sync: dev to extern-contrib by github-actions[bot] · Pull Request #950 · XMOJ-Script-dev/XMOJ-Script

github-actions · 2026-03-15T10:44:09Z

sync-branches: New code has just landed in dev, so let's bring extern-contrib up to speed!

Summary by cubic

Add messages.html, a standalone WebUI for XMOJ short messages so iOS/iPadOS and other browsers without userscript support can read and send messages. Updated index.html with a nav link and switched bootstrap CDN to cdnjs for better accessibility.

New Features
- Session (PHPSESSID) login with simple per-browser instructions; optional desktop bookmarklet.
- Thread view with Markdown rendering via marked sanitized by dompurify, plus image upload from clipboard or file.
- User info modal and badges, local contact search, auto-refresh, and a light/dark/auto theme toggle.
Bug Fixes
- Include required DebugMode in API requests to prevent failures.
- Sort messages oldest-first with auto-scroll to the latest; highlight incoming unread rows only.
- Fix dark-mode styles for table-primary and improve link/image behavior (open in new tab, click to zoom).

^{Written for commit 3ea071d. Summary will update on new commits.}

Adds a standalone messages.html page hosted on the Cloudflare Pages site, allowing iOS/iPadOS users (and anyone without userscript support) to read and send XMOJ short messages via the existing API. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…bility Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… instructions Bookmarklets are not usable on mobile and confusing on desktop. Make the session (PHPSESSID) tab the default with an accordion of step-by-step instructions for Chrome, Firefox, Safari (macOS), and iOS/iPadOS. Bookmarklet tab kept as secondary option for desktop users. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

API returns "参数DebugMode未找到" without it, causing all calls to fail. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Status badge (未读/已读) now reflects IsRead directly. Row highlight (table-primary) still only applies to incoming unread messages. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Desktop/mobile login tab priority: bookmarklet on desktop (pointer: fine), session on mobile - Replace sender name links with Bootstrap popovers showing user info popup - Image zoom: cursor: zoom-in/zoom-out, title tooltip on images - Global Ctrl+V paste handler for images anywhere in thread view - Auto-resize compose textarea as user types Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

…nfo modal Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

…in userinfo fetch Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

…ck + auto-scroll fix Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

feat(messages.html): user badges, contact search, auto-scroll to latest

Add caption "点击任意行打开对话 →" above table and a › chevron in a trailing column on each row. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Restored: contact search, renderMailList, mailListCache, user badges, user info modal, userSpan, auto-resize textarea, global paste handler, requestAnimationFrame scroll, setLoginTab, dark-mode table-primary fix. Added on top: caption "点击任意行打开对话 →" and › chevron column to make list rows obviously clickable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>

feat: messages.html WebUI for short messages

cloudflare-workers-and-pages · 2026-03-15T10:44:27Z

Deploying xmoj-script-dev-channel with Cloudflare Pages

Latest commit:	`3ea071d`
Status:	✅ Deploy successful!
Preview URL:	https://0af58099.xmoj-script-dev-channel.pages.dev

View logs

index.html

-    <link href="https://cdn.bootcdn.net/ajax/libs/twitter-bootstrap/5.2.3/css/bootstrap.min.css" rel="stylesheet">
-    <script src="https://cdn.bootcdn.net/ajax/libs/twitter-bootstrap/5.2.3/js/bootstrap.min.js"></script>
+    <link href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.2.3/css/bootstrap.min.css" rel="stylesheet">
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.2.3/js/bootstrap.min.js"></script>


messages.html

+    </div>
+</div>
+
+<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.3.3/js/bootstrap.bundle.min.js"></script>


messages.html

+</div>
+
+<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.3.3/js/bootstrap.bundle.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/marked/9.1.6/marked.min.js"></script>


messages.html

+
+<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/5.3.3/js/bootstrap.bundle.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/marked/9.1.6/marked.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.6/purify.min.js"></script>


cubic-dev-ai

1 issue found across 2 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="messages.html">

<violation number="1" location="messages.html:916">
P2: Decoding the combined `username:session` string before splitting on `:` breaks parsing when the username contains a colon. Split on the first `:` of the raw (still-encoded) string, then `decodeURIComponent` each part separately.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-03-15T10:47:32Z

messages.html

+function checkSessionHash() {
+    var hash = location.hash;
+    if (!hash.startsWith('#session=')) return false;
+    var val = decodeURIComponent(hash.slice('#session='.length));


P2: Decoding the combined username:session string before splitting on : breaks parsing when the username contains a colon. Split on the first : of the raw (still-encoded) string, then decodeURIComponent each part separately.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At messages.html, line 916: <comment>Decoding the combined `username:session` string before splitting on `:` breaks parsing when the username contains a colon. Split on the first `:` of the raw (still-encoded) string, then `decodeURIComponent` each part separately.</comment> <file context> @@ -0,0 +1,1061 @@ +function checkSessionHash() { + var hash = location.hash; + if (!hash.startsWith('#session=')) return false; + var val = decodeURIComponent(hash.slice('#session='.length)); + var idx = val.indexOf(':'); + if (idx < 1) return false; </file context>

boomzero and others added 24 commits March 15, 2026 16:25

fix: replace bootcdn with jsDelivr in messages.html

8e93694

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: switch CDN from jsDelivr to cdnjs (Cloudflare) for China accessi…

2713021

…bility Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add required DebugMode field to API request body

a1ca4e5

API returns "参数DebugMode未找到" without it, causing all calls to fail. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: decouple IsRead status display from message sender

1b811da

Status badge (未读/已读) now reflects IsRead directly. Row highlight (table-primary) still only applies to incoming unread messages. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: sort thread messages oldest-first so newest appears at bottom

380cc23

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: switch index.html CDN from bootcdn to cdnjs (Cloudflare)

6d2a5a7

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Initial plan

75a851d

fix: add year prefix to formatTime when message is from a previous year

a1e6eac

Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

fix: remove table-light from thead to fix dark mode color on user row

e8640be

Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

fix(messages.html): dark mode table-primary, year display bug, user i…

ff05e25

…nfo modal Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

fix(messages.html): set Referer to xmoj.tech and include credentials …

7678bd5

…in userinfo fetch Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

feat(messages.html): add local contact search box to mail list

5a4b175

Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

feat(messages.html): show badge next to username + clear search on ba…

d4f7bb1

…ck + auto-scroll fix Co-authored-by: PythonSmall-Q <106425289+PythonSmall-Q@users.noreply.github.com>

Merge pull request #946 from XMOJ-Script-dev/copilot/sub-pr-944-again

7a5dbe5

feat(messages.html): user badges, contact search, auto-scroll to latest

fix: make conversation rows obviously clickable in mail list

5d3fa3c

Add caption "点击任意行打开对话 →" above table and a › chevron in a trailing column on each row. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: correct colspan on loading row to match 4-column list table

24c80cc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: blur image before hiding modal to prevent aria-hidden focus warning

fef60ac

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Update link text for messages page in index.html

6457303

Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>

Update names

7dd281c

Signed-off-by: Shan Wenxiao <seanoj_noreply@yeah.net>

Merge pull request #944 from XMOJ-Script-dev/feature/messages-webui

3ea071d

feat: messages.html WebUI for short messages

pull-request-size bot added the size/XXL label Mar 15, 2026

github-advanced-security bot found potential problems Mar 15, 2026

View reviewed changes

cubic-dev-ai bot reviewed Mar 15, 2026

View reviewed changes

boomzero enabled auto-merge March 15, 2026 11:59

boomzero merged commit 97e906e into extern-contrib Mar 15, 2026
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sync: dev to extern-contrib#950

sync: dev to extern-contrib#950
boomzero merged 24 commits intoextern-contribfrom
dev

github-actions bot commented Mar 15, 2026 •

edited by cubic-dev-ai bot

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Mar 15, 2026

Uh oh!

Check warning

Check warning

Check warning

Check warning

cubic-dev-ai bot left a comment

Uh oh!

cubic-dev-ai bot Mar 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

github-actions bot commented Mar 15, 2026 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cloudflare-workers-and-pages bot commented Mar 15, 2026

Deploying xmoj-script-dev-channel with Cloudflare Pages

Uh oh!

Check warning

Check warning

Check warning

Check warning

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Mar 15, 2026 •

edited by cubic-dev-ai bot

Loading

cubic-dev-ai bot Mar 15, 2026 •

edited

Loading