@lobehub/chat 1.129.2 → 1.129.4

package/.cursor/rules/project-introduce.mdc

@@ -18,13 +18,13 @@ The project uses the following technologies:
 - Next.js 15 for frontend and backend, using app router instead of pages router
 - react 19, using hooks, functional components, react server components
 - TypeScript programming language
-- antd, @lobehub/ui for component framework
+- antd, `@lobehub/ui` for component framework
 - antd-style for css-in-js framework
 - react-layout-kit for flex layout
 - react-i18next for i18n
-- lucide-react, @ant-design/icons for icons
-- @lobehub/icons for AI provider/model logo icon
-- @formkit/auto-animate for react list animation
+- lucide-react, `@ant-design/icons` for icons
+- `@lobehub/icons` for AI provider/model logo icon
+- `@formkit/auto-animate` for react list animation
 - zustand for global state management
 - nuqs for type-safe search params state manager
 - SWR for react data fetch

package/.cursor/rules/react-component.mdc

@@ -86,9 +86,9 @@ const Card: FC<CardProps> = ({ title, content }) => {
 
 ## Lobe UI 包含的组件
 
-- 不知道 @lobehub/ui 的组件怎么用，有哪些属性，就自己搜下这个项目其它地方怎么用的，不要瞎猜，大部分组件都是在 antd 的基础上扩展了属性
+- 不知道 `@lobehub/ui` 的组件怎么用，有哪些属性，就自己搜下这个项目其它地方怎么用的，不要瞎猜，大部分组件都是在 antd 的基础上扩展了属性
 - 具体用法不懂可以联网搜索，例如 ActionIcon 就爬取 https://ui.lobehub.com/components/action-icon
-- 可以阅读 node_modules/@lobehub/ui/es/index.js 了解有哪些组件，每个组件的属性是什么
+- 可以阅读 `node_modules/@lobehub/ui/es/index.js` 了解有哪些组件，每个组件的属性是什么
 
 - General
   - ActionIcon

package/.cursor/rules/typescript.mdc

@@ -8,11 +8,63 @@ alwaysApply: false
 
 ## Types and Type Safety
 
-- Avoid explicit type annotations when TypeScript can infer types.
-- Avoid implicitly `any` variables; explicitly type when necessary (e.g., `let a: number` instead of `let a`).
-- Use the most accurate type possible (e.g., prefer `Record<PropertyKey, unknown>` over `object`).
-- Prefer `interface` over `type` for object shapes (e.g., React component props). Keep `type` for unions, intersections, and utility types.
-- Prefer `as const satisfies XyzInterface` over plain `as const` when suitable.
+- avoid explicit type annotations when TypeScript can infer types.
+- avoid implicitly `any` variables; explicitly type when necessary (e.g., `let a: number` instead of `let a`).
+- use the most accurate type possible (e.g., prefer `Record<PropertyKey, unknown>` over `object`).
+- prefer `interface` over `type` for object shapes (e.g., React component props). Keep `type` for unions, intersections, and utility types.
+- prefer `as const satisfies XyzInterface` over plain `as const` when suitable.
+- prefer `@ts-expect-error` over `@ts-ignore`
+- prefer `Record<string, any>` over `any`
+
+- **Avoid unnecessary null checks**: Before adding `xxx !== null`, `?.`, `??`, or `!.`, read the type definition to confirm the necessary. **Example:**
+
+  ```typescript
+  // ❌ Wrong: budget.spend and budget.maxBudget is number, not number | null
+  if (budget.spend !== null && budget.maxBudget !== null && budget.spend >= budget.maxBudget) {
+    // ...
+  }
+
+  // ✅ Right
+  if (budget.spend >= budget.maxBudget) {
+    // ...
+  }
+  ```
+
+- **Avoid redundant runtime checks**: Don't add runtime validation for conditions already guaranteed by types or previous checks. Trust the type system and calling contract. **Example:**
+
+  ```typescript
+  // ❌ Wrong: Adding impossible-to-fail checks
+  const due = await db.query.budgets.findMany({
+    where: and(isNotNull(budgets.budgetDuration)), // Already filtered non-null
+  });
+  const result = due.map(b => {
+    const nextReset = computeNextResetAt(b.budgetResetAt!, b.budgetDuration!);
+    if (!nextReset) { // This check is impossible to fail
+      throw new Error(`Unexpected null nextResetAt`);
+    }
+    return nextReset;
+  });
+
+  // ✅ Right: Trust the contract
+  const due = await db.query.budgets.findMany({
+    where: and(isNotNull(budgets.budgetDuration)),
+  });
+  const result = due.map(b => computeNextResetAt(b.budgetResetAt!, b.budgetDuration!));
+  ```
+
+- **Avoid meaningless null/undefined parameters**: Don't accept null/undefined for parameters that have no business meaning when null. Design strict function contracts. **Example:**
+
+  ```typescript
+  // ❌ Wrong: Function accepts meaningless null input
+  function computeNextResetAt(currentResetAt: Date, durationStr: string | null): Date | null {
+    if (!durationStr) return null; // Why accept null if it just returns null?
+  }
+
+  // ✅ Right: Strict contract, clear responsibility
+  function computeNextResetAt(currentResetAt: Date, durationStr: string): Date {
+    // Function has single clear purpose, caller ensures valid input
+  }
+  ```
 
 ## Imports and Modules
 

package/.vscode/settings.json

@@ -88,6 +88,8 @@
     "**/src/server/routers/async/*.ts": "${filename} • async",
     "**/src/server/routers/edge/*.ts": "${filename} • edge",
 
-    "**/src/locales/default/*.ts": "${filename} • locale"
+    "**/src/locales/default/*.ts": "${filename} • locale",
+
+    "**/index.*": "${dirname}/${filename}.${extname}"
   }
 }

package/AGENTS.md

@@ -12,7 +12,7 @@ Built with modern technologies:
 - **Database**: PostgreSQL, PGLite, Drizzle ORM
 - **Testing**: Vitest, Testing Library
 - **Package Manager**: pnpm (monorepo structure)
-- **Build Tools**: Next.js (Turbopack in dev, Webpack in prod), Vitest
+- **Build Tools**: Next.js (Turbopack in dev, Webpack in prod)
 
 ## Directory Structure
 
@@ -28,7 +28,7 @@ The project follows a well-organized monorepo structure:
 
 ### Git Workflow
 
-- Use rebase for git pull: `git pull --rebase`
+- Use rebase for git pull
 - Git commit messages should prefix with gitmoji
 - Git branch name format: `username/feat/feature-name`
 - Use `.github/PULL_REQUEST_TEMPLATE.md` for PR descriptions
@@ -52,9 +52,6 @@ The project follows a well-organized monorepo structure:
 #### React Components
 
 - Use functional components with hooks
-- Follow the component structure guidelines
-- Use antd-style & @lobehub/ui for styling
-- Implement proper error boundaries
 
 #### Database Schema
 

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 # Changelog
 
+### [Version 1.129.4](https://github.com/lobehub/lobe-chat/compare/v1.129.3...v1.129.4)
+
+<sup>Released on **2025-09-18**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Fix svg xss issue.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Fix svg xss issue, closes [#9313](https://github.com/lobehub/lobe-chat/issues/9313) ([9f044ed](https://github.com/lobehub/lobe-chat/commit/9f044ed))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
+### [Version 1.129.3](https://github.com/lobehub/lobe-chat/compare/v1.129.2...v1.129.3)
+
+<sup>Released on **2025-09-17**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Add qwen provider support for image-edit model.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Add qwen provider support for image-edit model, closes [#9277](https://github.com/lobehub/lobe-chat/issues/9277) [#9184](https://github.com/lobehub/lobe-chat/issues/9184) ([e137b33](https://github.com/lobehub/lobe-chat/commit/e137b33))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
 ### [Version 1.129.2](https://github.com/lobehub/lobe-chat/compare/v1.129.1...v1.129.2)
 
 <sup>Released on **2025-09-17**</sup>

package/changelog/v1.json

@@ -1,4 +1,22 @@
 [
+  {
+    "children": {
+      "fixes": [
+        "Fix svg xss issue."
+      ]
+    },
+    "date": "2025-09-18",
+    "version": "1.129.4"
+  },
+  {
+    "children": {
+      "fixes": [
+        "Add qwen provider support for image-edit model."
+      ]
+    },
+    "date": "2025-09-17",
+    "version": "1.129.3"
+  },
   {
     "children": {
       "fixes": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/chat",
-  "version": "1.129.2",
+  "version": "1.129.4",
   "description": "Lobe Chat - an open-source, high-performance chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",
@@ -75,7 +75,7 @@
     "stylelint": "stylelint \"src/**/*.{js,jsx,ts,tsx}\" --fix",
     "test": "npm run test-app && npm run test-server",
     "test-app": "vitest run",
-    "test-app:coverage": "vitest run --coverage",
+    "test-app:coverage": "vitest --coverage --silent='passed-only'",
     "test:update": "vitest -u",
     "type-check": "tsgo --noEmit",
     "webhook:ngrok": "ngrok http http://localhost:3011",

package/packages/agent-runtime/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "simple": "tsx examples/tools-calling.ts",
     "test": "vitest",
-    "test:coverage": "vitest --coverage"
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {},
   "devDependencies": {

package/packages/context-engine/package.json

@@ -14,7 +14,7 @@
   "main": "src/index.ts",
   "scripts": {
     "test": "vitest",
-    "test:coverage": "vitest --coverage",
+    "test:coverage": "vitest --coverage --silent='passed-only'",
     "test:update": "vitest -u"
   },
   "dependencies": {

package/packages/database/package.json

@@ -9,7 +9,7 @@
   "scripts": {
     "test": "npm run test:client-db && npm run test:server-db",
     "test:client-db": "vitest run",
-    "test:coverage": "vitest --coverage --config vitest.config.server.mts",
+    "test:coverage": "vitest --coverage --silent='passed-only' --config vitest.config.server.mts",
     "test:server-db": "vitest run --config vitest.config.server.mts"
   },
   "dependencies": {

package/packages/electron-server-ipc/package.json

@@ -6,7 +6,7 @@
   "types": "src/index.ts",
   "scripts": {
     "test": "vitest",
-    "test:coverage": "vitest --coverage"
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {
     "debug": "^4.3.4"

package/packages/file-loaders/package.json

@@ -22,7 +22,7 @@
   "main": "./src/index.ts",
   "scripts": {
     "test": "vitest",
-    "test:coverage": "vitest --coverage"
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {
     "@langchain/community": "^0.3.41",

package/packages/model-bank/package.json

@@ -71,9 +71,9 @@
   },
   "scripts": {
     "test": "vitest",
-    "test:coverage": "vitest --coverage"
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {
     "zod": "^3.25.76"
   }
-}
+}

package/packages/model-runtime/package.json

@@ -9,7 +9,7 @@
   },
   "scripts": {
     "test": "vitest",
-    "test:coverage": "vitest --coverage",
+    "test:coverage": "vitest --coverage --silent='passed-only'",
     "test:update": "vitest -u"
   },
   "dependencies": {

package/packages/model-runtime/src/core/RouterRuntime/baseRuntimeMap.ts

@@ -4,6 +4,7 @@ import { LobeCloudflareAI } from '../../providers/cloudflare';
 import { LobeFalAI } from '../../providers/fal';
 import { LobeGoogleAI } from '../../providers/google';
 import { LobeOpenAI } from '../../providers/openai';
+import { LobeQwenAI } from '../../providers/qwen';
 import { LobeXAI } from '../../providers/xai';
 
 export const baseRuntimeMap = {
@@ -13,5 +14,6 @@ export const baseRuntimeMap = {
   fal: LobeFalAI,
   google: LobeGoogleAI,
   openai: LobeOpenAI,
+  qwen: LobeQwenAI,
   xai: LobeXAI,
 };

package/packages/model-runtime/src/core/RouterRuntime/createRuntime.test.ts

@@ -9,14 +9,15 @@ describe('createRouterRuntime', () => {
   });
 
   describe('initialization', () => {
-    it('should throw error when routers array is empty', () => {
-      expect(() => {
-        const Runtime = createRouterRuntime({
-          id: 'test-runtime',
-          routers: [],
-        });
-        new Runtime();
-      }).toThrow('empty providers');
+    it('should throw error when routers array is empty', async () => {
+      const Runtime = createRouterRuntime({
+        id: 'test-runtime',
+        routers: [],
+      });
+      const runtime = new Runtime();
+
+      // 现在错误在使用时才抛出，因为是延迟创建
+      await expect(runtime.getRuntimeByModel('test-model')).rejects.toThrow('empty providers');
     });
 
     it('should create UniformRuntime class with valid routers', () => {
@@ -44,7 +45,7 @@ describe('createRouterRuntime', () => {
       expect(runtime).toBeDefined();
     });
 
-    it('should merge router options with constructor options', () => {
+    it('should merge router options with constructor options', async () => {
       const mockConstructor = vi.fn();
 
       class MockRuntime implements LobeRuntimeAI {
@@ -52,6 +53,10 @@ describe('createRouterRuntime', () => {
           mockConstructor(options);
         }
         chat = vi.fn();
+        textToImage = vi.fn();
+        models = vi.fn();
+        embeddings = vi.fn();
+        textToSpeech = vi.fn();
       }
 
       const Runtime = createRouterRuntime({
@@ -61,11 +66,15 @@ describe('createRouterRuntime', () => {
             apiType: 'openai',
             options: { baseURL: 'https://api.example.com' },
             runtime: MockRuntime as any,
+            models: ['test-model'],
           },
         ],
       });
 
-      new Runtime({ apiKey: 'constructor-key' });
+      const runtime = new Runtime({ apiKey: 'constructor-key' });
+
+      // 触发 runtime 创建
+      await runtime.getRuntimeByModel('test-model');
 
       expect(mockConstructor).toHaveBeenCalledWith(
         expect.objectContaining({
@@ -77,10 +86,14 @@ describe('createRouterRuntime', () => {
     });
   });
 
-  describe('getModels', () => {
-    it('should return synchronous models array directly', async () => {
+  describe('model matching', () => {
+    it('should return correct runtime for matching model', async () => {
       const mockRuntime = {
         chat: vi.fn(),
+        textToImage: vi.fn(),
+        models: vi.fn(),
+        embeddings: vi.fn(),
+        textToSpeech: vi.fn(),
       } as unknown as LobeRuntimeAI;
 
       const Runtime = createRouterRuntime({
@@ -96,50 +109,54 @@ describe('createRouterRuntime', () => {
       });
 
       const runtime = new Runtime();
-      const models = await runtime['getRouterMatchModels']({
-        id: 'test',
-        models: ['model-1', 'model-2'],
-        runtime: mockRuntime,
-      });
+      const selectedRuntime = await runtime.getRuntimeByModel('model-1');
 
-      expect(models).toEqual(['model-1', 'model-2']);
+      expect(selectedRuntime).toBeDefined();
     });
 
-    it('should call asynchronous models function', async () => {
+    it('should support dynamic routers with asynchronous model fetching', async () => {
       const mockRuntime = {
         chat: vi.fn(),
+        textToImage: vi.fn(),
+        models: vi.fn(),
+        embeddings: vi.fn(),
+        textToSpeech: vi.fn(),
       } as unknown as LobeRuntimeAI;
 
       const mockModelsFunction = vi.fn().mockResolvedValue(['async-model-1', 'async-model-2']);
 
       const Runtime = createRouterRuntime({
         id: 'test-runtime',
-        routers: [
-          {
-            apiType: 'openai',
-            options: {},
-            runtime: mockRuntime.constructor as any,
-            models: mockModelsFunction,
-          },
-        ],
+        routers: async () => {
+          // 异步获取模型列表
+          const models = await mockModelsFunction();
+          return [
+            {
+              apiType: 'openai',
+              options: {},
+              runtime: mockRuntime.constructor as any,
+              models, // 静态数组
+            },
+          ];
+        },
       });
 
       const runtime = new Runtime();
-      const runtimeItem = {
-        id: 'test',
-        models: mockModelsFunction,
-        runtime: mockRuntime,
-      };
 
-      // Call the function
-      const models = await runtime['getRouterMatchModels'](runtimeItem);
-      expect(models).toEqual(['async-model-1', 'async-model-2']);
-      expect(mockModelsFunction).toHaveBeenCalledTimes(1);
+      // 触发 routers 函数调用
+      const selectedRuntime = await runtime.getRuntimeByModel('async-model-1');
+
+      expect(selectedRuntime).toBeDefined();
+      expect(mockModelsFunction).toHaveBeenCalled();
     });
 
-    it('should return empty array when models is undefined', async () => {
+    it('should return fallback runtime when model not found', async () => {
       const mockRuntime = {
         chat: vi.fn(),
+        textToImage: vi.fn(),
+        models: vi.fn(),
+        embeddings: vi.fn(),
+        textToSpeech: vi.fn(),
       } as unknown as LobeRuntimeAI;
 
       const Runtime = createRouterRuntime({
@@ -149,17 +166,15 @@ describe('createRouterRuntime', () => {
             apiType: 'openai',
             options: {},
             runtime: mockRuntime.constructor as any,
+            models: ['known-model'],
           },
         ],
       });
 
       const runtime = new Runtime();
-      const models = await runtime['getRouterMatchModels']({
-        id: 'test',
-        runtime: mockRuntime,
-      });
+      const selectedRuntime = await runtime.getRuntimeByModel('unknown-model');
 
-      expect(models).toEqual([]);
+      expect(selectedRuntime).toBeDefined();
     });
   });
 
@@ -194,10 +209,10 @@ describe('createRouterRuntime', () => {
       const runtime = new Runtime();
 
       const result1 = await runtime.getRuntimeByModel('gpt-4');
-      expect(result1).toBe(runtime['_runtimes'][0].runtime);
+      expect(result1).toBeInstanceOf(MockRuntime1);
 
       const result2 = await runtime.getRuntimeByModel('claude-3');
-      expect(result2).toBe(runtime['_runtimes'][1].runtime);
+      expect(result2).toBeInstanceOf(MockRuntime2);
     });
 
     it('should return last runtime when no model matches', async () => {
@@ -230,7 +245,7 @@ describe('createRouterRuntime', () => {
       const runtime = new Runtime();
       const result = await runtime.getRuntimeByModel('unknown-model');
 
-      expect(result).toBe(runtime['_runtimes'][1].runtime);
+      expect(result).toBeInstanceOf(MockRuntime2);
     });
   });
 
@@ -277,6 +292,9 @@ describe('createRouterRuntime', () => {
 
       const Runtime = createRouterRuntime({
         id: 'test-runtime',
+        chatCompletion: {
+          handleError,
+        },
         routers: [
           {
             apiType: 'openai',
@@ -287,11 +305,7 @@ describe('createRouterRuntime', () => {
         ],
       });
 
-      const runtime = new Runtime({
-        chat: {
-          handleError,
-        },
-      });
+      const runtime = new Runtime();
 
       await expect(
         runtime.chat({ model: 'gpt-4', messages: [], temperature: 0.7 }),
@@ -452,7 +466,7 @@ describe('createRouterRuntime', () => {
   });
 
   describe('dynamic routers configuration', () => {
-    it('should support function-based routers configuration', () => {
+    it('should support function-based routers configuration', async () => {
       class MockRuntime implements LobeRuntimeAI {
         chat = vi.fn();
         textToImage = vi.fn();
@@ -461,7 +475,7 @@ describe('createRouterRuntime', () => {
         textToSpeech = vi.fn();
       }
 
-      const dynamicRoutersFunction = (options: any) => [
+      const dynamicRoutersFunction = vi.fn((options: any) => [
         {
           apiType: 'openai' as const,
           options: {
@@ -478,7 +492,7 @@ describe('createRouterRuntime', () => {
           runtime: MockRuntime as any,
           models: ['claude-3'],
         },
-      ];
+      ]);
 
       const Runtime = createRouterRuntime({
         id: 'test-runtime',
@@ -493,21 +507,32 @@ describe('createRouterRuntime', () => {
       const runtime = new Runtime(userOptions);
 
       expect(runtime).toBeDefined();
-      expect(runtime['_runtimes']).toHaveLength(2);
-      expect(runtime['_runtimes'][0].id).toBe('openai');
-      expect(runtime['_runtimes'][1].id).toBe('anthropic');
+
+      // 测试动态 routers 是否能正确工作
+      const result = await runtime.getRuntimeByModel('gpt-4');
+      expect(result).toBeDefined();
+
+      // 验证动态函数被调用时传入了正确的参数
+      expect(dynamicRoutersFunction).toHaveBeenCalledWith(
+        expect.objectContaining({
+          apiKey: 'test-key',
+          baseURL: 'https://yourapi.cn',
+        }),
+        { model: 'gpt-4' },
+      );
     });
 
-    it('should throw error when dynamic routers function returns empty array', () => {
+    it('should throw error when dynamic routers function returns empty array', async () => {
       const emptyRoutersFunction = () => [];
 
-      expect(() => {
-        const Runtime = createRouterRuntime({
-          id: 'test-runtime',
-          routers: emptyRoutersFunction,
-        });
-        new Runtime();
-      }).toThrow('empty providers');
+      const Runtime = createRouterRuntime({
+        id: 'test-runtime',
+        routers: emptyRoutersFunction,
+      });
+      const runtime = new Runtime();
+
+      // 现在错误在使用时才抛出，因为是延迟创建
+      await expect(runtime.getRuntimeByModel('test-model')).rejects.toThrow('empty providers');
     });
   });
 });