* ✨ Feature(gui): configure server upload secret in settings PicGo Core already supports authenticating `POST /upload` with a shared secret (`Authorization: Bearer <secret>`, `X-PicGo-Secret` or `?secret=`), resolved from `PICGO_SERVER_SECRET` or `settings.server.secret`, but the GUI offered no way to set it. Add a masked secret field with a show/hide toggle to the PicGo Server dialog, next to host and port. The dialog saves the trimmed value as `settings.server.secret`; an empty value disables authentication. Saving already restarts the server, and Core reads the secret from config on `listen()`, so the main process needs no change and `PICGO_SERVER_SECRET` still takes precedence. The secret value is never added to the settings search index. * 🐛 Fix(gui): keep server secret when normalizing settings normalizeSettingsConfig only copied host, port and enable from `settings.server`, so after a reload the renderer state had no secret: the server dialog reopened with an empty secret field, and saving it again (e.g. after changing the port) would have silently cleared the secret and disabled authentication. Keep `secret` (falling back to an empty string) and cover it with a test. * 📝 Docs: document renderer config normalizer whitelist in AGENTS.md The server secret was dropped from renderer state because normalizeSettingsConfig only copies listed fields, and the server dialog re-saves the whole object. Record the rule for future changes: when adding a persisted config field, update the shared types, renderer state type, default value and normalizer, and add a round-trip normalizer test. Also give `settings.server.secret` an explicit empty default to follow that rule. * 📝 Docs: require English PRs and squash merges in AGENTS.md
12 KiB
Repository Guidelines
Project Structure & Module Organization
PicGo is an Electron + Vue 3 desktop client. Source lives in src/: src/main for main-process and IPC logic, src/renderer for Vue views, and src/universal for shared helpers (types/, events/constants.ts). background.ts wires Electron Builder. Static assets and locale YAML files stay in public/ (add languages under public/i18n/), while docs/ hosts user-facing guides. Automation scripts live in scripts/, and legacy tests sit under test/unit (Karma) and test/e2e (Spectron).
Build, Test, and Development Commands
pnpm install— install dependencies;npm installis unsupported. Only run this when the user explicitly asks/coordinates it.- Always add/remove dependencies with
pnpm(never edit package.json versions by hand then install). pnpm dev— electron-vite dev server for main/preload/renderer.pnpm build— electron-vite build outputs todist/main,dist/preload,dist/renderer;pnpm previewfor preview mode.- Packaging config lives in
electron-builder.yml(read by electron-builder via package.jsonbuildfield/extraResources); setELECTRON_MIRROR=https://npmmirror.com/mirrors/electron/if downloads are slow. pnpm lint/pnpm lint:fix— run or auto-fix ESLint (Standard, TypeScript, Vue rules).pnpm lint:dpdm— fail fast on circular dependencies insrc/.pnpm check— runtsc+lint(run once before finishing a task).- Before completing a task, always run
pnpm checkand resolve any issues it reports. - i18n type files are auto-generated by the Vite
i18nTypesPluginwhenpublic/i18n/*.ymlchanges. Do not add or rely on a manualgen-i18nstep.
Coding Style & Naming Conventions
Follow ESLint Standard defaults: two-space indentation, single quotes, trailing commas where allowed, and no stray semicolons. Author new modules in TypeScript. Keep renderer files browser-safe; route Node APIs through IPC helpers such as src/main/events/picgoCoreIPC.ts. Name Vue components in PascalCase (UploadPanel.vue) and use camelCase for utilities. Centralize IPC event names inside src/universal/events/constants.ts, and store enums/types under src/universal/types/ so they stay reusable. Static assets are served from public/ and resolved via getStaticPath/getStaticFileUrl (src/universal/utils/staticPath.ts); avoid using __static directly.
Static assets are served from public/. In the main process use getStaticPath/getStaticFileUrl (src/universal/utils/staticPath.ts). In the renderer, place assets under public/ and resolve them via import.meta.env.BASE_URL + filename (helper: src/renderer/utils/static.ts); do not rely on __static in renderer code.
- Do not use
as anyunder any circumstances; keep typings explicit and safe. - Avoid
as anyin tests as well; build concrete typed stubs (e.g.,IpcMainInvokeEvent) instead. - Do not prefix method calls with
void(e.g. usestore?.refreshPicBeds()rather thanvoid store?.refreshPicBeds()). - Do not write
void someMethod()orvoid object.method()anywhere in the codebase. If you need fire-and-forget behavior, use anasynccallback withawait, or handle errors explicitly withtry/catchand logging instead of swallowing them. - Because the renderer uses React Compiler, do not add
useMemooruseCallbackby default. Prefer plain values and inline functions unless a specific API requires stable identity or there is a proven performance issue. - For Zustand store state/actions, prefer reading them directly in the consuming component with
useAppStore/useStoreinstead of passing them down through unnecessary prop layers. If a child can access the needed store value or action itself, do not thread it through parent props. - If a child component only needs a store action (for example
providerStoreActions.toggleExpanded,settingsStoreActions.setSearchValue, orgalleryStoreActions.setViewMode), do not pass that store action through props. Import and use the action directly inside the child component. - Renderer Zustand stores must follow the project store architecture:
src/renderer/store/app-store.tsis for true global renderer state only.- Feature/page-local UI state must live under
src/renderer/store/<feature>/(for examplesrc/renderer/store/gallery/store.ts,src/renderer/store/gallery/actions.ts), not insideapp-store.ts. - Do not add an extra nested
store/directory likesrc/renderer/store/gallery/store/store.ts.
- Zustand state and actions must be separated:
- Do not define state-mutating actions inside
create(). - Keep store files focused on state shape and initial state.
- Put global actions in
src/renderer/store/app-actions.ts. - Put feature actions in
src/renderer/store/<feature>/actions.ts. - Actions must update state via
useXxxStore.setState(...).
- Do not define state-mutating actions inside
- Follow strict IPC boundaries for Zustand actions:
- Pure IPC/service calls without Zustand state changes should call the adapter/service directly from the component or helper, not through a Zustand action.
- Flows that combine IPC/service work with Zustand state updates must live in actions files.
- Keep server state and client state separated:
- TanStack Query should own server state: remote API data, loading/error/stale status, refetching, cache, and request dedupe.
- Zustand should own client/UI state: selected source, selected ids, filters, view mode, panel open state, and other local user intent.
- Connect the two with ids, query params, and local UI state (for example
albumSource,typeFilter, orsearchValue), but do not mirror query response data back into Zustand. - If server state invalidates a local UI choice (for example a user becomes non-paid while
albumSourceis cloud), use a small effect/action to correct the local UI state instead of storing the whole server response in Zustand.
- When updating nested Zustand state (especially config-like objects), use
zustand/middleware/immer; do not reintroduce deep...statespread chains for nested updates. - Components must consume Zustand state through auto-generated selectors (for example
useAppStore.use.appConfig()), not by destructuring the whole store or writing ad-hoc hook selectors in components. - Renderer-side shared constants (for example responsive breakpoints, UI timing values, fixed dimensions, thresholds, and repeated literal values used across components) should be centralized in
src/renderer/utils/consts.tsinstead of being hardcoded inline in components. When a new renderer constant may be reused or affects shared behavior, add it there first. - Renderer-side date/time formatting should use
dayjsand shared format constants fromsrc/renderer/utils/consts.ts(for exampleDEFAULT_DATE_TIME_FORMAT) instead ofIntl.DateTimeFormator ad-hoc inline format strings. - Enum-like object constants declared with
as const(for example status maps, option maps, and value registries) must use PascalCase names, not camelCase. Prefer names likePicGoCloudRequestStatusValues,SettingsAppearanceValues, orAppPlatformValues. - If a renderer → main request mutates persisted config/state without using
saveConfig, callnotifyAppConfigUpdated()in main to inform renderers. - Renderer config normalization is a whitelist:
normalizeAppConfig/normalizeSettingsConfiginsrc/renderer/store/utils.tscopy only the fields they list (for examplesettings.server→host,port,enable,secret), and anything not listed is silently dropped from renderer state after every reload. When adding a new persisted config field, update all of: the shared types (src/universal/types/types.d.ts/view.d.ts), the renderer state type (e.g.SettingsConfigStateinsrc/renderer/components/main/settings/utils.ts), its default value, and the normalizer. Settings dialogs re-save the whole object (e.g.settings.server), so a field missing from the normalizer is not just invisible in the UI but gets overwritten with an empty value on the next save. Add a round-trip test (raw config → normalizer → field still present) next tosrc/__tests__/renderer/store/settings-normalize.spec.ts; a component test that feeds drafts directly will not catch this. - Prefer enums over union types for discrete value sets (e.g., encryption methods). Avoid introducing new string literal union types.
- Renderer page/component styles should prefer Tailwind utility classes; avoid adding new Vue
<style>blocks unless there's no reasonable Tailwind equivalent. - New renderer ↔ main request/response APIs should be implemented via RPC routes (see
src/main/events/rpc/routes/system.ts) withRPCRouter+IRPCActionTyperather than adding ad-hoc IPC modules (e.g.picgoCloudIPC).- For request/response semantics in renderer, prefer
invokeRPC(backed byipcMain.handle(RPC_ACTIONS, ...)insrc/main/events/rpc/index.ts).
- For request/response semantics in renderer, prefer
- AlertDialog async confirm buttons: Do not use
AlertDialogActionfor confirm buttons that perform async operations (API calls, etc.), becauseAlertDialogActionauto-closes the dialog on click regardless ofevent.preventDefault(). Use a plain<Button>instead, manageopenstate manually, and close the dialog only after the async operation completes (success or error). Seesrc/renderer/components/main/gallery/gallery-delete-dialog.tsxfor reference. - Nullish coalescing for optional checks: Prefer
(value?.field ?? fallback) > 0over verbosevalue !== null && value !== undefined && typeof value.field === 'number' && value.field > 0chains. Use TypeScript's optional chaining (?.) and nullish coalescing (??) to keep boolean checks concise.
Testing Guidelines
Place renderer unit specs in test/unit/specs with the .spec.js suffix; Karma picks them up via require.context. Run them with npx karma start test/unit/karma.conf.js --single-run and ensure new renderer folders are covered. Spectron e2e cases live in test/e2e/specs; build first (pnpm build), then run npx mocha test/e2e/index.js so Spectron can launch dist/electron/main.js. Document any test data, IPC stubs, or fixtures you add to keep suites reproducible.
Commit & Pull Request Guidelines
Commits follow the PicGo conventional preset enforced by Husky (pnpm lint:dpdm + Commitlint). Stage your changes and run pnpm cz to craft messages that pass CI. Pull requests should explain the change, link related issues, and attach UI screenshots or recordings. Note how you validated the work (dev server, build, Karma, Spectron) and call out migration or configuration steps reviewers must perform.
- Write pull request titles, descriptions, and review comments in English, even when the conversation with the maintainer is in another language.
- Merge pull requests with squash merge (
gh pr merge <number> --squash), using the PR title as the squash commit subject. Do not use merge commits or rebase merges, and only merge after all required CI checks have passed.
Internationalization Tips
Add locales by creating public/i18n/<locale>.yml, exposing its LANG_DISPLAY_LABEL, and registering it in src/universal/i18n/index.ts. Typed i18n declarations are generated automatically from public/i18n/en.yml into src/universal/types/i18n.d.ts and src/renderer/i18n/i18next.d.ts.
- Any user-facing copy (UI text, error messages, warnings, prompts, tips, notifications, etc.) MUST use i18n keys. Do not hardcode strings in code.
- Renderer: use
$T('KEY')fromsrc/renderer/i18n/index.ts. - Main process: use
T('KEY')fromsrc/main/i18n/index.ts. - Add new keys to all locales under
public/i18n/(at leasten.yml,zh-CN.yml,zh-TW.yml). The Vite i18n types plugin will regenerate the shared declarations automatically.
- Renderer: use