Skip to content

Release v3.2.3

Choose a tag to compare

View all tags
@Sakura520222 Sakura520222 released this 26 Sep 14:14
· 358 commits to main since this release
v3.2.3
77c623f

v3.2.3 (2026-09-26)

总结 / Summary

本版本为功能与维护版本，新增 GitHub App 用户授权中心与 7 天滑动 WebUI 会话，重构了 WebUI 导航与路由架构，并显著增强了 Host Updater 的回滚自愈与镜像清理能力。

核心变化包括：普通用户可直接在 GitHub App 授权中心查看与扩展授权范围；WebUI 统一按业务领域组织导航并将旧审查日志地址平滑重定向至 PR 页面；AI 审查与压缩全面支持单模型输出上限与请求策略解析；Host Updater 增强了部署前基线镜像拉取保障并在更新验证通过后自动清理未引用的旧官方镜像；针对仓库互助与后台服务，修复了并发 Token 刷新死锁、连接池耗尽以及管理端搜索转义与分页状态保留等问题。

This release is a feature and maintenance release that introduces the GitHub App user authorization center and seven-day sliding WebUI sessions, reorganizes the WebUI navigation and routing architecture, and hardens Host Updater rollback self-healing and post-update image cleanup.

Core changes include: enabling regular users to manage repository authorization scopes directly in the GitHub App authorization center; reorganizing WebUI navigation into business domains while smoothly redirecting legacy review logs to PR pages; enforcing per-model output limits and request policy resolution in AI review and compression; hardening Host Updater to ensure baseline rollback images exist before activation and safely clean up unused official images post-update; and resolving Star-Aid token refresh deadlocks, database pool exhaustion, and admin filter/pagination regressions.

升级提示 / Upgrade Notes

  • 重新同步 Python 依赖环境：本次发布升级了 cryptography (>=50.0.1)、sqlalchemy (2.0.54)、uvicorn (0.53.0)、pydantic (>=2.13.5)、openai (>=3.8.0) 和 redis (>=8.1.0) 等关键依赖，部署环境需执行依赖同步（例如 uv sync 或 pip install -r requirements.txt）。

  • 核对 GitHub App 与网关超时配置：若使用独立的 GitHub App 提供授权中心或仓库互助功能，需在系统配置中配置 star_aid_github_app_slug；若反向代理超时时间较短，需检查并配置 star_aid_github_app_discovery_timeout_seconds（默认 45 秒），确保低于网关或代理的超时设置。

  • Resynchronize Python dependencies: Key dependencies including cryptography (>=50.0.1), sqlalchemy (2.0.54), uvicorn (0.53.0), pydantic (>=2.13.5), openai (>=3.8.0), and redis (>=8.1.0) have been upgraded. Environments must resynchronize dependencies (e.g., via uv sync or pip install -r requirements.txt).

  • Verify GitHub App and gateway timeout settings: If using an independent GitHub App for the authorization center or Star-Aid, configure star_aid_github_app_slug in system config; if using a short reverse proxy timeout, verify star_aid_github_app_discovery_timeout_seconds (default 45s) is set lower than proxy/gateway timeouts.

注意事项 / Important Notes

Important

WebUI 导航架构调整：主导航已全面重构并按业务领域收拢，PR 列表成为唯一的审查记录入口。旧版 /logs/ 与 /logs/list-fragment 请求会自动重定向至 /pr/，旧审查片段请求会重定向至完整 PR 详情页。

WebUI navigation restructure: Primary navigation is now consolidated into business domains, and the PR list is the sole review record list. Legacy /logs/ and /logs/list-fragment requests automatically redirect to /pr/, and legacy review fragments redirect to the full PR detail page.

Note

AI 摘要输出上限折叠到单模型配置：历史摘要和仓库互助摘要的输出上限不再跟随全局 ai_max_tokens，而是折叠为跟随 summary 角色实际绑定模型的 max_output_tokens，并严格受当前上下文预算约束。

AI summary token limits folded into per-model configuration: Output caps for incremental history summaries and Star-Aid summaries no longer follow global ai_max_tokens; they now follow max_output_tokens on the model bound to the summary role under context budget constraints.

Note

Host Updater 镜像自动清理：三镜像部署验证成功并结束事务后，Updater 会自动清理本地不再被任何容器引用的旧版 Sakura-AI 官方镜像；清理失败仅记录警告，不影响已成功提交的更新。

Host Updater automated image cleanup: After a verified three-image deployment commits, the updater automatically cleans up unused official Sakura-AI images not referenced by any container; cleanup errors produce warnings and do not affect the committed deployment.

Note

WebUI 会话机制变更为 7 天滑动过期，仅在响应阶段基于最新权威账户状态刷新 claims。

WebUI sessions now use a 7-day sliding expiration, refreshing claims during response completion based on authoritative account state.

中文更新日志

新增功能

  • 新增 GitHub App 用户授权中心，支持普通用户查看已授权安装与仓库范围，并支持语言感知的 OAuth 流程与仓库可见性区分。
  • 支持 GitHub App slug 配置、应用身份解析以及在系统配置中显式清空 slug，并允许自定义发现超时时间。
  • 引入 7 天滑动 WebUI 会话机制，并在最终响应阶段使用权威账户状态刷新 claims。
  • Host Updater 在更新验证成功后自动清理不再被任何容器引用的官方旧镜像，并增强 systemd 单元管理与启动超时传递。
  • AI 审查器新增有效消息追踪、搜索限制与压缩器运行时刷新，并在压缩预算中纳入工具 token 和 enforce read_file 字符上限。
  • 在 AI 协议层引入请求策略解析机制并细化错误处理。
  • 增强仓库互助中的 GitHub 速率限制处理与安全同步机制，管理端仓库支持分页、搜索与筛选。

问题修复

  • 修复 Token 刷新时的连接池耗尽问题，在刷新期间复用调用方数据库会话，并通过行级排他锁与一致的 DB 加锁顺序消除并发死锁。
  • 修复仓库互助管理端 SQL 搜索通配符转义与筛选状态丢失问题，支持成员分页，并修复重新授权状态同步与调度器生命周期管理。
  • 限制用户安装发现的并发与超时时间；当发现期间凭据被替换时报告可重试错误，防止过期 401 撤销已替换的凭据，并在缺少回调 URL 时正确报告未配置状态。
  • 修复 WebUI 导航与审查筛选问题，在认证拒绝时保留 return_to 参数，并正确处理 App slug 缓存中的 Client ID 变更。
  • Host Updater 在激活前校验部署快照中的基线沙箱镜像对并在缺失时自动拉取；在回滚时保留镜像恢复错误；限制镜像清理执行时间并在清理异常时安全保留活动锁。
  • 修正 Updater 停止时优先经由 systemd 并在 socket 残留时回退至原生进程停止，确保重装与守护进程启动时正确透传 CLI 参数。
  • 在 Agent Team 中对不可安装的 pyproject.toml 文件跳过可编辑安装。

重构

  • 重构 WebUI 业务领域导航结构，将旧版审查日志平滑重定向至 PR 页面并清理导航界面。
  • 移除 AI 审查器中的最大文件大小硬编码检查，改为统一执行输出行数限制。
  • 简化 Updater 的 Docker 镜像清理流程与活跃作业检查逻辑。

文档更新

  • 补充代码审查规则并更新项目结构规范指南。
  • 补充 Host Updater 基于 systemd 的服务管理与运维文档。

测试

  • 在沙箱测试中增加 Docker 守护进程探测重试与 setup 失败门禁，适配时间戳白名单行号偏移与仓库互助回调注入回归测试。

其他变更

  • 升级运行时与工具依赖：SQLAlchemy (2.0.54)、Uvicorn (0.53.0)、Cryptography (>=50.0.1)、Pydantic (>=2.13.5)、OpenAI (>=3.8.0)、Redis (>=8.1.0)、Ruff (0.16.8)、Tzdata (2026.4)、Python-Slugify (>=9.0.0)、Watchfiles (>=1.2.0)、PyYAML (>=6.0.3)、Alembic (>=1.19.2) 与 Stripe (>=15.6.1)。
  • 版本号递增至 3.2.3，在 .gitignore 中忽略 .codex/ 目录，并补充 PR#600、Issue#599 与 Issue#613 的反思记录。
English Changelog

New Features

  • Added GitHub App user authorization center, allowing regular users to view authorized installations and repository scopes with language-aware OAuth flows and repository visibility support.
  • Added support for GitHub App slug configuration, app identity resolution, explicit slug clearing in system config, and configurable discovery timeout.
  • Introduced seven-day sliding WebUI sessions with claim renewal on final response against authoritative account state.
  • Added automatic cleanup of unused official images in Host Updater after verified updates, along with hardened systemd unit management and startup timeout propagation.
  • Added effective messages tracking, search limits, and compressor runtime refresh to AI reviewer, while including tool tokens in compression budget and enforcing read_file character limits.
  • Introduced request policy resolution and refined error handling in the AI protocol layer.
  • Enhanced GitHub rate limit handling and safe repository sync for Star-Aid, and added pagination, search, and filtering to admin repositories.

Bug Fixes

  • Fixed connection pool exhaustion during token refresh by reusing caller DB sessions, and eliminated concurrency deadlocks through durable row locks and consistent lock ordering.
  • Fixed SQL wildcard escaping and preserved filter states in Star-Aid admin views, added member pagination, and fixed reauthorization status sync and scheduler ticker lifecycle.
  • Bounded user installation discovery concurrency and timeout; reported retryable errors when credentials are replaced during discovery, prevented stale 401s from revoking replaced credentials, and reported unconfigured status when App callback URLs are missing.
  • Fixed navigation and review filter issues, preserved return_to on authentication denial, and handled client ID changes in the app slug cache.
  • Host Updater now ensures baseline sandbox image pairs exist before activation by automatically pulling missing images; preserved recovery errors during rollback; bounded image cleanup duration and safely retained the active gate across cleanup failures.
  • Routed updater stop operations through systemd with fallback to raw process termination if sockets survive, and forwarded CLI arguments during reinstall and daemon startup.
  • Skipped editable installation in Agent Team for non-installable pyproject.toml files.

Refactor

  • Consolidated WebUI navigation into business domains, sanitized legacy review log redirects to the PR page, and refined navigation UI.
  • Removed max file size check in AI reviewer and enforced output line limits.
  • Simplified Docker image cleanup logic and active job checks in the updater.

Documentation

  • Added code review rules and updated project structure guidelines.
  • Documented systemd service management for the host updater.

Tests

  • Added Docker daemon probe retries and setup error fail gate in sandboxer tests, and adapted timestamp allowlist and Star-Aid callback response injection regression tests.

Other Changes

  • Upgraded runtime and tool dependencies: SQLAlchemy (2.0.54), Uvicorn (0.53.0), Cryptography (>=50.0.1), Pydantic (>=2.13.5), OpenAI (>=3.8.0), Redis (>=8.1.0), Ruff (0.16.8), Tzdata (2026.4), Python-Slugify (>=9.0.0), Watchfiles (>=1.2.0), PyYAML (>=6.0.3), Alembic (>=1.19.2), and Stripe (>=15.6.1).
  • Bumped version to 3.2.3, added .codex/ to .gitignore, and added reflections for PR#600, Issue#599, and Issue#613.
Assets 9
Loading