Repository navigation
fix(maintenance): Resolve seven audit items / 完成七项维护修复 - #6
Merged
Merged
Conversation
English: - Replace deployment replacement and source overwrites with offline checks and isolated atomic bundles. - Validate exact codes, names, parents, complete feature sets and topology to prevent expanded download areas. - Pin hashed Python dependencies and add offline Windows/Linux contracts; incomplete bundles remain unavailable. 中文: - 将部署目录替换和源文件覆盖改为默认离线检查及独立原子资源包。 - 校验编码、名称、父级、全部匹配要素及拓扑，防止区域下载范围扩大。 - 锁定带哈希的 Python 依赖并增加 Windows/Linux 离线测试；未完成包不得使用。 Validation: - python -B -m unittest discover -s scripts -p test_region_tools.py -v: 13 passed; default CLI contract failed on baseline before repair. - .venv-region/Scripts/python -m pip install --require-hashes --only-binary=:all: -r scripts/requirements-region.lock: fresh Windows environment passed. - node scripts/release_preflight.mjs: Python contracts, go test ./..., JS checks, browser 390/768/1440px regressions and secret/generated scans passed. - audit_environment.py --mode workspace --workspace . --format text and validate_handoff_contract.py --path docs/long-term-memory.md --format text: passed. - git diff --check: passed. Linux dependency and race validation await CI; no production data or real region service tests performed.
English: - Resolve the temporary fixture root before using canonical region helpers. - Hosted Windows runners expose 8.3 aliases that differ from resolved absolute paths. - Preserve production path guards; Linux and local Windows behavior remains unchanged. 中文: - 在调用区域工具前将测试临时目录解析为规范路径。 - Windows 托管运行器使用短路径别名，导致测试输入与规范路径不一致。 - 保留生产路径保护；Linux 和本地 Windows 行为不变。 Validation: - .venv-region/Scripts/python -B -m unittest discover -s scripts -p test_region_tools.py -v: 13 passed. - GitHub run 34569093658 identified four Windows fixture failures; Linux tool and app checks passed. - Hosted Windows retry awaits CI. Password implementation remains a separate uncommitted batch.
English: - Add authenticated password changes, bounded per-user attempts and a responsive account dialog. - Revoke sessions transactionally and guard login issuance and legacy hash upgrades against stale credentials. - Add offline recovery with hidden input, shared/exclusive database maintenance locks and consistent backups; preserve tasks and user ownership. 中文: - 增加登录后改密接口、用户尝试次数限制和响应式账号弹窗。 - 事务撤销全部会话，登录签发及历史密码升级使用条件更新避免旧凭证恢复。 - 增加隐藏终端输入、数据库维护互斥及一致性备份的离线恢复，保留任务和用户归属。 Validation: - go test . -run 'TestPassword|TestOfflinePassword|TestLegacyPassword' -count=1: passed after correcting Windows file URI; covers rollback, races, session revocation, backup and locks. - node scripts/release_preflight.mjs: Python tests, full Go suite, JS syntax/security, real browser password change and login, 390/768/1440px checks and secret/generated scans passed. - go vet ./... and git diff --check: passed. - validate_handoff_contract.py --path docs/long-term-memory.md --format text: passed. - Linux race and native Linux offline recovery await CI; no production recovery or deployment performed.
English: - Record official administrative sources and provider checks for all five missing catalog boundaries. - Preserve unresolved geometry explicitly because announcements and unknown coordinate references cannot prove complete WGS84 boundaries. - Add stable API reasons, disabled UI choices and an offline gate rejecting unexpected gaps and stale exceptions; no approximated geometry is introduced. 中文: - 为五个缺失区域记录官方行政资料和原提供方接口核查结果。 - 公告及未确认坐标系不能证明完整 WGS84 边界，因此保留明确缺失状态。 - 增加稳定接口原因、页面禁用项及新增缺口和过时例外检查；不引入近似几何。 Validation: - node scripts/release_preflight.mjs: 15 Python tests, full Go tests, JS syntax/security, browser password and 390/768/1440px regressions, secret/generated scans passed. - go vet ./...: passed. - Read-only provider verification on 2026-09-11: both original code-query and static JSON endpoints returned 404 for each of five codes. - Official administrative announcements reviewed; zero complete boundary datasets adopted. No production data changed; no live region-service calls occur in automated tests.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
English: - Unify CLI, API, help, logs and UI build identity; stop treating legacy configuration as executable version metadata. - Build allowlisted Windows and Linux packages from explicit Git snapshots with deterministic archives, manifests and checksums. - Verify native extraction, login, assets and real worker output; align Docker metadata and deployment documentation without publishing tags or Releases. 中文: - 统一命令行、接口、帮助、日志和页面构建身份，旧配置不再冒充程序版本。 - 从明确 Git 快照构建白名单 Windows/Linux 安装包，统一确定性归档、文件清单及校验和。 - 验证原生解压、登录、资源及真实工作进程产物，同步 Docker 元信息和部署文档，不创建标签或发布 Release。 Validation: - node scripts/release_preflight.mjs: 18 Python contracts, full Go suite, JS/security checks, real password flow, responsive 390/768/1440px regressions and sensitive/generated scans passed. - go vet ./...; go test . -run 'TestBuildInfoAndVersion|TestPassword|TestOfflinePassword' -count=1: passed. - python -B scripts/build_release.py --ref HEAD --allow-dirty --output-dir ../../dist/maintenance-dev-a and maintenance-dev-b: Windows/Linux checksum pairs identical. - python -B scripts/verify_package.py ../../dist/maintenance-dev-a/map-tile-fetcher-dev+4ed880765e7c.dirty-windows-amd64.zip: passed 3270 manifest entries, version-only no writes, API/login/static assets and one real fixture tile. - docker run --rm with read-only repository mount and python:3.13-slim scripts/verify_package.py /workspace/dist/maintenance-dev-a/map-tile-fetcher-dev+4ed880765e7c.dirty-linux-amd64.tar.gz: passed native Linux permissions, systemd path, same API and download checks. - python -B scripts/verify_docker.py --allow-dirty: Docker metadata matched the package identity. - node scripts/smoke_ui.mjs: long development version repeated across 390/768/1440px passed. - Workspace audit, handoff contract and git diff --check: passed. Clean-commit native packages and Linux race validation await final CI.
English: - Record clean-source Windows/Linux package verification and immutable successful CI evidence for all seven maintenance items. - Distinguish five researched missing boundaries from completed code changes and preserve honest data limitations. - Update the handoff for future maintenance while retaining protected final-head and post-merge checks. 中文: - 记录干净源码 Windows/Linux 安装包验证及七项维护的成功 CI 证据。 - 区分五项已调查的数据缺口与完成的代码修复，保留真实数据限制。 - 更新后续维护交接，继续执行最终提交与合并后主分支保护检查。 Validation: - GitHub run 34571794614 for 6d4d088: all jobs succeeded, including Linux race/vet and native package matrix. - Clean commit Windows and Linux packages: manifest, version-only, login, static and local worker download checks passed. - git diff --check; handoff contract validation: passed. - Documentation-only batch; application tests were not rerun locally because code is unchanged. Final head CI remains required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR completes the seven maintenance items from the repository audit. Region tooling now uses read-only inputs and independent bundles; account password changes and offline recovery revoke stale sessions; catalog gaps have explicit evidence and UI reasons; build identity and Windows/Linux packaging share one verified entrypoint.
本 PR 处理七项维护问题：区域工具默认只读且仅生成独立资源包；网页改密及离线恢复撤销旧会话；五项区域缺口具备调查记录及明确禁用原因；统一构建身份和 Windows/Linux 安装包。
Scope and limits / 范围与限制:
Validation / 验证: