fz-mirrors/AstrBot
1
0
Fork 0
mirror of https://github.com/AstrBotDevs/AstrBot synced 2026-07-01 01:10:21 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,903 Commits 162 Branches 251 Tags
codex/fix-vulnerability-in-workspace-skills
Commit Graph

4903 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
LIghtJUNction
17505df304 fix: skip workspace prompts in group sessions 2026-06-30 14:14:14 +08:00
LIghtJUNction
b7da259787 fix: disable workspace skills in group sessions 2026-06-30 13:46:42 +08:00
MUHAMED FAZAL PS
b5e29511ac fix: reliably kill shell process tree on Windows timeout (#8822) 
* fix: reliably kill shell process tree on Windows timeout

Fixes #8809

* fix: remove redundant import and wrap taskkill in try/except

- Remove 'import subprocess as _sp' (subprocess already imported at top)
- Use subprocess.run directly with DEVNULL for stdout/stderr
- Wrap taskkill in try/except to avoid masking original TimeoutExpired
- If taskkill fails, cleanup failures don't prevent proc.wait() or re-raise

https://buymeacoffee.com/muhamedfazalps

* style: apply ruff formatting to local.py

* test: fix shell component tests to match Popen-based implementation

The tests were monkeypatching subprocess.run but the implementation
now uses subprocess.Popen + communicate() for timeout handling.
Updated tests to mock Popen instead.

Fixes CI Unit Tests failure

* fix: harden windows shell timeout cleanup

---------

Co-authored-by: Soulter <905617992@qq.com>
 2026-06-27 00:10:59 +08:00
Weilong Liao
d6738a03f3 fix: preserve jpeg quality during conversion (#9031) 2026-06-26 22:43:15 +08:00
FuShang114
6dd5e1e080 fix: prevent plugin detail marketplace mismatches (#9028) 2026-06-26 22:12:29 +08:00
NayukiChiba
c93bedf04d fix: unify handling of whitespace in streamed message segments and ensure trailing buffers are stripped before sending. (#9029) 
* perf(streaming): 将流式消息分段发送的空白过滤逻辑前移至核心方法

- 在 AstrMessageEvent 的 process_buffer 中统一进行 strip 并跳过空段，移除各平台子类的重复处理
- aiocqhttp 平台回退尾部 buffer 直接使用核心逻辑过滤，避免自身再次判断空白
- 简化流式消息发送链路，提升代码可维护性与执行效率

* test(strip-stream): 添加流式消息分段空白过滤的单元测试

- 新增 CollectingMessageEvent 与 CollectingAiocqhttpMessageEvent 辅助类，模拟消息发送与断言
- 覆盖 AstrMessageEvent.process_buffer 对段落前导空白行的 strip 和空段跳过逻辑
- 覆盖 AiocqhttpMessageEvent.send_streaming 回退缓冲区的空白过滤，确保跨平台行为一致

* fix(streaming): 调整流式消息分段发送限速等待位置

- 将限速等待（sleep）从循环末尾移动至消息发送成功后立即执行
- 仅在成功发送文本片段时才进行等待，避免无实际发送时的无谓延迟
- 修复因等待时机不当可能导致的流式消息发送频率异常问题

* test(strip-stream): 添加空白分段时跳过睡眠的单元测试
- 新增测试用例，验证当分段为空时不调用睡眠函数
- 确保处理缓冲区时正确剥离空白字符
- 测试通过验证发送消息的行为

* Delete tests/test_streaming_segment_strip.py

---------

Co-authored-by: Weilong Liao <37870767+Soulter@users.noreply.github.com>
 2026-06-26 22:11:31 +08:00
Lovely Moe Moli
110cc8736c fix: 'DashboardRequest' object has no attribute 'get_data' (#9021) (#9023) 2026-06-26 22:04:29 +08:00
Light
ce05ac0db6 docs: add spanish readme (#9020) 
* docs(i18n): add Spanish (es) translation for README

* docs(i18n): add Spanish (es) translation for README

* fix(i18n): 修复了导航栏的分隔符与多余字符
 2026-06-26 21:52:46 +08:00
Jia
9ae33e9344 docs: update Python requirement to 3.12 (#9022) 2026-06-26 19:43:50 +08:00
Weilong Liao
c6b2c65b04 fix: preserve image formats in media handling (#9019) 
* fix: preserve image formats in media handling

* fix: address image format review feedback

* fix: avoid tainted image temp path rename
 2026-06-26 11:27:32 +08:00
Weilong Liao
00c50b3b92 chore: bump version to 4.26.1 v4.26.1 2026-06-25 23:12:10 +08:00
Weilong Liao
090f9008b6 chore: revert "fix: preserve At components when sending messages on qq_official plat…" (#9004) 
This reverts commit bc117038fb.
 2026-06-25 17:07:08 +08:00
Weilong Liao
473377f340 feat: update permission handling to delegate event context in guarded tools (#9001) 2026-06-25 16:18:04 +08:00
Foolllll
9daf8f0a84 fix: check OnWaitingLLMRequestEvent stop signal before acquiring session lock (#8935) 2026-06-25 16:17:07 +08:00
Soulter
348fe81720 feat: add name and compatibility date to wrangler configuration 2026-06-25 14:12:39 +08:00
Soulter
44df70d2e7 feat: add wrangler configuration for assets directory 2026-06-25 13:39:57 +08:00
Weilong Liao
952d1bfad7 chore: bump version to 4.26.0 (#8994) 
* chore: bump version to 4.26.0

* feat: 更新 v4.26.0 更新日志，添加 WebUI 设置迁移提示及新功能说明

* fix: 修复多个 WebUI 和工具相关问题，提升稳定性和用户体验
v4.26.0 		2026-06-24 23:44:15 +08:00
Soulter
0cfe4163cd fix: update max_context_length and dequeue_context_length defaults 2026-06-24 23:21:50 +08:00
Weilong Liao
d90530af8e Revert "fix: reconnect MCP client on terminated session (#8694)" (#8991) 
This reverts commit 2bda4e4d96.
 2026-06-24 22:44:45 +08:00
EterUltimate
2bda4e4d96 fix: reconnect MCP client on terminated session (#8694) 
* fix: reconnect MCP client on terminated session

* Update astrbot/core/agent/mcp_client.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

* Update mcp_client.py

---------

Co-authored-by: Weilong Liao <37870767+Soulter@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
 2026-06-24 22:43:24 +08:00
ZouZhang
bc117038fb fix: preserve At components when sending messages on qq_official platform (#8983) 
- Add At component handling in _parse_to_qqofficial method
- Convert At(qq=openid) to <@openid> plain_text format
- Maintain original message chain order by appending
- Skip At(qq='all') since QQ Official API may not support it

Closes #8982
 2026-06-24 22:15:12 +08:00
FuShang114
b7cadfe704 fix: allow plugin page asset token fallback (#8970) 
Co-authored-by: beidou-lab-macmini <beidou-lab-macmini@beidou-lab-macminideMac-mini.local>
 2026-06-24 22:11:49 +08:00
dependabot[bot]
6a343b7656 chore(deps): bump actions/checkout in the github-actions group (#8963) 
Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-24 21:47:39 +08:00
Cooper
c89984bf42 Updated Documentation for Password Reset (#8987) 2026-06-24 21:47:20 +08:00
Weilong Liao
421d718041 feat: show public version details on login (#8986) 
* feat: show public version details on login

* fix: address login version review feedback
 2026-06-24 21:46:29 +08:00
Weilong Liao
967ed01cf7 fix: add data scope to api keys (#8985) 2026-06-24 16:37:46 +08:00
Weilong Liao
df4d93d724 fix: normalize cron weekday scheduling (#8984) 2026-06-24 16:22:58 +08:00
VectorPeak
3c7956e8c8 fix: prevent path traversal in plugin upload filenames (#8968) 2026-06-24 15:55:53 +08:00
VectorPeak
5266d170a3 fix: prevent path traversal vulnerability in knowledge base upload filenames (#8971) 2026-06-24 15:55:01 +08:00
Tanishq
ae29a7eaf9 feat(websearch): add Exa as a web search provider (#8973) 
- Add ExaWebSearchTool (web_search_exa) with keyword/semantic search,
  category filters, domain restrictions, and date range support
- Add ExaGetContentsTool (exa_get_contents) for extracting web page content
- Add _exa_search() and _exa_get_contents() API helpers hitting
  https://api.exa.ai/search and https://api.exa.ai/contents
- Add _EXA_KEY_ROTATOR for multi-key rotation
- Register Exa tools in _apply_web_search_tools() dispatch
- Add Exa to WEB_SEARCH_CITATION_TOOL_NAMES for citation support
- Add websearch_exa_key config default and provider option
- Add i18n metadata for en-US, zh-CN, ru-RU
- Add Exa section to docs (en + zh)
- Add 6 unit tests covering search, contents, error handling, and
  legacy config migration

Closes #5621
 2026-06-24 15:53:47 +08:00
Soulter
756469a39f fix: remove unused vocechat logo and update xmas hat image 2026-06-21 23:44:33 +08:00
Weilong Liao
16beb9a9d7 fix: remove redundant font family from stylesheet link (#8942) 2026-06-21 23:36:21 +08:00
Soulter
e30655b04e fix: refresh WebUI with cache buster 2026-06-21 18:12:07 +08:00
Soulter
1283421339 fix: update workflow names to improve readability 2026-06-21 14:17:36 +08:00
Soulter
7980ed28ad fix: restore cli init dashboard monkeypatch hook 2026-06-21 14:14:45 +08:00
Weilong Liao
c59ef11128 chore: bump version to 4.26.0-beta.12 (#8934) v4.26.0-beta.12 2026-06-21 14:12:07 +08:00
Weilong Liao
05148dfdd9 fix: add sdist build artifact path to allow dashboard artifact to be included (#8933) 
* fix: add sdist build artifact path to allow dashboard artifact to be included

* Update pyproject.toml

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
 2026-06-21 14:08:48 +08:00
Weilong Liao
39d425316f fix: created unnecessary data dir when executing astrbot command (#8932) 
* fix: created unnecessary data dir when executing astrbot command

fixes: #8853

* fix: 更新包版本更新函数以修改 astrbot/__init__.py 中的版本号
 2026-06-21 14:04:49 +08:00
lingyun14
42ca89d6c8 fix: 修复提供商源修改 ID 后保存被静默还原的问题 (#8915) 
* Update schemas.py

* Update schemas.py
 2026-06-21 11:55:54 +08:00
Weilong Liao
b6913833d4 chore: bump version to 4.26.0-beta.11 
Release 4.26.0-beta.11
v4.26.0-beta.11 		2026-06-20 22:32:56 +08:00
Soulter
f9d4082217 feat: add prerelease visibility toggle 2026-06-20 22:23:25 +08:00
Soulter
ddc4e142c7 fix: clarify WebUI recovery hint 2026-06-20 22:11:38 +08:00
Weilong Liao
d36987dd19 fix: restore static runtime version 
Fixes #8924
 2026-06-20 22:06:24 +08:00
NayukiChiba
0a0c677404 docs: 文档更新 - 指令、FAQ、网页搜索、插件发布等 (#8912) 
* docs(community): 更新 QQ 群组信息
- 移除了旧的 QQ 群组信息并添加了新的群组。
- 确保所有群组信息的准确性和完整性。
- 提升文档的可读性和用户体验。

* docs(webui): 为忘记密码章节添加 FAQ 引用链接

- 在英文和中文文档的"忘记密码"章节末尾添加 TIP 提示框
- 提示框链接至对应 FAQ 条目，提供更详细的操作说明
- 增强文档之间的关联性，提升用户查阅体验

* docs(command): 新增 /stats 和 /provider 指令文档，更新 FAQ 管理员指令列表

- 在英文和中文的命令文档中添加 /stats 和 /provider 指令的详细使用说明
- 更新中英文 FAQ 页面的管理员指令列表，与最新的默认指令保持一致
- 确保中英文文档内容同步，提升文档准确性和用户查阅体验

* docs(websearch): 新增 Firecrawl 网页搜索提供商文档支持

- 在开发版配置文档中补充 websearch_provider 选项，加入 firecrawl 及对应密钥配置项
- 更新中英文网页搜索使用指南，将支持搜索源数量同步为五种并提供 Firecrawl 注册指引
- 确保中英文文档内容一致，提升配置说明的完整性和用户查阅体验

* docs(plugin-publish): 更新插件提交方式至新仓库

- 废弃通过 AstrBot 主仓库 Issue 提交插件的方式
- 新增警告框提示正确提交入口为 AstrBot_Plugins_Collection
- 同步更新中英文版插件发布文档
 2026-06-20 16:43:58 +08:00
Weilong Liao
da7f53d5eb fix: keep system tools with persona tool lists (#8908) 2026-06-20 01:15:31 +08:00
Soulter
a7533aacda fix: fall back to stale WebUI when repair fails v4.26.0-beta.10 2026-06-20 00:01:29 +08:00
Weilong Liao
46a846b88b chore: bump version to 4.26.0-beta.10 (#8905) 2026-06-19 23:59:39 +08:00
lxfight
2d98d38078 fix: inject knowledge base context as temporary user content (#8904) 2026-06-19 22:48:23 +08:00
Weilong Liao
1b0f5cb0d3 fix: keep WebUI assets in sync with core version (#8901) 
* fix: keep WebUI assets in sync with core version

* fix: import dashboard version before bundled fallback

* fix: remove stale WebUI dist robustly
 2026-06-19 22:46:38 +08:00
Weilong Liao
cdfb0bdf91 fix: restore webui 401 login redirect (#8903) 2026-06-19 22:43:21 +08:00