@lobehub/lobehub 2.0.0-next.47 → 2.0.0-next.49

package/packages/model-runtime/src/providers/wenxin/index.test.ts

@@ -1,8 +1,8 @@
 // @vitest-environment node
-import { LobeOpenAICompatibleRuntime } from '@lobechat/model-runtime';
 import { ModelProvider } from 'model-bank';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
+import { LobeOpenAICompatibleRuntime } from '../../core/BaseAI';
 import { testProvider } from '../../providerTestUtils';
 import { LobeWenxinAI, params } from './index';
 

package/packages/model-runtime/src/providers/zhipu/index.test.ts

@@ -1,7 +1,7 @@
 // @vitest-environment node
-import { LobeOpenAICompatibleRuntime } from '@lobechat/model-runtime';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
+import { LobeOpenAICompatibleRuntime } from '../../core/BaseAI';
 import { testProvider } from '../../providerTestUtils';
 import { LobeZhipuAI, params } from './index';
 

package/packages/model-runtime/src/utils/errorResponse.test.ts

@@ -1,7 +1,7 @@
-import { AgentRuntimeErrorType } from '@lobechat/model-runtime';
 import { ChatErrorType } from '@lobechat/types';
 import { describe, expect, it, vi } from 'vitest';
 
+import { AgentRuntimeErrorType } from '../types/error';
 import { createErrorResponse } from './errorResponse';
 
 describe('createErrorResponse', () => {

package/packages/obervability-otel/src/node.ts

@@ -8,6 +8,7 @@ import { resourceFromAttributes } from '@opentelemetry/resources';
 import { PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } from '@opentelemetry/semantic-conventions';
+import { env } from 'node:process';
 
 export function register(options?: { debug?: true | DiagLogLevel; version?: string }) {
   const attributes: Record<string, string> = {
@@ -23,13 +24,26 @@ export function register(options?: { debug?: true | DiagLogLevel; version?: stri
     );
   }
 
+  let metricsExporterInterval = 1000;
+  if (env.OTEL_METRICS_EXPORTER_INTERVAL) {
+    const parsed = parseInt(env.OTEL_METRICS_EXPORTER_INTERVAL, 10);
+    if (!isNaN(parsed)) {
+      metricsExporterInterval = parsed;
+    }
+  }
+
   const sdk = new NodeSDK({
     instrumentations: [
       new PgInstrumentation(),
       new HttpInstrumentation(),
       getNodeAutoInstrumentations(),
     ],
-    metricReaders: [new PeriodicExportingMetricReader({ exporter: new OTLPMetricExporter() })],
+    metricReaders: [
+      new PeriodicExportingMetricReader({
+        exportIntervalMillis: metricsExporterInterval,
+        exporter: new OTLPMetricExporter(),
+      }),
+    ],
     resource: resourceFromAttributes(attributes),
     traceExporter: new OTLPTraceExporter(),
   });

package/packages/ssrf-safe-fetch/index.browser.ts

@@ -0,0 +1,14 @@
+/**
+ * Browser version of SSRF-safe fetch
+ * In browser environments, we simply use the native fetch API
+ * as SSRF attacks are not applicable in client-side code
+ */
+
+/**
+ * Browser-safe fetch implementation
+ * Uses native fetch API in browser environments
+ */
+// eslint-disable-next-line no-undef
+export const ssrfSafeFetch = async (url: string, options?: RequestInit): Promise<Response> => {
+  return fetch(url, options);
+};

package/packages/ssrf-safe-fetch/package.json

@@ -2,7 +2,14 @@
   "name": "ssrf-safe-fetch",
   "version": "1.0.0",
   "private": true,
-  "description": "",
+  "description": "SSRF-safe fetch implementation with browser/node conditional exports",
+  "exports": {
+    ".": {
+      "browser": "./index.browser.ts",
+      "node": "./index.ts",
+      "default": "./index.ts"
+    }
+  },
   "main": "index.ts",
   "scripts": {
     "test": "vitest run"

package/packages/types/src/discover/assistants.ts

@@ -24,6 +24,7 @@ export enum AssistantSorts {
   CreatedAt = 'createdAt',
   Identifier = 'identifier',
   KnowledgeCount = 'knowledgeCount',
+  MyOwn = 'myown',
   PluginCount = 'pluginCount',
   Title = 'title',
   TokenUsage = 'tokenUsage',
@@ -34,6 +35,7 @@ export enum AssistantNavKey {
   Overview = 'overview',
   Related = 'related',
   SystemRole = 'systemRole',
+  Version = 'version'
 }
 
 export interface DiscoverAssistantItem extends Omit<LobeAgentSettings, 'meta'>, MetaData {
@@ -47,14 +49,18 @@ export interface DiscoverAssistantItem extends Omit<LobeAgentSettings, 'meta'>,
   tokenUsage: number;
 }
 
+export type AssistantMarketSource = 'legacy' | 'new';
+
 export interface AssistantQueryParams {
   category?: string;
   locale?: string;
   order?: 'asc' | 'desc';
+  ownerId?: string;
   page?: number;
   pageSize?: number;
   q?: string;
   sort?: AssistantSorts;
+  source?: AssistantMarketSource;
 }
 
 export interface AssistantListResponse {
@@ -66,7 +72,17 @@ export interface AssistantListResponse {
 }
 
 export interface DiscoverAssistantDetail extends DiscoverAssistantItem {
+  currentVersion?: string;
   examples?: FewShots;
   related: DiscoverAssistantItem[];
   summary?: string;
+  versions?: DiscoverAssistantVersion[];
+}
+
+export interface DiscoverAssistantVersion {
+  createdAt?: string;
+  isLatest?: boolean;
+  isValidated?: boolean;
+  status?: 'published' | 'unpublished' | 'archived' | 'deprecated';
+  version: string;
 }

package/packages/types/src/index.ts

@@ -30,5 +30,6 @@ export * from './user';
 // it more likes the UI message payload
 export * from './openai/chat';
 export * from './openai/plugin';
+export * from './subscription';
 export * from './trace';
 export * from './zustand';

package/packages/types/src/message/common/base.ts

@@ -9,13 +9,13 @@ import { ErrorType } from '../../fetch';
  */
 export interface ChatMessageError {
   body?: any;
-  message: string;
+  message?: string;
   type: ErrorType | IPluginErrorType | ILobeAgentRuntimeErrorType;
 }
 
 export const ChatMessageErrorSchema = z.object({
   body: z.any().optional(),
-  message: z.string(),
+  message: z.string().optional(),
   type: z.union([z.string(), z.number()]),
 });
 

package/packages/types/src/message/common/tools.ts

@@ -4,10 +4,22 @@ import { z } from 'zod';
 
 import { LobeToolRenderType } from '../../tool';
 
+// ToolIntervention must be defined first to avoid circular dependency
+export interface ToolIntervention {
+  rejectedReason?: string;
+  status?: 'pending' | 'approved' | 'rejected' | 'none';
+}
+
+export const ToolInterventionSchema = z.object({
+  rejectedReason: z.string().optional(),
+  status: z.enum(['pending', 'approved', 'rejected', 'none']).optional(),
+});
+
 export interface ChatPluginPayload {
   apiName: string;
   arguments: string;
   identifier: string;
+  intervention?: ToolIntervention;
   type: LobeToolRenderType;
 }
 
@@ -16,6 +28,7 @@ export interface ChatToolPayload {
   arguments: string;
   id: string;
   identifier: string;
+  intervention?: ToolIntervention;
   result_msg_id?: string;
   type: LobeToolRenderType;
 }
@@ -34,7 +47,9 @@ export interface ChatToolResult {
  * Chat tool payload with merged execution result
  */
 export interface ChatToolPayloadWithResult extends ChatToolPayload {
+  intervention?: ToolIntervention;
   result?: ChatToolResult;
+  result_msg_id?: string;
 }
 
 export interface ToolsCallingContext {
@@ -91,6 +106,7 @@ export const ChatToolPayloadSchema = z.object({
   arguments: z.string(),
   id: z.string(),
   identifier: z.string(),
+  intervention: ToolInterventionSchema.optional(),
   result_msg_id: z.string().optional(),
   type: z.string(),
 });

package/packages/types/src/message/db/item.ts

@@ -1,6 +1,6 @@
 /* eslint-disable sort-keys-fix/sort-keys-fix , typescript-sort-keys/interface */
 import { GroundingSearch } from '../../search';
-import { MessageMetadata, ModelReasoning } from '../common';
+import { MessageMetadata, ModelReasoning, ToolIntervention } from '../common';
 
 export interface DBMessageItem {
   id: string;
@@ -33,3 +33,17 @@ export interface DBMessageItem {
   updatedAt: Date;
   createdAt: Date;
 }
+
+export interface MessagePluginItem {
+  id: string;
+  toolCallId?: string;
+  type: string;
+  intervention?: ToolIntervention;
+  apiName?: string;
+  arguments?: string;
+  identifier?: string;
+  state?: any;
+  error?: any;
+  clientId?: string;
+  userId: string;
+}

package/packages/types/src/message/ui/chat.ts

@@ -8,7 +8,12 @@ import {
   ModelReasoning,
   ModelUsage,
 } from '../common';
-import { ChatPluginPayload, ChatToolPayload, ChatToolPayloadWithResult } from '../common/tools';
+import {
+  ChatPluginPayload,
+  ChatToolPayload,
+  ChatToolPayloadWithResult,
+  ToolIntervention,
+} from '../common/tools';
 import { ChatMessageExtra } from './extra';
 import { ChatFileChunk } from './rag';
 import { ChatVideoItem } from './video';
@@ -95,6 +100,7 @@ export interface UIChatMessage {
   performance?: ModelPerformance;
   plugin?: ChatPluginPayload;
   pluginError?: any;
+  pluginIntervention?: ToolIntervention;
   pluginState?: any;
   provider?: string | null;
   /**

package/packages/types/src/message/ui/params.ts

@@ -4,7 +4,7 @@ import { z } from 'zod';
 import { UploadFileItem } from '../../files';
 import { MessageSemanticSearchChunk } from '../../rag';
 import { ChatMessageError, ChatMessageErrorSchema } from '../common/base';
-import { ChatPluginPayload } from '../common/tools';
+import { ChatPluginPayload, ToolInterventionSchema } from '../common/tools';
 import { UIChatMessage } from './chat';
 import { SemanticSearchChunkSchema } from './rag';
 
@@ -148,3 +148,17 @@ export const CreateNewMessageParamsSchema = z
     fileChunks: z.array(SemanticSearchChunkSchema).optional(),
   })
   .passthrough();
+
+export const UpdateMessagePluginSchema = z.object({
+  id: z.string().optional(),
+  toolCallId: z.string().optional(),
+  type: z.string().optional(),
+  intervention: ToolInterventionSchema.optional(),
+  apiName: z.string().optional(),
+  arguments: z.string().optional(),
+  identifier: z.string().optional(),
+  state: z.any().optional(),
+  error: z.any().optional(),
+  clientId: z.string().optional(),
+  userId: z.string().optional(),
+});

package/packages/types/src/meta.ts

@@ -10,6 +10,10 @@ export const LobeMetaDataSchema = z.object({
    */
   backgroundColor: z.string().optional(),
   description: z.string().optional(),
+  /**
+   * Market agent identifier for published agents
+   */
+  marketIdentifier: z.string().optional(),
 
   tags: z.array(z.string()).optional(),
   /**

package/packages/types/src/session/agentSession.ts

@@ -20,6 +20,8 @@ export interface LobeAgentSession {
   createdAt: Date;
   group?: string;
   id: string;
+  /** Market agent identifier for published agents */
+  marketIdentifier?: string;
   meta: MetaData;
   model: string;
   pinned?: boolean;

package/packages/types/src/tool/intervention.ts

@@ -5,10 +5,9 @@ import { z } from 'zod';
  */
 export type HumanInterventionPolicy =
   | 'never' // Never intervene, auto-execute
-  | 'always' // Always require intervention
-  | 'first'; // Require intervention on first call only
+  | 'require'; // Always require intervention
 
-export const HumanInterventionPolicySchema = z.enum(['never', 'always', 'first']);
+export const HumanInterventionPolicySchema = z.enum(['never', 'require']);
 
 /**
  * Argument Matcher for parameter-level filtering

package/packages/types/src/user/settings/tool.ts

@@ -1,42 +1,29 @@
-import type { HumanInterventionConfig } from '../../tool';
-
 export interface UserToolConfig {
+  /**
+   * Tool approval mode
+   * - auto-run: Automatically approve all tools without user consent
+   * - allow-list: Only approve tools in the allow list
+   * - manual: Require manual approval for each tool execution
+   */
+  approvalMode?: 'auto-run' | 'allow-list' | 'manual';
+
   dalle: {
     autoGenerate: boolean;
   };
+
   /**
-   * Human intervention configuration
+   * Tool intervention configuration
    */
   humanIntervention?: {
     /**
-     * List of confirmed tool calls (for 'once' policy)
-     * Format: "identifier/apiName" or "identifier/apiName#argsHash"
+     * Allow list of approved tools (used in 'allow-list' mode)
+     * Format: "identifier/apiName"
      *
      * Examples:
      * - "web-browsing/crawlSinglePage"
-     * - "bash/bash#a1b2c3d4"
-     */
-    confirmed?: string[];
-
-    /**
-     * Whether human intervention is enabled globally
-     * @default true
-     */
-    enabled: boolean;
-
-    /**
-     * Per-tool intervention policy overrides
-     * Key format: "identifier/apiName"
-     *
-     * Example:
-     * {
-     *   "web-browsing/crawlSinglePage": "confirm",
-     *   "bash/bash": [
-     *     { match: { command: "git add:*" }, policy: "auto" },
-     *     { policy: "confirm" }
-     *   ]
-     * }
+     * - "bash/bash"
+     * - "search/search"
      */
-    overrides?: Record<string, HumanInterventionConfig>;
+    allowList?: string[];
   };
 }

package/packages/utils/src/imageToBase64.ts

@@ -36,23 +36,30 @@ export const imageToBase64 = ({
   return canvas.toDataURL(type);
 };
 
+/**
+ * Convert image URL to base64
+ * Uses SSRF-safe fetch on server-side to prevent SSRF attacks
+ */
 export const imageUrlToBase64 = async (
   imageUrl: string,
 ): Promise<{ base64: string; mimeType: string }> => {
   try {
-    const res = await fetch(imageUrl);
+    const isServer = typeof window === 'undefined';
+
+    // Use SSRF-safe fetch on server-side to prevent SSRF attacks
+    const res = isServer
+      ? await import('ssrf-safe-fetch').then((m) => m.ssrfSafeFetch(imageUrl))
+      : await fetch(imageUrl);
+
     const blob = await res.blob();
     const arrayBuffer = await blob.arrayBuffer();
 
-    const base64 =
-      typeof btoa === 'function'
-        ? btoa(
-            new Uint8Array(arrayBuffer).reduce(
-              (data, byte) => data + String.fromCharCode(byte),
-              '',
-            ),
-          )
-        : Buffer.from(arrayBuffer).toString('base64');
+    // Client-side uses btoa, server-side uses Buffer
+    const base64 = isServer
+      ? Buffer.from(arrayBuffer).toString('base64')
+      : btoa(
+          new Uint8Array(arrayBuffer).reduce((data, byte) => data + String.fromCharCode(byte), ''),
+        );
 
     return { base64, mimeType: blob.type };
   } catch (error) {

package/packages/utils/src/index.ts

@@ -4,9 +4,9 @@ export * from './detectChinese';
 export * from './format';
 export * from './imageToBase64';
 export * from './keyboard';
+export * from './merge';
 export * from './number';
 export * from './object';
-export * from './parseModels';
 export * from './pricing';
 export * from './safeParseJSON';
 export * from './sleep';

package/renovate.json

@@ -17,22 +17,39 @@
   "ignoreDeps": [],
   "labels": ["dependencies"],
   "packageRules": [
-    // 1) Pinned deps: isolate (OK to use separate* here because there's no matchUpdateTypes)
     {
-      "description": "Isolate PRs for pinned deps (exact x.y.z)",
+      "description": "Un-group tilde ranges",
       "matchManagers": ["npm", "pnpm", "yarn", "bun"],
-      "matchCurrentValue": "^\\d+\\.\\d+\\.\\d+([+-][0-9A-Za-z.-]+)?$",
+      "matchCurrentValue": "^~.*$",
       "groupName": null,
-      "separateMinorPatch": true,
-      "separateMajorMinor": true
+      "groupSlug": null,
+      "separateMajorMinor": true,
+      "separateMinorPatch": true
     },
-    // 2) Non-pinned deps: Patch versions, grouped together
     {
-      "description": "Group patch versions together for non-pinned deps",
+      "description": "Un-group pinned deps (exact x.y.z)",
       "matchManagers": ["npm", "pnpm", "yarn", "bun"],
-      "matchCurrentValue": "/(^[~^]|[<>=| -])/", // anything that looks like a range
-      "groupName": "patch dependencies",
-      "matchUpdateTypes": ["patch"]
+      "matchCurrentValue": "/^\\d+\\.\\d+\\.\\d+([+-][0-9A-Za-z.-]+)?$/",
+      "groupName": null,
+      "groupSlug": null,
+      "separateMajorMinor": true,
+      "separateMinorPatch": true
+    },
+    {
+      "description": "Un-group experimental caret ranges (^0.x)",
+      "matchManagers": ["npm", "pnpm", "yarn", "bun"],
+      "matchCurrentValue": "^\\^0\\.\\d+(\\.\\d+)?([+-][0-9A-Za-z.-]+)?$",
+      "groupName": null,
+      "separateMajorMinor": true,
+      "separateMinorPatch": true
+    },
+    {
+      "description": "Group ^>=1 ranges for patch/minor",
+      "matchManagers": ["npm", "pnpm", "yarn", "bun"],
+      "matchCurrentValue": "/^\\^[1-9]+[0-9]*(\\.\\d+){0,2}([+-][0-9A-Za-z.-]+)?$/",
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-non-major-dependencies"
     }
   ],
   "postUpdateOptions": ["yarnDedupeHighest"],
@@ -41,7 +58,7 @@
   "rangeStrategy": "bump",
   "rebaseWhen": "conflicted",
   "schedule": "on sunday before 6:00am",
+  "separateMinorPatch": false,
   "separateMajorMinor": true,
-  "separateMultipleMajor": true,
   "timezone": "UTC"
 }

package/src/app/(backend)/market/agent/[[...segments]]/route.ts

@@ -0,0 +1,153 @@
+import { MarketSDK } from '@lobehub/market-sdk';
+import { NextRequest, NextResponse } from 'next/server';
+
+type RouteContext = {
+  params: Promise<{
+    segments?: string[];
+  }>;
+};
+
+const MARKET_BASE_URL = process.env.NEXT_PUBLIC_MARKET_BASE_URL || 'http://127.0.0.1:8787';
+
+const extractAccessToken = (req: NextRequest) => {
+  const authorization = req.headers.get('authorization');
+  if (!authorization) return undefined;
+
+  const [scheme, token] = authorization.split(' ');
+  if (scheme?.toLowerCase() !== 'bearer' || !token) return undefined;
+
+  return token;
+};
+
+const methodNotAllowed = (methods: string[]) =>
+  NextResponse.json(
+    {
+      error: 'method_not_allowed',
+      message: `Allowed methods: ${methods.join(', ')}`,
+      status: 'error',
+    },
+    {
+      headers: { Allow: methods.join(', ') },
+      status: 405,
+    },
+  );
+
+const badRequest = (error: string, message: string) =>
+  NextResponse.json(
+    {
+      error,
+      message,
+      status: 'error',
+    },
+    { status: 400 },
+  );
+
+const notFound = (reason: string) =>
+  NextResponse.json(
+    {
+      error: 'not_found',
+      message: reason,
+      status: 'error',
+    },
+    { status: 404 },
+  );
+
+const handleAgent = async (req: NextRequest, segments: string[]) => {
+  const accessToken = extractAccessToken(req);
+  const market = new MarketSDK({
+    accessToken,
+    baseURL: MARKET_BASE_URL,
+  });
+
+  if (segments.length === 0) {
+    return notFound('Missing agent action.');
+  }
+
+  const [action, ...rest] = segments;
+
+  if (action === 'create') {
+    if (req.method !== 'POST') return methodNotAllowed(['POST']);
+
+    try {
+      const payload = await req.json();
+      const response = await market.agents.createAgent(payload);
+      return NextResponse.json(response);
+    } catch (error) {
+      console.error('[Market] Failed to create agent:', error);
+      return NextResponse.json(
+        {
+          error: 'create_agent_failed',
+          message: error instanceof Error ? error.message : 'Unknown error',
+          status: 'error',
+        },
+        { status: 500 },
+      );
+    }
+  }
+
+  if (action === 'versions') {
+    if (rest.length !== 1 || rest[0] !== 'create') {
+      return notFound('Requested agent version endpoint is not available.');
+    }
+
+    if (req.method !== 'POST') return methodNotAllowed(['POST']);
+
+    try {
+      const payload = await req.json();
+      if (typeof payload !== 'object' || payload === null) {
+        return badRequest('invalid_payload', 'Request body must be a JSON object.');
+      }
+
+      const identifier = (payload as { identifier?: string }).identifier;
+      if (!identifier) {
+        return badRequest('missing_identifier', 'Identifier is required to create agent version.');
+      }
+
+      const response = await market.agents.createAgentVersion(payload);
+      return NextResponse.json(response);
+    } catch (error) {
+      console.error('[Market] Failed to create agent version:', error);
+      return NextResponse.json(
+        {
+          error: 'create_agent_version_failed',
+          message: error instanceof Error ? error.message : 'Unknown error',
+          status: 'error',
+        },
+        { status: 500 },
+      );
+    }
+  }
+
+  if (segments.length === 1) {
+    if (req.method !== 'GET') return methodNotAllowed(['GET']);
+
+    try {
+      const response = await market.agents.getAgentDetail(action);
+      return NextResponse.json(response);
+    } catch (error) {
+      console.error('[Market] Failed to get agent detail:', error);
+      return NextResponse.json(
+        {
+          error: 'get_agent_detail_failed',
+          message: error instanceof Error ? error.message : 'Unknown error',
+          status: 'error',
+        },
+        { status: 500 },
+      );
+    }
+  }
+
+  return notFound('Requested agent endpoint is not available.');
+};
+
+const handleProxy = async (req: NextRequest, context: RouteContext) => {
+  const { segments } = await context.params;
+  const normalizedSegments = segments?.map((segment) => decodeURIComponent(segment)) ?? [];
+
+  return handleAgent(req, normalizedSegments);
+};
+
+export const GET = (req: NextRequest, context: RouteContext) => handleProxy(req, context);
+export const POST = (req: NextRequest, context: RouteContext) => handleProxy(req, context);
+
+export const dynamic = 'force-dynamic';