Prod - #4528
Conversation
This reverts commit 6012953.
WalkthroughThis PR introduces comprehensive build automation, rebranding, and deployment configuration changes. It adds a GitHub Actions workflow for Docker image building and push notifications, creates PowerShell build scripts, updates the Dockerfile to use Aliyun mirrors, renames the system from "New API" to "GQ API" across multiple files, adds a new documentation page component, updates development server proxies, and includes minor configuration updates. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~70 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 6/8 reviews remaining, refill in 12 minutes and 18 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (4)
web/src/components/table/model-pricing/layout/header/SearchActions.jsx (1)
96-118: Remove the dead JSX and clean up unused props.Lines 96-118 contain commented-out
showWithRecharge/currencycontrols that are completely unused—these props appear nowhere else in the component. Since the replacement UI is now in a modal (PricingDisplaySettingsinFilterModalContent), delete this block and remove the four unused props from the destructuring signature (lines 34–37). Follow-up: update parent callsites (PricingVendorIntro.jsx,PricingTopSection.jsx) to stop passing these props toSearchActions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@web/src/components/table/model-pricing/layout/header/SearchActions.jsx` around lines 96 - 118, Remove the dead/commented JSX block (the commented Switch/Select fragment) from SearchActions.jsx and remove the now-unused props showWithRecharge, setShowWithRecharge, currency, and setCurrency from the component's destructuring signature (symbols: showWithRecharge, setShowWithRecharge, currency, setCurrency). After that, update parent callsites (PricingVendorIntro.jsx and PricingTopSection.jsx) to stop passing those four props into SearchActions so there are no unused prop warnings; also remove any related imports if they become unused..gitignore (1)
13-13: Avoid ignoringVERSIONin repo-level release flow.
VERSIONis part of your release/tagging pipeline; keeping it in.gitignoreis misleading and makes release intent less clear.🔧 Suggested fix
-VERSION🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.gitignore at line 13, Remove the "VERSION" entry from .gitignore so the repo-level release/tagging file is tracked; locate the literal "VERSION" line in the .gitignore and delete that line, then commit the change so the VERSION file is included in source control and part of the release flow.Dockerfile (1)
30-31: Make the APT mirror configurable instead of hardcoding Aliyun.Hardcoding a single regional mirror can cause flaky builds outside that region. Prefer a build arg with a default.
🔧 Suggested refactor
+ARG APT_MIRROR=deb.debian.org -RUN sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources 2>/dev/null || \ - sed -i 's|http://deb.debian.org|http://mirrors.aliyun.com|g' /etc/apt/sources.list 2>/dev/null || true +RUN sed -i "s|http://deb.debian.org|http://${APT_MIRROR}|g" /etc/apt/sources.list.d/debian.sources 2>/dev/null || \ + sed -i "s|http://deb.debian.org|http://${APT_MIRROR}|g" /etc/apt/sources.list 2>/dev/null || true🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 30 - 31, Replace the hardcoded Aliyun URL in the sed replacement commands with a configurable build arg: add an ARG (e.g. APT_MIRROR) with a sensible default (e.g. "http://mirrors.aliyun.com"), reference that ARG in the RUN sed commands instead of the literal URL, and ensure ARG is declared before the RUN that uses it so docker build can override via --build-arg APT_MIRROR=.... Update the two sed invocations (the lines performing replacements on /etc/apt/sources.list.d/debian.sources and /etc/apt/sources.list) to use the APT_MIRROR argument.scripts/build-and-docker.ps1 (1)
24-24: Remove unused local variable inGet-NewVersion.
$versionFileis assigned at Line 24 but never used.Suggested cleanup
- $versionFile = Join-Path $projectRoot "VERSION" $dateStr = Get-Date -Format "yyyyMMdd"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/build-and-docker.ps1` at line 24, In Get-NewVersion the local variable $versionFile is assigned but never used; either remove the unused assignment " $versionFile = Join-Path $projectRoot 'VERSION' " from the function or update Get-NewVersion to use $versionFile where appropriate (e.g., reading/writing the VERSION file) — locate the assignment by the symbol $versionFile and modify or delete it to eliminate the unused variable.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker-build-push.yml:
- Around line 219-223: The workflow uses github.event.head_commit.message and
github.event.head_commit.timestamp which can be empty for workflow_dispatch;
update the template to use expresssion fallbacks (e.g.
github.event.head_commit.message || github.event.inputs.commit_message ||
github.sha for the message, and github.event.head_commit.timestamp ||
github.event.inputs.timestamp || github.event.created_at for the timestamp) so
manual dispatches show meaningful values; modify the two table cells that
reference github.event.head_commit.message and
github.event.head_commit.timestamp to use these fallback expressions.
- Around line 123-124: Replace the hardcoded "gq-api" image name used in the
workflow tag lines with the required project identifier ("new-api" or
"QuantumNous") so CI/CD and downstream automation keep expected naming;
specifically update the two tag strings that currently read "${{
secrets.DOCKER_HUB_USERNAME }}/gq-api:${{ steps.version.outputs.version }}" and
"${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:latest" to use "${{
secrets.DOCKER_HUB_USERNAME }}/new-api:${{ steps.version.outputs.version }}" and
"${{ secrets.DOCKER_HUB_USERNAME }}/new-api:latest" (also scan other
Docker/CI-related symbols like Dockerfile, .dockerignore, docker-compose.* and
any remaining occurrences of "gq-api" and restore "new-api" / "QuantumNous"
where branding/identifiers were removed).
- Around line 77-82: The step with id "version" reads VERSION into the shell
variable VERSION and writes it to $GITHUB_OUTPUT but doesn't validate it; update
that step to verify the VERSION file exists and the VERSION variable is
non-empty (trim whitespace) and exit non-zero if not, before writing
"version=$VERSION" to $GITHUB_OUTPUT or proceeding to build/tag steps so the
workflow fails fast on missing or empty VERSION.
In `@common/constants.go`:
- Line 15: The SystemName variable was changed to "GQ API", which violates
protected branding rules; change the SystemName constant back to the
repository's protected identity string (restore SystemName to "new-api") so the
variable SystemName uses the original branding value instead of "GQ API".
In `@scripts/all-build-and-docker.ps1`:
- Around line 1-12: The script's deployment identifiers were changed to "gqapi"
/ "gq-api" which violates the new-api/QuantumNous naming policy; restore the
original Docker/CI identifiers by updating the param defaults $dockerHubUsername
and $imageName in the script to the sanctioned values used by the project (the
original new-api/QuantumNous identifiers) and ensure any other references in the
same script that use $dockerHubUsername or $imageName remain consistent with
those sanctioned names (so downstream Dockerfile/docker-compose references
continue to match the project's existing branding).
- Around line 140-143: The Push Docker image step currently runs two docker push
commands inside the same Invoke-BuildStep block so a failure of the first push
can be masked; modify the Invoke-BuildStep block around docker push to run and
validate each push separately (or immediately check the exit/LastExitCode after
each docker push) for both $imageTag and $latestTag and fail/throw/Write-Error
(so Invoke-BuildStep sees the failure) if any push returns a non-zero result,
ensuring the step aborts on the first push error.
- Around line 95-100: The current guard only checks for node_modules presence
which can leave stale deps; update the "Frontend: Install dependencies" step so
it computes a hash of package.json and package-lock.json (or yarn.lock) and
compares it to a stored stamp (e.g., .node_modules_hash) next to node_modules,
running npm ci (not npm install) when the hash differs or node_modules is
missing, then update the stamp; reference the existing Invoke-BuildStep
"Frontend: Install dependencies", node_modules, npm (use npm ci), package.json
and package-lock.json (or yarn.lock) when implementing this change.
In `@scripts/build-and-docker.ps1`:
- Around line 1-10: Revert the Docker naming change by restoring the original
"new-api"/"QuantumNous" identity: update the param defaults $dockerHubUsername
and $imageName (and any related $version if needed) in the param(...) block so
the image name and Docker Hub namespace use the repository's required "new-api"
branding (and any QuantumNous attribution), and scan the same script for any
occurrences of "gq-api" or "GQ API" and replace them back to
"new-api"/appropriate QuantumNous identifiers to keep Docker/CI/deployment
naming consistent with existing Dockerfile/.dockerignore/docker-compose
references.
- Around line 71-79: The docker push block performs two pushes (docker push
$imageTag and docker push $latestTag) but only checks $LASTEXITCODE once, which
can mask failures; update the script to check $LASTEXITCODE immediately after
each docker push call and handle failures independently (write error and exit 1)
so a failed push of $imageTag cannot be overridden by a subsequent successful
push of $latestTag; keep the conditional on $skipPush and use the existing error
reporting pattern around each push.
In `@web/index.html`:
- Line 19: The HTML title was changed to "GQ API" and must be reverted to the
protected project branding; update the <title> element in web/index.html so it
contains the original required branding (restore the previous value that
includes "new-api" or "QuantumNous" as used across the project) rather than "GQ
API", ensuring any meta/frontend references to project identity remain
unchanged.
In `@web/src/pages/Docs/index.jsx`:
- Around line 44-45: The iframe currently grants over-permissive features and
navigation rights; update the JSX in web/src/pages/Docs/index.jsx by removing
camera, microphone, geolocation, accelerometer, gyroscope, encrypted-media and
other sensitive tokens from the allow attribute (keep no features or only the
minimal feature needed, e.g., "clipboard-write" if required) and remove
"allow-top-navigation" from the sandbox attribute—use a minimal sandbox such as
sandbox="allow-same-origin allow-scripts" to serve internal documentation
safely.
In `@web/vite.config.js`:
- Around line 93-104: The dev server proxy currently routes '/api', '/mj', and
'/pg' directly to the production host 'https://zhang-liang.online'; change each
proxy entry to use an env-driven target with a safe local default to prevent
accidental calls to production (e.g., read a VITE_API_PROXY_TARGET or
API_PROXY_TARGET and fall back to 'http://localhost:3000' or similar). Update
the proxy objects for '/api', '/mj', and '/pg' in vite.config.js to reference
that env var (or import.meta.env if using Vite's env system) so local
development defaults to a local backend while allowing override for remote
targets. Ensure changeOrigin remains true and add a short comment explaining the
env override.
---
Nitpick comments:
In @.gitignore:
- Line 13: Remove the "VERSION" entry from .gitignore so the repo-level
release/tagging file is tracked; locate the literal "VERSION" line in the
.gitignore and delete that line, then commit the change so the VERSION file is
included in source control and part of the release flow.
In `@Dockerfile`:
- Around line 30-31: Replace the hardcoded Aliyun URL in the sed replacement
commands with a configurable build arg: add an ARG (e.g. APT_MIRROR) with a
sensible default (e.g. "http://mirrors.aliyun.com"), reference that ARG in the
RUN sed commands instead of the literal URL, and ensure ARG is declared before
the RUN that uses it so docker build can override via --build-arg
APT_MIRROR=.... Update the two sed invocations (the lines performing
replacements on /etc/apt/sources.list.d/debian.sources and
/etc/apt/sources.list) to use the APT_MIRROR argument.
In `@scripts/build-and-docker.ps1`:
- Line 24: In Get-NewVersion the local variable $versionFile is assigned but
never used; either remove the unused assignment " $versionFile = Join-Path
$projectRoot 'VERSION' " from the function or update Get-NewVersion to use
$versionFile where appropriate (e.g., reading/writing the VERSION file) — locate
the assignment by the symbol $versionFile and modify or delete it to eliminate
the unused variable.
In `@web/src/components/table/model-pricing/layout/header/SearchActions.jsx`:
- Around line 96-118: Remove the dead/commented JSX block (the commented
Switch/Select fragment) from SearchActions.jsx and remove the now-unused props
showWithRecharge, setShowWithRecharge, currency, and setCurrency from the
component's destructuring signature (symbols: showWithRecharge,
setShowWithRecharge, currency, setCurrency). After that, update parent callsites
(PricingVendorIntro.jsx and PricingTopSection.jsx) to stop passing those four
props into SearchActions so there are no unused prop warnings; also remove any
related imports if they become unused.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f09e189c-9075-4da7-8f3d-8ce416f67e20
⛔ Files ignored due to path filters (2)
web/public/favicon.icois excluded by!**/*.icoweb/public/logo.pngis excluded by!**/*.png
📒 Files selected for processing (13)
.github/workflows/docker-build-push.yml.gitignoreDockerfileVERSIONcommon/constants.goelectron/main.jsscripts/all-build-and-docker.ps1scripts/build-and-docker.ps1web/index.htmlweb/src/components/table/model-pricing/layout/header/SearchActions.jsxweb/src/helpers/utils.jsxweb/src/pages/Docs/index.jsxweb/vite.config.js
| - name: Read version from VERSION file | ||
| id: version | ||
| run: | | ||
| VERSION=$(cat VERSION) | ||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||
| echo "Building version: $VERSION" |
There was a problem hiding this comment.
Fail fast when VERSION is missing or empty before tagging images.
At Line 80-82, VERSION is consumed without validation. An empty/malformed value can break tag generation or publish unexpected tags.
Suggested hardening
- - name: Read version from VERSION file
+ - name: Read version from VERSION file
id: version
run: |
- VERSION=$(cat VERSION)
+ if [ ! -f VERSION ]; then
+ echo "::error::VERSION file not found"
+ exit 1
+ fi
+ VERSION="$(tr -d '\r\n' < VERSION)"
+ if [ -z "$VERSION" ]; then
+ echo "::error::VERSION file is empty"
+ exit 1
+ fi
echo "version=$VERSION" >> $GITHUB_OUTPUT
echo "Building version: $VERSION"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-build-push.yml around lines 77 - 82, The step with
id "version" reads VERSION into the shell variable VERSION and writes it to
$GITHUB_OUTPUT but doesn't validate it; update that step to verify the VERSION
file exists and the VERSION variable is non-empty (trim whitespace) and exit
non-zero if not, before writing "version=$VERSION" to $GITHUB_OUTPUT or
proceeding to build/tag steps so the workflow fails fast on missing or empty
VERSION.
| ${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:${{ steps.version.outputs.version }} | ||
| ${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:latest |
There was a problem hiding this comment.
Preserve new-api / QuantumNous identifiers in Docker and CI/CD references.
The new image tags and CI/CD messaging replace project identity references with gq-api / GQ API in deployment workflow paths. This conflicts with the repository constraint for Docker/CI naming and can break downstream automation expecting new-api naming.
Based on learnings: Applies to /Dockerfile,/.dockerignore,/docker,/docker-compose*.yml : Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api or QuantumNous in Docker image names, CI/CD references, and deployment configurations.
Also applies to: 177-200
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-build-push.yml around lines 123 - 124, Replace the
hardcoded "gq-api" image name used in the workflow tag lines with the required
project identifier ("new-api" or "QuantumNous") so CI/CD and downstream
automation keep expected naming; specifically update the two tag strings that
currently read "${{ secrets.DOCKER_HUB_USERNAME }}/gq-api:${{
steps.version.outputs.version }}" and "${{ secrets.DOCKER_HUB_USERNAME
}}/gq-api:latest" to use "${{ secrets.DOCKER_HUB_USERNAME }}/new-api:${{
steps.version.outputs.version }}" and "${{ secrets.DOCKER_HUB_USERNAME
}}/new-api:latest" (also scan other Docker/CI-related symbols like Dockerfile,
.dockerignore, docker-compose.* and any remaining occurrences of "gq-api" and
restore "new-api" / "QuantumNous" where branding/identifiers were removed).
| <td>${{ github.event.head_commit.message }}</td> | ||
| </tr> | ||
| <tr> | ||
| <td>构建时间</td> | ||
| <td>${{ github.event.head_commit.timestamp }}</td> |
There was a problem hiding this comment.
Use fallback metadata for manual dispatch notifications.
At Line 219 and Line 223, github.event.head_commit.* may be empty for workflow_dispatch, causing blank email fields.
Suggested fallback values
- <td>${{ github.event.head_commit.message }}</td>
+ <td>${{ github.event.head_commit.message || github.sha }}</td>
...
- <td>${{ github.event.head_commit.timestamp }}</td>
+ <td>${{ github.event.head_commit.timestamp || github.run_started_at }}</td>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker-build-push.yml around lines 219 - 223, The workflow
uses github.event.head_commit.message and github.event.head_commit.timestamp
which can be empty for workflow_dispatch; update the template to use expresssion
fallbacks (e.g. github.event.head_commit.message ||
github.event.inputs.commit_message || github.sha for the message, and
github.event.head_commit.timestamp || github.event.inputs.timestamp ||
github.event.created_at for the timestamp) so manual dispatches show meaningful
values; modify the two table cells that reference
github.event.head_commit.message and github.event.head_commit.timestamp to use
these fallback expressions.
| var StartTime = time.Now().Unix() // unit: second | ||
| var Version = "v0.0.0" // this hard coding will be replaced automatically when building, no need to manually change | ||
| var SystemName = "New API" | ||
| var SystemName = "GQ API" |
There was a problem hiding this comment.
SystemName rebrand violates repository branding constraints.
This replaces a protected project identity string.
🔧 Suggested fix
-var SystemName = "GQ API"
+var SystemName = "New API"Based on learnings: Applies to **/*.go — do NOT modify, delete, replace, or remove references/branding related to new-api or QuantumNous.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@common/constants.go` at line 15, The SystemName variable was changed to "GQ
API", which violates protected branding rules; change the SystemName constant
back to the repository's protected identity string (restore SystemName to
"new-api") so the variable SystemName uses the original branding value instead
of "GQ API".
| # GQ API - Build & Docker Script | ||
| # This script will: | ||
| # 1. Switch to gqapi_release branch and pull latest code | ||
| # 2. Build frontend (web folder) | ||
| # 3. Update version number | ||
| # 4. Build the Docker image | ||
| # 5. Push to Docker Hub (beyondandforever/gq-api) | ||
|
|
||
| param( | ||
| [string]$dockerHubUsername = "gqapi", | ||
| [string]$imageName = "gq-api", | ||
| [string]$version = "v0.13.2", |
There was a problem hiding this comment.
Keep Docker/deployment identifiers aligned with new-api policy.
This script switches deployment naming to gq-api / GQ API, which conflicts with the Docker/CI identity constraint and may break existing release consumers.
Based on learnings: Applies to /Dockerfile,/.dockerignore,/docker,/docker-compose*.yml : Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api or QuantumNous in Docker image names, CI/CD references, and deployment configurations.
Also applies to: 128-129
🧰 Tools
🪛 PSScriptAnalyzer (1.25.0)
[warning] Missing BOM encoding for non-ASCII encoded file 'all-build-and-docker.ps1'
(PSUseBOMForUnicodeEncodedFile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/all-build-and-docker.ps1` around lines 1 - 12, The script's
deployment identifiers were changed to "gqapi" / "gq-api" which violates the
new-api/QuantumNous naming policy; restore the original Docker/CI identifiers by
updating the param defaults $dockerHubUsername and $imageName in the script to
the sanctioned values used by the project (the original new-api/QuantumNous
identifiers) and ensure any other references in the same script that use
$dockerHubUsername or $imageName remain consistent with those sanctioned names
(so downstream Dockerfile/docker-compose references continue to match the
project's existing branding).
| # GQ API - Build & Docker Script | ||
| # This script will: | ||
| # 1. Update version number | ||
| # 2. Build the Docker image | ||
| # 3. Push to Docker Hub (beyondandforever/gq-api) | ||
|
|
||
| param( | ||
| [string]$dockerHubUsername = "gqapi", | ||
| [string]$imageName = "gq-api", | ||
| [string]$version = "v0.13.2", |
There was a problem hiding this comment.
Revert Docker naming changes that remove new-api identity in deployment scripts.
This script introduces gq-api/GQ API branding in Docker build/push paths, which conflicts with the repository’s Docker/CI naming constraint.
Based on learnings: Applies to /Dockerfile,/.dockerignore,/docker,/docker-compose*.yml : Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api or QuantumNous in Docker image names, CI/CD references, and deployment configurations.
Also applies to: 57-58
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/build-and-docker.ps1` around lines 1 - 10, Revert the Docker naming
change by restoring the original "new-api"/"QuantumNous" identity: update the
param defaults $dockerHubUsername and $imageName (and any related $version if
needed) in the param(...) block so the image name and Docker Hub namespace use
the repository's required "new-api" branding (and any QuantumNous attribution),
and scan the same script for any occurrences of "gq-api" or "GQ API" and replace
them back to "new-api"/appropriate QuantumNous identifiers to keep
Docker/CI/deployment naming consistent with existing
Dockerfile/.dockerignore/docker-compose references.
| if (-not $skipPush) { | ||
| # Push to Docker Hub | ||
| Write-Host "`nPushing to Docker Hub..." | ||
| docker push $imageTag | ||
| docker push $latestTag | ||
|
|
||
| if ($LASTEXITCODE -ne 0) { | ||
| Write-Error "Docker push failed!" | ||
| exit 1 |
There was a problem hiding this comment.
Check each docker push result independently to avoid false success.
Current logic checks $LASTEXITCODE only once after two pushes. If the first push fails and the second succeeds, the script can incorrectly report success.
Suggested fix
if (-not $skipPush) {
# Push to Docker Hub
Write-Host "`nPushing to Docker Hub..."
docker push $imageTag
+ if ($LASTEXITCODE -ne 0) {
+ Write-Error "Docker push failed for tag: $imageTag"
+ exit 1
+ }
docker push $latestTag
-
+
if ($LASTEXITCODE -ne 0) {
- Write-Error "Docker push failed!"
+ Write-Error "Docker push failed for tag: $latestTag"
exit 1
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (-not $skipPush) { | |
| # Push to Docker Hub | |
| Write-Host "`nPushing to Docker Hub..." | |
| docker push $imageTag | |
| docker push $latestTag | |
| if ($LASTEXITCODE -ne 0) { | |
| Write-Error "Docker push failed!" | |
| exit 1 | |
| if (-not $skipPush) { | |
| # Push to Docker Hub | |
| Write-Host "`nPushing to Docker Hub..." | |
| docker push $imageTag | |
| if ($LASTEXITCODE -ne 0) { | |
| Write-Error "Docker push failed for tag: $imageTag" | |
| exit 1 | |
| } | |
| docker push $latestTag | |
| if ($LASTEXITCODE -ne 0) { | |
| Write-Error "Docker push failed for tag: $latestTag" | |
| exit 1 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/build-and-docker.ps1` around lines 71 - 79, The docker push block
performs two pushes (docker push $imageTag and docker push $latestTag) but only
checks $LASTEXITCODE once, which can mask failures; update the script to check
$LASTEXITCODE immediately after each docker push call and handle failures
independently (write error and exit 1) so a failed push of $imageTag cannot be
overridden by a subsequent successful push of $latestTag; keep the conditional
on $skipPush and use the existing error reporting pattern around each push.
| /> | ||
| <meta name="generator" content="new-api" /> | ||
| <title>New API</title> | ||
| <title>GQ API</title> |
There was a problem hiding this comment.
Revert the title rebrand to preserve required project identity.
This changes a protected branding reference in an HTML title.
🔧 Suggested fix
- <title>GQ API</title>
+ <title>New API</title>Based on learnings: Do NOT modify, delete, replace, or remove any references, mentions, branding, metadata, or attributions related to new-api or QuantumNous in HTML titles/meta/frontend code.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <title>GQ API</title> | |
| <title>New API</title> |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/index.html` at line 19, The HTML title was changed to "GQ API" and must
be reverted to the protected project branding; update the <title> element in
web/index.html so it contains the original required branding (restore the
previous value that includes "new-api" or "QuantumNous" as used across the
project) rather than "GQ API", ensuring any meta/frontend references to project
identity remain unchanged.
| allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone' | ||
| sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation' |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For an iframe used to render internal documentation pages, what is the recommended minimal sandboxandallowpolicy, and why isallow-top-navigation considered risky?
💡 Result:
For an iframe rendering internal (same-origin) documentation pages, the recommended minimal sandbox policy is sandbox="allow-same-origin allow-scripts". This allows the content to be treated as same-origin (enabling access to cookies, localStorage, and same-origin APIs if needed for documentation functionality) and permits JavaScript execution (common in modern docs for interactivity like search, navigation, or dynamic content). An empty sandbox="" (all restrictions) would block scripts and treat content as unique origin, breaking most interactive docs. Adding allow-forms or allow-popups may be needed if docs have forms or links opening new tabs/windows. The allow attribute can be minimal or omitted if no special Permissions Policy features (e.g., geolocation, camera, fullscreen) are required: allow="". If fullscreen is needed (e.g., for diagrams), use allow="fullscreen". This sets a restrictive Permissions Policy for the iframe's content, disabling powerful features by default. allow-top-navigation is risky because it permits the iframe content to navigate the top-level (parent) browsing context without restrictions, enabling automatic redirects (e.g., via meta refresh, script location changes, or links with target="_top") that could trick users into malicious sites, even without user interaction. This is commonly abused in untrusted embeds like ads. Use allow-top-navigation-by-user-activation instead for safer user-initiated top navigation.
Citations:
- 1: https://html.spec.whatwg.org/multipage/the-iframe-element.html
- 2: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe/
- 3: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe
- 4: https://cloud.google.com/blog/products/data-analytics/iframe-sandbox-tutorial
- 5: https://web.dev/articles/sandboxed-iframes
- 6: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
- 7: https://iframetest.com/sandbox-tester
🏁 Script executed:
# Check if the file exists and view the context around lines 44-45
if [ -f "web/src/pages/Docs/index.jsx" ]; then
echo "=== File found, showing lines 30-60 for context ==="
cat -n "web/src/pages/Docs/index.jsx" | sed -n '30,60p'
else
echo "File not found at web/src/pages/Docs/index.jsx, searching for it..."
fd -i "docs.*index.jsx" web/
fiRepository: QuantumNous/new-api
Length of output: 797
🏁 Script executed:
# Find where DOCS_URL is defined and get more context
rg -n "DOCS_URL" web/src/pages/Docs/index.jsx -B 5 -A 2Repository: QuantumNous/new-api
Length of output: 407
🏁 Script executed:
# Search for docs-proxy definition or configuration
rg -r "docs-proxy" --type ts --type tsx --type js --type jsx | head -20Repository: QuantumNous/new-api
Length of output: 460
🏁 Script executed:
# Search for docs-proxy references in the codebase
rg "docs-proxy" --type ts --type tsx --type js --type jsxRepository: QuantumNous/new-api
Length of output: 91
🏁 Script executed:
# Search for docs-proxy without type restrictions
rg "docs-proxy"Repository: QuantumNous/new-api
Length of output: 125
🏁 Script executed:
# Search for backend routes or server code handling /docs-proxy
find . -type f \( -name "*.js" -o -name "*.ts" -o -name "server.*" -o -name "app.*" -o -name "routes.*" \) ! -path "*/node_modules/*" ! -path "*/.next/*" ! -path "*/dist/*" | head -20Repository: QuantumNous/new-api
Length of output: 853
🏁 Script executed:
# Look for backend implementation - search in project root and backend dirs
ls -la | grep -E "app|server|index"
find . -maxdepth 2 -type f \( -name "app.js" -o -name "server.js" -o -name "index.js" \) ! -path "*/node_modules/*" ! -path "*/web/*"Repository: QuantumNous/new-api
Length of output: 45
🏁 Script executed:
# Check repository structure
git ls-files | head -30Repository: QuantumNous/new-api
Length of output: 808
🏁 Script executed:
# Check directory structure at root level
ls -la | grep "^d" | awk '{print $NF}'
# Also search for any file containing "docs-proxy" as a route
rg "docs-proxy|'/docs'" --max-count 5Repository: QuantumNous/new-api
Length of output: 278
🏁 Script executed:
# Look for docs-proxy in router files
rg "docs-proxy|docs" router/ | head -20Repository: QuantumNous/new-api
Length of output: 244
🏁 Script executed:
# Search for docs-proxy in Go files
rg "docs-proxy" . --type goRepository: QuantumNous/new-api
Length of output: 45
🏁 Script executed:
# Check docs directory
ls -la docs/
# Also search for proxy middleware or configuration
rg "proxy|Proxy" . --type go | grep -i "docs\|handler" | head -10Repository: QuantumNous/new-api
Length of output: 1080
🏁 Script executed:
# Check if documentation contains forms or interactive elements
find docs -type f -name "*.md" | head -5 | xargs grep -l "form\|popup\|submit" | head -5Repository: QuantumNous/new-api
Length of output: 154
🏁 Script executed:
# Check the content of docs files for actual forms
grep -n "form\|popup" docs/channel/other_setting.md | head -5
grep -n "<form\|<input" docs/**/*.md 2>/dev/null | head -5Repository: QuantumNous/new-api
Length of output: 110
Tighten iframe permissions; current policy is over-permissive for internal documentation.
The allow-top-navigation directive enables automatic redirects and is unnecessary for serving documentation. Additionally, granting camera, microphone, geolocation, accelerometer, and gyroscope permissions is risky and should not be required for documentation content. For an internal same-origin documentation iframe, a minimal sandbox policy is sufficient.
🔧 Suggested hardening
- allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone'
- sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation'
+ allow=''
+ sandbox='allow-same-origin allow-scripts'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| allow='accelerometer; ambient-light-sensor; camera; encrypted-media; geolocation; gyroscope; microphone' | |
| sandbox='allow-same-origin allow-scripts allow-popups allow-forms allow-top-navigation' | |
| allow='' | |
| sandbox='allow-same-origin allow-scripts' |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/src/pages/Docs/index.jsx` around lines 44 - 45, The iframe currently
grants over-permissive features and navigation rights; update the JSX in
web/src/pages/Docs/index.jsx by removing camera, microphone, geolocation,
accelerometer, gyroscope, encrypted-media and other sensitive tokens from the
allow attribute (keep no features or only the minimal feature needed, e.g.,
"clipboard-write" if required) and remove "allow-top-navigation" from the
sandbox attribute—use a minimal sandbox such as sandbox="allow-same-origin
allow-scripts" to serve internal documentation safely.
| '/api': { | ||
| target: 'http://localhost:3000', | ||
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, | ||
| }, | ||
| '/mj': { | ||
| target: 'http://localhost:3000', | ||
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, | ||
| }, | ||
| '/pg': { | ||
| target: 'http://localhost:3000', | ||
| target: 'https://zhang-liang.online', | ||
| changeOrigin: true, | ||
| }, |
There was a problem hiding this comment.
Avoid proxying local dev traffic directly to a remote production origin.
This routes local /api, /mj, and /pg requests to a live host, which makes accidental production-side mutations much easier during development.
🔧 Suggested fix (env-driven target with safe local default)
+const proxyTarget = process.env.VITE_API_PROXY_TARGET || 'http://localhost:3000';
+
export default defineConfig({
@@
server: {
host: '0.0.0.0',
proxy: {
'/api': {
- target: 'https://zhang-liang.online',
+ target: proxyTarget,
changeOrigin: true,
},
'/mj': {
- target: 'https://zhang-liang.online',
+ target: proxyTarget,
changeOrigin: true,
},
'/pg': {
- target: 'https://zhang-liang.online',
+ target: proxyTarget,
changeOrigin: true,
},
},
},
});🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@web/vite.config.js` around lines 93 - 104, The dev server proxy currently
routes '/api', '/mj', and '/pg' directly to the production host
'https://zhang-liang.online'; change each proxy entry to use an env-driven
target with a safe local default to prevent accidental calls to production
(e.g., read a VITE_API_PROXY_TARGET or API_PROXY_TARGET and fall back to
'http://localhost:3000' or similar). Update the proxy objects for '/api', '/mj',
and '/pg' in vite.config.js to reference that env var (or import.meta.env if
using Vite's env system) so local development defaults to a local backend while
allowing override for remote targets. Ensure changeOrigin remains true and add a
short comment explaining the env override.
4 participants
Important
📝 变更描述 / Description
(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
(请在此粘贴截图、关键日志或测试报告，以证明变更生效)
Summary by CodeRabbit
Release Notes
New Features
Chores