Bundle required crypto and SSL DLLs and gate releases on a Windows native-load smoke test. Resolve loader paths independently of the working directory and encode file URLs correctly. Include the quick-login launcher built from Windows-Boot 0ff70ce10e34ac26411f9e6bcedaedfacc1e74f0. Validated builds, five path regressions, and live Shell and Windows Node startup to QR login.
The Windows release workflow now uses a fixed QQ installer URL and SHA256 hash, verifies the downloaded installer before packaging, and makes the download cache key sensitive to the selected QQ URL, hash, and Node version. The workflow also switches QQ downloads to curl with retries for transient HTTP errors and centralizes the Node version variable to keep the build config consistent.
The release publishing workflow now installs pnpm via pnpm/action-setup instead of globally via npm, and applies the same improvement to the APIFox update job. This keeps the workflow consistent and avoids relying on the environment's global pnpm installation.
Refresh the downstream release workflow to use the newer QQNT 3.2.30-50969 AppImage URLs for both x86_64 and arm64 builds.
Update release note prompt and AI model
Clarifies the release note prompt to require strict output format without wrapping the result in a code block. Also updates the release publish workflow to use `google/gemma-4-26b-a4b-it:free` instead of the previous OpenAI model endpoint setting.
Update QQNT installer URL in release workflow
Switches the release publish workflow to download a newer QQNT x64 installer (9.9.32.50969) from the updated qqdl.gtimg.cn source instead of the previous dldir1v6.qq.com link.
Add mappings for QQ 50969 builds
Add appid/QUA entries and native/packet send-recv offsets for the new 9.9.32-50969 Windows build and 3.2.30-50969 Linux x64/arm64 builds. Also normalize the existing 3.2.30-50828 x64 native recv offset format by removing the leading zero.
CI: use `pnpm i --ignore-scripts` in release-publish workflow to avoid running package install scripts during CI.
Shell: defer showing the QR code until after attempting WebUi quick-login/password fallback. Adds checks for NAPCAT_QUICK_ACCOUNT and quick-password env vars (and WebUi quick-login list), runs WebUi quick config, and only calls getQRCodePicture() if no fallback was attempted and the user is not logged in. Includes error handling for the quick-login attempt.
Introduce a safe PR build dispatch flow and related helpers.
- Add GitHubAPI.createWorkflowDispatch to .github/scripts/lib/github.ts and tighten getRepository nullability.
- Add .github/scripts/pr-build-dispatch.ts to dispatch an untrusted workflow_run (workflow_dispatch) for PR builds.
- Rewrite .github/workflows/build-pr.yml to split privileged checks (pull_request_target / issue_comment) from untrusted execution (workflow_dispatch):
- Add workflow_dispatch inputs for PR metadata.
- Ensure privileged jobs only check conditions, post comments and dispatch the untrusted build.
- Untrusted build jobs (framework/shell/publish) run under workflow_dispatch, checkout PR code into a separate workspace, clear GITHUB_TOKEN in build steps, and set stricter permissions and persist-credentials:false where appropriate.
- Adjust concurrency, outputs, and inter-job dependencies to work with inputs rather than passing sensitive data between privileged and untrusted contexts.
- Update trigger-docker and result-comment flows to rely on workflow_dispatch inputs and only run in the untrusted run where appropriate.
- Change packages/napcat-vite/vite-plugin-version.js to read NAPCAT_GITHUB_TOKEN (instead of GITHUB_TOKEN) to avoid exposing Actions write tokens in untrusted builds.
These changes aim to improve security by preventing execution of PR-controlled code with elevated repo permissions and by isolating token usage.
pnpm 10 exits non-zero on [ERR_PNPM_IGNORED_BUILDS] by default, which
broke CI after the global pnpm version on GitHub runners bumped.
Replace ad-hoc `npm i -g pnpm` calls with pnpm/action-setup@v4 pinned to
version 9 across build-ci.yml, build-pr.yml, and drop the redundant
Install pnpm step from pr-build-run.ts.
- pr-publish-release.ts: Use resolve() for releaseDir to get absolute path;
zip command runs with cwd=artifactDir so relative path was resolving wrong
- build-pr.yml: Expose steps.publish.outcome as publish_status job output;
pass PUBLISH_STATUS env to update-comment-result job
- pr-build-result.ts: Read PUBLISH_STATUS, pass publishFailed to comment
- comment.ts: Show '⚠️ Release 发布失败' section in PR comment when
publish failed but installInfo is absent
- lib/github.ts: Remove getEnv overload signatures (Node.js experimental-strip-types
does not support TS function overloads, causes SyntaxError at parse time)
- lib/github.ts: Handle 204 No Content in request<T> (DELETE returns 204,
calling response.json() on empty body throws)
- build-pr.yml: retention-days 7->5 (repo max is 5)
Remove the explicit `token: ${{ secrets.NAPCAT_BUILD }}` line from the release-publish GitHub Actions workflow. This stops passing the custom NAPCAT_BUILD secret to the release step, allowing the action to use the default authentication mechanism or another configured token and reducing exposure of the custom secret.
Change the OPENAI_MODEL environment variable in .github/workflows/release-publish.yml from "openrouter/hunter-alpha" to "z-ai/glm-4.5-air:free" so the release-publish job uses the new model endpoint for OpenAI API calls. No other workflow changes.
Replace secrets.NAPCAT_BUILD with the built-in secrets.GITHUB_TOKEN in the release-publish workflow to authenticate triggering downstream release workflows. This removes dependency on a custom secret and uses the repo-scoped Actions token for simpler, more secure automation.
Update the OPENAI_MODEL env var in .github/workflows/release-publish.yml from "stepfun/step-3.5-flash:free" to "openrouter/hunter-alpha" so the release publish job uses the new model for API calls. No other workflow changes.
Upgrade workflow action versions across .github/workflows: actions/checkout@v4 -> @v5, actions/setup-node@v4 -> @v6, actions/upload-artifact@v4 -> @v6, and actions/download-artifact@v4 -> @v7. Changes touch auto-release.yml, build.yml, pr-build.yml, and release.yml to keep CI tooling current and compatible with newer runner features; also add a missing newline at end of auto-release.yml.
Normalize code style across multiple packages: whitespace cleanup, consistent commas and trailing commas in arrays/enums/objects, fix table markdown lines in CI comment template, ensure newline at EOF, normalize header/object property quoting and spacing, remove stray blank lines and minor non-functional comment tweaks. These are formatting-only changes and small type/annotation spacing adjustments; no functional behavior changes intended.
Switch the release workflow to use the NAPCAT_BUILD secret instead of the default GITHUB_TOKEN. This allows the release job to run with a dedicated token (e.g., with different scopes or credentials) when creating tags, changelogs, and uploading release artifacts.
Delete the 'Windows 一键包' section from .github/prompt/default.md, removing the lightweight one-click deployment instructions, reference to NapCat.Shell.Windows.OneKey.zip, and related tutorial notes. Keeps the version header and warning section intact.
Remove console.log statements that printed the computed SHA512 hashes for the shell and framework in .github/scripts/publish-release-hash.mjs. This reduces log noise and prevents potentially sensitive hash values from appearing in CI logs while retaining the hash computation logic.
Update .github/workflows/release.yml to set GH_TOKEN from secrets.NAPCAT_BUILD instead of secrets.GH_TOKEN when publishing the release hash. This switches the workflow to use the new/rotated secret name for release publishing.
Invoke `gh auth setup-git` in the release GitHub Actions workflow before cloning the hash repo so git is configured to use the GitHub CLI authentication. This prevents authentication issues when running `gh repo clone` and subsequent git operations in CI.
In the release workflow, replace the token-based git clone URL with the GitHub CLI command. Removed the CLONE_URL variable and now run `gh repo clone NapNeko/napcat-release-hash hash-repo`, avoiding embedding GH_TOKEN in the clone URL and relying on gh authentication for a cleaner, more secure clone.
Update the release workflow to publish releases immediately by setting the softprops/action-gh-release step's draft flag to false. Also adjust the step name to "Create Release and Upload Artifacts" to reflect the change so CI will create a published release and upload artifacts instead of leaving a draft.
Add a new .github/scripts/publish-release-hash.mjs to compute SHA512 for Shell/Framework napcat.mjs, maintain a release.json (keep last 100 entries) and write it to a separate hash repo. Wire the script into .github/workflows/release.yml to clone NapNeko/napcat-release-hash and publish hashes on release. Backend: expose GET /base/GetNapCatFileHash to compute napcat.mjs SHA512. Frontend: add WebUIManager.GetNapCatFileHash and show a join-password snippet on About page by combining file hash and user UIN (hashed with CryptoJS); update About page links to QQ groups. Update README and localized docs to list community QQ groups. Error handling and basic logging added.
Update .github/workflows/release.yml to use the OpenRouter/OpenAI public endpoint and standardized env names. Replaced custom API URL and model with OPENAI_API_URL=https://openrouter.ai/api/v1/chat/completions and OPENAI_MODEL="stepfun/step-3.5-flash:free", renamed variables (OPENROUTER_* → OPENAI_*), adjusted the job step name and log messages, and updated the curl request and response handling to use the new env vars. Kept existing behavior for generating release notes and the fallback to the default template when the LLM output is empty.
Update .github/workflows/release.yml to use softprops/action-gh-release@v2 and add the tag_name input mapped to github.ref_name so the created draft release uses the current ref as the release tag. Other release settings (name, token, body_path) are preserved.
Read NAPCAT_ENABLE_VERBOSE_LOG at startup and call napi2nativeLoader.nativeExports.setVerbose(true) (if available) right after loading the wrapper so native verbose logging can be enabled via environment. Also includes an updated native .node binary.
Update .github/workflows/release.yml to raise the OpenRouter request max_tokens from 1500 to 5000. This allows the model to generate longer responses during the release workflow; be aware this may increase token usage and cost.
Add cleanupOrphanedProcesses to terminate leftover child processes when running in Electron. The function imports Electron at runtime, uses app.getAppMetrics() to enumerate processes, excludes the main and provided worker PIDs, and sends SIGTERM to stray PIDs while ignoring already-dead processes and API errors. Also invoke this cleanup in restartWorker after starting the new worker to avoid lingering processes after restarts. Includes @ts-ignore for the dynamic Electron import and debug logging on failure.
Merge and simplify the QQ and Node.js download steps in .github/workflows/release.yml: remove the actions/cache step and related QQ cache logic, always download the QQ x64 installer directly, and assemble/extract using a single temporary directory (TMPDIR). Also rename the step to "Download and Assemble NapCat.Shell.Windows.Node.zip" and switch NODE_EXTRACT to use TMPDIR instead of WORK_TMPDIR. This reduces workflow complexity and avoids maintaining a local cache for the QQ installer.
MliKiowa