@lobehub/lobehub 2.0.0-next.2 → 2.0.0-next.21

package/packages/model-runtime/src/utils/googleErrorParser.test.ts

@@ -86,6 +86,119 @@ describe('googleErrorParser', () => {
       });
       expect(result.prefix).toBe('Error');
     });
+
+    it('should handle multiple spaces between status code and text', () => {
+      const input = 'Error [500  Internal Server Error] Something went wrong';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'Something went wrong',
+        statusCode: 500,
+        statusCodeText: '[500 Internal Server Error]',
+      });
+      expect(result.prefix).toBe('Error');
+    });
+
+    it('should handle status code at the beginning of message', () => {
+      const input = '[429 Too Many Requests] Rate limit exceeded';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'Rate limit exceeded',
+        statusCode: 429,
+        statusCodeText: '[429 Too Many Requests]',
+      });
+      expect(result.prefix).toBe('');
+    });
+
+    it('should handle status code at the end of message', () => {
+      const input = 'Request failed [503 Service Unavailable]';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: '',
+        statusCode: 503,
+        statusCodeText: '[503 Service Unavailable]',
+      });
+      expect(result.prefix).toBe('Request failed');
+    });
+
+    it('should not be vulnerable to ReDoS attacks', () => {
+      // Test with a potentially malicious input that could cause catastrophic backtracking
+      const maliciousInput = 'Error ' + 'a'.repeat(10000) + ' [not matching]';
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with large input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails).toBeNull();
+    });
+
+    it('should not be vulnerable to ReDoS with many spaces', () => {
+      // Test the specific case mentioned in the security warning: '[9 ' + many spaces
+      const maliciousInput = '[9 ' + ' '.repeat(10000) + ']';
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with many spaces
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails).toBeDefined();
+    });
+
+    it('should handle very long error messages efficiently', () => {
+      const longMessage = 'a'.repeat(50000);
+      const input = `Prefix [400 Bad Request] ${longMessage}`;
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(input);
+      const endTime = Date.now();
+
+      // Should complete quickly even with very long input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails?.statusCode).toBe(400);
+    });
+
+    it('should safely handle edge cases with match.index', () => {
+      // Test various edge cases where match.index might be 0 or at different positions
+      const testCases = [
+        { input: '[400 Bad Request]', expectedPrefix: '' },
+        { input: '[500 Error] Message', expectedPrefix: '' },
+        { input: 'Some text [404 Not Found] More text', expectedPrefix: 'Some text' },
+      ];
+
+      testCases.forEach(({ input, expectedPrefix }) => {
+        const result = extractStatusCodeFromError(input);
+        expect(result.errorDetails).toBeDefined();
+        expect(result.prefix).toBe(expectedPrefix);
+      });
+    });
+
+    it('should find status code when there are multiple brackets', () => {
+      // Real-world case from Google AI API errors with JSON arrays in the message
+      const input =
+        '[GoogleGenerativeAI Error]: Error fetching: [400 Bad Request] API key not valid. [{"@type":"type.googleapis.com"}]';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'API key not valid. [{"@type":"type.googleapis.com"}]',
+        statusCode: 400,
+        statusCodeText: '[400 Bad Request]',
+      });
+      expect(result.prefix).toBe('[GoogleGenerativeAI Error]: Error fetching:');
+    });
+
+    it('should skip brackets that do not contain valid status codes', () => {
+      const input = 'Error [not a code] happened [500 Internal Server Error] please retry';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'please retry',
+        statusCode: 500,
+        statusCodeText: '[500 Internal Server Error]',
+      });
+      expect(result.prefix).toBe('Error [not a code] happened');
+    });
   });
 
   describe('parseGoogleErrorMessage', () => {
@@ -110,6 +223,18 @@ describe('googleErrorParser', () => {
       });
     });
 
+    it('should not be vulnerable to ReDoS in status JSON parsing', () => {
+      // Test with malicious input that could cause catastrophic backtracking
+      const maliciousInput = 'got status: UNAVAILABLE. ' + 'a'.repeat(10000);
+      const startTime = Date.now();
+      const result = parseGoogleErrorMessage(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with large input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorType).toBe(AgentRuntimeErrorType.ProviderBizError);
+    });
+
     it('should handle direct JSON parsing', () => {
       const input =
         '{"error":{"code":400,"message":"* API key not valid. Please pass a valid API key.","status":"INVALID_ARGUMENT"}}';

package/packages/model-runtime/src/utils/googleErrorParser.ts

@@ -17,64 +17,81 @@ export interface GoogleChatError {
 export type GoogleChatErrors = GoogleChatError[];
 
 /**
- * 清理错误消息，移除格式化字符和多余的空格
- * @param message - 原始错误消息
- * @returns 清理后的错误消息
+ * Clean error message by removing formatting characters and extra spaces
+ * @param message - Original error message
+ * @returns Cleaned error message
  */
 export function cleanErrorMessage(message: string): string {
   return message
-    .replaceAll(/^\*\s*/g, '') // 移除开头的星号和空格
-    .replaceAll('\\n', '\n') // 转换转义的换行符
-    .replaceAll(/\n+/g, ' ') // 将多个换行符替换为单个空格
-    .trim(); // 去除首尾空格
+    .replaceAll(/^\*\s*/g, '') // Remove leading asterisks and spaces
+    .replaceAll('\\n', '\n') // Convert escaped newlines
+    .replaceAll(/\n+/g, ' ') // Replace multiple newlines with single space
+    .trim(); // Trim leading/trailing spaces
 }
 
 /**
- * 从错误消息中提取状态码信息
- * @param message - 错误消息
- * @returns 提取的错误详情和前缀
+ * Extract status code information from error message
+ * @param message - Error message
+ * @returns Extracted error details and prefix
  */
 export function extractStatusCodeFromError(message: string): {
   errorDetails: any;
   prefix: string;
 } {
-  // 使用正则表达式匹配状态码部分 [数字 描述文本]
-  const regex = /^(.*?)(\[\d+ [^\]]+])(.*)$/;
-  const match = message.match(regex);
-
-  if (match) {
-    const prefix = match[1].trim();
-    const statusCodeWithBrackets = match[2].trim();
-    const messageContent = match[3].trim();
-
-    // 提取状态码数字
-    const statusCodeMatch = statusCodeWithBrackets.match(/\[(\d+)/);
-    const statusCode = statusCodeMatch ? parseInt(statusCodeMatch[1]) : null;
-
-    // 创建包含状态码和消息的JSON
-    const resultJson = {
-      message: messageContent,
-      statusCode: statusCode,
-      statusCodeText: statusCodeWithBrackets,
-    };
+  // Match status code pattern [number description text]
+  // Use string methods instead of regex to avoid ReDoS attacks
+  // We need to find a bracket that contains a status code (3-digit number followed by space and text)
+
+  let searchStart = 0;
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const openBracketIndex = message.indexOf('[', searchStart);
+    if (openBracketIndex === -1) {
+      return { errorDetails: null, prefix: message };
+    }
 
-    return {
-      errorDetails: resultJson,
-      prefix: prefix,
-    };
-  }
+    const closeBracketIndex = message.indexOf(']', openBracketIndex);
+    if (closeBracketIndex === -1) {
+      return { errorDetails: null, prefix: message };
+    }
 
-  // 如果无法匹配，返回原始消息
-  return {
-    errorDetails: null,
-    prefix: message,
-  };
+    const bracketContent = message.slice(openBracketIndex + 1, closeBracketIndex).trim();
+
+    // Find the first space to separate status code from description
+    const spaceIndex = bracketContent.indexOf(' ');
+    if (spaceIndex !== -1) {
+      const statusCodeStr = bracketContent.slice(0, spaceIndex);
+      const statusCode = parseInt(statusCodeStr, 10);
+
+      // Validate that statusCode is a valid HTTP status code (3 digits)
+      if (!isNaN(statusCode) && statusCode >= 100 && statusCode < 600) {
+        const statusText = bracketContent.slice(spaceIndex + 1).trim();
+        const prefix = message.slice(0, openBracketIndex).trim();
+        const messageContent = message.slice(closeBracketIndex + 1).trim();
+
+        // Create JSON containing status code and message
+        const resultJson = {
+          message: messageContent,
+          statusCode: statusCode,
+          statusCodeText: `[${statusCode} ${statusText}]`,
+        };
+
+        return {
+          errorDetails: resultJson,
+          prefix: prefix,
+        };
+      }
+    }
+
+    // Move to next bracket
+    searchStart = openBracketIndex + 1;
+  }
 }
 
 /**
- * 解析Google AI API返回的错误消息
- * @param message - 原始错误消息
- * @returns 解析后的错误对象和错误类型
+ * Parse error message from Google AI API
+ * @param message - Original error message
+ * @returns Parsed error object and error type
  */
 export function parseGoogleErrorMessage(message: string): ParsedError {
   const defaultError = {
@@ -82,12 +99,12 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     errorType: AgentRuntimeErrorType.ProviderBizError,
   };
 
-  // 快速识别特殊错误
+  // Quick identification of special errors
   if (message.includes('location is not supported')) {
     return { error: { message }, errorType: AgentRuntimeErrorType.LocationNotSupportError };
   }
 
-  // 统一的错误类型判断函数
+  // Unified error type determination function
   const getErrorType = (code: number | null, message: string): ILobeAgentRuntimeErrorType => {
     if (code === 400 && message.includes('API key not valid')) {
       return AgentRuntimeErrorType.InvalidProviderAPIKey;
@@ -97,30 +114,30 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     return AgentRuntimeErrorType.ProviderBizError;
   };
 
-  // 递归解析JSON，处理嵌套的JSON字符串
+  // Recursively parse JSON, handling nested JSON strings
   const parseJsonRecursively = (str: string, maxDepth: number = 5): any => {
     if (maxDepth <= 0) return null;
 
     try {
       const parsed = JSON.parse(str);
 
-      // 如果解析出的对象包含error字段
+      // If parsed object contains error field
       if (parsed && typeof parsed === 'object' && parsed.error) {
         const errorInfo = parsed.error;
 
-        // 清理错误消息
+        // Clean error message
         if (typeof errorInfo.message === 'string') {
           errorInfo.message = cleanErrorMessage(errorInfo.message);
 
-          // 如果error.message还是一个JSON字符串，继续递归解析
+          // If error.message is still a JSON string, continue recursive parsing
           try {
             const nestedResult = parseJsonRecursively(errorInfo.message, maxDepth - 1);
-            // 只有当深层结果包含带有 code 的 error 对象时，才优先返回深层结果
+            // Only return deeper result if it contains an error object with code
             if (nestedResult && nestedResult.error && nestedResult.error.code) {
               return nestedResult;
             }
           } catch {
-            // 如果嵌套解析失败，使用当前层的信息
+            // If nested parsing fails, use current layer info
           }
         }
 
@@ -133,31 +150,40 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     }
   };
 
-  // 1. 处理 "got status: UNAVAILABLE. {JSON}" 格式
-  const statusJsonMatch = message.match(/got status: (\w+)\.\s*({.*})$/);
-  if (statusJsonMatch) {
-    const statusFromMessage = statusJsonMatch[1];
-    const jsonPart = statusJsonMatch[2];
-
-    const parsedError = parseJsonRecursively(jsonPart);
-    if (parsedError && parsedError.error) {
-      const errorInfo = parsedError.error;
-      const finalMessage = errorInfo.message || message;
-      const finalCode = errorInfo.code || null;
-      const finalStatus = errorInfo.status || statusFromMessage;
-
-      return {
-        error: {
-          code: finalCode,
-          message: finalMessage,
-          status: finalStatus,
-        },
-        errorType: getErrorType(finalCode, finalMessage),
-      };
+  // 1. Handle "got status: UNAVAILABLE. {JSON}" format
+  const statusPrefix = 'got status: ';
+  const statusPrefixIndex = message.indexOf(statusPrefix);
+  if (statusPrefixIndex !== -1) {
+    const afterPrefix = message.slice(statusPrefixIndex + statusPrefix.length);
+    const dotIndex = afterPrefix.indexOf('.');
+    if (dotIndex !== -1) {
+      const statusFromMessage = afterPrefix.slice(0, dotIndex).trim();
+      const afterDot = afterPrefix.slice(dotIndex + 1).trim();
+      const braceIndex = afterDot.indexOf('{');
+      if (braceIndex !== -1) {
+        const jsonPart = afterDot.slice(braceIndex);
+
+        const parsedError = parseJsonRecursively(jsonPart);
+        if (parsedError && parsedError.error) {
+          const errorInfo = parsedError.error;
+          const finalMessage = errorInfo.message || message;
+          const finalCode = errorInfo.code || null;
+          const finalStatus = errorInfo.status || statusFromMessage;
+
+          return {
+            error: {
+              code: finalCode,
+              message: finalMessage,
+              status: finalStatus,
+            },
+            errorType: getErrorType(finalCode, finalMessage),
+          };
+        }
+      }
     }
   }
 
-  // 2. 尝试直接解析整个消息作为JSON
+  // 2. Try to parse entire message as JSON directly
   const directParsed = parseJsonRecursively(message);
   if (directParsed && directParsed.error) {
     const errorInfo = directParsed.error;
@@ -175,7 +201,7 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     };
   }
 
-  // 3. 处理嵌套JSON格式，特别是message字段包含JSON的情况
+  // 3. Handle nested JSON format, especially when message field contains JSON
   try {
     const firstLevelParsed = JSON.parse(message);
     if (firstLevelParsed && firstLevelParsed.error && firstLevelParsed.error.message) {
@@ -197,10 +223,10 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
       }
     }
   } catch {
-    // 继续其他解析方式
+    // Continue with other parsing methods
   }
 
-  // 4. 原有的数组格式解析逻辑
+  // 4. Original array format parsing logic
   const startIndex = message.lastIndexOf('[');
   if (startIndex !== -1) {
     try {
@@ -214,11 +240,11 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
 
       return { error: json, errorType: AgentRuntimeErrorType.ProviderBizError };
     } catch {
-      // 忽略解析错误
+      // Ignore parsing errors
     }
   }
 
-  // 5. 使用状态码提取逻辑作为最后的后备方案
+  // 5. Use status code extraction logic as last fallback
   const errorObj = extractStatusCodeFromError(message);
   if (errorObj.errorDetails) {
     return { error: errorObj.errorDetails, errorType: AgentRuntimeErrorType.ProviderBizError };

package/packages/types/src/message/common/base.ts

@@ -1,5 +1,6 @@
 import type { ILobeAgentRuntimeErrorType } from '@lobechat/model-runtime';
 import type { IPluginErrorType } from '@lobehub/chat-plugin-sdk';
+import { z } from 'zod';
 
 import { ErrorType } from '../../fetch';
 
@@ -12,6 +13,12 @@ export interface ChatMessageError {
   type: ErrorType | IPluginErrorType | ILobeAgentRuntimeErrorType;
 }
 
+export const ChatMessageErrorSchema = z.object({
+  body: z.any().optional(),
+  message: z.string(),
+  type: z.union([z.string(), z.number()]),
+});
+
 export interface ChatCitationItem {
   id?: string;
   onlyUrl?: boolean;
@@ -24,3 +31,9 @@ export interface ModelReasoning {
   duration?: number;
   signature?: string;
 }
+
+export const ModelReasoningSchema = z.object({
+  content: z.string().optional(),
+  duration: z.number().optional(),
+  signature: z.string().optional(),
+});

package/packages/types/src/message/common/image.ts

@@ -1,9 +1,17 @@
+import { z } from 'zod';
+
 export interface ChatImageItem {
   alt: string;
   id: string;
   url: string;
 }
 
+export const ChatImageItemSchema = z.object({
+  alt: z.string(),
+  id: z.string(),
+  url: z.string(),
+});
+
 export interface ChatImageChunk {
   data: string;
   id: string;

package/packages/types/src/message/common/metadata.ts

@@ -1,4 +1,5 @@
 /* eslint-disable sort-keys-fix/sort-keys-fix , typescript-sort-keys/interface */
+import { z } from 'zod';
 
 export interface ModelTokensUsage {
   // Input tokens breakdown
@@ -38,6 +39,44 @@ export interface ModelTokensUsage {
   totalTokens?: number;
 }
 
+export const ModelUsageSchema = z.object({
+  // Input tokens breakdown
+  inputCachedTokens: z.number().optional(),
+  inputCacheMissTokens: z.number().optional(),
+  inputWriteCacheTokens: z.number().optional(),
+  inputTextTokens: z.number().optional(),
+  inputImageTokens: z.number().optional(),
+  inputAudioTokens: z.number().optional(),
+  inputCitationTokens: z.number().optional(),
+
+  // Output tokens breakdown
+  outputTextTokens: z.number().optional(),
+  outputImageTokens: z.number().optional(),
+  outputAudioTokens: z.number().optional(),
+  outputReasoningTokens: z.number().optional(),
+
+  // Prediction tokens
+  acceptedPredictionTokens: z.number().optional(),
+  rejectedPredictionTokens: z.number().optional(),
+
+  // Total tokens
+  totalInputTokens: z.number().optional(),
+  totalOutputTokens: z.number().optional(),
+  totalTokens: z.number().optional(),
+
+  // Cost
+  cost: z.number().optional(),
+});
+
+export const ModelPerformanceSchema = z.object({
+  tps: z.number().optional(),
+  ttft: z.number().optional(),
+  duration: z.number().optional(),
+  latency: z.number().optional(),
+});
+
+export const MessageMetadataSchema = ModelUsageSchema.merge(ModelPerformanceSchema);
+
 export interface ModelUsage extends ModelTokensUsage {
   /**
    * dollar

package/packages/types/src/message/common/tools.ts

@@ -16,6 +16,7 @@ export interface ChatToolPayload {
   arguments: string;
   id: string;
   identifier: string;
+  result_msg_id?: string;
   type: LobeToolRenderType;
 }
 
@@ -85,6 +86,15 @@ export const MessageToolCallSchema = z.object({
   type: z.string(),
 });
 
+export const ChatToolPayloadSchema = z.object({
+  apiName: z.string(),
+  arguments: z.string(),
+  id: z.string(),
+  identifier: z.string(),
+  result_msg_id: z.string().optional(),
+  type: z.string(),
+});
+
 /**
  * 聊天消息错误对象
  */

package/packages/types/src/message/db/params.ts

@@ -1,11 +1,20 @@
-import { GroundingSearch } from '../../search';
+/* eslint-disable sort-keys-fix/sort-keys-fix */
+import { z } from 'zod';
+
+import { GroundingSearch, GroundingSearchSchema } from '../../search';
 import {
   ChatImageItem,
+  ChatImageItemSchema,
   ChatMessageError,
+  ChatMessageErrorSchema,
   ChatToolPayload,
+  ChatToolPayloadSchema,
   MessageMetadata,
+  MessageMetadataSchema,
   MessageToolCall,
+  MessageToolCallSchema,
   ModelReasoning,
+  ModelReasoningSchema,
 } from '../common';
 import { UIChatMessage } from '../ui';
 
@@ -34,6 +43,21 @@ export interface CreateMessageResult {
   messages: UIChatMessage[];
 }
 
+/**
+ * Result type for updateMessage
+ * Contains success status and optional message list
+ */
+export interface UpdateMessageResult {
+  /**
+   * Updated message list (only present when success is true and sessionId/topicId provided)
+   */
+  messages?: UIChatMessage[];
+  /**
+   * Whether the update was successful
+   */
+  success: boolean;
+}
+
 export interface NewMessage {
   agentId?: string | null;
   clientId?: string | null;
@@ -67,12 +91,14 @@ export interface UpdateMessageParams {
   imageList?: ChatImageItem[];
   metadata?: MessageMetadata;
   model?: string;
+  observationId?: string;
   provider?: string;
   reasoning?: ModelReasoning;
   role?: string;
   search?: GroundingSearch;
   toolCalls?: MessageToolCall[];
   tools?: ChatToolPayload[] | null;
+  traceId?: string;
 }
 
 export interface NewMessageQueryParams {
@@ -81,3 +107,23 @@ export interface NewMessageQueryParams {
   rewriteQuery: string;
   userQuery: string;
 }
+
+// ========== Zod Schemas ========== //
+
+export const UpdateMessageParamsSchema = z
+  .object({
+    content: z.string().optional(),
+    error: ChatMessageErrorSchema.nullable().optional(),
+    imageList: z.array(ChatImageItemSchema).optional(),
+    metadata: MessageMetadataSchema.optional(),
+    model: z.string().optional(),
+    observationId: z.string().optional(),
+    provider: z.string().optional(),
+    reasoning: ModelReasoningSchema.optional(),
+    role: z.string().optional(),
+    search: GroundingSearchSchema.optional(),
+    toolCalls: z.array(MessageToolCallSchema).optional(),
+    tools: z.array(ChatToolPayloadSchema).nullable().optional(),
+    traceId: z.string().optional(),
+  })
+  .passthrough();

package/packages/types/src/message/ui/chat.ts

@@ -26,10 +26,11 @@ export interface ChatFileItem {
 
 export interface AssistantContentBlock {
   content: string;
-  fileList?: ChatFileItem[];
+  error?: ChatMessageError | null;
   id: string;
   imageList?: ChatImageItem[];
   performance?: ModelPerformance;
+  reasoning?: ModelReasoning;
   tools?: ChatToolPayloadWithResult[];
   usage?: ModelUsage;
 }
@@ -62,6 +63,7 @@ export interface UIChatMessage {
   imageList?: ChatImageItem[];
   meta: MetaData;
   metadata?: MessageMetadata | null;
+  model?: string | null;
   /**
    * observation id
    */
@@ -78,6 +80,7 @@ export interface UIChatMessage {
   plugin?: ChatPluginPayload;
   pluginError?: any;
   pluginState?: any;
+  provider?: string | null;
   /**
    * quoted other message's id
    */