Harzva · Harzva · Aug 6, 2026 · Aug 6, 2026
diff --git a/.github/workflows/android-apk.yml b/.github/workflows/android-apk.yml
@@ -6,7 +6,7 @@ on:
       release_tag:
         description: GitHub Release tag to upload the APK to
         required: false
-        default: v0.1.76
+        default: v0.1.77
   push:
     tags:
       - 'v*'
@@ -22,6 +22,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Enforce public release credential policy
+        run: python3 scripts/verify_public_release_workflows.py
+
       - name: Setup Java
         uses: actions/setup-java@v5
         with:
@@ -73,42 +76,22 @@ jobs:
       - name: Build release APK
         working-directory: mobile_agent
         env:
-          MOBILECODE_MANAGED_API_KEY: ${{ secrets.MOBILECODE_MANAGED_API_KEY }}
-          MOBILECODE_DEEPSEEK_API_KEY: ${{ secrets.MOBILECODE_DEEPSEEK_API_KEY || secrets.DEEPSEEK_API_KEY }}
           MOBILECODE_MANAGED_RELAY_URL: ${{ vars.MOBILECODE_MANAGED_RELAY_URL }}
-          MOBILECODE_MANAGED_RELAY_TOKEN: ${{ secrets.MOBILECODE_MANAGED_RELAY_TOKEN }}
-          MOBILECODE_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.MOBILECODE_GITHUB_OAUTH_CLIENT_ID }}
-          MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET: ${{ secrets.MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET }}
+          MOBILECODE_GITHUB_OAUTH_CLIENT_ID: ${{ vars.MOBILECODE_GITHUB_OAUTH_CLIENT_ID }}
           MOBILECODE_GITHUB_OAUTH_REDIRECT_URI: ${{ vars.MOBILECODE_GITHUB_OAUTH_REDIRECT_URI }}
         run: |
           DART_DEFINES=()
           if [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_URL="$MOBILECODE_MANAGED_RELAY_URL")
-          fi
-          if [ -n "$MOBILECODE_MANAGED_RELAY_TOKEN" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_TOKEN="$MOBILECODE_MANAGED_RELAY_TOKEN")
-          fi
-          if [ -n "$MOBILECODE_MANAGED_API_KEY" ] || [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_PROVIDER=true)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro)
-          fi
-          if [ -z "$MOBILECODE_MANAGED_RELAY_URL" ] && [ -n "$MOBILECODE_MANAGED_API_KEY" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_API_KEY="$MOBILECODE_MANAGED_API_KEY")
-          fi
-          if [ -n "$MOBILECODE_DEEPSEEK_API_KEY" ] || [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_PROVIDER=true)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_BASE_URL=https://api.deepseek.com)
             DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_MODEL=deepseek-v4-flash)
           fi
-          if [ -z "$MOBILECODE_MANAGED_RELAY_URL" ] && [ -n "$MOBILECODE_DEEPSEEK_API_KEY" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_DEEPSEEK_API_KEY="$MOBILECODE_DEEPSEEK_API_KEY")
-          fi
           if [ -n "$MOBILECODE_GITHUB_OAUTH_CLIENT_ID" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_CLIENT_ID="$MOBILECODE_GITHUB_OAUTH_CLIENT_ID")
-          fi
-          if [ -n "$MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET" ]; then
-            DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET="$MOBILECODE_GITHUB_OAUTH_CLIENT_SECRET")
           fi
           if [ -n "$MOBILECODE_GITHUB_OAUTH_REDIRECT_URI" ]; then
             DART_DEFINES+=(--dart-define=MOBILECODE_GITHUB_OAUTH_REDIRECT_URI="$MOBILECODE_GITHUB_OAUTH_REDIRECT_URI")
@@ -118,7 +101,7 @@ jobs:
       - name: Stage APK
         id: stage_apk
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.77' }}
         run: |
           mkdir -p artifacts
           APK_PATH="artifacts/mobilecode-${RELEASE_TAG}.apk"
@@ -127,7 +110,7 @@ jobs:
 
       - name: Verify release version consistency
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.77' }}
         run: |
           python3 scripts/verify_mobilecode_release_version.py \
             --apk "${{ steps.stage_apk.outputs.apk_path }}" \
@@ -142,7 +125,7 @@ jobs:
       - name: Ensure GitHub Release exists
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.77' }}
         run: |
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists."
@@ -158,6 +141,6 @@ jobs:
       - name: Upload APK to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || github.ref_name || 'v0.1.77' }}
         run: |
           gh release upload "$RELEASE_TAG" "${{ steps.stage_apk.outputs.apk_path }}" --clobber --repo "$GITHUB_REPOSITORY"
diff --git a/.github/workflows/ios-archive.yml b/.github/workflows/ios-archive.yml
@@ -6,7 +6,7 @@ on:
       release_tag:
         description: GitHub Release tag to upload the unsigned iOS archive to
         required: false
-        default: v0.1.76
+        default: v0.1.77
       upload_to_release:
         description: Upload archive zip to the GitHub Release
         required: false
@@ -17,7 +17,7 @@ permissions:
   contents: write
 
 concurrency:
-  group: ios-archive-${{ github.ref }}-${{ github.event.inputs.release_tag || 'v0.1.76' }}
+  group: ios-archive-${{ github.ref }}-${{ github.event.inputs.release_tag || 'v0.1.77' }}
   cancel-in-progress: false
 
 jobs:
@@ -29,6 +29,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Enforce public release credential policy
+        run: python3 scripts/verify_public_release_workflows.py
+
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -60,22 +63,21 @@ jobs:
       - name: Build unsigned iOS device app
         working-directory: mobile_agent
         env:
-          MOBILECODE_MANAGED_API_KEY: ${{ secrets.MOBILECODE_MANAGED_API_KEY }}
+          MOBILECODE_MANAGED_RELAY_URL: ${{ vars.MOBILECODE_MANAGED_RELAY_URL }}
         run: |
-          if [ -n "$MOBILECODE_MANAGED_API_KEY" ]; then
-            flutter build ios --release --no-codesign --target lib/main.dart \
-              --dart-define=MOBILECODE_MANAGED_PROVIDER=true \
-              --dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic \
-              --dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro \
-              --dart-define=MOBILECODE_MANAGED_API_KEY="$MOBILECODE_MANAGED_API_KEY"
-          else
-            flutter build ios --release --no-codesign --target lib/main.dart
+          DART_DEFINES=()
+          if [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_URL="$MOBILECODE_MANAGED_RELAY_URL")
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_PROVIDER=true)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro)
           fi
+          flutter build ios --release --no-codesign --target lib/main.dart "${DART_DEFINES[@]}"
 
       - name: Package unsigned xcarchive
         working-directory: mobile_agent
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           set -euxo pipefail
           mkdir -p ../artifacts
@@ -166,7 +168,7 @@ jobs:
         if: ${{ github.event.inputs.upload_to_release != 'false' }}
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists."
@@ -183,6 +185,6 @@ jobs:
         if: ${{ github.event.inputs.upload_to_release != 'false' }}
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           gh release upload "$RELEASE_TAG" artifacts/mobilecode-ios-archive-"$RELEASE_TAG".xcarchive.zip artifacts/ios-archive-summary.txt --clobber --repo "$GITHUB_REPOSITORY"
diff --git a/.github/workflows/ios-simulator.yml b/.github/workflows/ios-simulator.yml
@@ -6,7 +6,7 @@ on:
       release_tag:
         description: GitHub Release tag to upload the iOS simulator build to
         required: false
-        default: v0.1.76
+        default: v0.1.77
       upload_to_release:
         description: Upload simulator zip to the GitHub Release
         required: false
@@ -22,7 +22,7 @@ permissions:
   contents: write
 
 concurrency:
-  group: ios-simulator-${{ github.ref }}-${{ github.event.inputs.release_tag || 'v0.1.76' }}
+  group: ios-simulator-${{ github.ref }}-${{ github.event.inputs.release_tag || 'v0.1.77' }}
   cancel-in-progress: false
 
 jobs:
@@ -34,6 +34,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Enforce public release credential policy
+        run: python3 scripts/verify_public_release_workflows.py
+
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -65,22 +68,21 @@ jobs:
       - name: Build iOS simulator app
         working-directory: mobile_agent
         env:
-          MOBILECODE_MANAGED_API_KEY: ${{ secrets.MOBILECODE_MANAGED_API_KEY }}
+          MOBILECODE_MANAGED_RELAY_URL: ${{ vars.MOBILECODE_MANAGED_RELAY_URL }}
         run: |
-          if [ -n "$MOBILECODE_MANAGED_API_KEY" ]; then
-            flutter build ios --simulator --debug --target lib/main.dart \
-              --dart-define=MOBILECODE_MANAGED_PROVIDER=true \
-              --dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic \
-              --dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro \
-              --dart-define=MOBILECODE_MANAGED_API_KEY="$MOBILECODE_MANAGED_API_KEY"
-          else
-            flutter build ios --simulator --debug --target lib/main.dart
+          DART_DEFINES=()
+          if [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_URL="$MOBILECODE_MANAGED_RELAY_URL")
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_PROVIDER=true)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro)
           fi
+          flutter build ios --simulator --debug --target lib/main.dart "${DART_DEFINES[@]}"
 
       - name: Install and launch on iOS simulator
         working-directory: mobile_agent
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           set -euxo pipefail
           mkdir -p ../artifacts
@@ -127,7 +129,7 @@ jobs:
         if: ${{ github.event.inputs.upload_to_release != 'false' }}
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists."
@@ -150,6 +152,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
+      - name: Enforce public release credential policy
+        run: python3 scripts/verify_public_release_workflows.py
+
       - name: Setup Flutter
         uses: subosito/flutter-action@v2
         with:
@@ -175,22 +180,21 @@ jobs:
       - name: Build unsigned iOS device app
         working-directory: mobile_agent
         env:
-          MOBILECODE_MANAGED_API_KEY: ${{ secrets.MOBILECODE_MANAGED_API_KEY }}
+          MOBILECODE_MANAGED_RELAY_URL: ${{ vars.MOBILECODE_MANAGED_RELAY_URL }}
         run: |
-          if [ -n "$MOBILECODE_MANAGED_API_KEY" ]; then
-            flutter build ios --release --no-codesign --target lib/main.dart \
-              --dart-define=MOBILECODE_MANAGED_PROVIDER=true \
-              --dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic \
-              --dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro \
-              --dart-define=MOBILECODE_MANAGED_API_KEY="$MOBILECODE_MANAGED_API_KEY"
-          else
-            flutter build ios --release --no-codesign --target lib/main.dart
+          DART_DEFINES=()
+          if [ -n "$MOBILECODE_MANAGED_RELAY_URL" ]; then
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_RELAY_URL="$MOBILECODE_MANAGED_RELAY_URL")
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_PROVIDER=true)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_BASE_URL=https://token-plan-cn.xiaomimimo.com/anthropic)
+            DART_DEFINES+=(--dart-define=MOBILECODE_MANAGED_MODEL=mimo-v2.5-pro)
           fi
+          flutter build ios --release --no-codesign --target lib/main.dart "${DART_DEFINES[@]}"
 
       - name: Package unsigned xcarchive
         working-directory: mobile_agent
         env:
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           set -euxo pipefail
           mkdir -p ../artifacts
@@ -281,7 +285,7 @@ jobs:
         if: ${{ github.event.inputs.upload_to_release != 'false' }}
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.76' }}
+          RELEASE_TAG: ${{ github.event.inputs.release_tag || 'v0.1.77' }}
         run: |
           if gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "Release $RELEASE_TAG already exists."