Sync Dev#983
Merged
Merged
Conversation
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2 to 3. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](actions/create-github-app-token@v2...v3) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…ngs API Agent-Logs-Url: https://github.com/XMOJ-Script-dev/XMOJ-Script/sessions/9b7ffa1a-8077-4f56-aac3-e85b3ec4876c Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>
Co-authored-by: sourcery-ai[bot] <58596630+sourcery-ai[bot]@users.noreply.github.com> Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>
…fault on) Agent-Logs-Url: https://github.com/XMOJ-Script-dev/XMOJ-Script/sessions/91cd1e68-c0d5-495a-bbed-36e3cd49d955 Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>
…r-settings feat: Cross-device settings sync via cloud backend
feat: Add hourly periodic cloud settings sync
…s/dev/actions/create-github-app-token-3 Bump actions/create-github-app-token from 2 to 3
Agent-Logs-Url: https://github.com/XMOJ-Script-dev/XMOJ-Script/sessions/606d7c42-f0ad-4d97-80ae-b8d92c2d6725 Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>
Signed-off-by: zsTree <wa2025666@gmail.com>
…1-again Migrate XMOJ-BBS client endpoints to `/v1` routes
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <copilot@github.com>
* switch endpoint to api.xmoj-script.uk for everything Agent-Logs-Url: https://github.com/XMOJ-Script-dev/XMOJ-Script/sessions/3a87c529-2f63-4617-8be5-5b9f3c33f751 Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com> * Update ASSET_BASE URL to use assets subdomain Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> * 3.4.6 * Update version info to 3.4.6 * Update image upload URLs to new asset location Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> * Update time and description of 3.4.6 * Update ServerURL for script debugging Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> * Update time and description of 3.4.6 * Update SSO button for development version Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> * Update time and description of 3.4.6 * Remove badge from messages link in navigation Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> * Update time and description of 3.4.6 --------- Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com> Co-authored-by: Shan Wenxiao <seanoj_noreply@yeah.net> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Contributor
Reviewer's GuideSynchronizes the dev environment with production by updating domains/versioning, adding cloud-based settings sync and preliminary SSO login support, enhancing the web UI footer/legal pages, and bumping GitHub workflow actions to the latest app token generator. Sequence diagram for cloud settings sync flowsequenceDiagram
participant Timer as BrowserTimer
participant UI as SettingsUI
participant Script as UserScript
participant LS as LocalStorage
participant API as APIBackend
%% Periodic sync trigger
Timer->>Script: PeriodicCloudSync()
Script->>LS: getItem(UserScript-CloudSync-LastSync)
Script-->>Script: [check interval & CloudSync]
Script->>API: RequestAPI(GetUserSettings, {})
API-->>Script: Response{Success, Data.Settings}
Script->>LS: setItem(UserScript-CloudSync-LastSync, now)
Script-->>Script: for each setting in Settings
Script->>LS: setItem(UserScript-Setting-*, value)
Script-->>Script: [if Theme changed]
Script->>Script: initTheme()
Script->>Script: SyncSettingsToCloud()
Script->>LS: iterate keys UserScript-Setting-*
Script->>API: RequestAPI(SetUserSettings, Settings)
API-->>Script: Response{Success}
%% Manual upload from settings page
User->>UI: Click 上传设置到云端
UI->>Script: SyncSettingsToCloud(CallBack)
Script->>LS: iterate keys UserScript-Setting-*
Script->>API: RequestAPI(SetUserSettings, Settings)
API-->>Script: Response{Success/Failure}
Script-->>UI: CallBack(Response)
%% Manual download from settings page
User->>UI: Click 从云端下载设置
UI->>API: RequestAPI(GetUserSettings, {})
API-->>UI: Response{Success, Data.Settings}
UI->>Script: ApplyCloudSettings(Settings)
Script->>LS: setItem(UserScript-Setting-*, value)
Script->>Script: initTheme()
Sequence diagram for SSO login in messages web UIsequenceDiagram
actor User
participant Page as MessagesPage
participant Script as WebUIScript
participant LS as LocalStorage
participant SSO as SSOAuthorizeServer
participant API as APIBackend
%% Start SSO login
User->>Page: Click btn-sso-login
Page->>Script: startSsoLogin()
Script->>Script: generateUuidV4()
Script->>LS: setItem(xmoj-msg-oauth-state, state)
Script-->>User: Redirect to OAUTH_AUTHORIZE_URL
%% SSO authorization
User->>SSO: Authenticate & authorize
SSO-->>User: Redirect to messages.html?code&state
%% Handle callback on init
User->>Page: Load messages.html
Page->>Script: init()
Script->>Script: handleSsoCallback()
Script->>Script: new URL(location.href)
Script-->>Script: Extract code, state
Script->>LS: getItem(xmoj-msg-oauth-state)
Script-->>Script: [if state mismatch]
Script-->>Script: showToast(失败, danger)
Script-->>Script: return false
Script-->>Script: [if state valid]
Script->>API: exchangeSsoCode(code, state)
API-->>Script: {Success, Data{Username, SessionID}}
Script->>LS: removeItem(xmoj-msg-oauth-state)
Script->>Script: saveSession(Username, SessionID)
Script->>Script: showToast(成功, success)
Script->>Script: onLoggedIn()
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
hendragon-bot
Bot
added
GitHub-related
user-script
Update to release 3.5.0
Deploying xmoj-script-dev-channel with
|
| Latest commit: |
ec4cadc
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://082e55af.xmoj-script-dev-channel.pages.dev |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 3 issues, and left some high level feedback:
- In messages.html the new SSO login tab button uses data-tab="sso-develop" but showLoginTab() and the content container use the id/tab key "sso", so clicking the tab will never show the SSO UI; align the data-tab value with the existing tab key.
- startSsoLogin() currently only builds the OAuth URL parameters but never actually navigates to OAUTH_AUTHORIZE_URL (e.g. via location.href or window.open), so the SSO flow cannot start; add the redirect using the constructed params.
- XMOJ.user.js now uses top-level await for the loginStatus fetch, which will throw a syntax error in environments where the userscript is executed as a classic script rather than an ES module; consider wrapping this logic in an async IIFE or an async init function instead of using top-level await.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In messages.html the new SSO login tab button uses data-tab="sso-develop" but showLoginTab() and the content container use the id/tab key "sso", so clicking the tab will never show the SSO UI; align the data-tab value with the existing tab key.
- startSsoLogin() currently only builds the OAuth URL parameters but never actually navigates to OAUTH_AUTHORIZE_URL (e.g. via location.href or window.open), so the SSO flow cannot start; add the redirect using the constructed params.
- XMOJ.user.js now uses top-level await for the loginStatus fetch, which will throw a syntax error in environments where the userscript is executed as a classic script rather than an ES module; consider wrapping this logic in an async IIFE or an async init function instead of using top-level await.
## Individual Comments
### Comment 1
<location path="messages.html" line_range="73-77" />
<code_context>
<a class="nav-link" href="#About">关于</a>
</li>
<li class="nav-item">
- <a class="nav-link" href="messages.html">短消息在线看
- <span class="badge bg-warning text-dark ms-1">Alpha</span>
</code_context>
<issue_to_address>
**issue (bug_risk):** The SSO tab button's data-tab value doesn't match the tab ID checked in changeTab, so the tab will never be shown.
In `changeTab` you only handle `tab === 'sso'` and show `#tab-sso`, but this button uses `data-tab="sso-develop"`, so clicking it never shows the SSO panel. Update either the `data-tab` value or the `changeTab` logic so they use the same identifier.
</issue_to_address>
### Comment 2
<location path="messages.html" line_range="984-992" />
<code_context>
+ });
+}
+
+function startSsoLogin() {
+ var state = generateUuidV4() + '.' + generateUuidV4();
+ localStorage.setItem(STORAGE_OAUTH_STATE, state);
+ var params = new URLSearchParams({
+ response_type: 'code',
+ client_id: OAUTH_CLIENT_ID,
+ redirect_uri: OAUTH_REDIRECT_URI,
+ scope: OAUTH_SCOPE,
+ state: state
+ });
+}
</code_context>
<issue_to_address>
**issue (bug_risk):** startSsoLogin builds OAuth parameters but never actually redirects to the authorization endpoint.
In `startSsoLogin`, `state` is stored and `params` is constructed but never used to trigger navigation, so the button click has no effect. You likely need to redirect to the auth endpoint with these params, e.g. `location.href = OAUTH_AUTHORIZE_URL + '?' + params.toString();` (or use `window.open(...)` if you want a new window).
</issue_to_address>
### Comment 3
<location path="XMOJ.user.js" line_range="916-918" />
<code_context>
//otherwise CurrentUsername might be undefined
+let loginStatus;
+await fetch("https://www.xmoj.tech/loginpage.php")
+ .then((response) => response.text())
+ .then((data) => (loginStatus = data));
+const logined = loginStatus == "<a href=logout.php>Please logout First!</a>";
if (UtilityEnabled("AutoLogin") && document.querySelector("body > a:nth-child(1)") != null && document.querySelector("body > a:nth-child(1)").innerText == "请登录后继续操作") {
</code_context>
<issue_to_address>
**issue:** Top-level await may cause compatibility issues depending on the userscript engine/wrapper.
This new probe uses top-level `await`. Some userscript engines wrap scripts in non-async IIFEs, where this is a syntax error. To preserve compatibility, wrap this in an `async` IIFE (e.g. `(async () => { ... })();`) or move it into your existing async init flow and await it there.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
4 issues found across 14 files
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Re-trigger cubic
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR bumps the project to v3.5.0, migrates endpoints to the xmoj-script.uk domain, introduces cloud settings sync in the userscript, and adds/update website pages (policies + login UI updates).
Changes:
- Bump versions to
3.5.0and expandUpdate.jsonrelease entries. - Add cloud settings sync (manual + hourly) and adjust login handling in
XMOJ.user.js. - Add service/privacy/child protection pages and extend
messages.htmlwith an in-progress SSO login flow; update GitHub Actions token action version.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
terms.html |
Adds a Terms of Service page. |
privacy.html |
Adds a Privacy Policy page. |
child-protection.html |
Adds a Child Protection Policy page. |
index.html |
Updates nav + footer links to policies and SSO center; fixes footer layout. |
messages.html |
Updates API/asset bases and adds an SSO login tab + OAuth callback handling. |
XMOJ.user.js |
Bumps version, migrates endpoints, adds cloud settings sync, adjusts login detection/redirect logic. |
package.json |
Bumps package version to 3.5.0. |
Update.json |
Adds prerelease history and 3.5.0 release aggregation. |
.github/workflows/*.yml |
Updates actions/create-github-app-token major version pin. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
boomzero
approved these changes
May 16, 2026
Member
（） |
Member
|
不要按那个东西 |
Member
Author
|
欸欸欸这个别按啊
|
Member
|
不合并吗 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR aim to accomplish?:
How does this PR accomplish the above?:
By submitting this pull request, I confirm the following:
git rebase)Summary by Sourcery
Update script infrastructure to use the new xmoj-script.uk backend, add cloud-based settings sync and SSO login support, and refresh site legal and navigation pages.
New Features:
Enhancements:
CI:
Summary by cubic
Adds cross‑device settings sync with hourly auto‑sync, switches all API and asset endpoints to the
xmoj-script.ukdomain, and bumps the script to 3.4.6. Also adds SSO login (in progress), new legal pages, and fixes an auto‑login redirect loop.New Features
Refactors
https://api.xmoj-script.ukand assets tohttps://assets.xmoj-script.uk; update WebSocket and image upload URLs.actions/create-github-app-token@v3.package.jsonandUpdate.json).Written for commit f6b0dcc. Summary will update on new commits. Review in cubic