From b9674fbf7b09bd8144988e9d42b3773a1f7595bb Mon Sep 17 00:00:00 2001 From: shaowei <466995322@qq.com> Date: Tue, 4 Aug 2026 02:42:34 +0800 Subject: [PATCH] fix: restore Windows release installation --- README.md | 3 +- docs/changelog.zh-CN.md | 6 ++++ docs/release-notes-2.7.4.zh-CN.md | 50 +++++++++++++++++++++++++++++++ package-lock.json | 4 +-- package.json | 2 +- scripts/package-release.ps1 | 1 + scripts/verify-governance.ps1 | 4 ++- scripts/verify-release.ps1 | 2 ++ tests.md | 14 +++++++++ 9 files changed, 81 insertions(+), 5 deletions(-) create mode 100644 docs/release-notes-2.7.4.zh-CN.md diff --git a/README.md b/README.md index 8ffd9af..f6c2509 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,8 @@ Self-hosted OpenAI Codex Web UI and Android client bridge. ## 快速入口 - 最新 Release: [github.com/Qjzn/CX-Codex/releases/latest](https://github.com/Qjzn/CX-Codex/releases/latest) -- 2.7.3 发布说明: [docs/release-notes-2.7.3.zh-CN.md](./docs/release-notes-2.7.3.zh-CN.md) +- 2.7.4 发布说明: [docs/release-notes-2.7.4.zh-CN.md](./docs/release-notes-2.7.4.zh-CN.md) +- 2.7.3 发布说明（已由 2.7.4 替代）: [docs/release-notes-2.7.3.zh-CN.md](./docs/release-notes-2.7.3.zh-CN.md) - 2.7.2 发布说明: [docs/release-notes-2.7.2.zh-CN.md](./docs/release-notes-2.7.2.zh-CN.md) - 2.6.0 发布说明: [docs/release-notes-2.6.0.zh-CN.md](./docs/release-notes-2.6.0.zh-CN.md) - 2.5.9 发布说明: [docs/release-notes-2.5.9.zh-CN.md](./docs/release-notes-2.5.9.zh-CN.md) diff --git a/docs/changelog.zh-CN.md b/docs/changelog.zh-CN.md index 9aa1a9c..62cbe64 100644 --- a/docs/changelog.zh-CN.md +++ b/docs/changelog.zh-CN.md @@ -2,6 +2,12 @@ ## 未发布 +## 2.7.4 - 2026-08-04 + +- 修复 2.7.3 Release ZIP 漏打 `vite.local-preview.config.ts`，导致 Windows 全新安装在本地预览构建阶段失败的问题；2.7.3 已撤回稳定最新版身份，由 2.7.4 替代。 +- 将主 Vite 配置和本地预览 Vite 配置同时纳入发布包必需清单、ZIP 内容断言和治理检查，缺少任一构建入口都会在发布前失败。 +- 延续 2.7.3 已完成验证的会话队列隔离、精确重排、长会话增量读取、计划与持续目标、文件引用、Android PDF 与任务宠物稳定性修复。 + ## 2.7.3 - 2026-08-04 - 计划模式改为持续生效，并新增结构化计划卡、一步提交实施和线程级持续目标；目标的暂停、继续、编辑、清除、预算与耗时都以 App Server 状态为准。 diff --git a/docs/release-notes-2.7.4.zh-CN.md b/docs/release-notes-2.7.4.zh-CN.md new file mode 100644 index 0000000..141282f --- /dev/null +++ b/docs/release-notes-2.7.4.zh-CN.md @@ -0,0 +1,50 @@ +# CX-Codex 2.7.4：恢复 Windows 全新安装，延续会话稳定性修复 + +2.7.4 是替代 2.7.3 的发布完整性热修复。2.7.3 的源码、会话回归、GitHub Actions、APK 签名和 SHA-256 校验均通过，但公开 Release ZIP 漏打了本地预览构建配置，真实 Windows 全新安装会在依赖安装后失败。该版本已撤回稳定最新版身份，2.7.4 补齐文件并把同类缺失升级为发布阻断项。 + +## Windows 安装修复 + +- Release ZIP 现在强制包含 `vite.config.ts` 与 `vite.local-preview.config.ts`，与 `npm run build:frontend` 的两个 Vite 构建入口保持一致。 +- 发布包烟测会同时检查两个配置文件；治理门禁也会锁定打包脚本中的必需清单，避免只在源码树可构建、解压后的发布包却无法构建。 +- Windows 正式安装继续支持 `RemoteQuick` 和稳定的 `JsonOutput` 合同： + +```powershell +& ([scriptblock]::Create((irm 'https://raw.githubusercontent.com/Qjzn/CX-Codex/main/scripts/bootstrap-windows.ps1'))) -RemoteQuick -JsonOutput +``` + +官方卸载入口保持不变： + +```powershell +& ([scriptblock]::Create((irm 'https://raw.githubusercontent.com/Qjzn/CX-Codex/main/scripts/uninstall-windows.ps1'))) -JsonOutput +``` + +## 会话稳定性 + +2.7.4 同时包含 2.7.3 的全部会话模块修复： + +- 消息队列由 7420 服务端持久接管，刷新、切换会话或关闭 Android 页面后继续按顺序发送。 +- 修复内部队列通知使用上一轮完成快照误结算新消息，以及秒级时间戳让新消息并入上一轮的问题；每条排队消息由独立 turn 承载。 +- 快速连续添加、删除、重试和重排按稳定消息 ID 合并；完整同步后才执行服务器精确顺序更新，并发冲突时回退到权威顺序。 +- 长会话优先读取最近 40 轮的本地有界投影，连续追加只读取新增字节；静默窗口后再做一次权威收敛，保留计划、命令、审批、文件和工具记录。 +- 已发送但尚未进入权威历史的消息可跨刷新恢复，外部 Codex 进程的 commentary 能及时显示。 + +## 计划、文件与 Android + +- 计划模式持续生效，并提供结构化计划卡与线程级持续目标；暂停、继续、编辑、清除、预算和耗时以 App Server 状态为准。 +- 文件引用显示真实文件名并安全打开完整路径；Android PDF 预览兼容旧 WebView。 +- Android 任务宠物减少浮窗打扰，未读状态使用持久化回复事件游标，进入准确会话后立即清除提醒。 + +## 安全、校验与兼容边界 + +- 本版没有放宽文件、工作区、Cookie、WebSocket、远程入口或 App Server 权限边界。 +- 正式 Android APK 继续由 GitHub Release 工作流使用固定证书构建；源码不内置私人服务地址或 Firebase 项目凭据。 +- 请同时下载对应 `.sha256` 文件校验 Release ZIP 或 APK 的 SHA-256。 +- 本地会话日志投影只用于快速恢复可显示内容，完整结构仍由权威 `thread/read` 收敛，不宣称完全兼容所有未来 App Server schema。 + +## 发布验证 + +- 会话队列真实执行、重排、回复延迟、会话列表、长会话、前端 36 场景、服务模块、前端 normalizer、生产构建和 CLI 构建已完成回归。 +- 2.7.4 新增发布 ZIP 双 Vite 配置断言，并要求从 GitHub 公网最新版执行隔离的 Windows `NoStart` 全新安装烟测。 +- 正式 APK、Release ZIP 及其 SHA-256 必须在标签工作流和公开下载后再次校验；Android 包名、版本号和固定签名证书也必须复核。 + +标签发布前，本版仍属于候选版本。只有主分支 CI、Release 工作流、公开 ZIP/APK、SHA-256、固定 Android 签名和公网 Windows 全新安装全部通过后，才视为正式稳定版本。 diff --git a/package-lock.json b/package-lock.json index e4e975f..124e3b5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cx-codex", - "version": "2.7.3", + "version": "2.7.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cx-codex", - "version": "2.7.3", + "version": "2.7.4", "license": "MIT", "dependencies": { "@capacitor/app": "^8.1.1", diff --git a/package.json b/package.json index 8cb73d3..a8a06c4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cx-codex", - "version": "2.7.3", + "version": "2.7.4", "description": "CX-Codex Web UI and browser bridge for Windows, Linux, Android, LAN, and remote self-hosted access", "type": "module", "license": "MIT", diff --git a/scripts/package-release.ps1 b/scripts/package-release.ps1 index e8d539c..4875af7 100644 --- a/scripts/package-release.ps1 +++ b/scripts/package-release.ps1 @@ -104,6 +104,7 @@ $releaseItems = @( "tsconfig.json", "tsup.config.ts", "vite.config.ts", + "vite.local-preview.config.ts", "dist", "dist-cli" ) diff --git a/scripts/verify-governance.ps1 b/scripts/verify-governance.ps1 index 4c6712f..18fcb5c 100644 --- a/scripts/verify-governance.ps1 +++ b/scripts/verify-governance.ps1 @@ -587,7 +587,9 @@ Assert-ContentIncludes "scripts/package-release.ps1" @( "SECURITY.md", "SUPPORT.md", "tests.md", - "release-capabilities.json" + "release-capabilities.json", + "vite.config.ts", + "vite.local-preview.config.ts" ) $releaseCapabilities = Get-Content -LiteralPath (Join-Path $repoRoot "release-capabilities.json") -Raw | ConvertFrom-Json diff --git a/scripts/verify-release.ps1 b/scripts/verify-release.ps1 index 67a29e0..81c64cc 100644 --- a/scripts/verify-release.ps1 +++ b/scripts/verify-release.ps1 @@ -359,6 +359,8 @@ if (-not $SkipPackageSmoke) { "tests.md", "index.html", "local-preview.html", + "vite.config.ts", + "vite.local-preview.config.ts", "docs\app-server-schema-audit-summary.json", "docs\app-server-protocol-matrix.zh-CN.md", "docs\changelog.zh-CN.md", diff --git a/tests.md b/tests.md index 31362d1..0115bc7 100644 --- a/tests.md +++ b/tests.md @@ -15766,3 +15766,17 @@ Current evidence: - The regenerated schema counts exactly matched `docs/app-server-schema-audit-summary.json`: TypeScript root `236 -> 77`, TypeScript v2 `199 -> 445`, JSON root `37 -> 35`, and JSON v2 `102 -> 202`. The existing protocol matrix already classifies thread goals/status/realtime, plugins, permissions and unknown notifications as partial, diagnostic or deferred capabilities, so no baseline replacement is required for this patch release. - npm `10.9.3` audited 131 production dependencies through the official registry with zero info, low, moderate, high or critical vulnerabilities. The default prefix-level npm `6.14.6` audit error was a local tool incompatibility, not a dependency finding. - GitHub authentication is active for `Qjzn/CX-Codex`, the latest public release remains `v2.7.2`, and all four required Android signing secret names are present. Publication still requires clean-worktree verification, main/tag CI, public asset inspection and certificate/checksum proof. + +## CX-Codex 2.7.4 release-package completeness (2026-08-04) + +1. `scripts/package-release.ps1` must treat both `vite.config.ts` and `vite.local-preview.config.ts` as required Release ZIP inputs because `npm run build:frontend` executes both configurations. +2. The release-package smoke must assert that both Vite configurations exist inside the generated ZIP. Governance verification must lock the same entries into the package manifest contract. +3. After the tag workflow publishes the release, run `bootstrap-windows.ps1` from `raw.githubusercontent.com` in an isolated user root with `-ReleaseVersion latest -NoStart`. It must resolve `v2.7.4`, verify the public ZIP checksum, install dependencies, complete both frontend builds and install package version `2.7.4`. +4. Do not restore the release to stable/latest until the public ZIP/APK, both SHA-256 files, Android version/signature and the isolated Windows installation all pass. + +Current evidence: + +- The isolated public `v2.7.3` bootstrap resolved and verified the published ZIP, then failed at `vite build --config vite.local-preview.config.ts` because the configuration was absent. The installer removed the incomplete installation; GitHub `releases/latest` was immediately restored to `v2.7.2`, and `v2.7.3` was marked as a prerelease. +- The root cause is limited to the Release ZIP manifest and its incomplete content assertion. The configuration exists in source, so repository and tag builds passed while the independently unpacked release could not rebuild the local-preview frontend. +- The patched `2.7.4` release gate completed in 105.8 seconds with governance, production frontend/CLI builds, normalizer, server-module, CLI launcher, ZIP checksum/content and npm package smokes passing. The generated ZIP contains `vite.config.ts` and `vite.local-preview.config.ts` as required entries. +- A fresh directory independently extracted that generated ZIP, installed 325 packages with npm `10.9.3`, and completed both Vite builds in 69.1 seconds. Its package version was `2.7.4`, and both `dist/index.html` and `dist/local-preview.html` existed after the build.