Conversation
翻译并替换和润色并替换此前固定使用内置服务，无法复用用户配置的在线模型，也不能为两个动作补充独立要求。现有逐 chunk 写回体验需要继续保留。 为两个动作增加独立服务 identifier 和追加要求，注册可用 OpenAI 兼容服务并在高级设置中展示当前模型。引入动作专用 Prompt 上下文和流式状态机，在首 chunk 前失败时最多回退一次。 这让替换动作沿用服务页的模型、endpoint、凭据、temperature 和 streaming 配置，同时避免普通 Custom Prompt 干扰动作语义。部分响应中断时保留已写入内容，日志仅记录净化后的元数据。 ---------------------------------------------------------------------- feat(replacement): support online models and additional requirements Translate and Replace and Polish and Replace previously used fixed built-in services, so they could not reuse configured online models or accept independent instructions. The existing per-chunk replacement experience still needed to be preserved. Add independent service identifiers and additional requirements for both actions, register eligible OpenAI-compatible services, and show their current models in Advanced settings. Introduce action-specific prompt context and a streaming state machine that falls back at most once before the first chunk. Replacement actions now inherit model, endpoint, credentials, temperature, and streaming configuration from the Services page without allowing generic custom prompts to override action semantics. Interrupted responses keep written content, while logs contain only sanitized metadata.
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
旧的 endpoint、URL Scheme 和明文配置导出边界可能泄露凭据或放宽网络信任。历史重放与跨应用替换也缺少对保存语言和实际插入结果的明确建模。 引入统一 endpoint 策略、fail-closed 配置 registry 和密码加密备份，同时删除 legacy WebView 信任绕过。语言感知重放与带 receipt 的插入 session 还区分 provider 失败、部分写入和未验证分发。 配置导入导出现在保持密文、原子写入和可回滚合并，凭据请求与日志也具有可测试的安全边界。独立旁路复审无阻断项，聚焦测试和 Debug、Release 构建均通过。 ---------------------------------------------------------------------- feat(security): harden configuration backups and text replacement The previous endpoint, URL Scheme, and plaintext configuration export boundaries could expose credentials or widen network trust. History replay and cross-application replacement also lacked explicit models for saved languages and actual insertion outcomes. Add a shared endpoint policy, a fail-closed configuration registry, and password-encrypted backups while removing the legacy WebView trust bypass. Language-aware replay and receipt-based insertion sessions now distinguish provider failures, partial writes, and unverified dispatch. Configuration transfer now preserves encryption, atomic writes, and rollback-safe merging, while credential requests and logs have testable security boundaries. Independent bypass review found no blockers, and the focused tests plus Debug and Release builds pass.
bb2cd8b to
fb011a8
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fb011a8138
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| serviceIdentifiers.allSatisfy({ | ||
| QueryServiceFactory.shared.metadata(withTypeId: $0) != nil | ||
| }) |
There was a problem hiding this comment.
When an imported backup contains a service-order entry such as BuiltInAI#invalid or OpenAI#arbitrary, this check accepts it because QueryServiceFactory.metadata(withTypeId:) only resolves the raw type before # and does not validate whether that service supports instances or whether the suffix is a UUID. The malformed identifier is then merged into kAllServiceTypesKey-*; LocalStorage subsequently constructs a phantom service and configuration namespace from it, potentially enabling a duplicate built-in service. Validate the complete identifier here—requiring no suffix for single-instance services and a valid UUID for multi-instance services—before applying the restore.
Useful? React with 👍 / 👎.
This branch has not been deployed
1 participant
变更说明 / Summary
本 PR 依赖 #1286，并在其在线服务与流式状态机之上完成第一批安全与可靠性改造；请先审查并合并 #1286。当前分支已重放到最新官方 dev，因此在 #1286 合并前，GitHub diff 会暂时包含其提交。主要改动包括：统一 HTTPS 与精确 loopback endpoint 策略并移除旧 WebView Translator；新增 PBKDF2-SHA256 与 AES-256-GCM 加密配置备份；按保存语言重放历史与收藏；引入文本插入 session、receipt、confidence 与针对性失败反馈；同步 URL Scheme 限制、日志脱敏、六种语言本地化和测试。
关联 Issue / Linked Issues
验证 / Verification
Debug build-for-testing 通过（389 个 Swift 文件）；主 focused test-without-building 通过（85 tests、10 suites、0 failures）；拆分合成 Basic Auth 测试字面量后，当前 head 的增量 build-for-testing 与受影响的 21 tests、2 suites 再次通过；Release build 通过，生产代码在后续测试修复中未变化，SwiftLint 仅 1 个既有 warning、0 serious，sentry-cli 未安装故跳过符号上传；SwiftFormat lint、两个 Info plist、PBX、String Catalog JSON 与 git diff --check 均通过；独立安全旁路复审阻断项为 0。跨应用手工矩阵与设置页截图仍待在 PR 中补充。
截图 / Screenshots
请在 GitHub PR 页面补充截图。 / Please add screenshots on the GitHub PR page.