@lobehub/lobehub 2.0.0-next.251 → 2.0.0-next.253

package/apps/desktop/src/main/controllers/__tests__/SystemCtr.test.ts

@@ -7,12 +7,13 @@ import { IpcHandler } from '@/utils/ipc/base';
 
 import SystemController from '../SystemCtr';
 
-const { ipcHandlers, ipcMainHandleMock } = vi.hoisted(() => {
+const { ipcHandlers, ipcMainHandleMock, readdirSyncMock } = vi.hoisted(() => {
   const handlers = new Map<string, (event: any, ...args: any[]) => any>();
   const handle = vi.fn((channel: string, handler: any) => {
     handlers.set(channel, handler);
   });
-  return { ipcHandlers: handlers, ipcMainHandleMock: handle };
+  const readdirSync = vi.fn();
+  return { ipcHandlers: handlers, ipcMainHandleMock: handle, readdirSyncMock: readdirSync };
 });
 
 const invokeIpc = async <T = any>(
@@ -44,28 +45,18 @@ vi.mock('@/utils/logger', () => ({
   }),
 }));
 
-const { spawnMock } = vi.hoisted(() => ({
-  spawnMock: vi.fn(() => {
-    const handlers = new Map<string, (...args: any[]) => void>();
-    return {
-      on: vi.fn((event: string, cb: (...args: any[]) => void) => {
-        handlers.set(event, cb);
-        return undefined;
-      }),
-    } as any;
-  }),
-}));
-
-vi.mock('node:child_process', () => ({
-  spawn: (...args: any[]) => spawnMock.call(null, ...args),
-}));
-
 // Mock electron
 vi.mock('electron', () => ({
   app: {
     getLocale: vi.fn(() => 'en-US'),
     getPath: vi.fn((name: string) => `/mock/path/${name}`),
   },
+  desktopCapturer: {
+    getSources: vi.fn(async () => []),
+  },
+  dialog: {
+    showMessageBox: vi.fn(async () => ({ response: 0 })),
+  },
   ipcMain: {
     handle: ipcMainHandleMock,
   },
@@ -89,6 +80,32 @@ vi.mock('electron-is', () => ({
   macOS: vi.fn(() => true),
 }));
 
+// Mock node:fs for Full Disk Access check
+vi.mock('node:fs', () => ({
+  default: {
+    readdirSync: readdirSyncMock,
+  },
+  readdirSync: readdirSyncMock,
+}));
+
+// Mock node:os for homedir and release
+vi.mock('node:os', () => ({
+  default: {
+    homedir: vi.fn(() => '/Users/testuser'),
+    release: vi.fn(() => '23.0.0'), // Darwin 23 = macOS 14 (Sonoma)
+  },
+  homedir: vi.fn(() => '/Users/testuser'),
+  release: vi.fn(() => '23.0.0'),
+}));
+
+// Mock node:path
+vi.mock('node:path', () => ({
+  default: {
+    join: vi.fn((...args: string[]) => args.join('/')),
+  },
+  join: vi.fn((...args: string[]) => args.join('/')),
+}));
+
 // Mock browserManager
 const mockBrowserManager = {
   broadcastToAllWindows: vi.fn(),
@@ -112,6 +129,7 @@ const mockStoreManager = {
 // Mock i18n
 const mockI18n = {
   changeLanguage: vi.fn().mockResolvedValue(undefined),
+  ns: vi.fn((namespace: string) => (key: string) => `${namespace}.${key}`),
 };
 
 const mockApp = {
@@ -177,14 +195,78 @@ describe('SystemController', () => {
     });
   });
 
-  describe('screen recording', () => {
-    it('should request screen recording access and open System Settings on macOS', async () => {
+  describe('microphone access', () => {
+    it('should ask for microphone access when status is not-determined', async () => {
+      const { systemPreferences } = await import('electron');
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('not-determined');
+
+      await invokeIpc('system.requestMicrophoneAccess');
+
+      expect(systemPreferences.getMediaAccessStatus).toHaveBeenCalledWith('microphone');
+      expect(systemPreferences.askForMediaAccess).toHaveBeenCalledWith('microphone');
+
+      // Reset
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('not-determined');
+    });
+
+    it('should return true immediately if microphone access is already granted', async () => {
       const { shell, systemPreferences } = await import('electron');
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('granted');
+
+      const result = await invokeIpc('system.requestMicrophoneAccess');
+
+      expect(result).toBe(true);
+      expect(systemPreferences.askForMediaAccess).not.toHaveBeenCalled();
+      expect(shell.openExternal).not.toHaveBeenCalled();
+
+      // Reset
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('not-determined');
+    });
+
+    it('should open System Settings if microphone access is denied', async () => {
+      const { shell, systemPreferences } = await import('electron');
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('denied');
+
+      const result = await invokeIpc('system.requestMicrophoneAccess');
+
+      expect(result).toBe(false);
+      expect(systemPreferences.askForMediaAccess).not.toHaveBeenCalled();
+      expect(shell.openExternal).toHaveBeenCalledWith(
+        'x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone',
+      );
+
+      // Reset
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('not-determined');
+    });
+
+    it('should return true on non-macOS', async () => {
+      const { macOS } = await import('electron-is');
+      const { shell, systemPreferences } = await import('electron');
+      vi.mocked(macOS).mockReturnValue(false);
+
+      const result = await invokeIpc('system.requestMicrophoneAccess');
+
+      expect(result).toBe(true);
+      expect(systemPreferences.getMediaAccessStatus).not.toHaveBeenCalled();
+      expect(shell.openExternal).not.toHaveBeenCalled();
+
+      // Reset
+      vi.mocked(macOS).mockReturnValue(true);
+    });
+  });
+
+  describe('screen recording', () => {
+    it('should use desktopCapturer and getDisplayMedia to trigger TCC and open System Settings on macOS', async () => {
+      const { desktopCapturer, shell, systemPreferences } = await import('electron');
 
       const result = await invokeIpc('system.requestScreenAccess');
 
       expect(systemPreferences.getMediaAccessStatus).toHaveBeenCalledWith('screen');
-      expect(systemPreferences.askForMediaAccess).toHaveBeenCalledWith('screen');
+      expect(desktopCapturer.getSources).toHaveBeenCalledWith({
+        fetchWindowIcons: true,
+        thumbnailSize: { height: 144, width: 256 },
+        types: ['screen', 'window'],
+      });
       expect(mockBrowserManager.getMainWindow).toHaveBeenCalled();
       expect(shell.openExternal).toHaveBeenCalledWith(
         'x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture',
@@ -192,15 +274,29 @@ describe('SystemController', () => {
       expect(typeof result).toBe('boolean');
     });
 
+    it('should return true immediately if screen access is already granted', async () => {
+      const { desktopCapturer, shell, systemPreferences } = await import('electron');
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('granted');
+
+      const result = await invokeIpc('system.requestScreenAccess');
+
+      expect(result).toBe(true);
+      expect(desktopCapturer.getSources).not.toHaveBeenCalled();
+      expect(shell.openExternal).not.toHaveBeenCalled();
+
+      // Reset
+      vi.mocked(systemPreferences.getMediaAccessStatus).mockReturnValue('not-determined');
+    });
+
     it('should return true on non-macOS and not open settings', async () => {
       const { macOS } = await import('electron-is');
-      const { shell, systemPreferences } = await import('electron');
+      const { desktopCapturer, shell } = await import('electron');
       vi.mocked(macOS).mockReturnValue(false);
 
       const result = await invokeIpc('system.requestScreenAccess');
 
       expect(result).toBe(true);
-      expect(systemPreferences.askForMediaAccess).not.toHaveBeenCalled();
+      expect(desktopCapturer.getSources).not.toHaveBeenCalled();
       expect(shell.openExternal).not.toHaveBeenCalled();
 
       // Reset
@@ -209,6 +305,40 @@ describe('SystemController', () => {
   });
 
   describe('full disk access', () => {
+    it('should return true when Full Disk Access is granted (can read protected directory)', async () => {
+      readdirSyncMock.mockReturnValue(['file1', 'file2']);
+
+      const result = await invokeIpc('system.getFullDiskAccessStatus');
+
+      expect(result).toBe(true);
+      // On macOS 14 (Darwin 23), should check com.apple.stocks
+      expect(readdirSyncMock).toHaveBeenCalledWith(
+        '/Users/testuser/Library/Containers/com.apple.stocks',
+      );
+    });
+
+    it('should return false when Full Disk Access is not granted (cannot read protected directory)', async () => {
+      readdirSyncMock.mockImplementation(() => {
+        throw new Error('EPERM: operation not permitted');
+      });
+
+      const result = await invokeIpc('system.getFullDiskAccessStatus');
+
+      expect(result).toBe(false);
+    });
+
+    it('should return true on non-macOS', async () => {
+      const { macOS } = await import('electron-is');
+      vi.mocked(macOS).mockReturnValue(false);
+
+      const result = await invokeIpc('system.getFullDiskAccessStatus');
+
+      expect(result).toBe(true);
+
+      // Reset
+      vi.mocked(macOS).mockReturnValue(true);
+    });
+
     it('should try to open Full Disk Access settings with fallbacks', async () => {
       const { shell } = await import('electron');
       vi.mocked(shell.openExternal)
@@ -218,25 +348,64 @@ describe('SystemController', () => {
       await invokeIpc('system.openFullDiskAccessSettings');
 
       expect(shell.openExternal).toHaveBeenCalledWith(
-        'com.apple.settings:Privacy&path=FullDiskAccess',
+        'x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?Privacy_AllFiles',
       );
       expect(shell.openExternal).toHaveBeenCalledWith(
         'x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles',
       );
     });
 
-    it('should spawn osascript when autoAdd is enabled', async () => {
+    it('should open fallback Privacy settings if all candidates fail', async () => {
       const { shell } = await import('electron');
-      vi.mocked(shell.openExternal).mockResolvedValueOnce(undefined);
+      vi.mocked(shell.openExternal)
+        .mockRejectedValueOnce(new Error('fail first'))
+        .mockRejectedValueOnce(new Error('fail second'))
+        .mockResolvedValueOnce(undefined);
 
-      await invokeIpc('system.openFullDiskAccessSettings', { autoAdd: true });
+      await invokeIpc('system.openFullDiskAccessSettings');
 
-      expect(spawnMock).toHaveBeenCalledWith(
-        'osascript',
-        expect.arrayContaining(['-e', expect.any(String), expect.any(String)]),
-        expect.objectContaining({ env: expect.any(Object) }),
+      expect(shell.openExternal).toHaveBeenCalledWith(
+        'x-apple.systempreferences:com.apple.preference.security?Privacy',
       );
     });
+
+    it('should return granted if Full Disk Access is already granted', async () => {
+      readdirSyncMock.mockReturnValue(['file1', 'file2']);
+
+      const result = await invokeIpc('system.promptFullDiskAccessIfNotGranted');
+
+      expect(result).toBe('granted');
+    });
+
+    it('should show dialog and open settings when user clicks Open Settings', async () => {
+      const { dialog, shell } = await import('electron');
+      readdirSyncMock.mockImplementation(() => {
+        throw new Error('EPERM: operation not permitted');
+      });
+      vi.mocked(dialog.showMessageBox).mockResolvedValue({ response: 0 } as any);
+
+      const result = await invokeIpc('system.promptFullDiskAccessIfNotGranted');
+
+      expect(result).toBe('opened_settings');
+      expect(dialog.showMessageBox).toHaveBeenCalled();
+      expect(shell.openExternal).toHaveBeenCalled();
+    });
+
+    it('should return skipped when user clicks Later', async () => {
+      const { dialog, shell } = await import('electron');
+      readdirSyncMock.mockImplementation(() => {
+        throw new Error('EPERM: operation not permitted');
+      });
+      vi.mocked(dialog.showMessageBox).mockResolvedValue({ response: 1 } as any);
+      vi.mocked(shell.openExternal).mockClear();
+
+      const result = await invokeIpc('system.promptFullDiskAccessIfNotGranted');
+
+      expect(result).toBe('skipped');
+      expect(dialog.showMessageBox).toHaveBeenCalled();
+      // Should not open settings when user skips
+      expect(shell.openExternal).not.toHaveBeenCalled();
+    });
   });
 
   describe('openExternalLink', () => {

package/apps/desktop/src/main/core/browser/Browser.ts

@@ -183,6 +183,7 @@ export default class Browser {
   private setupEventListeners(browserWindow: BrowserWindow): void {
     this.setupReadyToShowListener(browserWindow);
     this.setupCloseListener(browserWindow);
+    this.setupFocusListener(browserWindow);
   }
 
   private setupReadyToShowListener(browserWindow: BrowserWindow): void {
@@ -207,6 +208,14 @@ export default class Browser {
     browserWindow.on('close', closeHandler);
   }
 
+  private setupFocusListener(browserWindow: BrowserWindow): void {
+    logger.debug(`[${this.identifier}] Setting up 'focus' event listener.`);
+    browserWindow.on('focus', () => {
+      logger.debug(`[${this.identifier}] Window 'focus' event fired.`);
+      this.broadcast('windowFocused');
+    });
+  }
+
   // ==================== Window Actions ====================
 
   show(): void {

package/apps/desktop/src/main/locales/default/dialog.ts

@@ -8,9 +8,14 @@ const dialog = {
   'confirm.title': 'Please confirm',
   'confirm.yes': 'Continue',
   'error.button': 'OK',
-  'error.detail': 'Couldn\'t complete the action. Retry or try again later.',
+  'error.detail': "Couldn't complete the action. Retry or try again later.",
   'error.message': 'An error occurred',
   'error.title': 'Error',
+  'fullDiskAccess.message':
+    'LobeHub needs Full Disk Access to read files and enable knowledge base features. Please grant access in System Settings.',
+  'fullDiskAccess.openSettings': 'Open Settings',
+  'fullDiskAccess.skip': 'Later',
+  'fullDiskAccess.title': 'Full Disk Access Required',
   'update.downloadAndInstall': 'Download and Install',
   'update.downloadComplete': 'Download Complete',
   'update.downloadCompleteMessage': 'Update downloaded. Install now?',
@@ -22,4 +27,4 @@ const dialog = {
   'update.skipThisVersion': 'Skip This Version',
 };
 
-export default dialog;
+export default dialog;

package/apps/desktop/src/main/locales/default/menu.ts

@@ -7,6 +7,13 @@ const menu = {
   'dev.openStore': 'Open Data Folder',
   'dev.openUpdaterCacheDir': 'Open Updater Cache',
   'dev.openUserDataDir': 'Open User Data',
+  'dev.permissions.accessibility.request': 'Request Accessibility Permission',
+  'dev.permissions.fullDisk.open': 'Open Full Disk Access Settings',
+  'dev.permissions.fullDisk.request': 'Request Full Disk Access Permission',
+  'dev.permissions.microphone.request': 'Request Microphone Permission',
+  'dev.permissions.notification.request': 'Request Notification Permission',
+  'dev.permissions.screen.request': 'Request Screen Recording Permission',
+  'dev.permissions.title': 'Permissions',
   'dev.refreshMenu': 'Refresh Menu',
   'dev.reload': 'Reload',
   'dev.simulateAutoDownload': 'Simulate Auto Download (3s)',

package/apps/desktop/src/main/menus/impls/macOS.ts

@@ -2,6 +2,8 @@ import { Menu, MenuItemConstructorOptions, app, shell } from 'electron';
 import * as path from 'node:path';
 
 import { isDev } from '@/const/env';
+import NotificationCtr from '@/controllers/NotificationCtr';
+import SystemController from '@/controllers/SystemCtr';
 
 import type { IMenuPlatform, MenuOptions } from '../types';
 import { BaseMenuPlatform } from './BaseMenuPlatform';
@@ -57,7 +59,6 @@ export class MacOSMenu extends BaseMenuPlatform implements IMenuPlatform {
   private getAppMenuTemplate(options?: MenuOptions): MenuItemConstructorOptions[] {
     const appName = app.getName();
     const showDev = isDev || options?.showDevItems;
-
     // 创建命名空间翻译函数
     const t = this.app.i18n.ns('menu');
 
@@ -269,6 +270,48 @@ export class MacOSMenu extends BaseMenuPlatform implements IMenuPlatform {
             label: t('dev.refreshMenu'),
           },
           { type: 'separator' },
+          {
+            label: t('dev.permissions.title'),
+            submenu: [
+              {
+                click: () => {
+                  const notificationCtr = this.app.getController(NotificationCtr);
+                  void notificationCtr.requestNotificationPermission();
+                },
+                label: t('dev.permissions.notification.request'),
+              },
+              { type: 'separator' },
+              {
+                click: () => {
+                  const systemCtr = this.app.getController(SystemController);
+                  void systemCtr.requestAccessibilityAccess();
+                },
+                label: t('dev.permissions.accessibility.request'),
+              },
+              {
+                click: () => {
+                  const systemCtr = this.app.getController(SystemController);
+                  void systemCtr.requestMicrophoneAccess();
+                },
+                label: t('dev.permissions.microphone.request'),
+              },
+              {
+                click: () => {
+                  const systemCtr = this.app.getController(SystemController);
+                  void systemCtr.requestScreenAccess();
+                },
+                label: t('dev.permissions.screen.request'),
+              },
+              { type: 'separator' },
+              {
+                click: () => {
+                  const systemCtr = this.app.getController(SystemController);
+                  void systemCtr.promptFullDiskAccessIfNotGranted();
+                },
+                label: t('dev.permissions.fullDisk.request'),
+              },
+            ],
+          },
           {
             click: () => {
               const userDataPath = app.getPath('userData');

package/apps/desktop/src/main/utils/fullDiskAccess.ts

@@ -0,0 +1,121 @@
+/**
+ * Full Disk Access utilities for macOS
+ * Based on https://github.com/inket/FullDiskAccess
+ */
+import { shell } from 'electron';
+import { macOS } from 'electron-is';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { createLogger } from './logger';
+
+const logger = createLogger('utils:fullDiskAccess');
+
+/**
+ * Get the macOS major version number
+ * Returns 0 if not macOS or unable to determine
+ *
+ * Darwin version to macOS version mapping:
+ * - Darwin 23.x = macOS 14 (Sonoma)
+ * - Darwin 22.x = macOS 13 (Ventura)
+ * - Darwin 21.x = macOS 12 (Monterey)
+ * - Darwin 20.x = macOS 11 (Big Sur)
+ * - Darwin 19.x = macOS 10.15 (Catalina)
+ * - Darwin 18.x = macOS 10.14 (Mojave)
+ */
+export function getMacOSMajorVersion(): number {
+  if (!macOS()) return 0;
+  try {
+    const release = os.release(); // e.g., "23.0.0" for macOS 14 (Sonoma)
+    const darwinMajor = Number.parseInt(release.split('.')[0], 10);
+    if (darwinMajor >= 20) {
+      return darwinMajor - 9; // Darwin 20 = macOS 11, Darwin 21 = macOS 12, etc.
+    }
+    // For older versions, return 10 (covers Mojave and Catalina)
+    return 10;
+  } catch {
+    return 0;
+  }
+}
+
+/**
+ * Check if Full Disk Access is granted by attempting to read a protected directory.
+ *
+ * On macOS 12+ (Monterey, Ventura, Sonoma, Sequoia): checks ~/Library/Containers/com.apple.stocks
+ * On macOS 10.14-11 (Mojave, Catalina, Big Sur): checks ~/Library/Safari
+ *
+ * Reading these directories will also register the app in TCC database,
+ * making it appear in System Settings > Privacy & Security > Full Disk Access
+ */
+export function checkFullDiskAccess(): boolean {
+  if (!macOS()) return true;
+
+  const homeDir = os.homedir();
+  const macOSVersion = getMacOSMajorVersion();
+
+  // Determine which protected directory to check based on macOS version
+  let checkPath: string;
+  if (macOSVersion >= 12) {
+    // macOS 12+ (Monterey, Ventura, Sonoma, Sequoia)
+    checkPath = path.join(homeDir, 'Library', 'Containers', 'com.apple.stocks');
+  } else {
+    // macOS 10.14-11 (Mojave, Catalina, Big Sur)
+    checkPath = path.join(homeDir, 'Library', 'Safari');
+  }
+
+  try {
+    fs.readdirSync(checkPath);
+    logger.info(`[FullDiskAccess] Access granted (able to read ${checkPath})`);
+    return true;
+  } catch {
+    logger.info(`[FullDiskAccess] Access not granted (unable to read ${checkPath})`);
+    return false;
+  }
+}
+
+/**
+ * Open Full Disk Access settings page in System Settings
+ *
+ * NOTE: Full Disk Access cannot be requested programmatically.
+ * User must manually add the app in System Settings.
+ * There is NO entitlement for Full Disk Access - it's purely TCC controlled.
+ */
+export async function openFullDiskAccessSettings(): Promise<void> {
+  if (!macOS()) {
+    logger.info('[FullDiskAccess] Not macOS, skipping');
+    return;
+  }
+
+  logger.info('[FullDiskAccess] Opening Full Disk Access settings...');
+
+  // On macOS 13+ (Ventura), System Preferences is replaced by System Settings,
+  // and deep links may differ. We try multiple known schemes for compatibility.
+  const candidates = [
+    // macOS 13+ (Ventura and later) - System Settings
+    'x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?Privacy_AllFiles',
+    // macOS 13+ alternative format
+    'x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles',
+  ];
+
+  for (const url of candidates) {
+    try {
+      logger.info(`[FullDiskAccess] Trying URL: ${url}`);
+      await shell.openExternal(url);
+      logger.info(`[FullDiskAccess] Successfully opened via ${url}`);
+      return;
+    } catch (error) {
+      logger.warn(`[FullDiskAccess] Failed with URL ${url}:`, error);
+    }
+  }
+
+  // Fallback: open Privacy & Security pane
+  try {
+    const fallbackUrl = 'x-apple.systempreferences:com.apple.preference.security?Privacy';
+    logger.info(`[FullDiskAccess] Trying fallback URL: ${fallbackUrl}`);
+    await shell.openExternal(fallbackUrl);
+    logger.info('[FullDiskAccess] Opened Privacy & Security settings as fallback');
+  } catch (error) {
+    logger.error('[FullDiskAccess] Failed to open any Privacy settings:', error);
+  }
+}

package/changelog/v1.json

@@ -1,4 +1,18 @@
 [
+  {
+    "children": {},
+    "date": "2026-01-09",
+    "version": "2.0.0-next.253"
+  },
+  {
+    "children": {
+      "features": [
+        "Add the agent cron job."
+      ]
+    },
+    "date": "2026-01-09",
+    "version": "2.0.0-next.252"
+  },
   {
     "children": {},
     "date": "2026-01-09",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/lobehub",
-  "version": "2.0.0-next.251",
+  "version": "2.0.0-next.253",
   "description": "LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",

package/packages/builtin-tool-notebook/src/client/Render/CreateDocument/DocumentCard.tsx

@@ -11,7 +11,6 @@ import { useChatStore } from '@/store/chat';
 
 import { NotebookDocument } from '../../../types';
 
-
 const styles = createStaticStyles(({ css, cssVar }) => ({
   container: css`
     position: relative;
@@ -26,7 +25,6 @@ const styles = createStaticStyles(({ css, cssVar }) => ({
   `,
   content: css`
     padding-inline: 16px;
-
     font-size: 14px;
   `,
   expandButton: css`

package/packages/database/migrations/meta/_journal.json

@@ -479,4 +479,4 @@
     }
   ],
   "version": "6"
-}
+}