Stable release 4.0.0: merge dev into master

.claude/agents/xmoj-code-navigator.md

@@ -2,7 +2,7 @@
 name: xmoj-code-navigator
 description: "Use this agent when you need to locate, retrieve, or understand specific sections of the XMOJ.user.js file without loading the entire file into context. This includes scenarios like:\\n\\n<example>\\nContext: The user is debugging a feature and needs to understand how login authentication works in XMOJ.user.js.\\nuser: \"Can you help me understand how the login flow works in XMOJ.user.js?\"\\nassistant: \"I'll use the Task tool to launch the xmoj-code-navigator agent to locate and retrieve the relevant login authentication code from XMOJ.user.js.\"\\n<commentary>\\nSince the user needs specific code from the large XMOJ.user.js file, use the xmoj-code-navigator agent to efficiently find and extract the relevant sections without loading the entire file.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: The user is adding a new feature and wants to see how similar features are implemented.\\nuser: \"I want to add a feature to handle quiz submissions. Can you show me how other submission handlers are implemented?\"\\nassistant: \"Let me use the xmoj-code-navigator agent to search through XMOJ.user.js for existing submission handler implementations.\"\\n<commentary>\\nThe user needs to reference existing patterns in the large file. The xmoj-code-navigator agent can efficiently locate and extract relevant code examples without overwhelming the context window.\\n</commentary>\\n</example>\\n\\n<example>\\nContext: The user is reviewing code changes and needs to verify if a specific function exists.\\nuser: \"Does XMOJ.user.js have a function for parsing XML responses?\"\\nassistant: \"I'll use the xmoj-code-navigator agent to search for XML parsing functions in XMOJ.user.js.\"\\n<commentary>\\nThis is a targeted search task in a large file - perfect for the xmoj-code-navigator agent.\\n</commentary>\\n</example>"
 tools: Glob, Grep, Read, WebFetch, WebSearch
-model: haiku
+model: sonnet
 color: cyan
 ---
 

.github/dependabot.yml

@@ -5,3 +5,8 @@ updates:
     target-branch: "dev"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    target-branch: "dev"
+    schedule:
+      interval: "daily"

.github/workflows/Prerelease.yml

@@ -33,7 +33,19 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         id: get_version
         run: node ./Update/GetVersion.js
+      # 版本号没变（例如合并了没有更新版本号的 PR）时，不能把已发布的正式版覆盖成预发布版；同版本的预发布版照常更新
+      - name: Check for an existing release
+        id: existing_release
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          VERSION: ${{ steps.get_version.outputs.version }}
+        run: |
+          if [ "$(gh release view "$VERSION" --json isPrerelease --jq .isPrerelease 2>/dev/null)" = "false" ]; then
+            echo "Release $VERSION is already published as a stable release, skipping the prerelease."
+            echo exists=true >> $GITHUB_OUTPUT
+          fi
       - id: create_release
+        if: steps.existing_release.outputs.exists != 'true'
         uses: softprops/action-gh-release@v2
         env:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
@@ -44,8 +56,3 @@ jobs:
           prerelease: true
           files: XMOJ.user.js
           target_commitish: ${{ github.sha }}
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: .
-      - uses: actions/deploy-pages@v4

.github/workflows/Release.yml

@@ -1,12 +1,10 @@
 name: Release
 on:
-  workflow_dispatch:
   push:
     branches:
       - master
     paths:
       - XMOJ.user.js
-      - .github/workflows/Release.yml
 jobs:
   Release:
     runs-on: ubuntu-latest
@@ -20,7 +18,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 16
           registry-url: https://registry.npmjs.org/
       - uses: actions/checkout@v6
         with:
@@ -38,13 +36,3 @@ jobs:
           draft: false
           prerelease: false
           files: XMOJ.user.js
-      - uses: cloudflare/wrangler-action@v3
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: 89969bdf9d5ab8202f8ad8b8ae2c40b8
-          command: pages deploy . --project-name=xmoj-script --branch=master
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: .
-      - uses: actions/deploy-pages@v4

.github/workflows/UpdateToRelease.yml

@@ -11,24 +11,34 @@ on:
 jobs:
   UpdateToRelease:
     runs-on: ubuntu-latest
-    # 添加条件：如果是 bot 触发的则跳过，避免无限循环
-    if: github.event.pull_request.user.login != 'github-actions[bot]'
+    # 添加条件：如果是 bot 触发的则跳过，避免无限循环；fork 的 PR 拿不到 secrets，也跳过
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'github-actions[bot]'
     permissions:
       pull-requests: write
       contents: write
     steps:
+      # 用 GitHub App 的 token 创建版本 PR，这样它的工作流无需手动批准就能运行并自动合并
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          token: ${{ steps.generate_token.outputs.token }}
       - name: Update to release
         run: |
           if [[ ${{ github.event.pull_request.head.ref }} != dev && $(git diff --name-only HEAD HEAD~1) == *XMOJ.user.js* ]]; then
             echo Closing PR
             gh pr comment ${{ github.event.pull_request.number }} --body "请向\`dev\`分支提交pull request, 本pull request将被自动关闭"
             gh pr close ${{ github.event.pull_request.number }}
           else
-            node ./Update/UpdateToRelease.js ${{ secrets.GITHUB_TOKEN }} ${{ github.event.pull_request.number }} "$PR_BODY"
+            node ./Update/UpdateToRelease.js ${{ steps.generate_token.outputs.token }} ${{ github.event.pull_request.number }} "$PR_BODY"
           fi
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
           PR_BODY: ${{ github.event.pull_request.body }}

.github/workflows/UpdateVersion.yml

@@ -24,6 +24,11 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/checkout@v6
       - name: Update version
+        # PR 标题不可信，通过环境变量传入，不直接拼进 shell 命令
         env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          PR_NUMBER: ${{ github.event.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
-        run: node ./Update/UpdateVersion.js ${{ steps.generate_token.outputs.token }} ${{ github.event.number }} "${{ github.event.pull_request.title }}" "$PR_BODY" "${{ github.event.action }}"
+          PR_ACTION: ${{ github.event.action }}
+        run: node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" "$PR_ACTION"

.github/workflows/UpdateVersionFork.yml

@@ -0,0 +1,54 @@
+name: UpdateVersionFork
+# fork 的 PR 拿不到 secrets，也不能推送到 fork，所以合并前没法更新版本号。
+# 维护者合并后会推送到 dev：在这次（可信的）推送上找出所有已合并、但 Update.json 里还没有记录的 fork PR，
+# 逐个基于最新的 dev 更新版本号，并以 GitHub App 身份开自动合并的 PR，等它合并后再处理下一个。
+# 并发组最多保留一个排队的运行，被替换掉的运行要处理的 PR 也会被后面的运行补上。
+on:
+  push:
+    branches:
+      - dev
+    paths:
+      - XMOJ.user.js
+  workflow_dispatch:
+concurrency:
+  group: update-version-fork
+  cancel-in-progress: false
+jobs:
+  UpdateVersionFork:
+    runs-on: ubuntu-latest
+    if: ${{ !endsWith(github.actor, '[bot]') }}
+    permissions:
+      contents: read
+    steps:
+      - name: Generate a token
+        id: generate_token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+      - uses: actions/checkout@v6
+        with:
+          ref: dev
+          token: ${{ steps.generate_token.outputs.token }}
+      - name: Update versions of merged fork PRs
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+          REPOSITORY: ${{ github.repository }}
+          # 在此之前合并的 fork PR 不再补记版本号
+          SINCE: "2026-10-06T00:00:00Z"
+        run: |
+          PRS=$(gh pr list --repo "$REPOSITORY" --base dev --state merged --limit 50 --json number,isCrossRepository,mergedAt \
+            --jq "map(select(.isCrossRepository and .mergedAt >= \"$SINCE\")) | sort_by(.mergedAt) | .[].number")
+          for PR_NUMBER in $PRS; do
+            git fetch -q origin dev
+            git checkout -q -B dev origin/dev
+            if jq -e --argjson pr "$PR_NUMBER" '[.UpdateHistory[].UpdateContents[].PR] | index($pr)' Update.json > /dev/null; then
+              echo "#$PR_NUMBER already has a version."
+              continue
+            fi
+            PR_TITLE=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq .title)
+            PR_BODY=$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER" --jq '.body // ""')
+            node ./Update/UpdateVersion.js "$GITHUB_TOKEN" "$PR_NUMBER" "$PR_TITLE" "$PR_BODY" fork-merged
+          done

.gitmodules

@@ -1,3 +1,4 @@
 [submodule "backend"]
 	path = backend
 	url = https://github.com/XMOJ-Script-dev/XMOJ-bbs
+	branch = master