@leterhong/multichat 1.6.0

package/backend/mcp.ts

@@ -0,0 +1,417 @@
+'use strict';
+
+// MCP client used by MultiChat's runtime and extension manager.
+// STDIO follows the MCP transport contract: one JSON-RPC message per line.
+// Streamable HTTP is supported for remote servers. Connections are cached by
+// server configuration so tools/list and tools/call share one session.
+const { spawn } = require('child_process');
+const { redactSecrets } = require('./lib/redact');
+const { readPackageVersion } = require('./lib/catalog');
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import type { JsonRecord, RequestOptions } from './types';
+
+interface PendingRequest {
+  resolve: (value: any) => void;
+  reject: (reason?: any) => void;
+  timer: NodeJS.Timeout;
+  signal?: AbortSignal;
+  onAbort?: () => void;
+}
+
+interface McpClientConfig {
+  command?: string;
+  args?: string[];
+  cwd?: string;
+  env?: Record<string, string>;
+  url?: string;
+  headers?: Record<string, string>;
+  fetchImpl?: typeof fetch;
+}
+
+const PROTOCOL_VERSION = '2025-06-18';
+const REQUEST_TIMEOUT_MS = 60_000;
+const MAX_STDOUT_BUFFER = 4 * 1024 * 1024;
+const MAX_HTTP_BODY = 8 * 1024 * 1024;
+
+function timeoutError(label: string) { return new Error(`${label} timed out`); }
+
+function childEnvironment(extra?: Record<string, string>): NodeJS.ProcessEnv {
+  // Arbitrary MCP packages do not inherit user profiles, credential helpers or
+  // NODE_PATH. A server that truly needs a value must declare it explicitly in
+  // its own MCP configuration.
+  const keep = ['PATH', 'Path', 'PATHEXT', 'SystemRoot', 'WINDIR', 'ComSpec', 'TEMP', 'TMP'];
+  const base: NodeJS.ProcessEnv = {};
+  for (const key of keep) if (process.env[key] !== undefined) base[key] = process.env[key];
+  return { ...base, ...(extra || {}) };
+}
+
+async function readLimitedText(response: Response, limit = MAX_HTTP_BODY) {
+  const declared = Number(response.headers.get('content-length') || 0);
+  if (declared > limit) throw new Error(`MCP HTTP response exceeds ${limit} bytes`);
+  if (!response.body) return '';
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let total = 0;
+  let text = '';
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) { await reader.cancel(); throw new Error(`MCP HTTP response exceeds ${limit} bytes`); }
+    text += decoder.decode(value, { stream: true });
+  }
+  return text + decoder.decode();
+}
+
+class McpStdioClient {
+  command: string;
+  args: string[];
+  cwd?: string;
+  env: Record<string, string>;
+  proc: ChildProcessWithoutNullStreams | null;
+  buffer: string;
+  nextId: number;
+  pending: Map<number, PendingRequest>;
+  starting: Promise<void> | null;
+  ready: boolean;
+  protocolVersion: string;
+  serverInfo: JsonRecord | null;
+  instructions: string;
+
+  constructor(command: string, args?: string[], cwd?: string, env?: Record<string, string>) {
+    this.command = command;
+    this.args = Array.isArray(args) ? args : [];
+    this.cwd = cwd;
+    this.env = env || {};
+    this.proc = null;
+    this.buffer = '';
+    this.nextId = 1;
+    this.pending = new Map();
+    this.starting = null;
+    this.ready = false;
+    this.protocolVersion = PROTOCOL_VERSION;
+    this.serverInfo = null;
+    this.instructions = '';
+  }
+
+  async ensureStarted(options: RequestOptions = {}) {
+    if (this.ready && this.proc) return;
+    if (this.starting) return this.starting;
+    this.starting = this._start(options);
+    try { await this.starting; }
+    finally { this.starting = null; }
+  }
+
+  async _start(options: RequestOptions = {}) {
+    if (!this.command) throw new Error('MCP stdio command is required');
+    this.proc = spawn(this.command, this.args, {
+      cwd: this.cwd || undefined,
+      env: childEnvironment(this.env),
+      windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    this.proc.stdout.setEncoding('utf8');
+    this.proc.stdout.on('data', (chunk: string) => this._onData(chunk));
+    this.proc.stderr.setEncoding('utf8');
+    this.proc.stderr.on('data', (chunk: string) => {
+      const text = String(chunk).trim();
+      if (text) console.error('[mcp stderr]', redactSecrets(text).slice(0, 500));
+    });
+    this.proc.on('error', (error: Error) => this._disconnect(error));
+    this.proc.on('exit', (code: number | null) => this._disconnect(new Error(`MCP server exited with code ${code}`)));
+
+    try {
+      const initialized = await this._request('initialize', {
+        protocolVersion: PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: 'MultiChat', version: readPackageVersion() },
+      }, options);
+      this.protocolVersion = initialized?.protocolVersion || PROTOCOL_VERSION;
+      this.serverInfo = initialized?.serverInfo || null;
+      this.instructions = initialized?.instructions || '';
+      this._notify('notifications/initialized', {});
+      this.ready = true;
+    } catch (error) {
+      if (this.proc) this.proc.kill();
+      this._disconnect(error);
+      throw error;
+    }
+  }
+
+  _disconnect(error: Error) {
+    this.ready = false;
+    this.proc = null;
+    this.buffer = '';
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      if (pending.signal && pending.onAbort) pending.signal.removeEventListener('abort', pending.onAbort);
+      pending.reject(error);
+    }
+    this.pending.clear();
+  }
+
+  _write(message: JsonRecord) {
+    if (!this.proc?.stdin?.writable) throw new Error('MCP server is not running');
+    this.proc.stdin.write(JSON.stringify(message) + '\n');
+  }
+
+  _notify(method: string, params: JsonRecord) { this._write({ jsonrpc: '2.0', method, params }); }
+
+  _request(method: string, params: JsonRecord, options: RequestOptions = {}): Promise<any> {
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const signal = options.signal;
+      const finish = (callback: (value: any) => void, value: any) => {
+        const pending = this.pending.get(id);
+        if (!pending) return;
+        this.pending.delete(id);
+        clearTimeout(pending.timer);
+        if (pending.signal && pending.onAbort) pending.signal.removeEventListener('abort', pending.onAbort);
+        callback(value);
+      };
+      const timer = setTimeout(() => {
+        finish(reject, timeoutError(`MCP ${method}`));
+      }, REQUEST_TIMEOUT_MS);
+      const onAbort = () => {
+        try { this._notify('notifications/cancelled', { requestId: id, reason: 'cancelled by caller' }); } catch {}
+        const error = new Error('MCP request cancelled'); error.name = 'AbortError';
+        finish(reject, error);
+      };
+      this.pending.set(id, { resolve, reject, timer, signal, onAbort });
+      if (signal) {
+        if (signal.aborted) { onAbort(); return; }
+        signal.addEventListener('abort', onAbort, { once: true });
+      }
+      try { this._write({ jsonrpc: '2.0', id, method, params }); }
+      catch (error) {
+        finish(reject, error);
+      }
+    });
+  }
+
+  _onData(chunk: string) {
+    this.buffer += chunk;
+    if (this.buffer.length > MAX_STDOUT_BUFFER) {
+      const error = new Error('MCP stdout buffer limit exceeded');
+      if (this.proc) this.proc.kill();
+      this._disconnect(error);
+      return;
+    }
+    while (true) {
+      const newline = this.buffer.indexOf('\n');
+      if (newline < 0) break;
+      const line = this.buffer.slice(0, newline).trim();
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line) continue;
+      let message;
+      try { message = JSON.parse(line); }
+      catch {
+        console.error('[mcp] ignored non-JSON stdout line:', redactSecrets(line).slice(0, 200));
+        continue;
+      }
+      if (message.id === undefined || message.id === null) continue;
+      const pending = this.pending.get(message.id);
+      if (!pending) continue;
+      this.pending.delete(message.id);
+      clearTimeout(pending.timer);
+      if (pending.signal && pending.onAbort) pending.signal.removeEventListener('abort', pending.onAbort);
+      if (message.error) pending.reject(new Error(message.error.message || 'MCP error'));
+      else pending.resolve(message.result);
+    }
+  }
+
+  async listTools(options: RequestOptions = {}) {
+    await this.ensureStarted(options);
+    const tools: JsonRecord[] = [];
+    let cursor: string | null | undefined;
+    do {
+      const result = await this._request('tools/list', cursor ? { cursor } : {}, options);
+      if (Array.isArray(result?.tools)) tools.push(...result.tools);
+      cursor = result?.nextCursor || null;
+    } while (cursor);
+    return tools;
+  }
+
+  async callTool(name: string, args: JsonRecord, options: RequestOptions = {}) {
+    await this.ensureStarted(options);
+    return this._request('tools/call', { name, arguments: args || {} }, options);
+  }
+
+  close() {
+    if (this.proc) this.proc.kill();
+    this._disconnect(new Error('MCP client closed'));
+  }
+}
+
+class McpHttpClient {
+  url: string;
+  headers: Record<string, string>;
+  fetchImpl: typeof fetch;
+  sessionId: string | null;
+  nextId: number;
+  ready: boolean;
+  starting: Promise<void> | null;
+  protocolVersion: string;
+  serverInfo: JsonRecord | null;
+  instructions: string;
+
+  constructor(url: string, headers?: Record<string, string>, fetchImpl?: typeof fetch) {
+    this.url = url;
+    this.headers = headers || {};
+    this.fetchImpl = fetchImpl || fetch;
+    this.sessionId = null;
+    this.nextId = 1;
+    this.ready = false;
+    this.starting = null;
+    this.protocolVersion = PROTOCOL_VERSION;
+    this.serverInfo = null;
+    this.instructions = '';
+  }
+
+  async ensureStarted(options: RequestOptions = {}) {
+    if (this.ready) return;
+    if (this.starting) return this.starting;
+    this.starting = (async () => {
+      const initialized = await this._request('initialize', {
+        protocolVersion: PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: 'MultiChat', version: readPackageVersion() },
+      }, options);
+      const negotiated = initialized?.protocolVersion;
+      if (negotiated !== undefined && (typeof negotiated !== 'string' || !negotiated.trim())) {
+        throw new Error('MCP server returned an invalid protocolVersion');
+      }
+      this.protocolVersion = negotiated || PROTOCOL_VERSION;
+      this.serverInfo = initialized?.serverInfo || null;
+      this.instructions = initialized?.instructions || '';
+      await this._notify('notifications/initialized', {}, options);
+      this.ready = true;
+    })();
+    try { await this.starting; }
+    finally { this.starting = null; }
+  }
+
+  async _post(message: JsonRecord, signal?: AbortSignal): Promise<any> {
+    const headers: Record<string, string> = {
+      ...this.headers,
+      Accept: 'application/json, text/event-stream',
+      'Content-Type': 'application/json',
+      'MCP-Protocol-Version': this.protocolVersion,
+    };
+    if (this.sessionId) headers['MCP-Session-Id'] = this.sessionId;
+    const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const requestSignal = signal && AbortSignal.any ? AbortSignal.any([timeoutSignal, signal]) : (signal || timeoutSignal);
+    const response = await this.fetchImpl(this.url, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(message),
+      signal: requestSignal,
+    });
+    if (!response.ok) throw new Error(`MCP HTTP ${response.status}: ${(await readLimitedText(response, 64 * 1024)).slice(0, 300)}`);
+    const sessionId = response.headers.get('mcp-session-id');
+    if (sessionId) this.sessionId = sessionId;
+    if (response.status === 202 || !response.body) return null;
+    const text = await readLimitedText(response);
+    if (!text.trim()) return null;
+    const contentType = response.headers.get('content-type') || '';
+    if (contentType.includes('text/event-stream')) {
+      const messages: JsonRecord[] = [];
+      for (const block of text.split(/\r?\n\r?\n/)) {
+        const data = block.split(/\r?\n/).filter(line => line.startsWith('data:')).map(line => line.slice(5).trim()).join('\n');
+        if (!data) continue;
+        try { messages.push(JSON.parse(data)); } catch {}
+      }
+      return messages.find(item => item.id === message.id) || messages.at(-1) || null;
+    }
+    return JSON.parse(text);
+  }
+
+  async _notify(method: string, params: JsonRecord, options: RequestOptions = {}) { await this._post({ jsonrpc: '2.0', method, params }, options.signal); }
+
+  async _request(method: string, params: JsonRecord, options: RequestOptions = {}): Promise<any> {
+    const id = this.nextId++;
+    const message = await this._post({ jsonrpc: '2.0', id, method, params }, options.signal);
+    if (!message) throw new Error(`MCP ${method} returned no response`);
+    if (message.error) throw new Error(message.error.message || 'MCP error');
+    return message.result;
+  }
+
+  async listTools(options: RequestOptions = {}) {
+    await this.ensureStarted(options);
+    const tools: JsonRecord[] = [];
+    let cursor: string | null | undefined;
+    do {
+      const result = await this._request('tools/list', cursor ? { cursor } : {}, options);
+      if (Array.isArray(result?.tools)) tools.push(...result.tools);
+      cursor = result?.nextCursor || null;
+    } while (cursor);
+    return tools;
+  }
+
+  async callTool(name: string, args: JsonRecord, options: RequestOptions = {}) {
+    await this.ensureStarted(options);
+    return this._request('tools/call', { name, arguments: args || {} }, options);
+  }
+
+  close() { this.ready = false; this.sessionId = null; }
+}
+
+const MCP_IDLE_TIMEOUT_MS = Math.max(30_000, Number(process.env.MCP_IDLE_TIMEOUT_MS || 5 * 60_000));
+type CachedClient = { client: McpStdioClient | McpHttpClient; timer: NodeJS.Timeout };
+const clientCache = new Map<string, CachedClient>();
+
+function touchClient(key: string, cached: CachedClient) {
+  clearTimeout(cached.timer);
+  cached.timer = setTimeout(() => {
+    const current = clientCache.get(key);
+    if (current !== cached) return;
+    current.client.close();
+    clientCache.delete(key);
+  }, MCP_IDLE_TIMEOUT_MS);
+  cached.timer.unref?.();
+}
+
+function getMcpClient(config: McpClientConfig) {
+  if (!config || (!config.command && !config.url)) return null;
+  const key = JSON.stringify({ ...config, fetchImpl: undefined });
+  if (!clientCache.has(key)) {
+    const client = config.url
+      ? new McpHttpClient(config.url, config.headers, config.fetchImpl)
+      : new McpStdioClient(config.command, config.args, config.cwd, config.env);
+    const cached = { client, timer: setTimeout(() => {}, MCP_IDLE_TIMEOUT_MS) };
+    clientCache.set(key, cached);
+    touchClient(key, cached);
+  }
+  const cached = clientCache.get(key);
+  touchClient(key, cached);
+  return cached.client;
+}
+
+function closeMcpClient(config: McpClientConfig) {
+  if (!config) return;
+  const key = JSON.stringify({ ...config, fetchImpl: undefined });
+  const cached = clientCache.get(key);
+  if (cached) {
+    clearTimeout(cached.timer);
+    cached.client.close();
+  }
+  clientCache.delete(key);
+}
+
+function closeAllMcpClients() {
+  for (const cached of clientCache.values()) {
+    clearTimeout(cached.timer);
+    cached.client.close();
+  }
+  clientCache.clear();
+}
+
+module.exports = {
+  McpClient: McpStdioClient,
+  McpStdioClient,
+  McpHttpClient,
+  getMcpClient,
+  closeMcpClient,
+  closeAllMcpClients,
+  childEnvironment,
+};

package/backend/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "multichat-backend",
+  "version": "1.6.0",
+  "private": true,
+  "type": "commonjs",
+  "description": "MultiChat backend — Express-based multi-model Agent platform",
+  "main": "dist/server.js",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "start": "node dist/server.js",
+    "dev": "tsx watch server.ts",
+    "test": "tsc -p tsconfig.test.json && node --test .test-dist/tests/*.test.js",
+    "lint": "eslint . --ext .ts,.cjs --max-warnings 99999",
+    "typecheck": "tsc --noEmit"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "dependencies": {
+    "@leterhong/multichat": "file:..",
+    "adm-zip": "^0.6.0",
+    "cors": "^2.8.5",
+    "express": "^4.19.2"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.10.0",
+    "@typescript-eslint/eslint-plugin": "^8.18.0",
+    "@typescript-eslint/parser": "^8.18.0",
+    "eslint": "^8.57.1",
+    "tsx": "^4.19.2",
+    "typescript": "^5.6.3"
+  }
+}

package/backend/prompts.json

@@ -0,0 +1,82 @@
+[
+  {
+    "id": "code-assistant",
+    "title": "代码助手",
+    "category": "编程",
+    "icon": "💻",
+    "systemPrompt": "你是一位资深的全栈开发工程师，精通多种编程语言和框架。请用简洁、专业的方式回答编程问题，优先给出可运行的代码示例，必要时解释关键逻辑和设计思路。代码注释使用中文。",
+    "inputPlaceholder": "描述你想实现的功能或遇到的 bug…"
+  },
+  {
+    "id": "code-reviewer",
+    "title": "代码审查助手",
+    "category": "编程",
+    "icon": "🔍",
+    "systemPrompt": "你是一位严格的代码审查专家。用户会粘贴代码，请你从以下维度逐一审查：1) 潜在 Bug 和逻辑错误 2) 安全漏洞（注入、XSS、敏感信息泄露等）3) 性能问题 4) 代码风格和可读性 5) 最佳实践偏离。每个问题标注严重等级（🔴 严重 / 🟡 建议 / 🟢 优化），并给出修复建议和修改后的代码片段。如果代码质量优秀，也请指出亮点。",
+    "inputPlaceholder": "粘贴需要审查的代码…"
+  },
+  {
+    "id": "translator",
+    "title": "翻译专家",
+    "category": "翻译",
+    "icon": "🌐",
+    "systemPrompt": "你是一位专业翻译，精通中英双语互译。翻译时做到信达雅：准确传达原文含义，表达自然流畅，兼顾语言美感。如遇专业术语，请在译文中用括号标注原文。用户发送任何文本，你直接给出翻译结果，无需多余解释。",
+    "inputPlaceholder": "输入需要翻译的文本…"
+  },
+  {
+    "id": "email-polisher",
+    "title": "英文邮件润色",
+    "category": "翻译",
+    "icon": "✉️",
+    "systemPrompt": "你是一位英文商务邮件润色专家。用户会提供中文邮件草稿或英文初稿，请你：1) 润色为地道、专业的商务英文 2) 根据邮件场景（正式/半正式/内部沟通）调整语气 3) 优化措辞使表达更简洁有力 4) 修正语法和用词错误。输出格式：先给出润色后的完整邮件，再用简短注释说明主要改动。如用户未指定收件人关系，默认为正式商务场景。",
+    "inputPlaceholder": "粘贴需要润色的邮件内容（中英文均可）…"
+  },
+  {
+    "id": "copywriter",
+    "title": "文案策划",
+    "category": "写作",
+    "icon": "✍️",
+    "systemPrompt": "你是一位顶尖文案策划，擅长品牌文案、社交媒体内容、营销话术和活动策划。请根据用户的需求，提供有创意、有感染力的文案方案，并给出适用于不同平台的版本建议。",
+    "inputPlaceholder": "描述你的文案需求，如产品、场景、目标受众…"
+  },
+  {
+    "id": "xiaohongshu-copy",
+    "title": "小红书爆款文案",
+    "category": "写作",
+    "icon": "📕",
+    "systemPrompt": "你是一位小红书爆款文案专家，深谙平台推荐算法和用户心理。请根据用户提供的主题生成小红书笔记文案，要求：1) 标题：包含数字、对比、悬念或情绪词，15字以内抓眼球 2) 正文：口语化、场景化，多用短句和换行，穿插emoji增加阅读节奏 3) 结尾设置互动钩子（提问/投票/征集）4) 生成5-8个相关话题标签 5) 提供3个备选标题供选择。语气要真诚不做作，像朋友分享而非广告。",
+    "inputPlaceholder": "输入你想写的小红书笔记主题，如：平价护肤推荐、职场穿搭…"
+  },
+  {
+    "id": "data-analyst",
+    "title": "数据分析",
+    "category": "分析",
+    "icon": "📊",
+    "systemPrompt": "你是一位数据分析专家，擅长数据清洗、统计分析、可视化建议和业务洞察。请用结构化的方式回答：先明确问题和数据现状，再给出分析思路和具体方法，最后提供可操作的结论和建议。涉及代码时优先使用 Python（pandas / matplotlib / plotly）。",
+    "inputPlaceholder": "描述你的数据分析问题或粘贴数据…"
+  },
+  {
+    "id": "weekly-report",
+    "title": "周报生成器",
+    "category": "工作",
+    "icon": "📋",
+    "systemPrompt": "你是一位职场周报撰写助手。用户会提供本周工作的零散记录（要点、完成的任务、遇到的问题等），请你整理为结构清晰的周报，格式如下：\n\n## 本周完成\n- 按优先级排列，每项用一句话概括成果（用动词开头）\n\n## 进行中\n- 正在推进的事项及当前进度\n\n## 下周计划\n- 基于本周进展推导下一步\n\n## 需要协助\n- 阻塞项和资源需求\n\n要求：语言精练专业，突出成果而非过程，用数据说话。如果用户信息模糊，合理推断补充但标注[需确认]。",
+    "inputPlaceholder": "输入本周做了什么（随意写，越碎越好，我来整理）…"
+  },
+  {
+    "id": "interview-coach",
+    "title": "面试教练",
+    "category": "职场",
+    "icon": "🎯",
+    "systemPrompt": "你是一位资深面试教练，熟悉互联网、金融、咨询等行业的面试流程和常见问题。请根据用户提供的职位信息和背景，模拟真实面试场景提问，对用户的回答给出专业点评和改进建议，帮助用户提升面试表现。",
+    "inputPlaceholder": "输入你准备面试的职位和公司…"
+  },
+  {
+    "id": "study-notes",
+    "title": "学习笔记整理",
+    "category": "学习",
+    "icon": "📝",
+    "systemPrompt": "你是一位学习笔记整理专家。用户会提供课堂笔记、读书摘录、会议记录等原始内容，请你：1) 提取核心概念和关键信息 2) 用结构化格式重新组织（标题、列表、表格、思维导图文字版）3) 标注知识点之间的逻辑关系（因果、对比、递进）4) 对重要概念给出简明解释 5) 生成3-5个复习自测问题。输出要求层次分明、一目了然，方便后续复习。",
+    "inputPlaceholder": "粘贴你的原始笔记、课堂记录或读书摘录…"
+  }
+]

package/backend/routes/agents.ts

@@ -0,0 +1,55 @@
+'use strict';
+// ── Agents CRUD ────────────────────────────────────────────────────────
+// 注：/api/agents/:id/chat（流式工具循环）位于 routes/chat.js，
+// 与 /v1/chat/completions 共用 adapters 与 agent runtime，便于统一维护。
+const ctx = require('../lib/context');
+
+function normalizeCapabilityRefs(agent, migrateLegacyTools = true) {
+  const builtinToolIds = new Set(ctx.store.read(ctx.SKILL_FILE, [])
+    .filter(item => !['prompt', 'mcp'].includes(item.type))
+    .map(item => item.id));
+  const legacyIds = Array.isArray(agent.skillIds) ? agent.skillIds.map(String) : [];
+  const explicitTools = Array.isArray(agent.toolIds) ? agent.toolIds.map(String) : [];
+  const legacyTools = migrateLegacyTools ? legacyIds.filter(id => builtinToolIds.has(id)) : [];
+  agent.toolIds = [...new Set([...explicitTools, ...legacyTools])];
+  agent.skillIds = legacyIds.filter(id => !builtinToolIds.has(id));
+  agent.skillRefs = Array.isArray(agent.skillRefs) ? agent.skillRefs.map(String) : [];
+  agent.mcpServerIds = Array.isArray(agent.mcpServerIds) ? agent.mcpServerIds.map(String) : [];
+  return agent;
+}
+
+module.exports = function registerAgents(app) {
+  app.get('/api/agents', (req, res) => res.json(ctx.store.read(ctx.AGENT_FILE, [])));
+  app.get('/api/agents/:id', (req, res) => {
+    const agent = ctx.store.read(ctx.AGENT_FILE, []).find(x => x.id === req.params.id);
+    if (!agent) return res.status(404).json({ error: 'not found' });
+    res.json(agent);
+  });
+  app.post('/api/agents', (req, res) => {
+    const agents = ctx.store.read(ctx.AGENT_FILE, []);
+    const agent = normalizeCapabilityRefs(
+      { id: 'ag_' + Date.now().toString(36), skillIds: [], skillRefs: [], toolIds: [], mcpServerIds: [], systemPrompt: '', createdAt: new Date().toISOString(), ...req.body },
+      !Array.isArray(req.body?.toolIds),
+    );
+    agents.push(agent);
+    ctx.store.write(ctx.AGENT_FILE, agents);
+    res.json(agent);
+  });
+  app.put('/api/agents/:id', (req, res) => {
+    const agents = ctx.store.read(ctx.AGENT_FILE, []);
+    const idx = agents.findIndex(a => a.id === req.params.id);
+    if (idx < 0) return res.status(404).json({ error: 'not found' });
+    agents[idx] = normalizeCapabilityRefs(
+      { ...agents[idx], ...req.body, id: req.params.id },
+      !Array.isArray(req.body?.toolIds),
+    );
+    ctx.store.write(ctx.AGENT_FILE, agents);
+    res.json(agents[idx]);
+  });
+  app.delete('/api/agents/:id', (req, res) => {
+    let agents = ctx.store.read(ctx.AGENT_FILE, []);
+    agents = agents.filter(a => a.id !== req.params.id);
+    ctx.store.write(ctx.AGENT_FILE, agents);
+    res.json({ ok: true });
+  });
+};

package/backend/routes/assistants.ts

@@ -0,0 +1,30 @@
+'use strict';
+// ── Assistants CRUD（遗留，保留兼容） ──────────────────────────────────
+const ctx = require('../lib/context');
+
+module.exports = function registerAssistants(app) {
+  app.get('/api/assistants', (req, res) => {
+    res.json(ctx.store.read('assistants.json', []));
+  });
+  app.post('/api/assistants', (req, res) => {
+    const assistants = ctx.store.read('assistants.json', []);
+    const assistant = { id: Date.now().toString(36), ...req.body };
+    assistants.push(assistant);
+    ctx.store.write('assistants.json', assistants);
+    res.json(assistant);
+  });
+  app.put('/api/assistants/:id', (req, res) => {
+    const assistants = ctx.store.read('assistants.json', []);
+    const idx = assistants.findIndex(a => a.id === req.params.id);
+    if (idx < 0) return res.status(404).json({ error: 'not found' });
+    assistants[idx] = { ...assistants[idx], ...req.body, id: req.params.id };
+    ctx.store.write('assistants.json', assistants);
+    res.json(assistants[idx]);
+  });
+  app.delete('/api/assistants/:id', (req, res) => {
+    let assistants = ctx.store.read('assistants.json', []);
+    assistants = assistants.filter(a => a.id !== req.params.id);
+    ctx.store.write('assistants.json', assistants);
+    res.json({ ok: true });
+  });
+};