@leterhong/multichat 1.6.0 → 1.8.0

package/backend/routes/conversations.ts

@@ -2,11 +2,66 @@
 // ── Conversations CRUD ──────────────────────────────────────────────────
 const ctx = require('../lib/context');
 
+// 消息文件名由 id 拼接而成（messages_<id>.json）。id 必须先过白名单，
+// 否则带路径分隔符的 id 会落到 store 的 basename 校验上变成 500 + 内部报错泄漏。
+const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+function assertSafeId(res, id) {
+  if (typeof id === 'string' && SAFE_ID_RE.test(id)) return true;
+  res.status(400).json({ error: 'invalid conversation id', code: 'INVALID_ID' });
+  return false;
+}
+
+function bodyObject(value) {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+
+function optionalText(input, key, max) {
+  if (input[key] === undefined) return {};
+  const value = String(input[key] || '').trim().slice(0, max);
+  return { [key]: value };
+}
+
+function conversationChanges(raw) {
+  const input = bodyObject(raw);
+  return {
+    ...optionalText(input, 'title', 200),
+    ...optionalText(input, 'modelA', 200),
+    ...optionalText(input, 'modelB', 200),
+    ...optionalText(input, 'systemPrompt', 30_000),
+    ...optionalText(input, 'inputPlaceholder', 500),
+    ...(input.compareMode !== undefined ? { compareMode: input.compareMode === true } : {}),
+    ...(input.workspaceId !== undefined ? { workspaceId: input.workspaceId ? ctx.safeId(input.workspaceId, 'workspace id') : null } : {}),
+    ...(input.projectId !== undefined ? { projectId: input.projectId ? ctx.safeId(input.projectId, 'project id') : null } : {}),
+  };
+}
+
+function validateConversationLocation(workspaceId, projectId) {
+  const workspace = workspaceId ? ctx.workspaceStore.getWorkspace(workspaceId) : null;
+  const project = projectId ? ctx.workspaceStore.getProject(projectId) : null;
+  if (workspaceId && !workspace) throw new Error('workspace not found');
+  if (projectId && !project) throw new Error('project not found');
+  if (workspace && project && project.workspaceId !== workspace.id) throw new Error('project does not belong to workspace');
+}
+
+function validateMessages(value) {
+  if (!Array.isArray(value)) throw new Error('messages must be an array');
+  if (value.length > 2_000) throw new Error('messages exceed 2000 entries');
+  if (Buffer.byteLength(JSON.stringify(value), 'utf8') > 16_000_000) throw new Error('messages exceed 16 MB');
+  for (const message of value) {
+    if (!message || typeof message !== 'object' || Array.isArray(message)) throw new Error('each message must be an object');
+    if (!['system', 'user', 'assistant', 'tool'].includes(message.role) || typeof message.content !== 'string') {
+      throw new Error('each message requires a valid role and string content');
+    }
+  }
+  return value;
+}
+
 module.exports = function registerConversations(app) {
   app.get('/api/conversations', (req, res) => {
     res.json(ctx.store.read('conversations.json', []));
   });
   app.get('/api/conversations/:id', (req, res) => {
+    if (!assertSafeId(res, req.params.id)) return;
     const convs = ctx.store.read('conversations.json', []);
     const conv = convs.find(c => c.id === req.params.id);
     if (!conv) return res.status(404).json({ error: 'not found' });
@@ -14,37 +69,53 @@ module.exports = function registerConversations(app) {
     res.json({ ...conv, messages });
   });
   app.post('/api/conversations', (req, res) => {
-    const convs = ctx.store.read('conversations.json', []);
-    const defaultWorkspace = ctx.workspaceStore.workspaces()[0];
-    const defaultProject = ctx.workspaceStore.projects().find(x => x.workspaceId === defaultWorkspace?.id);
-    const { messages: _messages, id: _id, createdAt: _createdAt, ...input } = req.body || {};
-    const conv = {
-      id: Date.now().toString(36),
-      createdAt: new Date().toISOString(),
-      compareMode: false,
-      modelA: '',
-      modelB: '',
-      systemPrompt: '',
-      inputPlaceholder: '',
-      workspaceId: input.workspaceId || defaultWorkspace?.id || null,
-      projectId: input.projectId || defaultProject?.id || null,
-      ...input,
-    };
-    convs.unshift(conv);
-    ctx.store.write('conversations.json', convs);
-    ctx.store.write(`messages_${conv.id}.json`, []);
-    res.json(conv);
+    try {
+      const convs = ctx.store.read('conversations.json', []);
+      const defaultWorkspace = ctx.workspaceStore.workspaces()[0];
+      const input = conversationChanges(req.body);
+      const workspaceId = input.workspaceId || defaultWorkspace?.id || null;
+      const defaultProject = ctx.workspaceStore.projects().find(x => x.workspaceId === workspaceId);
+      const projectId = input.projectId || defaultProject?.id || null;
+      validateConversationLocation(workspaceId, projectId);
+      const conv = {
+        compareMode: false,
+        modelA: '',
+        modelB: '',
+        systemPrompt: '',
+        inputPlaceholder: '',
+        title: '新对话',
+        ...input,
+        id: Date.now().toString(36),
+        createdAt: new Date().toISOString(),
+        workspaceId,
+        projectId,
+      };
+      convs.unshift(conv);
+      ctx.store.write('conversations.json', convs);
+      ctx.store.write(`messages_${conv.id}.json`, []);
+      res.json(conv);
+    } catch (error) {
+      res.status(400).json({ error: error.message, code: 'BAD_REQUEST' });
+    }
   });
   app.put('/api/conversations/:id', (req, res) => {
-    const convs = ctx.store.read('conversations.json', []);
-    const idx = convs.findIndex(c => c.id === req.params.id);
-    if (idx < 0) return res.status(404).json({ error: 'not found' });
-    const { messages: _messages, createdAt: _createdAt, ...changes } = req.body || {};
-    convs[idx] = { ...convs[idx], ...changes, id: req.params.id };
-    ctx.store.write('conversations.json', convs);
-    res.json(convs[idx]);
+    if (!assertSafeId(res, req.params.id)) return;
+    try {
+      const convs = ctx.store.read('conversations.json', []);
+      const idx = convs.findIndex(c => c.id === req.params.id);
+      if (idx < 0) return res.status(404).json({ error: 'not found' });
+      const changes = conversationChanges(req.body);
+      const next = { ...convs[idx], ...changes, id: req.params.id, createdAt: convs[idx].createdAt };
+      validateConversationLocation(next.workspaceId, next.projectId);
+      convs[idx] = next;
+      ctx.store.write('conversations.json', convs);
+      res.json(next);
+    } catch (error) {
+      res.status(400).json({ error: error.message, code: 'BAD_REQUEST' });
+    }
   });
   app.delete('/api/conversations/:id', (req, res) => {
+    if (!assertSafeId(res, req.params.id)) return;
     let convs = ctx.store.read('conversations.json', []);
     convs = convs.filter(c => c.id !== req.params.id);
     ctx.store.write('conversations.json', convs);
@@ -54,9 +125,14 @@ module.exports = function registerConversations(app) {
   });
   // Save messages for a conversation
   app.post('/api/conversations/:id/messages', (req, res) => {
+    if (!assertSafeId(res, req.params.id)) return;
     const convs = ctx.store.read('conversations.json', []);
     if (!convs.find(c => c.id === req.params.id)) return res.status(404).json({ error: 'not found' });
-    ctx.store.write(`messages_${req.params.id}.json`, req.body);
-    res.json({ ok: true });
+    try {
+      ctx.store.write(`messages_${req.params.id}.json`, validateMessages(req.body));
+      res.json({ ok: true });
+    } catch (error) {
+      res.status(400).json({ error: error.message, code: 'BAD_REQUEST' });
+    }
   });
 };

package/backend/routes/import.ts

@@ -44,7 +44,7 @@ function normalizeAgent(raw) {
 }
 
 module.exports = function registerImport(app) {
-  app.post('/api/import', async (req, res) => {
+  app.post('/api/import', (req, res, next) => {
     const body = req.body || {};
     if (body.url || body.format === 'zip' || body.skills || body.type || body.mcp) {
       return fail(res, 400, 'INVALID_PACKAGE', 'Skill 请导入标准 SKILL.md 目录，Plugin 请使用 .codex-plugin/plugin.json，MCP 请使用独立 MCP server 配置');
@@ -59,14 +59,15 @@ module.exports = function registerImport(app) {
     let normalized;
     try { normalized = incoming.map(normalizeAgent); }
     catch (error) { return fail(res, 400, 'INVALID_PACKAGE', error.message); }
-    await ctx.store.mutate(ctx.AGENT_FILE, agents => {
-      for (const item of normalized) {
-        const index = agents.findIndex(agent => agent.id === item.id);
-        if (index >= 0) agents[index] = item;
-        else agents.push(item);
-      }
-      return agents;
-    }, []);
-    res.json({ ok: true, agents: normalized.length, skills: 0 });
+    void ctx.store.mutate(ctx.AGENT_FILE, agents => {
+        for (const item of normalized) {
+          const index = agents.findIndex(agent => agent.id === item.id);
+          if (index >= 0) agents[index] = item;
+          else agents.push(item);
+        }
+        return agents;
+      }, [])
+      .then(() => res.json({ ok: true, agents: normalized.length, skills: 0 }))
+      .catch(next);
   });
 };

package/backend/routes/mock.ts

@@ -4,6 +4,10 @@
 // built-in “Mock (本地体验)” provider. It never calls the network and makes the
 // first-run/chat/usage UI testable without an API key.
 module.exports = function registerMock(app) {
+  app.get('/api/mock/v1/models', (_req, res) => {
+    res.json({ object: 'list', data: [{ id: 'echo', object: 'model', owned_by: 'multichat-local' }] });
+  });
+
   app.post('/api/mock/v1/chat/completions', (req, res) => {
     const body = req.body || {};
     const messages = Array.isArray(body.messages) ? body.messages : [];

package/backend/routes/prompt-templates.ts

@@ -0,0 +1,38 @@
+'use strict';
+// ── 提示词模板库：运行配置系统指令的可复用命名模板（纯文本，无执行语义）──
+const ctx = require('../lib/context');
+
+function normalize(raw) {
+  if (!raw || typeof raw !== 'object') throw new Error('template must be an object');
+  const name = String(raw.name || '').trim();
+  const content = String(raw.content || '').replace(/\r\n/g, '\n').trim();
+  if (!name || name.length > 80) throw new Error('模板名称必须是 1-80 个字符');
+  if (!content || content.length > 30_000) throw new Error('模板内容必须是 1-30000 个字符');
+  return { id: ctx.safeId(raw.id || 'pt_' + Date.now().toString(36), 'template id'), name, content, createdAt: raw.createdAt || new Date().toISOString() };
+}
+
+module.exports = function registerPromptTemplates(app) {
+  app.get('/api/prompt-templates', (req, res) => res.json(ctx.store.read('prompt_templates.json', [])));
+  app.post('/api/prompt-templates', (req, res, next) => {
+    let tpl;
+    try { tpl = normalize(req.body); } catch (e) { return res.status(400).json({ error: e.message, code: 'INVALID_TEMPLATE' }); }
+    void ctx.store.mutate('prompt_templates.json', rows => {
+        const i = rows.findIndex(r => r.name === tpl.name);
+        if (i >= 0) rows[i] = tpl; else rows.push(tpl);
+        return rows;
+      }, [])
+      .then(() => res.status(201).json(tpl))
+      .catch(next);
+  });
+  app.delete('/api/prompt-templates/:id', (req, res, next) => {
+    let found = false;
+    void ctx.store.mutate('prompt_templates.json', rows => rows.filter(row => {
+        if (row.id === req.params.id) found = true;
+        return row.id !== req.params.id;
+      }), [])
+      .then(() => found
+        ? res.json({ ok: true })
+        : res.status(404).json({ error: 'template not found', code: 'TEMPLATE_NOT_FOUND' }))
+      .catch(next);
+  });
+};

package/backend/routes/providers.ts

@@ -89,12 +89,17 @@ module.exports = function registerProviders(app) {
     res.json(models);
   });
 
-  // ── 连接测试：用服务端保存的密钥探测 OpenAI 兼容的 GET /models，返回可达性与模型清单 ──
+  // ── 连接测试：用服务端保存的密钥探测 OpenAI 兼容的 GET /models，返回可达性与模型清单。
+  // 探测到的能力（vision/reasoning 启发式）会写回 provider 记录，供界面标注。──
   app.post('/api/providers/:id/probe', async (req, res) => {
     const providers = ctx.providerStore.list();
-    const provider = providers.find(p => p.id === req.params.id);
-    if (!provider) return res.status(404).json({ error: 'provider not found', code: 'NOT_FOUND' });
-    const baseUrl = String(provider.baseUrl || '').replace(/\/+$/, '');
+    const idx = providers.findIndex(p => p.id === req.params.id);
+    if (idx < 0) return res.status(404).json({ error: 'provider not found', code: 'NOT_FOUND' });
+    const provider = providers[idx];
+    const configuredBaseUrl = String(provider.baseUrl || '').replace(/\/+$/, '');
+    const baseUrl = provider.id === 'mock' && /(?:127\.0\.0\.1|localhost):3099/i.test(configuredBaseUrl)
+      ? `http://127.0.0.1:${ctx.PORT}/api/mock/v1`
+      : configuredBaseUrl;
     let parsed: URL;
     try { parsed = new URL(baseUrl); } catch { return res.status(400).json({ error: 'provider baseUrl 无效' }); }
     const modelsUrl = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}/models`;
@@ -114,6 +119,11 @@ module.exports = function registerProviders(app) {
         vision: models.some(m => /(?:vision|vl|omni|multimodal|4o|gpt-4-turbo|gemini|claude-[35])/i.test(m)),
         reasoning: models.some(m => /(?:reason|think|o[1345]-|r1|qwq)/i.test(m)),
       };
+      // 持久化探测到的能力，界面无需再次探测即可标注。
+      try {
+        providers[idx] = { ...provider, capabilities: { ...(provider.capabilities as JsonRecord | undefined), ...capabilities } };
+        ctx.providerStore.save(providers);
+      } catch { /* 能力标注失败不影响探测结果返回 */ }
       res.json({ ok: true, models, capabilities, modelCount: models.length });
     } catch (error) {
       const raw = error instanceof Error ? error.message : String(error);

package/backend/routes/runs.ts

@@ -10,6 +10,15 @@ module.exports = function registerRuns(app) {
     res.json(runs.slice(0, limit));
   });
 
+  // ── 审计导出：完整 Run/Turn/Step/审批链，供合规归档（JSON，企业审计包入口）──
+  app.get('/api/runs/export', (req, res) => {
+    const runs = ctx.store.read(ctx.RUN_FILE, []);
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Content-Disposition', 'attachment; filename="multichat-audit-' + stamp + '.json"');
+    res.json({ exportedAt: new Date().toISOString(), format: 'multichat-audit/v1', runCount: runs.length, runs });
+  });
+
   app.get('/api/runs/:id', (req, res) => {
     const run = ctx.store.read(ctx.RUN_FILE, []).find(x => x.id === req.params.id);
     if (!run) return res.status(404).json({ error: 'run not found' });
@@ -30,26 +39,39 @@ module.exports = function registerRuns(app) {
   // 审批决策：写入持久化检查点，不占用原 Agent 响应连接。
   app.post('/api/runs/:id/approval/:approvalId', (req, res, next) => {
     void (async () => {
-    const run = ctx.store.read(ctx.RUN_FILE, []).find(x => x.id === req.params.id);
-    if (!run) return res.status(404).json({ error: { message: 'run not found' }, code: 'RUN_NOT_FOUND' });
-    const rec = (run.approvals || []).find(a => a.id === req.params.approvalId);
-    if (!rec || rec.status !== 'pending') {
-      return res.status(409).json({
-        error: { message: '审批请求不存在或已处理' + (rec ? '（当前状态：' + rec.status + '）' : '') },
-        code: 'APPROVAL_NOT_PENDING',
-      });
-    }
-    const action = req.body && req.body.action;
-    if (action !== 'approve' && action !== 'reject') {
-      return res.status(400).json({ error: { message: 'action 必须是 approve 或 reject' }, code: 'BAD_REQUEST' });
-    }
-    rec.status = action === 'approve' ? 'approved' : 'rejected';
-    rec.resolvedAt = new Date().toISOString();
-    run.status = 'paused';
-    run.pauseReason = action === 'approve' ? 'approval granted; ready to resume' : 'approval rejected; ready to resume';
-    if (run.checkpoint) run.checkpoint.approvalDecision = action;
-    await ctx.store.mutate(ctx.RUN_FILE, (runs) => runs.map(item => item.id === run.id ? run : item), []);
-    res.json({ ok: true, approvalId: req.params.approvalId, action, runId: req.params.id, resumable: true });
+      const action = req.body && req.body.action;
+      if (action !== 'approve' && action !== 'reject') {
+        return res.status(400).json({ error: { message: 'action 必须是 approve 或 reject' }, code: 'BAD_REQUEST' });
+      }
+
+      let outcome = { kind: 'missing-run', status: '' };
+      await ctx.store.mutate(ctx.RUN_FILE, (runs) => {
+        const run = runs.find(item => item.id === req.params.id);
+        if (!run) return undefined;
+        const rec = (run.approvals || []).find(item => item.id === req.params.approvalId);
+        if (!rec || rec.status !== 'pending') {
+          outcome = { kind: 'not-pending', status: rec?.status || '' };
+          return undefined;
+        }
+        rec.status = action === 'approve' ? 'approved' : 'rejected';
+        rec.resolvedAt = new Date().toISOString();
+        run.status = 'paused';
+        run.pauseReason = action === 'approve' ? 'approval granted; ready to resume' : 'approval rejected; ready to resume';
+        if (run.checkpoint) run.checkpoint.approvalDecision = action;
+        outcome = { kind: 'updated', status: rec.status };
+        return runs;
+      }, []);
+
+      if (outcome.kind === 'missing-run') {
+        return res.status(404).json({ error: { message: 'run not found' }, code: 'RUN_NOT_FOUND' });
+      }
+      if (outcome.kind === 'not-pending') {
+        return res.status(409).json({
+          error: { message: '审批请求不存在或已处理' + (outcome.status ? '（当前状态：' + outcome.status + '）' : '') },
+          code: 'APPROVAL_NOT_PENDING',
+        });
+      }
+      res.json({ ok: true, approvalId: req.params.approvalId, action, runId: req.params.id, resumable: true });
     })().catch(next);
   });
 };

package/backend/routes/tools.ts

@@ -24,17 +24,19 @@ module.exports = function registerTools(app) {
 
   // ── 本地试跑：只开放无网络、无副作用的纯计算类工具，避免端点被当作代理 ──
   const TESTABLE_TYPES = new Set(['datetime', 'calculator']);
-  app.post('/api/tools/:id/test', async (req, res) => {
-    const tool = listTools().find(item => item.id === req.params.id);
-    if (!tool) return res.status(404).json({ error: 'tool not found', code: 'NOT_FOUND' });
-    if (!TESTABLE_TYPES.has(tool.type)) {
-      return res.status(400).json({ error: `「${tool.name}」暂不支持界面试跑（涉及网络访问，请通过对话调用）`, code: 'NOT_TESTABLE' });
-    }
-    const args = tool.type === 'calculator'
-      ? { expression: String(req.body?.expression ?? '').trim() }
-      : {};
-    const started = Date.now();
-    const result = await agent.executeSkill(tool, args);
-    res.json({ ...result, elapsedMs: Date.now() - started });
+  app.post('/api/tools/:id/test', (req, res, next) => {
+    void (async () => {
+      const tool = listTools().find(item => item.id === req.params.id);
+      if (!tool) return res.status(404).json({ error: 'tool not found', code: 'NOT_FOUND' });
+      if (!TESTABLE_TYPES.has(tool.type)) {
+        return res.status(400).json({ error: `「${tool.name}」暂不支持界面试跑（涉及网络访问，请通过对话调用）`, code: 'NOT_TESTABLE' });
+      }
+      const args = tool.type === 'calculator'
+        ? { expression: String(req.body?.expression ?? '').trim() }
+        : {};
+      const started = Date.now();
+      const result = await agent.executeSkill(tool, args);
+      res.json({ ...result, elapsedMs: Date.now() - started });
+    })().catch(next);
   });
 };

package/backend/runtime/auto-snapshot.ts

@@ -0,0 +1,60 @@
+'use strict';
+// ── 每日自动快照：为每个项目在距上次自动快照 ≥24h 时创建一份，并只保留最近 N 份自动快照 ──
+// 手动创建的项目快照永不参与清理。MULTICHAT_AUTO_SNAPSHOT=0 可整体关闭。
+const ctx = require('../lib/context');
+const controlPlane = require('../routes/control-plane');
+
+const SWEEP_INTERVAL_MS = 6 * 60 * 60 * 1000; // 每 6 小时巡检一次，是否到期由 24h 阈值判断
+const DUE_MS = 24 * 60 * 60 * 1000;
+const KEEP = Math.max(1, Number(process.env.MULTICHAT_AUTO_SNAPSHOT_KEEP || 7));
+const AUTO_TITLE_PREFIX = '自动快照 ';
+
+function isAutomatic(row) { return row.automatic === true || String(row.title || '').startsWith(AUTO_TITLE_PREFIX); }
+
+export function runAutoSnapshotSweep(nowMs = Date.now()) {
+  if (process.env.MULTICHAT_AUTO_SNAPSHOT === '0') return { created: [], pruned: 0, disabled: true };
+  const created = [];
+  let pruned = 0;
+  const projects = ctx.workspaceStore.projects();
+  const assets = ctx.workspaceStore.assets();
+  const memories = ctx.store.read('memories.json', []);
+  const rows = ctx.store.read('snapshots.json', []);
+  for (const project of projects) {
+    const hasRecoverableState = assets.some(item => item.projectId === project.id)
+      || memories.some(item => item.projectId === project.id)
+      || Boolean(project.defaultAgentId || project.defaultProviderId || project.defaultModel);
+    // A fresh inbox/project has nothing to recover. Skipping it avoids a daily
+    // stream of empty snapshots that obscures meaningful restore points.
+    if (!hasRecoverableState) continue;
+    const autoRows = rows
+      .filter(row => row.projectId === project.id && isAutomatic(row))
+      .sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+    const newest = autoRows[0]?.createdAt ? Date.parse(autoRows[0].createdAt) : 0;
+    if (Number.isFinite(newest) && nowMs - newest < DUE_MS) continue;
+    try {
+      const row = controlPlane.makeSnapshot(project.id, { title: AUTO_TITLE_PREFIX + new Date(nowMs).toISOString().slice(0, 10) }, true);
+      created.push({ projectId: project.id, id: row.id, title: row.title });
+    } catch { /* 单个项目失败（如超大文件）不阻断其他项目 */ }
+  }
+  if (created.length) {
+    const all = ctx.store.read('snapshots.json', []);
+    const keep = new Set();
+    for (const project of ctx.workspaceStore.projects()) {
+      all.filter(row => row.projectId === project.id && isAutomatic(row))
+        .sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)))
+        .slice(0, KEEP)
+        .forEach(row => keep.add(row.id));
+    }
+    const next = all.filter(row => !isAutomatic(row) || keep.has(row.id));
+    pruned = all.length - next.length;
+    if (pruned > 0) ctx.store.write('snapshots.json', next);
+  }
+  return { created, pruned };
+}
+
+export function startAutoSnapshots() {
+  if (process.env.MULTICHAT_AUTO_SNAPSHOT === '0') return;
+  const boot = setTimeout(() => { try { runAutoSnapshotSweep(); } catch {} }, 2 * 60 * 1000);
+  const timer = setInterval(() => { try { runAutoSnapshotSweep(); } catch {} }, SWEEP_INTERVAL_MS);
+  boot.unref?.(); timer.unref?.();
+}

package/backend/server.ts

@@ -62,6 +62,7 @@ require('./routes/conversations')(app);
 require('./routes/workspaces')(app);
 require('./routes/assistants')(app);
 require('./routes/runs')(app);
+require('./routes/prompt-templates')(app);
 require('./routes/usage')(app);
 require('./routes/control-plane')(app);
 require('./routes/skills')(app);
@@ -87,6 +88,8 @@ app.use(errorHandler);
 runtime.ensureSeed();
 require('./extensions/manager').ensureDefaults();
 
+// 每日自动快照调度（可用 MULTICHAT_AUTO_SNAPSHOT=0 关闭）
+require("./runtime/auto-snapshot").startAutoSnapshots();
 const server = app.listen(PORT, HOST, () => {
   console.log(`Multi-model chat server running on http://${HOST}:${PORT}`);
   console.log(`OpenAI-compatible endpoint: POST /v1/chat/completions`);

package/bin/multichat.mjs

@@ -10,6 +10,8 @@ import {
   readFileSync,
   readdirSync,
   statSync,
+  unlinkSync,
+  writeFileSync,
 } from 'node:fs';
 import { mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
@@ -333,6 +335,11 @@ async function runWeb(options, deployAlias = false) {
   }
   assertDistinctDirectories(options.workspace, options.dataDir);
   await mkdir(options.dataDir, { recursive: true });
+  try {
+    probeDirectoryWrite(options.dataDir);
+  } catch (error) {
+    throw new CliError(`数据目录不可写：${options.dataDir}（${error.message}）`);
+  }
 
   const port = await checkPort(options.host, options.port);
   if (!port.ok) {
@@ -401,6 +408,15 @@ function nearestExistingDirectory(target) {
   return isDirectory(current) ? current : path.dirname(current);
 }
 
+function probeDirectoryWrite(directory) {
+  const probe = path.join(directory, `.multichat-write-probe-${process.pid}-${Date.now()}`);
+  try {
+    writeFileSync(probe, 'ok', { encoding: 'utf8', flag: 'wx' });
+  } finally {
+    try { unlinkSync(probe); } catch {}
+  }
+}
+
 async function runDoctor(options) {
   const runtime = resolveRuntime();
   const results = [];
@@ -418,6 +434,7 @@ async function runDoctor(options) {
   } else {
     try {
       accessSync(options.workspace, constants.R_OK | constants.W_OK);
+      probeDirectoryWrite(options.workspace);
       add('PASS', '工作区', options.workspace);
     } catch (error) {
       add('FAIL', '工作区', `${options.workspace}：${error.message}`);
@@ -433,6 +450,7 @@ async function runDoctor(options) {
     try {
       if (!writableRoot) throw new Error('找不到可写父目录');
       accessSync(writableRoot, constants.W_OK);
+      probeDirectoryWrite(writableRoot);
       add('PASS', '数据目录', existsSync(options.dataDir) ? options.dataDir : `${options.dataDir}（首次启动时创建）`);
     } catch (error) {
       add('FAIL', '数据目录', `${options.dataDir}：${error.message}`);

package/frontend/dist/assets/agentPicker-Jan8fWb3.js

@@ -0,0 +1,18 @@
+import{E as e,O as t,T as n,b as r,y as i}from"./index-CeU_ksnE.js";import{importProjectFolder as a}from"./assets-ChkvQqhp.js";e(`#workspacePicker`).onclick=()=>{let e=r.projects.map(e=>({id:e.id,name:e.name,description:e.description}));showModal({title:`选择项目`,body:`<div class="picker-dialog-intro"><span>每个项目保存自己的文件、记忆和对话上下文</span><span>${e.length} 个项目</span></div>
+      <button type="button" class="picker-import-project" data-import-project>
+        <span class="picker-provider-mark folder" aria-hidden="true">＋</span>
+        <span class="picker-option-copy"><strong>打开本地项目文件夹</strong><small>自动创建项目并导入可读取的源码与文档</small></span>
+        <span class="picker-option-state" aria-hidden="true">›</span>
+      </button>
+      <div class="model-picker-list">${e.map(e=>{let n=r.selectedProject?.id===e.id,i=e.id===`pr_inbox`||e.name===`收件箱`,a=i?`临时对话`:e.name,o=i?`不载入项目文件，只进行普通对话`:e.description||`本地项目`;return`<button type="button" class="picker-option${n?` active`:``}" data-pid="${t(e.id)}" aria-pressed="${n}">
+          <span class="picker-provider-mark" aria-hidden="true">${i?`—`:t(a.trim().slice(0,1).toUpperCase()||`P`)}</span>
+          <span class="picker-option-copy"><strong>${t(a)}</strong><small>${t(o)}</small></span>
+          <span class="picker-option-state" aria-hidden="true">${n?`✓`:`›`}</span>
+        </button>`}).join(``)}</div>`,onMount:e=>{let t=e.querySelector(`[data-import-project]`);t&&(t.onclick=()=>{closeModal(),a()}),e.querySelectorAll(`[data-pid]`).forEach(e=>e.onclick=async()=>{let t=r.projects.find(t=>t.id===e.dataset.pid)||null;t&&(r.selectedProject=t,localStorage.setItem(`multichat_project`,t.id),await loadProjects(),await newConversation(),renderTopbar(),renderFileContext(),closeModal())})}})},e(`#agentPicker`).onclick=()=>{if(!r.agents.length){openSettings(`agents`),n(`请先创建运行配置`);return}let e=[{id:``,name:`直接对话`,description:`不注入系统提示词，也不启用工具`}].concat(r.agents.map(e=>({id:e.id,name:e.name,description:e.description})));showModal({title:`选择运行配置`,body:`<div class="picker-dialog-intro"><span>选择本轮使用的提示词与能力组合</span><span>${r.agents.length} 个配置</span></div>
+      <div class="model-picker-list">
+      ${e.map(e=>{let n=(r.selectedAgent?.id||``)===e.id;return`<button type="button" class="picker-option${n?` active`:``}" data-aid="${t(e.id)}" aria-pressed="${n}">
+          <span class="picker-provider-mark agent" aria-hidden="true">${e.id?t(e.name.trim().slice(0,1).toUpperCase()||`A`):`—`}</span>
+          <span class="picker-option-copy"><strong>${t(e.name)}</strong><small>${t(e.description||`自定义运行配置`)}</small></span>
+          <span class="picker-option-state" aria-hidden="true">${n?`✓`:`›`}</span>
+        </button>`}).join(``)}
+    </div>`,onMount:e=>{e.querySelectorAll(`[data-aid]`).forEach(e=>{e.onclick=()=>{let t=e.dataset.aid;r.selectedAgent=t?r.agents.find(e=>e.id===t):null,i(),renderTopbar(),closeModal(),r.messages.length||renderContent()}})}})};

package/frontend/dist/assets/assets-ChkvQqhp.js

@@ -0,0 +1 @@
+import{T as e,b as t,f as n}from"./index-CeU_ksnE.js";var r=18e5,i=16e6,a=240,o=new Set([`.git`,`.hg`,`.svn`,`.idea`,`.vscode`,`node_modules`,`dist`,`build`,`coverage`,`.next`,`.nuxt`,`.cache`,`target`,`vendor`,`__pycache__`]),s=new Set(`txt.md.mdx.json.jsonc.csv.tsv.js.jsx.mjs.cjs.ts.tsx.py.go.rs.java.kt.kts.c.h.cpp.hpp.cs.php.rb.swift.vue.svelte.html.htm.css.scss.sass.less.yaml.yml.toml.ini.conf.env.sql.graphql.gql.sh.bash.zsh.fish.ps1.bat.cmd.xml.svg.lock`.split(`.`)),c=new Set([`readme`,`license`,`changelog`,`makefile`,`procfile`,`dockerfile`,`.gitignore`,`.gitattributes`,`.editorconfig`,`.npmrc`,`.nvmrc`]);function l(e){return String(e.webkitRelativePath||e.name).replaceAll(`\\`,`/`).replace(/^\/+/,``)}function u(e){let t=Array.from(e,e=>{let t=l(e);return t.includes(`/`)?t.split(`/`).filter(Boolean)[0]:``}).filter(Boolean);return t.length&&t.every(e=>e===t[0])?t[0].slice(0,120):`本地项目`}function d(e,t){let n=l(e),r=`${t}/`;return n.startsWith(r)?n.slice(r.length):n}function f(e){let t=l(e).split(`/`).filter(Boolean);if(!t.length||t.some(e=>o.has(e.toLowerCase()))||!e.size||e.size>r)return!1;let n=t.at(-1)?.toLowerCase()||``,i=n.includes(`.`)&&n.split(`.`).pop()||``;return e.type.startsWith(`text/`)||s.has(i)||c.has(n)}function p(e){let t=Array.from(e),n=u(t),r=[],o=0,s=0;for(let e of t)r.length>=a||!f(e)||o+e.size>i?s+=1:(r.push({file:e,name:d(e,n)}),o+=e.size);return{selected:r,skipped:s,bytes:o}}async function m(e){if(!t.selectedWorkspace)throw Error(`项目存储尚未初始化，请刷新页面后重试`);let r=t.projects.find(t=>t.id!==`pr_inbox`&&String(t.name).toLowerCase()===e.toLowerCase());r||(r=await n(`/api/projects`,{method:`POST`,body:JSON.stringify({workspaceId:t.selectedWorkspace.id,name:e,description:`从本地项目文件夹导入`})}),t.projects=[r,...t.projects]);let i=t.selectedProject?.id!==r.id;return t.selectedProject=r,localStorage.setItem(`multichat_project`,r.id),t.assets=await n(`/api/assets?projectId=`+encodeURIComponent(r.id)),t.selectedAssetIds=new Set(t.assets.map(e=>e.id)),await loadProjectControlData(),i&&(document.querySelector(`#settings.open`)&&closeSettings(),await newConversation()),renderTopbar(),renderFileContext(),r}async function h(r){let{selected:i,skipped:a}=p(r);if(!i.length){e(`文件夹中没有可导入的文本或源代码文件`,`error`);return}let o=u(r),s;try{s=await m(o)}catch(t){e(t.message||`无法创建项目`,`error`);return}let c=s.id,l=new Set((t.assets||[]).map(e=>String(e.name).toLowerCase())),d=i.filter(e=>!l.has(e.name.toLowerCase())),f=i.length-d.length;if(!d.length){e(`该文件夹中的可用文件已经在当前项目中`);return}e(`正在打开「${o}」并导入 ${d.length} 个文件…`);let h=[],g=[],_=0,v=async()=>{for(;_<d.length;){let e=d[_++];try{let t=await n(`/api/assets`,{method:`POST`,body:JSON.stringify({projectId:c,name:e.name,mimeType:e.file.type||`text/plain`,content:await e.file.text()})});h.push(t)}catch{g.push(e.name)}}};await Promise.all(Array.from({length:Math.min(4,d.length)},()=>v())),h.length&&(t.assets=[...h,...t.assets],t.selectedAssetIds=new Set([...t.selectedAssetIds,...h.map(e=>e.id)]));let y=[a?`跳过 ${a} 个构建产物、二进制或超限文件`:``,f?`忽略 ${f} 个重复文件`:``,g.length?`${g.length} 个文件导入失败`:``].filter(Boolean);renderTopbar(),renderFileContext(),e(`项目「${o}」已打开，新增 ${h.length} 个文件${y.length?`；${y.join(`，`)}`:``}`,g.length?`error`:void 0)}function g(){return new Promise(e=>{let t=document.createElement(`input`);t.type=`file`,t.multiple=!0,t.setAttribute(`webkitdirectory`,``),t.setAttribute(`directory`,``),t.className=`project-folder-input`,t.setAttribute(`aria-hidden`,`true`),document.body.appendChild(t);let n=()=>{t.remove(),e()};t.addEventListener(`change`,()=>{h(Array.from(t.files||[])).finally(n)},{once:!0}),t.addEventListener(`cancel`,n,{once:!0}),t.click()})}export{g as importProjectFolder,f as isProjectTextFile,u as projectFolderName,p as selectProjectFiles};

package/frontend/dist/assets/compare-CkyqXEbN.js

@@ -0,0 +1 @@
+import{D as e,T as t,b as n,m as r}from"./index-CeU_ksnE.js";function i(){return(n.providers||[]).flatMap(e=>(e.models||[]).map(t=>({id:`${e.id}:${t}`,providerId:e.id,providerName:e.name||e.id,model:t})))}async function a(e,t,i){let a=performance.now();try{let o=await fetch(n.apiBase+`/v1/chat/completions`,{method:`POST`,headers:{"Content-Type":`application/json`,...r()},signal:i,body:JSON.stringify({providerId:e.providerId,model:e.model,messages:[{role:`user`,content:t}],stream:!1,temperature:n.params.temperature,max_tokens:n.params.max_tokens,top_p:n.params.top_p,workspaceId:n.selectedWorkspace?.id||null,projectId:n.selectedProject?.id||null,assetIds:[...n.selectedAssetIds],interactionId:`compare_${crypto.randomUUID()}`})}),s=await o.json();if(!o.ok){let e=typeof s?.error==`string`?s.error:s?.error?.message;throw Error(e||`HTTP ${o.status}`)}return{...e,status:`success`,text:s?.choices?.[0]?.message?.content||``,usage:s?.usage||{},elapsedMs:Math.round(performance.now()-a)}}catch(t){return t instanceof Error&&t.name===`AbortError`?{...e,status:`cancelled`,elapsedMs:Math.round(performance.now()-a)}:{...e,status:`error`,error:t instanceof Error?t.message:String(t),elapsedMs:Math.round(performance.now()-a)}}}async function o(e,r){if(!e.text)return;let i=(n.providers||[]).find(t=>t.id===e.providerId);i&&(n.selectedProvider=i,n.selectedModel=e.model),n.messages=[...n.messages,{role:`user`,content:r},{role:`assistant`,content:e.text,model:e.model,providerName:e.providerName,usage:e.usage,elapsedMs:e.elapsedMs,importedFromCompare:!0}];try{await ensureConversation(),await saveCurrentMessages()}catch{}renderTopbar(),renderContent(),renderConvList(),t(`已采用 ${e.model} 的结果`)}function s(){openSettings(`experiment`)}function c(){e(`[data-open-compare]`).forEach(e=>e.onclick=s)}export{o as adoptResult,i as compareTargets,a as executeTarget,s as openCompare,c as setupCompare};

package/frontend/dist/assets/conversations-DoyXfY4T.js

@@ -0,0 +1 @@
+import{C as e,E as t,T as n,b as r,f as i,i as a,w as o,y as s}from"./index-CeU_ksnE.js";function c(t=r.currentConvId,n=r.selectedProject?.id){let i=o(t,n);r.workflowScope=i,r.workflow=e(i)}async function l(){try{r.conversations=await i(`/api/conversations`),r.conversationsLoadFailed=!1}catch{r.conversations=[],r.conversationsLoadFailed=!0}}function u(){}async function d(e){let o=r.conversations.find(t=>t.id===e);if(o&&await showConfirm({title:`删除对话`,message:`删除「${o.title||`新对话`}」？`,confirmLabel:`删除`,danger:!0}))try{await i(`/api/conversations/`+encodeURIComponent(e),{method:`DELETE`}),r.conversations=r.conversations.filter(t=>t.id!==e),r.currentConvId===e&&(r.currentConvId=null,r.messages=[],c(null,r.selectedProject?.id),t(`#topbarTitle`).textContent=`新对话`,a(`chat`),location.hash!==`#/new`&&history.replaceState(null,``,`#/new`)),n(`对话已删除`)}catch(e){n(`删除对话失败：`+e.message,`error`)}}async function f(e){let a=r.conversations.find(t=>t.id===e);if(!a)return;let o=await showPrompt({title:`重命名任务`,label:`任务名称`,value:a.title||`新任务`,placeholder:`输入新的任务名称`,maxLength:120});if(o?.trim())try{let a=await i(`/api/conversations/`+encodeURIComponent(e),{method:`PUT`,body:JSON.stringify({title:o.trim()})});r.conversations=r.conversations.map(t=>t.id===e?{...t,...a}:t),r.currentConvId===e&&(t(`#topbarTitle`).textContent=a.title||o.trim()),n(`任务已重命名`)}catch(e){n(`重命名失败：`+e.message,`error`)}}async function p(){a(`home`),r.currentConvId=null,r.messages=[],c(null,r.selectedProject?.id),t(`#topbarTitle`).textContent=`新对话`,renderContent(),renderInspector(),requestAnimationFrame(()=>t(`#heroInput`)?.focus()),location.hash!==`#/home`&&history.pushState(null,``,`#/home`)}async function m(e){try{a(`chat`);let n=await i(`/api/conversations/`+encodeURIComponent(e));(n.workspaceId&&(!r.selectedWorkspace||r.selectedWorkspace.id!==n.workspaceId)||n.projectId&&(!r.selectedProject||r.selectedProject.id!==n.projectId))&&(r.selectedWorkspace=r.workspaces.find(e=>e.id===n.workspaceId)||r.selectedWorkspace,r.selectedWorkspace&&await loadProjects(),n.projectId&&(r.selectedProject=r.projects.find(e=>e.id===n.projectId)||r.selectedProject,r.selectedProject&&(localStorage.setItem(`multichat_project`,r.selectedProject.id),r.assets=await i(`/api/assets?projectId=`+encodeURIComponent(r.selectedProject.id)),r.selectedAssetIds=new Set(r.assets.map(e=>e.id))))),r.currentConvId=n.id,r.messages=(n.messages||[]).map(e=>({role:e.role,content:e.content,model:e.model})),c(n.id,n.projectId||r.selectedProject?.id),t(`#topbarTitle`).textContent=n.title||`对话`,renderTopbar(),renderContent(),g();let o=`#/chat/${encodeURIComponent(n.id)}`;location.hash!==o&&history.pushState(null,``,o)}catch(t){if(t?.status===404){r.conversations=r.conversations.filter(t=>t.id!==e),r.currentConvId===e&&(r.currentConvId=null,r.messages=[],c(null,r.selectedProject?.id)),a(`home`),history.replaceState(null,``,`#/home`),renderTopbar(),renderContent(),n(`该任务不存在或已被删除，已返回新任务页`,`error`);return}n(`打开对话失败：`+t.message,`error`)}}function h(e){try{return e<1024?e+` B`:e<1048576?(e/1024).toFixed(1)+` KB`:(e/1024/1024).toFixed(1)+` MB`}catch{return``}}function g(){renderContent(),renderInspector()}function _(){let e=r.selectedProject;if(e){if(e.defaultAgentId){let t=r.agents.find(t=>t.id===e.defaultAgentId);t&&(r.selectedAgent=t,s())}if(e.defaultProviderId&&e.defaultModel){let t=r.providers.find(t=>t.id===e.defaultProviderId);t&&(r.selectedProvider=t,r.selectedModel=e.defaultModel,localStorage.setItem(`multichat_lastModel`,t.id+`:`+e.defaultModel))}renderTopbar()}}export{c as activateWorkflow,_ as applyProjectDefaults,d as deleteConversation,h as fmtSize,l as loadConversations,p as newConversation,m as openConversation,f as renameConversation,u as renderConvList,g as renderFileContext};

package/frontend/dist/assets/data-BN7t_AoO.js

@@ -0,0 +1 @@
+import{b as e,f as t}from"./index-CeU_ksnE.js";async function n(){try{e.providers=await t(`/api/providers`)}catch{e.providers=[]}}async function r(){try{e.runtime=await t(`/api/runtime`)}catch{e.runtime=null}}async function i(){try{e.runs=await t(`/api/runs?limit=40`)}catch{e.runs=[]}}async function a(n=e.usageRange){e.usageRange=String(n||`30`),e.usageLoading=!0;try{let n=new Date().getTimezoneOffset();e.usage=await t(`/api/usage?range=${encodeURIComponent(e.usageRange)}&offset=${n}`)}catch{e.usage=null}finally{e.usageLoading=!1}}async function o(){try{e.capabilities=await t(`/api/capabilities`)}catch{e.capabilities=null}}async function s(){if(!e.selectedProject)e.memories=[],e.snapshots=[];else try{[e.memories,e.snapshots]=await Promise.all([t(`/api/memories?projectId=`+encodeURIComponent(e.selectedProject.id)),t(`/api/snapshots?projectId=`+encodeURIComponent(e.selectedProject.id))])}catch{e.memories=[],e.snapshots=[]}}async function c(){try{e.workspaces=await t(`/api/workspaces`);let n=localStorage.getItem(`multichat_workspace`);e.selectedWorkspace=e.workspaces.find(e=>e.id===n)||e.workspaces[0]||null,await l()}catch{e.workspaces=[],e.projects=[]}}async function l(){if(!e.selectedWorkspace)e.projects=[],e.selectedProject=null;else try{e.projects=await t(`/api/projects?workspaceId=`+encodeURIComponent(e.selectedWorkspace.id));let n=localStorage.getItem(`multichat_project`);e.selectedProject=e.projects.find(e=>e.id===n)||e.projects.find(t=>t.id===e.selectedWorkspace.defaultProjectId)||e.projects[0]||null,localStorage.setItem(`multichat_workspace`,e.selectedWorkspace.id),e.selectedProject&&localStorage.setItem(`multichat_project`,e.selectedProject.id),e.selectedProject&&(e.assets=await t(`/api/assets?projectId=`+encodeURIComponent(e.selectedProject.id)),e.selectedAssetIds=new Set(e.assets.map(e=>e.id)),applyProjectDefaults(),await s())}catch{e.projects=[],e.selectedProject=null,e.assets=[],e.selectedAssetIds=new Set}}async function u(){try{e.skills=await t(`/api/skills`)}catch{e.skills=[]}}async function d(){try{e.tools=await t(`/api/tools`)}catch{e.tools=[]}}async function f(){try{e.mcpServers=await t(`/api/mcp-servers`)}catch{e.mcpServers=[]}}async function p(){let n=e.selectedAgent?.id;try{e.agents=await t(`/api/agents`),n&&(e.selectedAgent=e.agents.find(e=>e.id===n)||null)}catch{e.agents=[],n&&(e.selectedAgent=null)}}async function m(){try{e.plugins=await t(`/api/plugins`)}catch{e.plugins=[]}}export{p as loadAgents,o as loadCapabilities,f as loadMcpServers,m as loadPlugins,s as loadProjectControlData,l as loadProjects,n as loadProviders,i as loadRuns,r as loadRuntime,u as loadSkills,d as loadTools,a as loadUsage,c as loadWorkspaces};