@lobehub/lobehub 2.0.0-next.3 → 2.0.0-next.31

package/packages/model-bank/src/aiModels/siliconcloud.ts

@@ -145,6 +145,25 @@ const siliconcloudChatModels: AIChatModelCard[] = [
     releasedAt: '2025-09-01',
     type: 'chat',
   },
+  {
+    abilities: {
+      functionCall: true,
+    },
+    contextWindowTokens: 131_072,
+    description:
+      'KAT-Dev（32B）是一款专为软件工程任务设计的开源 32B 参数模型。在 SWE-Bench Verified 基准测试中，它取得了 62.4% 的解决率，在所有不同规模的开源模型中排名第五。该模型通过多个阶段进行优化，包括中间训练、监督微调（SFT）与强化学习（RL），旨在为代码补全、缺陷修复、代码评审等复杂编程任务提供强大支持。',
+    displayName: 'KAT-Dev 32B',
+    id: 'Kwaipilot/KAT-Dev',
+    pricing: {
+      currency: 'CNY',
+      units: [
+        { name: 'textInput', rate: 1, strategy: 'fixed', unit: 'millionTokens' },
+        { name: 'textOutput', rate: 4, strategy: 'fixed', unit: 'millionTokens' },
+      ],
+    },
+    releasedAt: '2025-09-27',
+    type: 'chat',
+  },
   {
     abilities: {
       functionCall: true,

package/packages/model-runtime/src/core/streams/openai/__snapshots__/responsesStream.test.ts.snap

@@ -145,25 +145,6 @@ exports[`OpenAIResponsesStream > Reasoning > summary 1`] = `
 ]
 `;
 
-exports[`OpenAIResponsesStream > should handle chunk errors in catch block 1`] = `
-[
-  "id: resp_error_catch
-",
-  "event: data
-",
-  "data: "in_progress"
-
-",
-  "id: undefined
-",
-  "event: reasoning
-",
-  "data: undefined
-
-",
-]
-`;
-
 exports[`OpenAIResponsesStream > should handle chunks with undefined values gracefully 1`] = `
 [
   "id: resp_undefined_vals
@@ -546,25 +527,6 @@ exports[`OpenAIResponsesStream > should handle response.reasoning_summary_text.d
 ]
 `;
 
-exports[`OpenAIResponsesStream > should handle stream chunk transformation error with null access 1`] = `
-[
-  "id: resp_error_test
-",
-  "event: data
-",
-  "data: "in_progress"
-
-",
-  "id: null
-",
-  "event: text
-",
-  "data: "test"
-
-",
-]
-`;
-
 exports[`OpenAIResponsesStream > should handle unknown chunk type as data 1`] = `
 [
   "id: resp_unknown

package/packages/model-runtime/src/providers/minimax/index.ts

@@ -17,11 +17,11 @@ export const LobeMinimaxAI = createOpenAICompatibleRuntime({
 
       const minimaxTools = enabledSearch
         ? [
-            ...(tools || []),
-            {
-              type: 'web_search',
-            },
-          ]
+          ...(tools || []),
+          {
+            type: 'web_search',
+          },
+        ]
         : tools;
 
       // Resolve parameters with constraints

package/packages/model-runtime/src/providers/search1api/index.test.ts

@@ -830,9 +830,9 @@ describe('LobeSearch1API - custom features', () => {
     it('should handle mix of known and unknown models', async () => {
       mockClient.models.list.mockResolvedValue({
         data: [
-          { id: 'gpt-4o-mini' },
+          { id: 'gpt-4o' },
           { id: 'unknown-model-1' },
-          { id: 'claude-3-5-sonnet-20241022' },
+          { id: 'gpt-4o-mini' },
           { id: 'unknown-model-2' },
         ],
       });

package/packages/model-runtime/src/utils/googleErrorParser.test.ts

@@ -86,6 +86,119 @@ describe('googleErrorParser', () => {
       });
       expect(result.prefix).toBe('Error');
     });
+
+    it('should handle multiple spaces between status code and text', () => {
+      const input = 'Error [500  Internal Server Error] Something went wrong';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'Something went wrong',
+        statusCode: 500,
+        statusCodeText: '[500 Internal Server Error]',
+      });
+      expect(result.prefix).toBe('Error');
+    });
+
+    it('should handle status code at the beginning of message', () => {
+      const input = '[429 Too Many Requests] Rate limit exceeded';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'Rate limit exceeded',
+        statusCode: 429,
+        statusCodeText: '[429 Too Many Requests]',
+      });
+      expect(result.prefix).toBe('');
+    });
+
+    it('should handle status code at the end of message', () => {
+      const input = 'Request failed [503 Service Unavailable]';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: '',
+        statusCode: 503,
+        statusCodeText: '[503 Service Unavailable]',
+      });
+      expect(result.prefix).toBe('Request failed');
+    });
+
+    it('should not be vulnerable to ReDoS attacks', () => {
+      // Test with a potentially malicious input that could cause catastrophic backtracking
+      const maliciousInput = 'Error ' + 'a'.repeat(10000) + ' [not matching]';
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with large input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails).toBeNull();
+    });
+
+    it('should not be vulnerable to ReDoS with many spaces', () => {
+      // Test the specific case mentioned in the security warning: '[9 ' + many spaces
+      const maliciousInput = '[9 ' + ' '.repeat(10000) + ']';
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with many spaces
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails).toBeDefined();
+    });
+
+    it('should handle very long error messages efficiently', () => {
+      const longMessage = 'a'.repeat(50000);
+      const input = `Prefix [400 Bad Request] ${longMessage}`;
+      const startTime = Date.now();
+      const result = extractStatusCodeFromError(input);
+      const endTime = Date.now();
+
+      // Should complete quickly even with very long input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorDetails?.statusCode).toBe(400);
+    });
+
+    it('should safely handle edge cases with match.index', () => {
+      // Test various edge cases where match.index might be 0 or at different positions
+      const testCases = [
+        { input: '[400 Bad Request]', expectedPrefix: '' },
+        { input: '[500 Error] Message', expectedPrefix: '' },
+        { input: 'Some text [404 Not Found] More text', expectedPrefix: 'Some text' },
+      ];
+
+      testCases.forEach(({ input, expectedPrefix }) => {
+        const result = extractStatusCodeFromError(input);
+        expect(result.errorDetails).toBeDefined();
+        expect(result.prefix).toBe(expectedPrefix);
+      });
+    });
+
+    it('should find status code when there are multiple brackets', () => {
+      // Real-world case from Google AI API errors with JSON arrays in the message
+      const input =
+        '[GoogleGenerativeAI Error]: Error fetching: [400 Bad Request] API key not valid. [{"@type":"type.googleapis.com"}]';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'API key not valid. [{"@type":"type.googleapis.com"}]',
+        statusCode: 400,
+        statusCodeText: '[400 Bad Request]',
+      });
+      expect(result.prefix).toBe('[GoogleGenerativeAI Error]: Error fetching:');
+    });
+
+    it('should skip brackets that do not contain valid status codes', () => {
+      const input = 'Error [not a code] happened [500 Internal Server Error] please retry';
+      const result = extractStatusCodeFromError(input);
+
+      expect(result.errorDetails).toEqual({
+        message: 'please retry',
+        statusCode: 500,
+        statusCodeText: '[500 Internal Server Error]',
+      });
+      expect(result.prefix).toBe('Error [not a code] happened');
+    });
   });
 
   describe('parseGoogleErrorMessage', () => {
@@ -110,6 +223,18 @@ describe('googleErrorParser', () => {
       });
     });
 
+    it('should not be vulnerable to ReDoS in status JSON parsing', () => {
+      // Test with malicious input that could cause catastrophic backtracking
+      const maliciousInput = 'got status: UNAVAILABLE. ' + 'a'.repeat(10000);
+      const startTime = Date.now();
+      const result = parseGoogleErrorMessage(maliciousInput);
+      const endTime = Date.now();
+
+      // Should complete quickly (under 100ms) even with large input
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(result.errorType).toBe(AgentRuntimeErrorType.ProviderBizError);
+    });
+
     it('should handle direct JSON parsing', () => {
       const input =
         '{"error":{"code":400,"message":"* API key not valid. Please pass a valid API key.","status":"INVALID_ARGUMENT"}}';

package/packages/model-runtime/src/utils/googleErrorParser.ts

@@ -17,64 +17,81 @@ export interface GoogleChatError {
 export type GoogleChatErrors = GoogleChatError[];
 
 /**
- * 清理错误消息，移除格式化字符和多余的空格
- * @param message - 原始错误消息
- * @returns 清理后的错误消息
+ * Clean error message by removing formatting characters and extra spaces
+ * @param message - Original error message
+ * @returns Cleaned error message
  */
 export function cleanErrorMessage(message: string): string {
   return message
-    .replaceAll(/^\*\s*/g, '') // 移除开头的星号和空格
-    .replaceAll('\\n', '\n') // 转换转义的换行符
-    .replaceAll(/\n+/g, ' ') // 将多个换行符替换为单个空格
-    .trim(); // 去除首尾空格
+    .replaceAll(/^\*\s*/g, '') // Remove leading asterisks and spaces
+    .replaceAll('\\n', '\n') // Convert escaped newlines
+    .replaceAll(/\n+/g, ' ') // Replace multiple newlines with single space
+    .trim(); // Trim leading/trailing spaces
 }
 
 /**
- * 从错误消息中提取状态码信息
- * @param message - 错误消息
- * @returns 提取的错误详情和前缀
+ * Extract status code information from error message
+ * @param message - Error message
+ * @returns Extracted error details and prefix
  */
 export function extractStatusCodeFromError(message: string): {
   errorDetails: any;
   prefix: string;
 } {
-  // 使用正则表达式匹配状态码部分 [数字 描述文本]
-  const regex = /^(.*?)(\[\d+ [^\]]+])(.*)$/;
-  const match = message.match(regex);
-
-  if (match) {
-    const prefix = match[1].trim();
-    const statusCodeWithBrackets = match[2].trim();
-    const messageContent = match[3].trim();
-
-    // 提取状态码数字
-    const statusCodeMatch = statusCodeWithBrackets.match(/\[(\d+)/);
-    const statusCode = statusCodeMatch ? parseInt(statusCodeMatch[1]) : null;
-
-    // 创建包含状态码和消息的JSON
-    const resultJson = {
-      message: messageContent,
-      statusCode: statusCode,
-      statusCodeText: statusCodeWithBrackets,
-    };
+  // Match status code pattern [number description text]
+  // Use string methods instead of regex to avoid ReDoS attacks
+  // We need to find a bracket that contains a status code (3-digit number followed by space and text)
+
+  let searchStart = 0;
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const openBracketIndex = message.indexOf('[', searchStart);
+    if (openBracketIndex === -1) {
+      return { errorDetails: null, prefix: message };
+    }
 
-    return {
-      errorDetails: resultJson,
-      prefix: prefix,
-    };
-  }
+    const closeBracketIndex = message.indexOf(']', openBracketIndex);
+    if (closeBracketIndex === -1) {
+      return { errorDetails: null, prefix: message };
+    }
 
-  // 如果无法匹配，返回原始消息
-  return {
-    errorDetails: null,
-    prefix: message,
-  };
+    const bracketContent = message.slice(openBracketIndex + 1, closeBracketIndex).trim();
+
+    // Find the first space to separate status code from description
+    const spaceIndex = bracketContent.indexOf(' ');
+    if (spaceIndex !== -1) {
+      const statusCodeStr = bracketContent.slice(0, spaceIndex);
+      const statusCode = parseInt(statusCodeStr, 10);
+
+      // Validate that statusCode is a valid HTTP status code (3 digits)
+      if (!isNaN(statusCode) && statusCode >= 100 && statusCode < 600) {
+        const statusText = bracketContent.slice(spaceIndex + 1).trim();
+        const prefix = message.slice(0, openBracketIndex).trim();
+        const messageContent = message.slice(closeBracketIndex + 1).trim();
+
+        // Create JSON containing status code and message
+        const resultJson = {
+          message: messageContent,
+          statusCode: statusCode,
+          statusCodeText: `[${statusCode} ${statusText}]`,
+        };
+
+        return {
+          errorDetails: resultJson,
+          prefix: prefix,
+        };
+      }
+    }
+
+    // Move to next bracket
+    searchStart = openBracketIndex + 1;
+  }
 }
 
 /**
- * 解析Google AI API返回的错误消息
- * @param message - 原始错误消息
- * @returns 解析后的错误对象和错误类型
+ * Parse error message from Google AI API
+ * @param message - Original error message
+ * @returns Parsed error object and error type
  */
 export function parseGoogleErrorMessage(message: string): ParsedError {
   const defaultError = {
@@ -82,12 +99,12 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     errorType: AgentRuntimeErrorType.ProviderBizError,
   };
 
-  // 快速识别特殊错误
+  // Quick identification of special errors
   if (message.includes('location is not supported')) {
     return { error: { message }, errorType: AgentRuntimeErrorType.LocationNotSupportError };
   }
 
-  // 统一的错误类型判断函数
+  // Unified error type determination function
   const getErrorType = (code: number | null, message: string): ILobeAgentRuntimeErrorType => {
     if (code === 400 && message.includes('API key not valid')) {
       return AgentRuntimeErrorType.InvalidProviderAPIKey;
@@ -97,30 +114,30 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     return AgentRuntimeErrorType.ProviderBizError;
   };
 
-  // 递归解析JSON，处理嵌套的JSON字符串
+  // Recursively parse JSON, handling nested JSON strings
   const parseJsonRecursively = (str: string, maxDepth: number = 5): any => {
     if (maxDepth <= 0) return null;
 
     try {
       const parsed = JSON.parse(str);
 
-      // 如果解析出的对象包含error字段
+      // If parsed object contains error field
       if (parsed && typeof parsed === 'object' && parsed.error) {
         const errorInfo = parsed.error;
 
-        // 清理错误消息
+        // Clean error message
         if (typeof errorInfo.message === 'string') {
           errorInfo.message = cleanErrorMessage(errorInfo.message);
 
-          // 如果error.message还是一个JSON字符串，继续递归解析
+          // If error.message is still a JSON string, continue recursive parsing
           try {
             const nestedResult = parseJsonRecursively(errorInfo.message, maxDepth - 1);
-            // 只有当深层结果包含带有 code 的 error 对象时，才优先返回深层结果
+            // Only return deeper result if it contains an error object with code
             if (nestedResult && nestedResult.error && nestedResult.error.code) {
               return nestedResult;
             }
           } catch {
-            // 如果嵌套解析失败，使用当前层的信息
+            // If nested parsing fails, use current layer info
           }
         }
 
@@ -133,31 +150,40 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     }
   };
 
-  // 1. 处理 "got status: UNAVAILABLE. {JSON}" 格式
-  const statusJsonMatch = message.match(/got status: (\w+)\.\s*({.*})$/);
-  if (statusJsonMatch) {
-    const statusFromMessage = statusJsonMatch[1];
-    const jsonPart = statusJsonMatch[2];
-
-    const parsedError = parseJsonRecursively(jsonPart);
-    if (parsedError && parsedError.error) {
-      const errorInfo = parsedError.error;
-      const finalMessage = errorInfo.message || message;
-      const finalCode = errorInfo.code || null;
-      const finalStatus = errorInfo.status || statusFromMessage;
-
-      return {
-        error: {
-          code: finalCode,
-          message: finalMessage,
-          status: finalStatus,
-        },
-        errorType: getErrorType(finalCode, finalMessage),
-      };
+  // 1. Handle "got status: UNAVAILABLE. {JSON}" format
+  const statusPrefix = 'got status: ';
+  const statusPrefixIndex = message.indexOf(statusPrefix);
+  if (statusPrefixIndex !== -1) {
+    const afterPrefix = message.slice(statusPrefixIndex + statusPrefix.length);
+    const dotIndex = afterPrefix.indexOf('.');
+    if (dotIndex !== -1) {
+      const statusFromMessage = afterPrefix.slice(0, dotIndex).trim();
+      const afterDot = afterPrefix.slice(dotIndex + 1).trim();
+      const braceIndex = afterDot.indexOf('{');
+      if (braceIndex !== -1) {
+        const jsonPart = afterDot.slice(braceIndex);
+
+        const parsedError = parseJsonRecursively(jsonPart);
+        if (parsedError && parsedError.error) {
+          const errorInfo = parsedError.error;
+          const finalMessage = errorInfo.message || message;
+          const finalCode = errorInfo.code || null;
+          const finalStatus = errorInfo.status || statusFromMessage;
+
+          return {
+            error: {
+              code: finalCode,
+              message: finalMessage,
+              status: finalStatus,
+            },
+            errorType: getErrorType(finalCode, finalMessage),
+          };
+        }
+      }
     }
   }
 
-  // 2. 尝试直接解析整个消息作为JSON
+  // 2. Try to parse entire message as JSON directly
   const directParsed = parseJsonRecursively(message);
   if (directParsed && directParsed.error) {
     const errorInfo = directParsed.error;
@@ -175,7 +201,7 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
     };
   }
 
-  // 3. 处理嵌套JSON格式，特别是message字段包含JSON的情况
+  // 3. Handle nested JSON format, especially when message field contains JSON
   try {
     const firstLevelParsed = JSON.parse(message);
     if (firstLevelParsed && firstLevelParsed.error && firstLevelParsed.error.message) {
@@ -197,10 +223,10 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
       }
     }
   } catch {
-    // 继续其他解析方式
+    // Continue with other parsing methods
   }
 
-  // 4. 原有的数组格式解析逻辑
+  // 4. Original array format parsing logic
   const startIndex = message.lastIndexOf('[');
   if (startIndex !== -1) {
     try {
@@ -214,11 +240,11 @@ export function parseGoogleErrorMessage(message: string): ParsedError {
 
       return { error: json, errorType: AgentRuntimeErrorType.ProviderBizError };
     } catch {
-      // 忽略解析错误
+      // Ignore parsing errors
     }
   }
 
-  // 5. 使用状态码提取逻辑作为最后的后备方案
+  // 5. Use status code extraction logic as last fallback
   const errorObj = extractStatusCodeFromError(message);
   if (errorObj.errorDetails) {
     return { error: errorObj.errorDetails, errorType: AgentRuntimeErrorType.ProviderBizError };

package/packages/obervability-otel/package.json

@@ -18,8 +18,6 @@
     "@opentelemetry/sdk-node": "^0.207.0",
     "@opentelemetry/sdk-trace-node": "^2.0.1",
     "@opentelemetry/semantic-conventions": "^1.36.0",
-    "@vercel/otel": "^1.13.0",
-    "import-in-the-middle": "^1.14.2",
-    "require-in-the-middle": "^7.5.2"
+    "@vercel/otel": "^1.13.0"
   }
 }

package/packages/obervability-otel/src/node.ts

@@ -9,9 +9,7 @@ import { PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic-conventions';
 
-
-
-export function register(options?: { debug?: true | DiagLogLevel, version?: string; }) {
+export function register(options?: { debug?: true | DiagLogLevel; version?: string }) {
   const attributes: Record<string, string> = {
     [ATTR_SERVICE_NAME]: 'lobe-chat',
   };
@@ -31,9 +29,7 @@ export function register(options?: { debug?: true | DiagLogLevel, version?: stri
       new HttpInstrumentation(),
       getNodeAutoInstrumentations(),
     ],
-    metricReader: new PeriodicExportingMetricReader({
-      exporter: new OTLPMetricExporter(),
-    }),
+    metricReaders: [new PeriodicExportingMetricReader({ exporter: new OTLPMetricExporter() })],
     resource: resourceFromAttributes(attributes),
     traceExporter: new OTLPTraceExporter(),
   });
@@ -41,4 +37,4 @@ export function register(options?: { debug?: true | DiagLogLevel, version?: stri
   sdk.start();
 }
 
-export {DiagLogLevel} from '@opentelemetry/api';
+export { DiagLogLevel } from '@opentelemetry/api';

package/packages/types/src/discover/mcp.ts

@@ -39,10 +39,16 @@ export enum McpNavKey {
   Version = 'version',
 }
 
+export enum McpConnectionType {
+  http = 'http',
+  stdio = 'stdio'
+}
+
 export type DiscoverMcpItem = PluginItem;
 
 export interface McpQueryParams {
   category?: string;
+  connectionType?: McpConnectionType;
   locale?: string;
   order?: 'asc' | 'desc';
   page?: number;

package/packages/types/src/index.ts

@@ -26,7 +26,6 @@ export * from './session';
 export * from './tool';
 export * from './topic';
 export * from './user';
-export * from './user/settings';
 // FIXME: I think we need a refactor for the "openai" types
 // it more likes the UI message payload
 export * from './openai/chat';

package/packages/types/src/message/common/base.ts

@@ -1,5 +1,6 @@
 import type { ILobeAgentRuntimeErrorType } from '@lobechat/model-runtime';
 import type { IPluginErrorType } from '@lobehub/chat-plugin-sdk';
+import { z } from 'zod';
 
 import { ErrorType } from '../../fetch';
 
@@ -12,6 +13,12 @@ export interface ChatMessageError {
   type: ErrorType | IPluginErrorType | ILobeAgentRuntimeErrorType;
 }
 
+export const ChatMessageErrorSchema = z.object({
+  body: z.any().optional(),
+  message: z.string(),
+  type: z.union([z.string(), z.number()]),
+});
+
 export interface ChatCitationItem {
   id?: string;
   onlyUrl?: boolean;
@@ -24,3 +31,9 @@ export interface ModelReasoning {
   duration?: number;
   signature?: string;
 }
+
+export const ModelReasoningSchema = z.object({
+  content: z.string().optional(),
+  duration: z.number().optional(),
+  signature: z.string().optional(),
+});

package/packages/types/src/message/common/image.ts

@@ -1,9 +1,17 @@
+import { z } from 'zod';
+
 export interface ChatImageItem {
   alt: string;
   id: string;
   url: string;
 }
 
+export const ChatImageItemSchema = z.object({
+  alt: z.string(),
+  id: z.string(),
+  url: z.string(),
+});
+
 export interface ChatImageChunk {
   data: string;
   id: string;