page component. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 7/8 reviews remaining, refill in 7 minutes and 30 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (4)
web/classic/src/components/table/model-pricing/layout/header/SearchActions.jsx (1)
96-118: Prefer deleting disabled JSX instead of keeping it commented out.Line 96 to Line 118 now permanently disables this UI by comment-wrapping the block. Keeping large commented code in-place usually causes drift and confusion; remove it (or gate with an explicit feature flag) for cleaner maintenance.
Suggested cleanup diff
- {/* - {supportsCurrencyDisplay && ( - <div className='flex items-center gap-2'> - <span className='text-sm text-gray-600'>{t('充值价格显示')}</span> - <Switch - checked={showWithRecharge} - onChange={setShowWithRecharge} - /> - </div> - )} - - - {supportsCurrencyDisplay && showWithRecharge && ( - <Select - value={currency} - onChange={setCurrency} - optionList={[ - { value: 'USD', label: 'USD' }, - { value: 'CNY', label: 'CNY' }, - { value: 'CUSTOM', label: t('自定义货币') }, - ]} - /> - )} */}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@web/classic/src/components/table/model-pricing/layout/header/SearchActions.jsx` around lines 96 - 118, Remove the large commented-out JSX block that disables the currency UI (the code referencing supportsCurrencyDisplay, showWithRecharge, Switch, Select, currency, setCurrency) to avoid dead/commented code; either delete the commented lines entirely or reintroduce the UI behind a proper feature flag (e.g., a boolean prop/feature toggle) and implement conditional rendering using that flag instead of leaving the JSX commented out so the intent and codebase stay clean.web/src/pages/Docs/index.jsx (1)
29-33: Avoid hardcoded header offset in fixed layout.Line 29 hardcodes
64px; this can break docs viewport sizing if header height changes. Prefer a shared CSS variable/layout token.Suggested refactor diff
- top: '64px', + top: 'var(--app-header-height, 64px)',🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@web/src/pages/Docs/index.jsx` around lines 29 - 33, Replace the hardcoded top: '64px' in the Docs page fixed layout with a shared layout token or CSS variable (e.g., top: 'var(--header-height, 64px)') or read from the theme (e.g., theme.layout.headerHeight) so header height changes propagate; update the style object where top: '64px' appears and ensure the CSS variable or theme token is set (eg. :root or the Header component exports the token) so the docs viewport sizing remains correct.electron/main.js (1)
400-400: Centralize app name to prevent mixed UI labels.Line 400 updates the window title, but the same file still uses
"New API"in tray/menu/log strings. Define oneAPP_NAMEconstant and reuse it to avoid drift.♻️ Suggested refactor
+const APP_NAME = 'GQ API'; @@ - title: 'GQ API', + title: APP_NAME, @@ - label: 'Show New API', + label: `Show ${APP_NAME}`, @@ - tray.setToolTip('New API'); + tray.setToolTip(APP_NAME);🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@electron/main.js` at line 400, Introduce a single APP_NAME constant (e.g. const APP_NAME = 'GQ API') near the top of the module and replace all hard-coded uses of 'GQ API' and 'New API' in this file with that constant; specifically update the BrowserWindow option title field (title: 'GQ API'), any Tray tooltip/label, MenuItem labels that show "New API", and any log messages so they reference APP_NAME to keep UI labels consistent across window title, tray/menu entries, and logs.common/constants.go (1)
16-16: Use a single source of truth for product name.Line 16 updates
SystemName, but"New API"is still hardcoded in other paths (e.g.,relay/channel/openai/adaptor.goand defaults inweb/default). That can cause mixed branding at runtime. Prefer reading from shared config/constant everywhere.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@common/constants.go` at line 16, You changed the product name variable SystemName but left literal "New API" strings elsewhere; replace all hardcoded "New API" usages with a single source reference to the shared SystemName constant (e.g., import the package that declares var SystemName and use constants.SystemName instead of the string) — specifically update the OpenAI adaptor and the web defaults to read SystemName, add the necessary import/namespace adjustments where those modules reference the name, and run/update any tests or default-generation code that assert the previous literal.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker-build-push.yml:
- Around line 122-124: The workflow tags currently publish images as "${{
secrets.DOCKER_HUB_USERNAME }}/gq-api:..." which changes the established
repository identity; update the tag values to "${{ secrets.DOCKER_HUB_USERNAME
}}/new-api:${{ steps.version.outputs.version }}" and "${{
secrets.DOCKER_HUB_USERNAME }}/new-api:latest" (i.e., replace the literal
'gq-api' occurrences with 'new-api') so CI/CD, deploy automation, and
branding/attribution for new-api/QuantumNous remain intact.
- Around line 167-179: The From header in the "Send email notification" step is
set to a display name only (from: GQ API CI/CD), which violates RFC 5322; update
the from field to include a valid mailbox in the format "Display Name
<address@domain>" or supply a secret email variable (e.g., use an existing
secret like ${{ secrets.NOTIFY_EMAIL }} or add ${{ secrets.SENDER_EMAIL }}) so
the action uses a proper email address; ensure the change is applied to the
"from" key in that step so SMTP providers will accept the message.
In `@Dockerfile`:
- Around line 41-42: Replace the hardcoded sed replacement in the Dockerfile
with an opt-in build ARG so mirror override is optional: add an ARG like
APT_MIRROR (default empty) and change the RUN that currently contains the sed
commands to only perform the sed replacement when $APT_MIRROR is non-empty
(e.g., test -n "$APT_MIRROR" && sed -i "s|http://deb.debian.org|$APT_MIRROR|g"
...), keeping the existing fallback/true behavior so default Debian sources
remain unchanged when no build-arg is supplied.
In `@scripts/all-build-and-docker.ps1`:
- Around line 10-11: The default image name was changed to "gq-api" causing
published Docker coordinates to diverge from the established "new-api" identity;
revert the default by setting the $imageName variable back to "new-api" (leave
$dockerHubUsername as-is or set to the org if needed) and ensure no other
references to "new-api" or "QuantumNous" are removed or renamed in the script
(look for the $imageName and $dockerHubUsername variables to locate and update
the change).
- Around line 9-15: The script's $version param default prevents the
auto-generation path from running; change the param declaration for
[string]$version in the param(...) block to default to an empty string so that
the Get-NewVersion logic is exercised when no explicit version is passed; update
references to $version (including where Get-NewVersion is called) to rely on
that empty-string check so auto-versioning runs as intended.
- Around line 140-145: The current Invoke-BuildStep block runs two docker push
commands back-to-back so a failure in the first (docker push $imageTag) can be
masked by a succeeding second push ($latestTag); after each docker push call
check the exit status immediately (inspect $LASTEXITCODE or use try/catch) and
on non-zero return call Write-Error/throw or invoke the same failure handling
used by Invoke-BuildStep so the step fails immediately for the failing tag;
update the block around the docker push lines referencing docker push $imageTag
and docker push $latestTag to perform per-command error checks and stop the step
on the first push failure.
- Around line 121-123: The VERSION file is being written with Set-Content which
defaults to UTF-16LE on Windows PowerShell; replace the Set-Content call in the
Invoke-BuildStep that sets $versionFile (and mirror the same change in
scripts/build-and-docker.ps1) with a call to System.IO.File::WriteAllText to
write the $version string using explicit UTF-8 encoding (preserving the
no-newline behavior), so Linux/Docker consumers reading the file see consistent
UTF-8 text.
In `@scripts/build-and-docker.ps1`:
- Around line 7-11: The default for the script parameter $version is hardcoded
to "v0.13.2", which prevents the auto-generation branch that checks
[string]::IsNullOrEmpty($version) from ever running; change the param
declaration for $version in the param(...) block to default to an empty string
("") so the existing logic that generates a version when $version is empty will
execute during unattended builds.
- Around line 50-52: Set the VERSION file using explicit BOM-less UTF-8
encoding: when writing to $versionFile with Set-Content, add the -Encoding
parameter (UTF8NoBOM) so the file is written in UTF-8 without a BOM instead of
the system code page; update the call that currently uses "$version |
Set-Content $versionFile -NoNewline" to include -Encoding UTF8NoBOM while
preserving -NoNewline.
In `@web/classic/index.html`:
- Line 19: Revert the HTML title change in the <title> tag (currently "GQ API")
to restore the original repository branding by restoring the string that
includes "new-api" and/or "QuantumNous" so it matches project policy; update the
<title> element in web/classic/index.html back to the original branded value
(keep any existing surrounding markup intact) so references to
new-api/QuantumNous are not removed or altered.
In `@web/classic/vite.config.js`:
- Around line 94-103: The proxy entries for '/api', '/mj', and '/pg' are
hardcoded to 'https://zhang-liang.online'; change them to use an
environment-driven target with a localhost fallback by reading a single env var
(e.g. process.env.PROXY_TARGET or VITE_PROXY_TARGET) and defaulting to
'http://localhost:PORT' (replace PORT with your dev backend port) when not set,
then assign that variable as the target for the '/api', '/mj', and '/pg' proxy
objects while preserving changeOrigin: true; ensure the chosen env var name is
documented/used consistently with other config (e.g.
web/default/rsbuild.config.ts).
In `@web/src/pages/Docs/index.jsx`:
- Around line 44-45: The iframe currently exposes unsafe capabilities via the
allow attribute and a permissive sandbox; remove the unnecessary allow attribute
entirely (or limit it to only needed features) and tighten the sandbox string in
web/src/pages/Docs/index.jsx by removing allow-same-origin and
allow-top-navigation, drop allow-popups unless required, and if user-triggered
top-level navigation is needed replace allow-top-navigation with
allow-top-navigation-by-user-activation; ensure only minimal sandbox flags
(e.g., keep allow-scripts or allow-forms only if the docs renderer truly needs
them).
---
Nitpick comments:
In `@common/constants.go`:
- Line 16: You changed the product name variable SystemName but left literal
"New API" strings elsewhere; replace all hardcoded "New API" usages with a
single source reference to the shared SystemName constant (e.g., import the
package that declares var SystemName and use constants.SystemName instead of the
string) — specifically update the OpenAI adaptor and the web defaults to read
SystemName, add the necessary import/namespace adjustments where those modules
reference the name, and run/update any tests or default-generation code that
assert the previous literal.
In `@electron/main.js`:
- Line 400: Introduce a single APP_NAME constant (e.g. const APP_NAME = 'GQ
API') near the top of the module and replace all hard-coded uses of 'GQ API' and
'New API' in this file with that constant; specifically update the BrowserWindow
option title field (title: 'GQ API'), any Tray tooltip/label, MenuItem labels
that show "New API", and any log messages so they reference APP_NAME to keep UI
labels consistent across window title, tray/menu entries, and logs.
In
`@web/classic/src/components/table/model-pricing/layout/header/SearchActions.jsx`:
- Around line 96-118: Remove the large commented-out JSX block that disables the
currency UI (the code referencing supportsCurrencyDisplay, showWithRecharge,
Switch, Select, currency, setCurrency) to avoid dead/commented code; either
delete the commented lines entirely or reintroduce the UI behind a proper
feature flag (e.g., a boolean prop/feature toggle) and implement conditional
rendering using that flag instead of leaving the JSX commented out so the intent
and codebase stay clean.
In `@web/src/pages/Docs/index.jsx`:
- Around line 29-33: Replace the hardcoded top: '64px' in the Docs page fixed
layout with a shared layout token or CSS variable (e.g., top:
'var(--header-height, 64px)') or read from the theme (e.g.,
theme.layout.headerHeight) so header height changes propagate; update the style
object where top: '64px' appears and ensure the CSS variable or theme token is
set (eg. :root or the Header component exports the token) so the docs viewport
sizing remains correct.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a3b9607d-4882-4664-b8b5-2070233f204e
⛔ Files ignored due to path filters (2)
web/default/public/favicon.icois excluded by!**/*.icoweb/default/public/logo.pngis excluded by!**/*.png
📒 Files selected for processing (13)
.github/workflows/docker-build-push.yml.gitignoreDockerfileVERSIONcommon/constants.goelectron/main.jsscripts/all-build-and-docker.ps1scripts/build-and-docker.ps1web/classic/index.htmlweb/classic/src/components/table/model-pricing/layout/header/SearchActions.jsxweb/classic/src/helpers/utils.jsxweb/classic/vite.config.jsweb/src/pages/Docs/index.jsx
| tags: | | ||
| ${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:${{ steps.version.outputs.version }} | ||
| ${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:latest |
There was a problem hiding this comment.
Keep the published image name aligned with new-api.
These tags switch the pushed repository from the established new-api identity to gq-api. Any existing deploy/pull automation still pointing at new-api will stop receiving releases once this workflow is used.
Based on learnings: Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api (project name/identity) or QuantumNous (organization/author identity) in Docker image names, CI/CD references, and deployment configurations.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-build-push.yml around lines 122 - 124, The workflow
tags currently publish images as "${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:..."
which changes the established repository identity; update the tag values to "${{
secrets.DOCKER_HUB_USERNAME }}/new-api:${{ steps.version.outputs.version }}" and
"${{ secrets.DOCKER_HUB_USERNAME }}/new-api:latest" (i.e., replace the literal
'gq-api' occurrences with 'new-api') so CI/CD, deploy automation, and
branding/attribution for new-api/QuantumNous remain intact.
| - name: Send email notification | ||
| uses: dawidd6/action-send-mail@v3 | ||
| with: | ||
| # SMTP 服务器配置 | ||
| server_address: ${{ secrets.SMTP_SERVER }} | ||
| server_port: ${{ secrets.SMTP_PORT }} | ||
| # SMTP 认证信息 | ||
| username: ${{ secrets.SMTP_USERNAME }} | ||
| password: ${{ secrets.SMTP_PASSWORD }} | ||
| # 邮件内容 | ||
| subject: "GQ API Docker 构建通知 - ${{ steps.status.outputs.status }}" | ||
| to: ${{ secrets.NOTIFY_EMAIL }} | ||
| from: GQ API CI/CD |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
dawidd6/action-send-mail v3 from parameter documentation
💡 Result:
The from parameter in dawidd6/action-send-mail v3 is a required input that specifies the sender of the email. It supports formats parsed by nodemailer's addressparser library. From the action.yml (v5, consistent with v3 structure): - description: Full name of mail sender (might be with an email address specified in <>) - required: true From README.md examples across versions including v3 usages: - from: 'Luke Skywalker user@example.com' Supported address formats (per README): Uses nodemailer's addressparser. Formats described at https://nodemailer.com/extras/addressparser/. Addresses with YAML special characters (e.g., '<', '>') should be single-quoted. Recent changes (post-v3, e.g., v16 relaxes checks, earlier release notes mention stricter forms like "Plain Simple Name" or "user@example.com", but v3 predates these). Usage in workflows: with: from: 'Luke Skywalker user@example.com' Note: v3 is an older tag; current latest is v16 (2026-03-18). Documentation consistent across sources.
Citations:
- 1: https://github.com/dawidd6/action-send-mail/blob/master/README.md
- 2: https://github.com/dawidd6/action-send-mail
- 3: https://raw.githubusercontent.com/dawidd6/action-send-mail/v5/action.yml
- 4: https://github.com/dawidd6/action-send-mail/tree/refs/heads/master
- 5: https://github.com/dawidd6/action-send-mail/releases
🌐 Web query:
SMTP From field display name only vs email address requirement
💡 Result:
According to RFC 5322, the standard for Internet Message Format, the From header requires a mailbox-list, where each mailbox is either a name-addr (optional display-name followed by angle-addr containing an addr-spec email address) or a bare addr-spec (email address alone). A display name by itself, without an email address (addr-spec), does not constitute a valid mailbox and thus is not permitted in the From field. Valid formats include: - From: sender@example.com (bare addr-spec) - From: "Display Name" sender@example.com (name-addr) Invalid examples explicitly rejected by RFC-compliant systems like Microsoft 365 include: - From: "Microsoft 365" (display name only, no email address) - From: Display Name sender@example.com (display name without enclosing email address in angle brackets) While SMTP servers (per RFC 5321) should not reject messages solely based on header defects, modern receivers often enforce strict RFC 5322 compliance for anti-phishing reasons, marking non-compliant From headers as invalid and potentially rejecting or quarantining mail. The display name serves only for user-friendly presentation and has no functional role in delivery or replies (replies default to the addr-spec). Group syntax allows display-name-only in limited cases (e.g., From: "Group":;), but RFC 6854 recommends against it for originator fields, and it requires a Sender field with a mailbox if used.
Citations:
- 1: https://datatracker.ietf.org/doc/html/rfc5322.html
- 2: https://datatracker.ietf.org/doc/html/rfc5322
- 3: https://rfc-editor.org/rfc/rfc5322.html
- 4: https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-from-email-address-validation?view=o365-worldwide
- 5: https://www.mailertogo.com/rfc/5322
Fix the sender email format to comply with SMTP standards.
from: GQ API CI/CD is only a display name without an email address. RFC 5322 requires the From field to include a valid mailbox (email address), either as a bare address or in the Name <address> format. Modern SMTP providers enforce this standard and will reject or quarantine mail with a display-name-only From header, causing post-build notifications to fail even when the build succeeds.
Suggested change
- from: GQ API CI/CD
+ from: GQ API CI/CD <${{ secrets.SMTP_USERNAME }}>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Send email notification | |
| uses: dawidd6/action-send-mail@v3 | |
| with: | |
| # SMTP 服务器配置 | |
| server_address: ${{ secrets.SMTP_SERVER }} | |
| server_port: ${{ secrets.SMTP_PORT }} | |
| # SMTP 认证信息 | |
| username: ${{ secrets.SMTP_USERNAME }} | |
| password: ${{ secrets.SMTP_PASSWORD }} | |
| # 邮件内容 | |
| subject: "GQ API Docker 构建通知 - ${{ steps.status.outputs.status }}" | |
| to: ${{ secrets.NOTIFY_EMAIL }} | |
| from: GQ API CI/CD | |
| - name: Send email notification | |
| uses: dawidd6/action-send-mail@v3 | |
| with: | |
| # SMTP 服务器配置 | |
| server_address: ${{ secrets.SMTP_SERVER }} | |
| server_port: ${{ secrets.SMTP_PORT }} | |
| # SMTP 认证信息 | |
| username: ${{ secrets.SMTP_USERNAME }} | |
| password: ${{ secrets.SMTP_PASSWORD }} | |
| # 邮件内容 | |
| subject: "GQ API Docker 构建通知 - ${{ steps.status.outputs.status }}" | |
| to: ${{ secrets.NOTIFY_EMAIL }} | |
| from: GQ API CI/CD <${{ secrets.SMTP_USERNAME }}> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-build-push.yml around lines 167 - 179, The From
header in the "Send email notification" step is set to a display name only
(from: GQ API CI/CD), which violates RFC 5322; update the from field to include
a valid mailbox in the format "Display Name <address@domain>" or supply a secret
email variable (e.g., use an existing secret like ${{ secrets.NOTIFY_EMAIL }} or
add ${{ secrets.SENDER_EMAIL }}) so the action uses a proper email address;
ensure the change is applied to the "from" key in that step so SMTP providers
will accept the message.
| RUN sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \ | ||
| sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "Dockerfile" -type f | head -20Repository: QuantumNous/new-api
Length of output: 76
🏁 Script executed:
wc -l ./DockerfileRepository: QuantumNous/new-api
Length of output: 79
🏁 Script executed:
cat -n ./DockerfileRepository: QuantumNous/new-api
Length of output: 2172
🏁 Script executed:
# Verify the suggested change syntax is valid shell/Dockerfile
cat > /tmp/test_dockerfile << 'EOF'
FROM debian:bookworm-slim
ARG DEBIAN_MIRROR=
RUN if [ -n "$DEBIAN_MIRROR" ]; then \
sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; \
sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list 2>/dev/null || true; \
fi
RUN apt-get update
EOF
# Basic syntax validation
if grep -q "ARG DEBIAN_MIRROR=" /tmp/test_dockerfile && \
grep -q 'if \[ -n "$DEBIAN_MIRROR" \]' /tmp/test_dockerfile; then
echo "Proposed change syntax looks valid"
else
echo "Syntax issue detected"
fiRepository: QuantumNous/new-api
Length of output: 98
Make the Debian mirror override optional.
This hardcodes every build to use a regional mirror (mirrors.aliyun.com). If that mirror is slow, unavailable, or lagging, image builds fail even when the default Debian infrastructure is healthy. Especially problematic for non-China builds. Use a build argument instead to allow opt-in mirror configuration while keeping Debian's defaults as the fallback.
Suggested change
+ARG DEBIAN_MIRROR=
-RUN sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \
- sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true
+RUN if [ -n "$DEBIAN_MIRROR" ]; then \
+ sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; \
+ sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list 2>/dev/null || true; \
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \ | |
| sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true | |
| ARG DEBIAN_MIRROR= | |
| RUN if [ -n "$DEBIAN_MIRROR" ]; then \ | |
| sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; \ | |
| sed -i "s|http://deb.debian.org|$DEBIAN_MIRROR|g" /etc/apt/sources.list 2>/dev/null || true; \ | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 41 - 42, Replace the hardcoded sed replacement in
the Dockerfile with an opt-in build ARG so mirror override is optional: add an
ARG like APT_MIRROR (default empty) and change the RUN that currently contains
the sed commands to only perform the sed replacement when $APT_MIRROR is
non-empty (e.g., test -n "$APT_MIRROR" && sed -i
"s|http://deb.debian.org|$APT_MIRROR|g" ...), keeping the existing fallback/true
behavior so default Debian sources remain unchanged when no build-arg is
supplied.
| param( | ||
| [string]$dockerHubUsername = "gqapi", | ||
| [string]$imageName = "gq-api", | ||
| [string]$version = "v0.13.2", | ||
| [switch]$skipPush = $false, | ||
| [switch]$skipFrontendBuild = $false, | ||
| [switch]$skipGitPull = $false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, locate the file
find . -name "all-build-and-docker.ps1" -type fRepository: QuantumNous/new-api
Length of output: 98
🏁 Script executed:
# Read the file to examine the relevant sections
cat -n ./scripts/all-build-and-docker.ps1 | head -150Repository: QuantumNous/new-api
Length of output: 6004
Change -version default to empty string to enable auto-generation.
The parameter defaults to "v0.13.2", but the auto-generation logic at lines 113–118 only runs when $version is empty. This makes the Get-NewVersion function unused in normal invocations, defeating the intended auto-versioning behavior on each build.
Suggested change
- [string]$version = "v0.13.2",
+ [string]$version = "",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| param( | |
| [string]$dockerHubUsername = "gqapi", | |
| [string]$imageName = "gq-api", | |
| [string]$version = "v0.13.2", | |
| [switch]$skipPush = $false, | |
| [switch]$skipFrontendBuild = $false, | |
| [switch]$skipGitPull = $false | |
| param( | |
| [string]$dockerHubUsername = "gqapi", | |
| [string]$imageName = "gq-api", | |
| [string]$version = "", | |
| [switch]$skipPush = $false, | |
| [switch]$skipFrontendBuild = $false, | |
| [switch]$skipGitPull = $false |
🧰 Tools
🪛 PSScriptAnalyzer (1.25.0)
[warning] Missing BOM encoding for non-ASCII encoded file 'all-build-and-docker.ps1'
(PSUseBOMForUnicodeEncodedFile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/all-build-and-docker.ps1` around lines 9 - 15, The script's $version
param default prevents the auto-generation path from running; change the param
declaration for [string]$version in the param(...) block to default to an empty
string so that the Get-NewVersion logic is exercised when no explicit version is
passed; update references to $version (including where Get-NewVersion is called)
to rely on that empty-string check so auto-versioning runs as intended.
| [string]$dockerHubUsername = "gqapi", | ||
| [string]$imageName = "gq-api", |
There was a problem hiding this comment.
Keep the default image name aligned with new-api.
Defaulting this script to gq-api changes the published Docker coordinates for a release path that previously used the new-api identity. Any existing deployment automation still pulling new-api will miss these builds.
Based on learnings: Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api (project name/identity) or QuantumNous (organization/author identity) in Docker image names, CI/CD references, and deployment configurations.
🧰 Tools
🪛 PSScriptAnalyzer (1.25.0)
[warning] Missing BOM encoding for non-ASCII encoded file 'all-build-and-docker.ps1'
(PSUseBOMForUnicodeEncodedFile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/all-build-and-docker.ps1` around lines 10 - 11, The default image
name was changed to "gq-api" causing published Docker coordinates to diverge
from the established "new-api" identity; revert the default by setting the
$imageName variable back to "new-api" (leave $dockerHubUsername as-is or set to
the org if needed) and ensure no other references to "new-api" or "QuantumNous"
are removed or renamed in the script (look for the $imageName and
$dockerHubUsername variables to locate and update the change).
| param( | ||
| [string]$dockerHubUsername = "gqapi", | ||
| [string]$imageName = "gq-api", | ||
| [string]$version = "v0.13.2", | ||
| [switch]$skipPush = $false |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd -type f -name "build-and-docker.ps1" --exec cat -n {} \;Repository: QuantumNous/new-api
Length of output: 234
🏁 Script executed:
fd "build-and-docker.ps1" --exec cat -n {} \;Repository: QuantumNous/new-api
Length of output: 10715
Change the -version parameter default to an empty string.
Line 10 sets $version = "v0.13.2" as the default. Since line 44 only auto-generates a version when [string]::IsNullOrEmpty($version), the hardcoded default prevents the auto-generation branch from ever executing during normal runs. Unattended builds will repeatedly use the stale v0.13.2 release tag instead of generating a fresh version.
Suggested change
- [string]$version = "v0.13.2",
+ [string]$version = "",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| param( | |
| [string]$dockerHubUsername = "gqapi", | |
| [string]$imageName = "gq-api", | |
| [string]$version = "v0.13.2", | |
| [switch]$skipPush = $false | |
| param( | |
| [string]$dockerHubUsername = "gqapi", | |
| [string]$imageName = "gq-api", | |
| [string]$version = "", | |
| [switch]$skipPush = $false |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/build-and-docker.ps1` around lines 7 - 11, The default for the script
parameter $version is hardcoded to "v0.13.2", which prevents the auto-generation
branch that checks [string]::IsNullOrEmpty($version) from ever running; change
the param declaration for $version in the param(...) block to default to an
empty string ("") so the existing logic that generates a version when $version
is empty will execute during unattended builds.
| # Update VERSION file | ||
| $versionFile = Join-Path $projectRoot "VERSION" | ||
| $version | Set-Content $versionFile -NoNewline |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
git ls-files | grep -i "build.*docker.*ps1"Repository: QuantumNous/new-api
Length of output: 125
🏁 Script executed:
cat -n scripts/build-and-docker.ps1 | head -60Repository: QuantumNous/new-api
Length of output: 2204
🏁 Script executed:
cat -n scripts/build-and-docker.ps1 | sed -n '45,55p'Repository: QuantumNous/new-api
Length of output: 448
🏁 Script executed:
find . -name "Dockerfile*" -type fRepository: QuantumNous/new-api
Length of output: 93
🏁 Script executed:
cat -n DockerfileRepository: QuantumNous/new-api
Length of output: 2172
🏁 Script executed:
rg "VERSION" --type-list | head -20Repository: QuantumNous/new-api
Length of output: 453
🏁 Script executed:
rg "VERSION" . --max-count=20Repository: QuantumNous/new-api
Length of output: 2531
🌐 Web query:
PowerShell 5.1 Set-Content default encoding Windows
💡 Result:
In PowerShell 5.1 on Windows, the default encoding for Set-Content (when no -Encoding parameter is specified) is the system's active code page, referred to as "Default" or "ANSI". This is typically Windows-1252 for Western European locales (e.g., English US), an 8-bit superset of ASCII that supports additional characters. Non-ASCII characters are preserved (e.g., 'ö' writes as 0xF6 byte), unlike true ASCII which would replace them with '?'. Specifying -Encoding Default explicitly uses the same encoding. Official Microsoft documentation confirms: "Default: Uses the encoding that corresponds to the system's active code page (usually ANSI)." This behavior is consistent across Windows PowerShell versions up to 5.1 and differs from PowerShell 7+ (defaults to utf8NoBOM). To check your system's code page: [System.Text.Encoding]::Default.WindowsCodePage (e.g., 1252). Example: 'Hello ö' | Set-Content -Path test.txt # Uses ANSI/Default Get-Content test.txt -Encoding Byte # Shows bytes confirming ANSI (e.g., 72,101,108,108,111,32,246 for 'ö')
Citations:
- 1: Set-Content / Add-Content help topics incorrectly claim that the default character encoding is ASCII - it is "ANSI" MicrosoftDocs/PowerShell-Docs#1483
- 2: https://github.com/MicrosoftDocs/PowerShell-Docs/blob/main/reference/5.1/Microsoft.PowerShell.Core/About/about_Character_Encoding.md
- 3: the default encoding is not ascii (5.1) (set-content) MicrosoftDocs/PowerShell-Docs#3263
- 4: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_character_encoding?view=powershell-7.6
- 5: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-content?view=powershell-5.1
- 6: https://ss64.com/ps/set-content.html
Use explicit BOM-less UTF-8 encoding when writing the VERSION file.
Set-Content without an -Encoding parameter uses the system's active code page (typically Windows-1252 on Windows) rather than UTF-8. This causes a cross-platform encoding mismatch: the Dockerfile and Makefile consume the file with cat VERSION (a Linux tool), which expects UTF-8. To ensure consistent behavior across platforms, write the file with explicit BOM-less UTF-8 encoding.
Suggested change
- $version | Set-Content $versionFile -NoNewline
+ [System.IO.File]::WriteAllText(
+ $versionFile,
+ $version,
+ [System.Text.UTF8Encoding]::new($false)
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Update VERSION file | |
| $versionFile = Join-Path $projectRoot "VERSION" | |
| $version | Set-Content $versionFile -NoNewline | |
| # Update VERSION file | |
| $versionFile = Join-Path $projectRoot "VERSION" | |
| [System.IO.File]::WriteAllText( | |
| $versionFile, | |
| $version, | |
| [System.Text.UTF8Encoding]::new($false) | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/build-and-docker.ps1` around lines 50 - 52, Set the VERSION file
using explicit BOM-less UTF-8 encoding: when writing to $versionFile with
Set-Content, add the -Encoding parameter (UTF8NoBOM) so the file is written in
UTF-8 without a BOM instead of the system code page; update the call that
currently uses "$version | Set-Content $versionFile -NoNewline" to include
-Encoding UTF8NoBOM while preserving -NoNewline.
| /> | ||
| <meta name="generator" content="new-api" /> | ||
| <title>New API</title> | ||
| <title>GQ API</title> |
There was a problem hiding this comment.
Revert title branding change to match repository policy.
Line 19 changes the HTML title branding, which conflicts with the project rule for *.html files.
🔁 Proposed fix
- <title>GQ API</title>
+ <title>New API</title>Based on learnings: "Applies to /*.json,/.html,**/.tsx,**/*.ts : Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api (project name/identity) or QuantumNous (organization/author identity) in HTML titles, meta tags, footer text, about pages, package metadata, and frontend code."
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <title>GQ API</title> | |
| <title>New API</title> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/classic/index.html` at line 19, Revert the HTML title change in the
<title> tag (currently "GQ API") to restore the original repository branding by
restoring the string that includes "new-api" and/or "QuantumNous" so it matches
project policy; update the <title> element in web/classic/index.html back to the
original branded value (keep any existing surrounding markup intact) so
references to new-api/QuantumNous are not removed or altered.
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, | ||
| }, | ||
| '/mj': { | ||
| target: 'http://localhost:3000', | ||
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, | ||
| }, | ||
| '/pg': { | ||
| target: 'http://localhost:3000', | ||
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify hardcoded proxy targets and env-driven server URL patterns
rg -n "proxy|target:\\s*'https?://|VITE_REACT_APP_SERVER_URL|loadEnv\\(" web/classic/vite.config.js web/default/rsbuild.config.ts web/classic/src/helpers/api.jsRepository: QuantumNous/new-api
Length of output: 990
🏁 Script executed:
cat -n web/classic/vite.config.jsRepository: QuantumNous/new-api
Length of output: 3603
🏁 Script executed:
cat -n web/default/rsbuild.config.ts | head -30Repository: QuantumNous/new-api
Length of output: 1304
🏁 Script executed:
# Check for any other hardcoded proxy targets in the web folder
rg -n "target:\s*['\"]https?://" web/Repository: QuantumNous/new-api
Length of output: 292
Avoid hardcoded remote proxy targets in dev server config.
Lines 94/98/102 hardcode a public host. This breaks local/staging parity and can unintentionally send local authenticated traffic to a remote backend. Make proxy target environment-driven with localhost fallback.
🔧 Proposed fix
-import { defineConfig, transformWithEsbuild } from 'vite';
+import { defineConfig, transformWithEsbuild, loadEnv } from 'vite';
@@
-export default defineConfig({
+export default defineConfig(({ mode }) => {
+ const env = loadEnv(mode, process.cwd(), 'VITE_');
+ const serverUrl = env.VITE_REACT_APP_SERVER_URL || 'http://localhost:3000';
+ return {
@@
server: {
host: '0.0.0.0',
proxy: {
'/api': {
- target: 'https://zhang-liang.online',
+ target: serverUrl,
changeOrigin: true,
},
'/mj': {
- target: 'https://zhang-liang.online',
+ target: serverUrl,
changeOrigin: true,
},
'/pg': {
- target: 'https://zhang-liang.online',
+ target: serverUrl,
changeOrigin: true,
},
},
},
-});
+ };
+});Aligns with environment-driven pattern in web/default/rsbuild.config.ts and retrieval learning to never hardcode configuration.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/classic/vite.config.js` around lines 94 - 103, The proxy entries for
'/api', '/mj', and '/pg' are hardcoded to 'https://zhang-liang.online'; change
them to use an environment-driven target with a localhost fallback by reading a
single env var (e.g. process.env.PROXY_TARGET or VITE_PROXY_TARGET) and
defaulting to 'http://localhost:PORT' (replace PORT with your dev backend port)
when not set, then assign that variable as the target for the '/api', '/mj', and
'/pg' proxy objects while preserving changeOrigin: true; ensure the chosen env
var name is documented/used consistently with other config (e.g.
web/default/rsbuild.config.ts).
| allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone' | ||
| sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation' |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In HTML iframe security, what are the risks of using sandbox="allow-scripts allow-same-origin", and what is the safer alternative to allow-top-navigation for user-initiated navigation?
💡 Result:
The primary risk of using sandbox="allow-scripts allow-same-origin" is that if the embedded content is from the same origin as the parent page, a script in the iframe can access the iframe element, remove the sandbox attribute entirely, and reload itself, completely escaping the sandbox restrictions and behaving as an unsandboxed same-origin iframe. This vulnerability is explicitly documented in the HTML Living Standard and MDN Web Docs. For user-initiated navigation as a safer alternative to allow-top-navigation, use allow-top-navigation-by-user-activation. This token permits the iframe content to navigate the top-level browsing context only when triggered by transient user activation (e.g., a recent click), preventing programmatic or malicious top navigations while still allowing legitimate user actions like clicking links.
Citations:
- 1: https://html.spec.whatwg.org/multipage/the-iframe-element.html
- 2: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe/
- 3: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe
🏁 Script executed:
cat -n web/src/pages/Docs/index.jsx | head -60Repository: QuantumNous/new-api
Length of output: 1851
🏁 Script executed:
# Search for any comments or documentation about the iframe configuration
rg -A 5 -B 5 "allow='accelerometer" web/src/pages/Docs/ || echo "Pattern not found"
rg -i "docs.*url\|docs.*proxy" web/src/pages/Docs/index.jsxRepository: QuantumNous/new-api
Length of output: 737
🏁 Script executed:
# Check if DOCS_URL is defined elsewhere and understand what it serves
rg "DOCS_URL" web/src/ -A 2 -B 2Repository: QuantumNous/new-api
Length of output: 524
Remove unnecessary allow permissions and tighten iframe sandbox.
The allow attribute (line 44) grants unnecessary device/sensor permissions unrelated to documentation serving. More critically, the sandbox on line 45 combines allow-scripts and allow-same-origin, which is a documented vulnerability: same-origin scripts can remove the sandbox attribute entirely and escape restrictions. Additionally, allow-popups and allow-top-navigation are unnecessary. Reduce to the minimum required capabilities.
Suggested hardening
<iframe
src={DOCS_URL}
@@
- allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone'
- sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation'
+ allow=''
+ sandbox='allow-scripts allow-forms'
/>If the docs require top-level navigation triggered by user clicks, use allow-top-navigation-by-user-activation instead of allow-top-navigation to prevent programmatic navigation.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone' | |
| sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation' | |
| <iframe | |
| src={DOCS_URL} | |
| allow='' | |
| sandbox='allow-scripts allow-forms' | |
| /> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/src/pages/Docs/index.jsx` around lines 44 - 45, The iframe currently
exposes unsafe capabilities via the allow attribute and a permissive sandbox;
remove the unnecessary allow attribute entirely (or limit it to only needed
features) and tighten the sandbox string in web/src/pages/Docs/index.jsx by
removing allow-same-origin and allow-top-navigation, drop allow-popups unless
required, and if user-triggered top-level navigation is needed replace
allow-top-navigation with allow-top-navigation-by-user-activation; ensure only
minimal sandbox flags (e.g., keep allow-scripts or allow-forms only if the docs
renderer truly needs them).
4 participants
Important
📝 变更描述 / Description
(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
(请在此粘贴截图、关键日志或测试报告，以证明变更生效)
Summary by CodeRabbit
New Features
Updates