@leterhong/multichat 1.6.0

package/backend/routes/control-plane.ts

@@ -0,0 +1,165 @@
+'use strict';
+const crypto = require('crypto');
+const { spawnSync } = require('child_process');
+const ctx = require('../lib/context');
+const agentRuntime = require('../runtime/agent');
+const extensions = require('../extensions/manager');
+
+const MEMORY_FILE = 'memories.json';
+const SNAPSHOT_FILE = 'snapshots.json';
+
+function now() { return new Date().toISOString(); }
+function cleanText(value, max) { return String(value || '').trim().slice(0, max); }
+function risk(permissions) {
+  if ((permissions || []).some(item => ['filesystem', 'process', 'external'].includes(item))) return 'high';
+  if ((permissions || []).length) return 'medium';
+  return 'low';
+}
+function sourceOf(item) {
+  return item.source?.kind || (item.managed ? 'managed' : 'builtin');
+}
+function gitState() {
+  const root = ctx.path.resolve(process.env.MULTICHAT_PROJECT_ROOT || ctx.path.join(ctx.BACKEND_ROOT, '..'));
+  const run = args => {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8', timeout: 3000, windowsHide: true });
+    return result.status === 0 ? String(result.stdout || '').trim() : '';
+  };
+  return { branch: run(['branch', '--show-current']) || null, commit: run(['rev-parse', '--short', 'HEAD']) || null, dirty: Boolean(run(['status', '--porcelain'])) };
+}
+
+function capabilityPassports() {
+  const skills = extensions.listSkills().map(item => ({
+    type: 'skill', id: item.key || item.id, name: item.name, version: item.modifiedAt || null,
+    description: item.description || '', enabled: item.enabled !== false, source: sourceOf(item), scope: item.scope || item.source?.scope || 'project',
+    permissions: [], risk: item.invalid ? 'high' : 'low', trust: item.invalid ? 'invalid' : 'reviewed-local',
+    integrity: item.invalid ? 'invalid' : 'discovered', path: item.path || null, issues: item.invalid ? [item.error || 'Skill 格式无效'] : [],
+  }));
+  const tools = ctx.store.read(ctx.SKILL_FILE, []).filter(item => !['prompt', 'mcp'].includes(item.type)).map(item => {
+    const permissions = agentRuntime.skillPermissions(item);
+    return { type: 'tool', id: item.id, name: item.name, description: item.description || '', enabled: item.enabled !== false, source: 'builtin', scope: 'runtime', permissions, risk: risk(permissions), trust: 'first-party', integrity: 'built-in', issues: [] };
+  });
+  const mcp = extensions.listMcpServers().map(item => {
+    const permissions = ['network', 'external'];
+    const issues = [];
+    if (item.trustLevel !== 'trusted') issues.push('未标记为可信，调用前需要审批');
+    if (item.lastError) issues.push(item.lastError);
+    return { type: 'mcp', id: item.id, name: item.name, description: item.description || '', enabled: item.enabled !== false, source: sourceOf(item), scope: item.scope || item.source?.scope || 'project', permissions, risk: risk(permissions), trust: item.trustLevel || 'untrusted', integrity: item.source?.kind === 'plugin' ? 'plugin-declared' : 'user-configured', version: item.updatedAt || null, issues, tools: (item.tools || []).length };
+  });
+  const plugins = extensions.listPlugins().map(item => {
+    const permissions = Array.isArray(item.policy?.permissions) ? item.policy.permissions.map(String) : [];
+    const issues = [];
+    if (item.invalid) issues.push('插件结构无效或组件路径越界');
+    if (!item.version || item.version === '0.0.0') issues.push('未声明可追踪版本');
+    return { type: 'plugin', id: item.key || item.id, name: item.name, description: item.description || '', enabled: item.enabled !== false, source: sourceOf(item), scope: item.source?.scope || 'project', permissions, risk: item.invalid ? 'high' : risk(permissions), trust: item.source?.kind === 'repo' ? 'project-owned' : 'managed', integrity: item.invalid ? 'invalid' : 'manifest-validated', version: item.version || null, author: item.author || null, components: item.components || {}, issues };
+  });
+  const items = [...plugins, ...skills, ...mcp, ...tools];
+  return { generatedAt: now(), summary: { total: items.length, enabled: items.filter(item => item.enabled).length, highRisk: items.filter(item => item.risk === 'high').length, issues: items.reduce((sum, item) => sum + item.issues.length, 0) }, items };
+}
+
+function snapshotRows() { return ctx.store.read(SNAPSHOT_FILE, []); }
+function publicSnapshot(row) {
+  const { payload, ...rest } = row;
+  return { ...rest, assets: payload?.assets?.length || 0, memories: payload?.memories?.length || 0, size: Buffer.byteLength(JSON.stringify(payload || {}), 'utf8') };
+}
+function makeSnapshot(projectId, input: Record<string, any> = {}, automatic = false) {
+  const project = ctx.workspaceStore.requireProject(projectId);
+  const assets = ctx.workspaceStore.assets().filter(item => item.projectId === projectId);
+  const memories = ctx.store.read(MEMORY_FILE, []).filter(item => item.projectId === projectId);
+  const assetBytes = assets.reduce((sum, item) => sum + Buffer.byteLength(String(item.content || ''), 'utf8'), 0);
+  if (assetBytes > 7_000_000) throw new Error('snapshot project files exceed 7 MB; remove large files first');
+  const agents = ctx.store.read(ctx.AGENT_FILE, []);
+  const linkedAgent = project.defaultAgentId ? agents.find(item => item.id === project.defaultAgentId) || null : null;
+  const payload = { project, assets, memories, linkedAgent, capabilityRefs: capabilityPassports().items.filter(item => item.enabled).map(item => ({ type: item.type, id: item.id, version: item.version || null })) };
+  const serialized = JSON.stringify(payload);
+  if (Buffer.byteLength(serialized, 'utf8') > 8_000_000) throw new Error('snapshot exceeds 8 MB; remove large project files first');
+  const row = { id: `snap_${Date.now().toString(36)}_${crypto.randomBytes(3).toString('hex')}`, projectId, title: cleanText(input.title, 120) || (automatic ? '恢复前自动备份' : `项目快照 ${new Date().toLocaleString('zh-CN')}`), note: cleanText(input.note, 500), createdAt: now(), automatic, git: gitState(), fingerprint: crypto.createHash('sha256').update(serialized).digest('hex').slice(0, 16), payload };
+  const rows = snapshotRows(); rows.unshift(row); ctx.store.write(SNAPSHOT_FILE, rows.slice(0, 50));
+  return row;
+}
+
+module.exports = function registerControlPlane(app) {
+  app.get('/api/capabilities', (req, res, next) => { try { res.json(capabilityPassports()); } catch (error) { next(error); } });
+
+  app.get('/api/memories', (req, res) => {
+    let rows = ctx.store.read(MEMORY_FILE, []);
+    if (req.query.projectId) rows = rows.filter(item => item.projectId === req.query.projectId);
+    res.json(rows);
+  });
+  app.post('/api/memories', async (req, res) => {
+    try {
+      const project = ctx.workspaceStore.requireProject(ctx.safeId(req.body?.projectId, 'project id'));
+      const title = cleanText(req.body?.title, 120), content = cleanText(req.body?.content, 4000);
+      if (!title || !content) return res.status(400).json({ error: 'title and content are required' });
+      const row = { id: `mem_${Date.now().toString(36)}_${crypto.randomBytes(3).toString('hex')}`, projectId: project.id, title, content, enabled: req.body?.enabled !== false, createdAt: now(), updatedAt: now() };
+      await ctx.store.mutate(MEMORY_FILE, rows => [row, ...rows].slice(0, 1000), []);
+      res.status(201).json(row);
+    } catch (error) { res.status(400).json({ error: error.message }); }
+  });
+  app.put('/api/memories/:id', async (req, res) => {
+    let updated = null;
+    await ctx.store.mutate(MEMORY_FILE, rows => rows.map(item => {
+      if (item.id !== req.params.id) return item;
+      updated = { ...item, ...(req.body.title !== undefined ? { title: cleanText(req.body.title, 120) } : {}), ...(req.body.content !== undefined ? { content: cleanText(req.body.content, 4000) } : {}), ...(req.body.enabled !== undefined ? { enabled: req.body.enabled === true } : {}), updatedAt: now() };
+      return updated;
+    }), []);
+    if (!updated) return res.status(404).json({ error: 'memory not found' });
+    res.json(updated);
+  });
+  app.delete('/api/memories/:id', async (req, res) => {
+    let found = false;
+    await ctx.store.mutate(MEMORY_FILE, rows => rows.filter(item => { if (item.id === req.params.id) found = true; return item.id !== req.params.id; }), []);
+    if (!found) return res.status(404).json({ error: 'memory not found' });
+    res.json({ ok: true });
+  });
+
+  app.get('/api/projects/:id/search', (req, res) => {
+    try {
+      ctx.workspaceStore.requireProject(req.params.id);
+      const query = cleanText(req.query.q, 1000);
+      if (!query) return res.json([]);
+      res.json(agentRuntime.projectSearch(req.params.id, query, null, Number(req.query.limit) || 12));
+    } catch (error) { res.status(400).json({ error: error.message }); }
+  });
+
+  app.get('/api/snapshots', (req, res) => {
+    let rows = snapshotRows();
+    if (req.query.projectId) rows = rows.filter(item => item.projectId === req.query.projectId);
+    res.json(rows.map(publicSnapshot));
+  });
+  app.post('/api/snapshots', (req, res) => {
+    try { res.status(201).json(publicSnapshot(makeSnapshot(ctx.safeId(req.body?.projectId, 'project id'), req.body || {}))); }
+    catch (error) { res.status(400).json({ error: error.message }); }
+  });
+  app.post('/api/snapshots/:id/restore', (req, res) => {
+    try {
+      const snapshot = snapshotRows().find(item => item.id === req.params.id);
+      if (!snapshot) return res.status(404).json({ error: 'snapshot not found' });
+      makeSnapshot(snapshot.projectId, { title: '恢复前自动备份', note: `即将恢复 ${snapshot.title}` }, true);
+      const payload = snapshot.payload || {};
+      ctx.workspaceStore.updateProject(snapshot.projectId, {
+        name: payload.project?.name,
+        description: payload.project?.description,
+        defaultAgentId: payload.project?.defaultAgentId,
+        defaultProviderId: payload.project?.defaultProviderId,
+        defaultModel: payload.project?.defaultModel,
+      });
+      const otherAssets = ctx.workspaceStore.assets().filter(item => item.projectId !== snapshot.projectId);
+      const restoredAssets = (payload.assets || []).map(item => ({ ...item, projectId: snapshot.projectId, workspaceId: payload.project.workspaceId, updatedAt: now() }));
+      ctx.store.write('assets.json', [...restoredAssets, ...otherAssets]);
+      const otherMemories = ctx.store.read(MEMORY_FILE, []).filter(item => item.projectId !== snapshot.projectId);
+      ctx.store.write(MEMORY_FILE, [...(payload.memories || []), ...otherMemories]);
+      if (payload.linkedAgent) {
+        const agents = ctx.store.read(ctx.AGENT_FILE, []);
+        const index = agents.findIndex(item => item.id === payload.linkedAgent.id);
+        if (index >= 0) { agents[index] = payload.linkedAgent; ctx.store.write(ctx.AGENT_FILE, agents); }
+      }
+      res.json({ ok: true, snapshot: publicSnapshot(snapshot) });
+    } catch (error) { res.status(400).json({ error: error.message }); }
+  });
+  app.delete('/api/snapshots/:id', (req, res) => {
+    const rows = snapshotRows();
+    if (!rows.some(item => item.id === req.params.id)) return res.status(404).json({ error: 'snapshot not found' });
+    ctx.store.write(SNAPSHOT_FILE, rows.filter(item => item.id !== req.params.id));
+    res.json({ ok: true });
+  });
+};

package/backend/routes/conversations.ts

@@ -0,0 +1,62 @@
+'use strict';
+// ── Conversations CRUD ──────────────────────────────────────────────────
+const ctx = require('../lib/context');
+
+module.exports = function registerConversations(app) {
+  app.get('/api/conversations', (req, res) => {
+    res.json(ctx.store.read('conversations.json', []));
+  });
+  app.get('/api/conversations/:id', (req, res) => {
+    const convs = ctx.store.read('conversations.json', []);
+    const conv = convs.find(c => c.id === req.params.id);
+    if (!conv) return res.status(404).json({ error: 'not found' });
+    const messages = ctx.store.read(`messages_${req.params.id}.json`, []);
+    res.json({ ...conv, messages });
+  });
+  app.post('/api/conversations', (req, res) => {
+    const convs = ctx.store.read('conversations.json', []);
+    const defaultWorkspace = ctx.workspaceStore.workspaces()[0];
+    const defaultProject = ctx.workspaceStore.projects().find(x => x.workspaceId === defaultWorkspace?.id);
+    const { messages: _messages, id: _id, createdAt: _createdAt, ...input } = req.body || {};
+    const conv = {
+      id: Date.now().toString(36),
+      createdAt: new Date().toISOString(),
+      compareMode: false,
+      modelA: '',
+      modelB: '',
+      systemPrompt: '',
+      inputPlaceholder: '',
+      workspaceId: input.workspaceId || defaultWorkspace?.id || null,
+      projectId: input.projectId || defaultProject?.id || null,
+      ...input,
+    };
+    convs.unshift(conv);
+    ctx.store.write('conversations.json', convs);
+    ctx.store.write(`messages_${conv.id}.json`, []);
+    res.json(conv);
+  });
+  app.put('/api/conversations/:id', (req, res) => {
+    const convs = ctx.store.read('conversations.json', []);
+    const idx = convs.findIndex(c => c.id === req.params.id);
+    if (idx < 0) return res.status(404).json({ error: 'not found' });
+    const { messages: _messages, createdAt: _createdAt, ...changes } = req.body || {};
+    convs[idx] = { ...convs[idx], ...changes, id: req.params.id };
+    ctx.store.write('conversations.json', convs);
+    res.json(convs[idx]);
+  });
+  app.delete('/api/conversations/:id', (req, res) => {
+    let convs = ctx.store.read('conversations.json', []);
+    convs = convs.filter(c => c.id !== req.params.id);
+    ctx.store.write('conversations.json', convs);
+    const messageFile = `messages_${req.params.id}.json`;
+    ctx.store.remove(messageFile);
+    res.json({ ok: true });
+  });
+  // Save messages for a conversation
+  app.post('/api/conversations/:id/messages', (req, res) => {
+    const convs = ctx.store.read('conversations.json', []);
+    if (!convs.find(c => c.id === req.params.id)) return res.status(404).json({ error: 'not found' });
+    ctx.store.write(`messages_${req.params.id}.json`, req.body);
+    res.json({ ok: true });
+  });
+};

package/backend/routes/extensions-import.ts

@@ -0,0 +1,15 @@
+'use strict';
+
+const importer = require('../extensions/importer');
+
+module.exports = function registerExtensionImport(app) {
+  app.post('/api/extensions/import/:kind/inspect', (req, res, next) => {
+    try { res.json(importer.inspect(req.params.kind, req.body || {})); }
+    catch (error) { next(error); }
+  });
+
+  app.post('/api/extensions/import/:kind/install', (req, res, next) => {
+    try { res.status(201).json(importer.install(req.params.kind, req.body || {})); }
+    catch (error) { next(error); }
+  });
+};

package/backend/routes/import.ts

@@ -0,0 +1,72 @@
+'use strict';
+
+// Legacy JSON import is intentionally limited to declarative Agent records.
+// Skills and plugins use their standard directory formats and MCP servers use
+// /api/mcp-servers; this endpoint never accepts commands or executable config.
+const ctx = require('../lib/context');
+const extensions = require('../extensions/manager');
+const { fail } = require('../lib/errors');
+
+function normalizeAgent(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new Error('agent must be an object');
+  const id = ctx.safeId(raw.id || `ag_${Date.now().toString(36)}`, 'agent id');
+  const name = String(raw.name || id).trim();
+  const systemPrompt = String(raw.systemPrompt || '').trim();
+  if (!name || name.length > 120) throw new Error('agent name must be 1-120 characters');
+  if (systemPrompt.length > 30_000) throw new Error('systemPrompt exceeds 30000 characters');
+  const stringIds = value => Array.isArray(value) ? value.map(String).filter(item => /^[A-Za-z0-9._-]{1,128}$/.test(item)) : [];
+  const legacySkillIds = stringIds(raw.skillIds);
+  const builtinTools = ctx.store.read(ctx.SKILL_FILE, []).filter(item => !['prompt', 'mcp'].includes(item.type));
+  const builtinToolIds = new Set(builtinTools.map(item => item.id));
+  const workflowSkills = extensions.listSkills();
+  const skillRefs = Array.isArray(raw.skillRefs)
+    ? stringIds(raw.skillRefs)
+    : legacySkillIds
+      .filter(item => !builtinToolIds.has(item) && item !== 'sk_mcp_time' && item !== 'sk_mcp_readfile')
+      .map(item => workflowSkills.find(skill => skill.key === item || skill.id === item || skill.name === item)?.key || item);
+  const toolIds = [...new Set([...stringIds(raw.toolIds), ...legacySkillIds.filter(item => builtinToolIds.has(item))])];
+  const mcpServerIds = [...new Set([
+    ...stringIds(raw.mcpServerIds),
+    ...(legacySkillIds.some(item => item === 'sk_mcp_time' || item === 'sk_mcp_readfile') ? ['multichat-demo'] : []),
+  ])];
+  return {
+    id,
+    name,
+    description: String(raw.description || '').slice(0, 1000),
+    systemPrompt,
+    skillIds: legacySkillIds.filter(item => !builtinToolIds.has(item) && item !== 'sk_mcp_time' && item !== 'sk_mcp_readfile'),
+    skillRefs,
+    toolIds,
+    mcpServerIds,
+    createdAt: raw.createdAt || new Date().toISOString(),
+    _import: 'agent-json',
+  };
+}
+
+module.exports = function registerImport(app) {
+  app.post('/api/import', async (req, res) => {
+    const body = req.body || {};
+    if (body.url || body.format === 'zip' || body.skills || body.type || body.mcp) {
+      return fail(res, 400, 'INVALID_PACKAGE', 'Skill 请导入标准 SKILL.md 目录，Plugin 请使用 .codex-plugin/plugin.json，MCP 请使用独立 MCP server 配置');
+    }
+    let value = body;
+    if (typeof body.payload === 'string') {
+      if (body.payload.length > 2_000_000) return fail(res, 413, 'IMPORT_FAILED', '导入文件超过 2 MB');
+      try { value = JSON.parse(body.payload); }
+      catch { return fail(res, 400, 'INVALID_PACKAGE', 'payload 不是合法 JSON'); }
+    }
+    const incoming = Array.isArray(value) ? value : (Array.isArray(value.agents) ? value.agents : [value.agent || value]);
+    let normalized;
+    try { normalized = incoming.map(normalizeAgent); }
+    catch (error) { return fail(res, 400, 'INVALID_PACKAGE', error.message); }
+    await ctx.store.mutate(ctx.AGENT_FILE, agents => {
+      for (const item of normalized) {
+        const index = agents.findIndex(agent => agent.id === item.id);
+        if (index >= 0) agents[index] = item;
+        else agents.push(item);
+      }
+      return agents;
+    }, []);
+    res.json({ ok: true, agents: normalized.length, skills: 0 });
+  });
+};

package/backend/routes/mcp-servers.ts

@@ -0,0 +1,36 @@
+'use strict';
+
+// MCP servers are managed independently from skills and plugins. Tool schemas
+// are discovered from the live server via tools/list.
+const extensions = require('../extensions/manager');
+
+module.exports = function registerMcpServers(app) {
+  app.get('/api/mcp-servers', (req, res, next) => {
+    try { res.json(extensions.listMcpServers()); } catch (error) { next(error); }
+  });
+
+  app.post('/api/mcp-servers', (req, res, next) => {
+    try { res.status(201).json(extensions.createMcpServer(req.body || {})); }
+    catch (error) { next(error); }
+  });
+
+  app.put('/api/mcp-servers/:id', (req, res, next) => {
+    try { res.json(extensions.updateMcpServer(req.params.id, req.body || {})); }
+    catch (error) { next(error); }
+  });
+
+  app.delete('/api/mcp-servers/:id', (req, res, next) => {
+    try { res.json(extensions.deleteMcpServer(req.params.id)); }
+    catch (error) { next(error); }
+  });
+
+  app.post('/api/mcp-servers/:id/discover', async (req, res, next) => {
+    try { res.json(await extensions.discoverMcpTools(req.params.id, true)); }
+    catch (error) { next(error); }
+  });
+
+  app.post('/api/mcp-servers/sync/codex', (req, res, next) => {
+    try { res.json(extensions.syncCodexMcpConfig()); }
+    catch (error) { next(error); }
+  });
+};

package/backend/routes/meta.ts

@@ -0,0 +1,38 @@
+'use strict';
+// ── Meta：runtime / catalog / health（信息聚合端点） ─────────────────────
+const ctx = require('../lib/context');
+const extensions = require('../extensions/manager');
+const { assetMeta } = require('../lib/util');
+
+module.exports = function registerMeta(app) {
+  app.get('/api/runtime', (req, res) => {
+    const providers = ctx.providerStore.list();
+    const skills = extensions.listSkills();
+    const agents = ctx.store.read(ctx.AGENT_FILE, []);
+    const plugins = extensions.listPlugins();
+    const mcpServers = extensions.listMcpServers();
+    res.json({
+      name: 'MultiChat Agent Workspace',
+      version: ctx.VERSION,
+      node: process.version,
+      mode: process.env.NODE_ENV || 'development',
+      capabilities: ['chat', 'streaming', 'agents', 'agent-skills', 'plugins', 'mcp-discovery', 'codex-sync', 'git-diff', 'run-history', 'usage-ledger', 'context-lens', 'capability-passports', 'project-memory', 'project-snapshots'],
+      counts: { providers: providers.length, models: providers.reduce((n, p) => n + (p.models || []).length, 0), skills: skills.length, agents: agents.length, plugins: plugins.length, mcpServers: mcpServers.length, runs: ctx.store.read(ctx.RUN_FILE, []).length, workspaces: ctx.workspaceStore.workspaces().length, projects: ctx.workspaceStore.projects().length, assets: ctx.workspaceStore.assets().length },
+      adapters: Object.keys(ctx.ADAPTER_MAP),
+    });
+  });
+
+  app.get('/api/catalog', (req, res) => {
+    const providers = ctx.providerStore.list();
+    const skills = extensions.listSkills();
+    const tools = ctx.store.read(ctx.SKILL_FILE, []).filter(item => !['prompt', 'mcp'].includes(item.type));
+    const agents = ctx.store.read(ctx.AGENT_FILE, []);
+    const plugins = extensions.listPlugins();
+    const mcpServers = extensions.listMcpServers();
+    res.json({ providers: providers.map(ctx.providerStore.publicRecord), skills, tools, agents, plugins, mcpServers, workspaces: ctx.workspaceStore.workspaces(), projects: ctx.workspaceStore.projects(), assets: ctx.workspaceStore.assets().map(assetMeta) });
+  });
+
+  app.get('/api/health', (req, res) => {
+    res.json({ status: 'ok', version: ctx.VERSION, uptime: process.uptime(), storage: ctx.store.kind || 'json', storageFallback: ctx.STORAGE_FALLBACK, skills: extensions.listSkills().length, mcpServers: extensions.listMcpServers().length, agents: ctx.store.read(ctx.AGENT_FILE, []).length });
+  });
+};

package/backend/routes/mock.ts

@@ -0,0 +1,25 @@
+'use strict';
+
+// A deterministic, fully local OpenAI-compatible endpoint used by the
+// built-in “Mock (本地体验)” provider. It never calls the network and makes the
+// first-run/chat/usage UI testable without an API key.
+module.exports = function registerMock(app) {
+  app.post('/api/mock/v1/chat/completions', (req, res) => {
+    const body = req.body || {};
+    const messages = Array.isArray(body.messages) ? body.messages : [];
+    const last = [...messages].reverse().find(item => item.role === 'user');
+    const input = typeof last?.content === 'string' ? last.content : JSON.stringify(last?.content || '');
+    const output = input ? `本地回声：${input}` : 'MultiChat 本地体验已就绪。';
+    const promptTokens = Math.max(1, Math.ceil(JSON.stringify(messages).length / 4));
+    const completionTokens = Math.max(1, Math.ceil(output.length / 4));
+    const usage = { prompt_tokens: promptTokens, completion_tokens: completionTokens, total_tokens: promptTokens + completionTokens };
+    if (body.stream !== true) return res.json({ id: `mock-${Date.now()}`, model: body.model || 'echo', choices: [{ index: 0, message: { role: 'assistant', content: output }, finish_reason: 'stop' }], usage });
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache');
+    const chunks = output.match(/.{1,8}/gu) || [output];
+    for (const content of chunks) res.write(`data: ${JSON.stringify({ id: `mock-${Date.now()}`, model: body.model || 'echo', choices: [{ index: 0, delta: { content }, finish_reason: null }] })}\n\n`);
+    res.write(`data: ${JSON.stringify({ model: body.model || 'echo', choices: [{ index: 0, delta: {}, finish_reason: 'stop' }], usage })}\n\n`);
+    res.write('data: [DONE]\n\n');
+    res.end();
+  });
+};

package/backend/routes/plugins.ts

@@ -0,0 +1,27 @@
+'use strict';
+
+// Plugins are packages discovered through repo/managed marketplace.json files.
+// Their components are referenced in place; they are never flattened into
+// skills.json or agents.json.
+const extensions = require('../extensions/manager');
+
+module.exports = function registerPlugins(app) {
+  app.get('/api/plugins', (req, res, next) => {
+    try { res.json(extensions.listPlugins()); } catch (error) { next(error); }
+  });
+
+  app.get('/api/plugins/:id/diff', (req, res, next) => {
+    try { res.json(extensions.pluginDiff(req.params.id)); }
+    catch (error) { next(error); }
+  });
+
+  app.post('/api/plugins/:id/toggle', (req, res, next) => {
+    try { res.json(extensions.setPluginEnabled(req.params.id, req.body?.enabled !== false)); }
+    catch (error) { next(error); }
+  });
+
+  app.delete('/api/plugins/:id', (req, res, next) => {
+    try { res.json(extensions.deleteImportedPlugin(req.params.id)); }
+    catch (error) { next(error); }
+  });
+};

package/backend/routes/providers.ts

@@ -0,0 +1,166 @@
+'use strict';
+// ── Provider / Models 路由 ──────────────────────────────────────────────
+// GET 接口返回脱敏后的 provider（apiKey 不出现在响应体中）。
+const ctx = require('../lib/context');
+const { readResponseJson, readResponseText } = require('../lib/util');
+const { redactSecrets } = require('../lib/redact');
+import type { JsonRecord } from '../types';
+
+function normalizeProvider(input: JsonRecord, previous: JsonRecord | null = null) {
+  const id = previous?.id || ctx.safeId(input.id || Date.now().toString(36), 'provider id');
+  const apiType = String(input.apiType ?? previous?.apiType ?? 'openai').trim().toLowerCase();
+  if (!ctx.ADAPTER_MAP[apiType]) throw new Error('unsupported provider apiType');
+  const baseUrl = String(input.baseUrl ?? previous?.baseUrl ?? '').trim().replace(/\/+$/, '');
+  if (!baseUrl || baseUrl.length > 2048) throw new Error('baseUrl is required');
+  let parsed: URL;
+  try { parsed = new URL(baseUrl); } catch { throw new Error('baseUrl must be a valid URL'); }
+  if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password) {
+    throw new Error('baseUrl must be an http(s) URL without embedded credentials');
+  }
+  if ([...parsed.searchParams.keys()].some(key => /(?:api[-_]?key|access[-_]?token|token|secret|password|authorization|credential)/i.test(key))) {
+    throw new Error('baseUrl must not contain credential query parameters');
+  }
+  const modelInput = input.models ?? previous?.models;
+  const models: string[] = Array.isArray(modelInput)
+    ? [...new Set(modelInput.map(value => String(value).trim()).filter(Boolean))].slice(0, 200)
+    : [];
+  if (models.some(model => model.length > 200)) throw new Error('model name is too long');
+  return {
+    id,
+    name: String(input.name ?? previous?.name ?? id).trim().slice(0, 120) || id,
+    apiType,
+    baseUrl,
+    apiKey: input.apiKey !== undefined ? String(input.apiKey || '') : String(previous?.apiKey || ''),
+    models,
+    allowPrivate: input.allowPrivate !== undefined
+      ? input.allowPrivate === true
+      : (previous?.allowPrivate === true || ['ollama', 'lmstudio'].includes(apiType)),
+    updatedAt: new Date().toISOString(),
+    createdAt: previous?.createdAt || new Date().toISOString(),
+  };
+}
+
+module.exports = function registerProviders(app) {
+  app.get('/api/providers', (req, res) => {
+    res.json(ctx.providerStore.publicList());
+  });
+  app.post('/api/providers', (req, res) => {
+    let provider;
+    try { provider = normalizeProvider(req.body || {}); }
+    catch (error) { return res.status(400).json({ error: error.message }); }
+    const providers = ctx.providerStore.list();
+    if (providers.some(item => item.id === provider.id)) return res.status(409).json({ error: 'provider id already exists' });
+    providers.push(provider);
+    ctx.providerStore.save(providers);
+    res.json(ctx.providerStore.publicRecord(provider));
+  });
+  app.put('/api/providers/:id', (req, res) => {
+    const providers = ctx.providerStore.list();
+    const idx = providers.findIndex(p => p.id === req.params.id);
+    if (idx < 0) return res.status(404).json({ error: 'not found' });
+    const body = req.body || {};
+    const prev = providers[idx];
+    // 未提供新密钥（或回传 masked 占位）时保留原 apiKey，避免被掩码覆盖
+    let apiKey = prev.apiKey;
+    if (body.apiKey && !body.apiKeyMasked && body.apiKey !== '••••••••') apiKey = body.apiKey;
+    let updated;
+    try { updated = normalizeProvider({ ...body, apiKey }, prev); }
+    catch (error) { return res.status(400).json({ error: error.message }); }
+    providers[idx] = updated;
+    ctx.providerStore.save(providers);
+    res.json(ctx.providerStore.publicRecord(updated));
+  });
+  app.delete('/api/providers/:id', (req, res) => {
+    let providers = ctx.providerStore.list();
+    providers = providers.filter(p => p.id !== req.params.id);
+    ctx.providerStore.save(providers);
+    res.json({ ok: true });
+  });
+
+  // ── Models: list all models grouped by provider ──
+  app.get('/api/models', (req, res) => {
+    const providers = ctx.providerStore.list();
+    const models = [];
+    for (const p of providers) {
+      (p.models || []).forEach(m => {
+        models.push({ id: `${p.id}:${m}`, name: m, providerId: p.id, providerName: p.name });
+      });
+    }
+    res.json(models);
+  });
+
+  // ── 连接测试：用服务端保存的密钥探测 OpenAI 兼容的 GET /models，返回可达性与模型清单 ──
+  app.post('/api/providers/:id/probe', async (req, res) => {
+    const providers = ctx.providerStore.list();
+    const provider = providers.find(p => p.id === req.params.id);
+    if (!provider) return res.status(404).json({ error: 'provider not found', code: 'NOT_FOUND' });
+    const baseUrl = String(provider.baseUrl || '').replace(/\/+$/, '');
+    let parsed: URL;
+    try { parsed = new URL(baseUrl); } catch { return res.status(400).json({ error: 'provider baseUrl 无效' }); }
+    const modelsUrl = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}/models`;
+    const headers: Record<string, string> = { accept: 'application/json' };
+    if (provider.apiKey) headers.authorization = `Bearer ${provider.apiKey}`;
+    try {
+      const resp = await ctx.safeFetch(modelsUrl, { headers, signal: AbortSignal.timeout(8000) }, provider.allowPrivate === true);
+      if (!resp.ok) {
+        const detail = await readResponseText(resp).catch(() => '');
+        const brief = redactSecrets(String(detail || '').slice(0, 200));
+        return res.status(resp.status).json({ ok: false, error: `HTTP ${resp.status}${brief ? `：${brief}` : ''}` });
+      }
+      const data = await readResponseJson(resp, 2_000_000) as JsonRecord;
+      const raw = Array.isArray(data.data) ? data.data : Array.isArray(data.models) ? data.models : [];
+      const models = raw.map((m: JsonRecord) => String(m?.id || m?.name || '')).filter(Boolean);
+      const capabilities = {
+        vision: models.some(m => /(?:vision|vl|omni|multimodal|4o|gpt-4-turbo|gemini|claude-[35])/i.test(m)),
+        reasoning: models.some(m => /(?:reason|think|o[1345]-|r1|qwq)/i.test(m)),
+      };
+      res.json({ ok: true, models, capabilities, modelCount: models.length });
+    } catch (error) {
+      const raw = error instanceof Error ? error.message : String(error);
+      const causeCode = (error as { cause?: { code?: string } })?.cause?.code || '';
+      const timedOut = /timeout|abort/i.test(raw);
+      const friendly = timedOut ? '连接超时（8s）——请确认 baseUrl 可达'
+        : /fetch failed/i.test(raw) ? `无法连接到 ${parsed.host}${causeCode ? `（${causeCode}）` : ''}`
+        : redactSecrets(raw);
+      res.status(502).json({ ok: false, error: friendly });
+    }
+  });
+
+  // ── Local model discovery (Ollama / LM Studio) ──
+  app.post('/api/fetch-local-models', async (req, res) => {
+    const { apiType, baseUrl } = req.body || {};
+    if (!apiType || !baseUrl) {
+      return res.status(400).json({ error: 'apiType and baseUrl are required' });
+    }
+    try {
+      let parsed: URL;
+      try { parsed = new URL(baseUrl); } catch { return res.status(400).json({ error: 'baseUrl must be a valid URL' }); }
+      const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+      if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !['localhost', '127.0.0.1', '::1'].includes(hostname)) {
+        return res.status(400).json({ error: 'local model discovery only accepts loopback addresses' });
+      }
+      if (!['ollama', 'lmstudio'].includes(String(apiType).toLowerCase())) {
+        return res.status(400).json({ error: `Unsupported apiType for local discovery: ${apiType}` });
+      }
+      if (apiType === 'ollama') {
+        const url = new URL('/api/tags', parsed.origin).toString();
+        const resp = await ctx.safeFetch(url, { signal: AbortSignal.timeout(5000) }, true);
+        if (!resp.ok) return res.status(resp.status).json({ error: `Ollama returned HTTP ${resp.status}` });
+        const data = await readResponseJson(resp, 2_000_000) as JsonRecord;
+        const models = (data.models || []).map(m => m.name || m.model).filter(Boolean);
+        return res.json({ models });
+      }
+      if (apiType === 'lmstudio') {
+        const base = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`;
+        const url = `${base}${/\/v1$/i.test(base) ? '' : '/v1'}/models`;
+        const resp = await ctx.safeFetch(url, { signal: AbortSignal.timeout(5000) }, true);
+        if (!resp.ok) return res.status(resp.status).json({ error: `LM Studio returned HTTP ${resp.status}` });
+        const data = await readResponseJson(resp, 2_000_000) as JsonRecord;
+        const models = (data.data || []).map(m => m.id).filter(Boolean);
+        return res.json({ models });
+      }
+    } catch (e) {
+      res.status(502).json({ error: `Cannot connect to the local model service: ${redactSecrets(e.message)}` });
+    }
+  });
+};