Maodouchat 1.0.3

Maodouchat v1.0.3

由 GitHub Actions 自动构建（commit cb15cc0）

安装包

• maodouchat-1.0.3.apk — Android 应用
• maodouchat-server-1.0.3.tar.gz — Ktor 服务端发行包
• SHA256SUMS.txt — 各文件 SHA-256 校验和

部署服务端见 docs/docker-deployment.md（或直接用 Docker 镜像方式部署）。

本次变更

cb15cc0 perf: 动画状态读取下沉到 placement/draw
d8fdc31 perf: 使用 Compose 原始类型状态减少装箱
c5427bb fix: 修复 720px 断点 CSS 语法错误(空块缺少闭括号)
d5cbeaf Merge branch 'main' of github.com:xalor888/Maodouchat
c49f023 XiaoYu-xdz-1
8f36e80 fix: 规范化 TURN 用户名并补齐 SealedSender 证书测试
4396e60 fix(brand): redrawn logo with natural aspect ratio and update website and app icons
742b1d1 fix: 替换 ScreenSecurePolicy 平台 Uri 依赖为标准解包
3a7002f fix: 统一 webhook IP 字面量配置期校验
89f8506 fix: 服务端地址 scheme 大小写规范化
65989db fix: 封堵客户端 IPv4 transition 字面量绕过
8d15671 fix: 规范化运行时服务器 scheme 大小写
34824ce fix: 统一服务器地址校验边界
20db308 fix: 拒绝带路径的运行时服务器地址
ae238f3 fix: 加强贴纸缓存完整性与路径边界
82c8519 fix: 收紧按需贴纸下载同源策略
55db49f fix: 封堵 webhook IPv6 兼容地址绕过
0355728 fix: 阅后即焚清理复用通知中心单例
dab5747 fix: 封堵链接预览 IPv6 内网绕过
a59de80 fix: 修复链接预览 SSRF 绕过并收紧 AI 预算检查
de04eb8 fix: token 刷新路径统一切到 IO 调度器
6d58f23 fix: 修复附件取消与收藏页加载竞态
8fe59e6 fix: 修复客户端与服务端并发竞态并补齐数据库迁移
fe1ee1a feat(website): streamline pages, point downloads to GitHub releases, fix SVG icons, and optimize transparent 1:1 logo
3982e5a 修复悬浮球与语音播放竞态并加固服务端并发
251ec2c 加固 release CI 并修正体积基线
963ddfa 统一清理换号后的输入状态
0550279 注销时清除假聊天解锁状态
8f6e1cb 修复拨号码恢复图标后的偏好状态
83e8af2 消除单聊详情存在性探测
6c3a8d0 撤回消息同步清理星标废行
c67bc1e 过滤撤回消息的永久未读计数
5af1025 收窄通话邀请去重键范围
bf96367 收紧评论点赞与删除的路径归属校验
9255a7b 消除深链与格式化字符串 lint 误报
c0594f1 加固拨号广播校验与启动 trace 配对
be4948d 升级 GitHub Actions 至当前稳定 major
b95d3d8 收紧客户端单例与悬浮球生命周期
18444d9 全文搜索排除锁定会话
a9189fd 修复置顶计数 H2 语法并清理测试数据库连接
bb9b318 修复 ChatRepository 批量写入缺少 batchInsert 导入
bcb9104 过滤已读与搜索中的过期及私密密聊命中
32e92a8 添加 Apache-2.0 开源协议
9063a52 重做官网首页视觉系统并补齐样式路由
2fbcdce 合并批量运行时配置写入事务
36a2be8 批量写入用户标签绑定
3dae938 批量写入建群参与者
489dbc7 批量检查 WebSocket 1对1拉黑预检
1e18caf 批量检查建群成员拉黑关系
f395ff3 减少发消息拉黑预检与批量令牌审计事务
75d16f3 重做官网首页视觉与响应式布局
099bb65 批量写入风险标签事件
b7c536b 批量查询好友事件拉黑过滤
8fc643b 批量过滤拍一拍静音推送收件人
d79a20e 修正 getChatMember 命令日志仅成员命中时写入
6fe48cd 修正秘密提示命令日志写入门禁
1bc38b3 加固广播前拉黑查询异常处理
35cc397 统一机器人命令日志仅成功写入
8c37ce6 移除已读回执重复拉黑查询
085f4a7 重做官网首页视觉与响应式布局
6fe47f8 优化机器人消息广播拉黑过滤
8fe39eb 收紧机器人命令日志写入状态门禁
1b79791 收紧机器人消息写路径状态门禁
581a6ca 收紧机器人群管理写路径状态门禁
6c69c4e 收紧机器人群投票与置顶写路径状态门禁
fe6f767 在机器人消息事务内复验 owner 状态
7f229d5 收口主 REST 机器人状态错误码
d4793ab 区分开发者机器人状态与输入错误语义
93f2dc7 收紧 bot-token 管理端点状态错误语义
b0e2899 补齐开发者机器人设置端点限流
08e5073 阻断封禁机器人拉取或清理收件箱
538023b 封住机器人直写接口的状态竞态窗口
34d51bd 收紧机器人收件箱写入门禁
bc800e8 重写官网首页视觉与内容布局
5260341 阻断封禁账号机器人接收回调事件
bb8a5b9 阻断封禁账号机器人继续接收 webhook 事件
376c89f 删除机器人时关闭在线状态展示
05fa7cc 限制开发者 webhook 测试频率
b250ab0 修复开发者账号删除机器人未广播群成员版本
5308519 补齐开发者门户写操作的维护与限流
5cc45bd 收紧开发者会话白名单并补齐机器人维护门禁
44d7178 补齐机器人管理与邀请进群的维护封禁门禁
78c796f 补齐阅后即焚、群昵称和消息置顶的状态门禁
9ca3f56 补齐群管理写端点的封禁校验
2f5fcd5 补齐机器人创建端点的维护与封禁校验
9bdb7ca 统一风控规则创建与更新的阈值边界
c23da81 限制消息变更同步游标长度
df396e5 修复官网存储受限时主题脚本崩溃
6aaf453 重写官网首页并补齐交互测试
c459c23 9.174: 会话最后消息过滤过期阅后即焚并删除死查询
3465cfd 9.173: 双向拉黑过滤合并单次列查询并补反向测试
ba3c719 9.172: 修正通话前台通知取消 key 不匹配
5baebfa 9.171: 前台服务类型按 API 30 边界使用
c1b06e0 9.170: 图片 EXIF 读取迁移 AndroidX ExifInterface
5c6824f 9.169: 媒体缓存清理移至 IO 调度避免主线程阻塞
7390d36 9.168: 修正服务端 SDP 视频检测大小写剥离
72fdbf2 9.167: 修复 H2 保留字 matched 迁移失败并补齐测试参数
2c2b0c4 9.165-9.166: 群通话邀请去重上限对齐群硬上限+60s 窗口；WebRTC SDP 大小写/焦点竞态/音轨失败回滚/旧会话清理守卫
903d898 9.164: WS 新消息通知改 IO 调度，消除主线程 runBlocking 阻塞
12496d8 9.163: 来电消费改 CAS 原子读-清，杜绝双消费重复接听
e6590c5 9.162: Explore 六处回调补会话门禁+reportPost owner 快照，图片缩放 NaN 回落
fc4201c 9.161: file_analyze 非 PDF 按解码字符估算预算预检，封堵文本放大绕过
72da6ab 9.160: AI 网关 token 估算回填+读失败可重试，Markdown 围栏长度匹配+双波浪死分支，滑动行 snapTo 取消
d326e07 9.159: 设备移除/改名弹窗只存 deviceId 并按 state.devices 现查，目标消失自动关闭
d22bde0 9.158: 投票创建 options 严格解析，非法元素整体拒绝
e5444f5 9.157: 投票 optionIndexes 严格解析整体拒绝，杜绝非法元素静默截成子集投票
2a9c07d 9.156: 会话列表消息搜索转义与陈旧守卫统一用截断值，修复超长输入恒丢弃
2fed7a6 9.155: 语言弹窗统一走 VM 云同步+重建，点赞者列表补复合覆盖索引
bc31d48 9.154: 管理审计 detail 列宽 800+启动 ALTER，处置端点按 update 行数判定生效
96703d5 9.153: 置顶预览与收藏搜索预览统一 meta 末位边界口径
c14a50f 9.152: 群玩法广播逐收件人 payload、签到双签唯一冲突幂等回读、收藏清空顺序执行+权威重拉
6034b0b 9.151: 附件 Range 支持闭区间/后缀形式，上传者退群不再误删 COMMITTED 密文
e5b523c 9.150: 弹窗陈旧快照守卫、菜单动作按 id 现查、外观偏好 ON_RESUME 刷新、请求体读取 awaitContent 防空转
4d44ba7 fix: align link-preview meta boundary with parsedContent lastIndexOf semantics
2692c76 fix: snapshot session and gate the AI summary DB read in requestAiSummary
ad9d2eb fix: serialize view-once media wipe with the download lock and wipe expired media from secret-chat isolated dirs
b90b4ab fix: video view-once/spoiler guards, forward memberRole to text bubbles, stop blank-body meta leak, remove dead ~wm: branch, gate purge loop, guard group share sends, align WS receipt/index semantics
f9f0050 fix: enforce suspension guard on poll create/vote/close endpoints, consistent with group-play write policy
43a64b1 fix: widen reports and risk_events columns to match repository truncation bounds, preventing PG 22001 errors on valid inputs
2a2cb0e fix: locate meta block by last occurrence so literal in plaintext no longer truncates, and round-trip forwardedFrom in meta JSON
229578c fix: scope ai_operations deletion to owner, stop voice focus-loss callback from re-playing switched audio, parse link previews against final redirect URL, serialize preview cache trimming
bcc0e20 fix: rebuild surviving prekey list after failed replenish rollback, and reject single-device fallback bundles that resolve to a different device
745583e fix: owner-scoped purges on password change/logout, step-up gate for TOTP disable, device-confirm stale-list false block, and admin audit rowCount/404/overflow correctness
74a3a55 fix: toggleStar PG-safe unique handling, OCR session gates, widget sender-uid fail-closed, concurrent send-code overwrite, and cross-chat-qa first-hop token metering
2953d12 fix: reject blank bot media payloads, remove duplicate sendMessage rate-limit acquire, bound registrationId to libsignal range
8c8ca25 fix: move AI audit token columns into schema to stop PG transaction poisoning, and redact post-interaction notification previews under hide-preview/App Lock
26287b3 fix: cap POST_DELETED broadcast fanout, close WS maintenance-mode bypasses, add fanout+sanitization to secret surface hints, and harden backlog sync session gates
c94ffe2 fix: channel subscriber roster enumeration, bounded-text char budget, audit pagination truncation, bot hint sanitization, and client vote/comment state resets
c4f47e5 fix: dead draft persistence code and chat-detail race conditions
4fd61db fix: align shieldz surface tag with capture-shield flags
ec9da64 fix: developer login per-account rate limit, bot-free capabilities auth
489027c fix: fanout bot card/hint messages live, tighten admin bulk boolean validation
65af843 fix: checkin snapshot keeps alive streak instead of showing zero
a150fbd fix: filter blocked peers from friend request WS fanout
a4a34ce fix: bulk dispositions keep the longest restriction instead of shortening
2f94580 fix: CSV formula-injection guard on trim-start first char
ce8d676 fix: dialect-independent retry-style AI preference upsert
b5a36f9 fix: bot log pagination total and residual bot event fanout blocking
891a73a fix: PG aborted-transaction recovery, bot poll cascade and fanout blocking
b84fd78 fix: clear chat-local member metadata on leave and removal
71dc499 fix: clear bot personal metadata and poll votes on bot delete
409f519 fix: require current group membership to close a PK round
35ce466 perf: batch reaction fanout filtering instead of per-recipient queries
9d35d8c fix: clean group play data when members leave and keep chain sequence unique
5783f88 fix: filter group play broadcasts and internal chat previews by blocked users
908414f fix: clean reply links and likes on moderated comment delete
75b249f fix: fill group audit pages past blocked rows
d6557d0 perf: cache local media availability per message content
33a3a32 fix: filter blocked users from chat creation and invite responses
e834115 fix: exclude blocked users from comment like counts
f3a9395 fix: exclude blocked users from post like and comment counts
62c43f9 fix: bound message history limit at repository layer
2035fe2 fix: rethrow cancellation in chat open and nickname reads
0ff53b2 fix: rethrow cancellation in media center and task screen reads
d7725c7 fix: filter reaction broadcasts per recipient
fe42d86 perf: reuse blocked set across group play list rows
9befe14 fix: rethrow cancellation in search index and secret chat paths
0d9ae60 fix: rethrow cancellation in export and local cleanup paths
90ced04 fix: rethrow cancellation in chat list unread cache writes
0f53a85 fix: exclude blocked senders from batch mark read
17b7943 fix: clear stale post image claims on lookup
2c2c5c5 fix: exact-match legacy post image claims
d81834a fix: filter blocked users from chat participants
816aa54 fix: hide blocked users in read receipts
9618748 fix: hide blocked users in message reaction lists
11a737e fix: filter blocked creators in SQL before limiting group play lists
1beb4c6 fix: filter blocked users from group audit
3d3452d fix: filter blocked users from group member list
0152543 fix: align my check-in rank with blocked filtering
c56702f fix: filter blocked users from check-in ranking
1d6ed0f fix: filter blocked users from group play metadata
b6d9366 fix: bound AI rate limit chat tracking
acbd396 fix: rethrow cancellation in batch mark read
fff12f6 fix: stabilize AI summary sync pending order
42394b4 fix: block legacy post image reuse during create
67d0cdb fix: return all friends up to configured friend limit
98ae9a9 fix: purge search index when toggling secret chat
8b36acd fix: page past invisible users in nearby results
350710f fix: add tie-break to remaining offset pagination lists
0414280 fix: add stable tie-break to remaining offset pagination
70f435d perf: index post image claims by post id
c2497f8 fix: clear reactions when message is revoked
f3a9535 fix: enforce post image uniqueness in database
c712f8e fix: rethrow cancellation in websocket reconnect refresh
6ed484d fix: purge comment likes...

Maodouchat 1.0.2

Maodouchat v1.0.2

由 GitHub Actions 自动构建（commit 7f19fd1）

安装包

• maodouchat-1.0.2.apk — Android 应用
• maodouchat-server-1.0.2.tar.gz — Ktor 服务端发行包
• SHA256SUMS.txt — 各文件 SHA-256 校验和

部署服务端见 docs/docker-deployment.md（或直接用 Docker 镜像方式部署）。

本次变更

7f19fd1 fix: zero Android lint errors (172 LocalContextGetResourceValueCall + 5 NewApi + 6 MissingPermission)
dce3d90 fix: real runtime bugs found by lint (NewApi crashes + missing permission + compose correctness)
f4eb1c7 ci: assembleDebug as hard gate + aapt2 badging verify (manifest/resources parse + icon)

Maodouchat 1.0.1

Maodouchat v1.0.1

由 GitHub Actions 自动构建（commit d99f462）

安装包

• maodouchat-1.0.1.apk — Android 应用
• maodouchat-server-1.0.1.tar.gz — Ktor 服务端发行包
• SHA256SUMS.txt — 各文件 SHA-256 校验和

部署服务端见 docs/docker-deployment.md（或直接用 Docker 镜像方式部署）。

本次变更

d99f462 e2e: wait overlay hidden state instead of visible (CSS .hidden is display:none)
3d6f7d7 e2e: confirm modal for rule create/edit/toggle/delete
a27fc96 ci: fix admin E2E session clock assertion (badge shows only mm:ss, no label)
6eb66bb ci: fix admin E2E dashboard stats selector (#stats .stat -> #content .stat-card)
fee16e8 fix: dayBucketExpression used Kotlin FQN via string interpolation -> H2 reads 'com' as DB name
50e1f6b fix: dayBucketExpression CAST AS SIGNED is MySQL-only, breaks H2 2.x and PostgreSQL
601de63 fix: H2 single-key upsert MERGE incompatibility in RateLimitStats/SystemSettings (admin trends E2E)
8bfd5bb ci: admin E2E assert base-uri instead of unsafe-inline absence (CSP deliberately allows inline, see AdminRouting)
1475ef3 fix: Postgres integration test (widen column SQL used driver config instead of actual DB; memberRevision expectation)
407dff0 ci: sign release APK with temp debug key when no production keystore configured
2329a42 fix: make all unit tests pass (server + app) and fix real bugs
41dc951 fix: test compile errors + commit .env.docker.example for CI compose validation

Maodouchat 1.0.0

Maodouchat v1.0.0

由 GitHub Actions 自动构建（commit 5a0d288）

安装包

• maodouchat-1.0.0.apk — Android 应用
• maodouchat-server-1.0.0.tar.gz — Ktor 服务端发行包
• SHA256SUMS.txt — 各文件 SHA-256 校验和

部署服务端见 docs/docker-deployment.md（或直接用 Docker 镜像方式部署）。

本次变更

5a0d288 ci: handle unsigned release APK filename in release packaging
e18b1c0 chore: raise release size baseline 10MB -> 14MB (measured APK ~12.0MB)
efcef60 fix: resolve ~162 Ktor server compile errors (server compiles clean)
cb4fb95 fix: resolve ~550 Kotlin compile errors across app (app compiles clean)
ec912ed fix: escape apostrophes in string resources (aapt2 requires \')
5a51bc9 fix: resolve duplicate string resources and XML entity that broke release build
c70b70b chore: stop tracking .opencode workspace (tool-local config)
e1bd783 ci: add GitHub Release workflow (auto-build APK + server dist + publish release on v* tags)
4a81930 Initial commit: Maodouchat messenger (Android app + Ktor server + Docker deployment)