@researai/deepscientist 1.5.15 → 1.5.16

package/src/deepscientist/codex_cli_compat.py

@@ -2,12 +2,19 @@ from __future__ import annotations
 
 import json
 import re
+import shutil
 import subprocess
 import tomllib
 from functools import lru_cache
+from pathlib import Path
+
+from .shared import ensure_dir, read_text, write_text
 
 _MIN_XHIGH_SUPPORTED_VERSION = (0, 63, 0)
 _CODEX_VERSION_PATTERN = re.compile(r"codex-cli\s+(\d+)\.(\d+)\.(\d+)", re.IGNORECASE)
+_CODEX_HOME_SYNCED_FILES = ("config.toml", "auth.json")
+_CODEX_HOME_SYNCED_DIRS = ("skills", "agents", "prompts")
+_CODEX_HOME_QUEST_OVERLAY_DIRS = ("skills", "prompts")
 
 
 def parse_codex_cli_version(text: str) -> tuple[int, int, int] | None:
@@ -115,3 +122,228 @@ def adapt_profile_only_provider_config(
             f"{', '.join(injected_fields)} to the top level for Codex compatibility."
         ),
     )
+
+
+def _remove_tree_path(path: Path) -> None:
+    if not path.exists() and not path.is_symlink():
+        return
+    if path.is_symlink() or path.is_file():
+        path.unlink()
+        return
+    shutil.rmtree(path)
+
+
+def _overlay_file_sources(*roots: Path) -> dict[Path, Path]:
+    merged: dict[Path, Path] = {}
+    for root in roots:
+        if not root.exists() or not root.is_dir():
+            continue
+        for source_path in sorted(root.rglob("*")):
+            if not source_path.is_file():
+                continue
+            merged[source_path.relative_to(root)] = source_path
+    return merged
+
+
+def _sync_overlay_directory(target_dir: Path, *source_dirs: Path) -> None:
+    desired_files = _overlay_file_sources(*source_dirs)
+    if not desired_files:
+        _remove_tree_path(target_dir)
+        return
+
+    desired_dirs: set[Path] = {Path(".")}
+    for relative in desired_files:
+        parent = relative.parent
+        while True:
+            desired_dirs.add(parent)
+            if parent == Path("."):
+                break
+            parent = parent.parent
+
+    if target_dir.exists() or target_dir.is_symlink():
+        for existing_path in sorted(target_dir.rglob("*"), reverse=True):
+            relative = existing_path.relative_to(target_dir)
+            if existing_path.is_dir() and not existing_path.is_symlink():
+                if relative not in desired_dirs:
+                    shutil.rmtree(existing_path)
+                continue
+            if relative not in desired_files:
+                existing_path.unlink()
+
+    ensure_dir(target_dir)
+    for relative in sorted(desired_dirs, key=lambda item: (len(item.parts), item.as_posix())):
+        if relative == Path("."):
+            continue
+        current = target_dir / relative
+        if current.exists() and (current.is_symlink() or current.is_file()):
+            current.unlink()
+        ensure_dir(current)
+
+    for relative, source_path in desired_files.items():
+        target_path = target_dir / relative
+        if target_path.exists() and target_path.is_dir() and not target_path.is_symlink():
+            shutil.rmtree(target_path)
+        ensure_dir(target_path.parent)
+        try:
+            same_path = source_path.resolve() == target_path.resolve()
+        except FileNotFoundError:
+            same_path = False
+        if same_path:
+            continue
+        shutil.copy2(source_path, target_path)
+
+
+def materialize_codex_runtime_home(
+    *,
+    source_home: str | Path,
+    target_home: str | Path,
+    profile: str = "",
+    quest_codex_root: str | Path | None = None,
+) -> str | None:
+    source_root = Path(source_home).expanduser()
+    target_root = ensure_dir(Path(target_home))
+
+    for filename in _CODEX_HOME_SYNCED_FILES:
+        source_path = source_root / filename
+        target_path = target_root / filename
+        if not source_path.exists():
+            _remove_tree_path(target_path)
+            continue
+        if target_path.exists() and target_path.is_dir() and not target_path.is_symlink():
+            shutil.rmtree(target_path)
+        ensure_dir(target_path.parent)
+        try:
+            same_path = source_path.resolve() == target_path.resolve()
+        except FileNotFoundError:
+            same_path = False
+        if not same_path:
+            shutil.copy2(source_path, target_path)
+
+    overlay_root = Path(quest_codex_root) if quest_codex_root is not None else None
+    for dirname in _CODEX_HOME_SYNCED_DIRS:
+        overlay_dir = overlay_root / dirname if overlay_root is not None and dirname in _CODEX_HOME_QUEST_OVERLAY_DIRS else None
+        source_dirs: list[Path] = [source_root / dirname]
+        if overlay_dir is not None:
+            source_dirs.append(overlay_dir)
+        _sync_overlay_directory(target_root / dirname, *source_dirs)
+
+    warning: str | None = None
+    config_path = target_root / "config.toml"
+    if profile and config_path.exists():
+        adapted_text, warning = adapt_profile_only_provider_config(read_text(config_path), profile=profile)
+        write_text(config_path, adapted_text)
+    return warning
+
+
+def provider_profile_metadata(
+    config_text: str,
+    *,
+    profile: str,
+) -> dict[str, str | bool | None]:
+    normalized_profile = str(profile or "").strip()
+    if not normalized_profile or not str(config_text or "").strip():
+        return {
+            "provider": None,
+            "model": None,
+            "env_key": None,
+            "base_url": None,
+            "wire_api": None,
+            "requires_openai_auth": None,
+        }
+    try:
+        parsed = tomllib.loads(config_text)
+    except tomllib.TOMLDecodeError:
+        return {
+            "provider": None,
+            "model": None,
+            "env_key": None,
+            "base_url": None,
+            "wire_api": None,
+            "requires_openai_auth": None,
+        }
+
+    profiles = parsed.get("profiles")
+    if not isinstance(profiles, dict):
+        return {
+            "provider": None,
+            "model": None,
+            "env_key": None,
+            "base_url": None,
+            "wire_api": None,
+            "requires_openai_auth": None,
+        }
+    profile_payload = profiles.get(normalized_profile)
+    if not isinstance(profile_payload, dict):
+        return {
+            "provider": None,
+            "model": None,
+            "env_key": None,
+            "base_url": None,
+            "wire_api": None,
+            "requires_openai_auth": None,
+        }
+
+    model_provider = str(
+        profile_payload.get("model_provider")
+        or parsed.get("model_provider")
+        or ""
+    ).strip() or None
+    model = str(
+        profile_payload.get("model")
+        or parsed.get("model")
+        or ""
+    ).strip() or None
+    provider_payload = None
+    model_providers = parsed.get("model_providers")
+    if model_provider and isinstance(model_providers, dict):
+        candidate = model_providers.get(model_provider)
+        if isinstance(candidate, dict):
+            provider_payload = candidate
+
+    env_key = (
+        str(provider_payload.get("env_key") or "").strip()
+        if isinstance(provider_payload, dict)
+        else None
+    ) or None
+    base_url = (
+        str(provider_payload.get("base_url") or "").strip()
+        if isinstance(provider_payload, dict)
+        else None
+    ) or None
+    wire_api = (
+        str(provider_payload.get("wire_api") or "").strip()
+        if isinstance(provider_payload, dict)
+        else None
+    ) or None
+    requires_openai_auth = (
+        bool(provider_payload.get("requires_openai_auth"))
+        if isinstance(provider_payload, dict) and "requires_openai_auth" in provider_payload
+        else None
+    )
+
+    return {
+        "provider": model_provider,
+        "model": model,
+        "env_key": env_key,
+        "base_url": base_url,
+        "wire_api": wire_api,
+        "requires_openai_auth": requires_openai_auth,
+    }
+
+
+def provider_profile_metadata_from_home(
+    config_home: str | Path,
+    *,
+    profile: str,
+) -> dict[str, str | bool | None]:
+    config_path = Path(config_home).expanduser() / "config.toml"
+    if not config_path.exists():
+        return {
+            "provider": None,
+            "model": None,
+            "env_key": None,
+            "base_url": None,
+            "wire_api": None,
+            "requires_openai_auth": None,
+        }
+    return provider_profile_metadata(config_path.read_text(encoding="utf-8"), profile=profile)

package/src/deepscientist/config/models.py

@@ -38,6 +38,7 @@ def default_config(home: Path) -> dict:
         "ui": {
             "host": "0.0.0.0",
             "port": 20999,
+            "auth_enabled": False,
             "auto_open_browser": True,
             "default_mode": "web",
         },
@@ -96,7 +97,7 @@ def default_runners() -> dict:
             "binary": "codex",
             "config_dir": "~/.codex",
             "profile": "",
-            "model": "gpt-5.4",
+            "model": "inherit",
             "model_reasoning_effort": "xhigh",
             "approval_policy": "never",
             "sandbox_mode": "danger-full-access",

package/src/deepscientist/config/service.py

@@ -4,13 +4,17 @@ import json
 import os
 import subprocess
 import tempfile
-from shutil import copy2
 from copy import deepcopy
 from pathlib import Path
 from urllib.error import URLError
 from urllib.request import Request
 
-from ..codex_cli_compat import adapt_profile_only_provider_config, normalize_codex_reasoning_effort
+from ..codex_cli_compat import (
+    adapt_profile_only_provider_config,
+    materialize_codex_runtime_home,
+    normalize_codex_reasoning_effort,
+    provider_profile_metadata_from_home,
+)
 from ..connector.connector_profiles import PROFILEABLE_CONNECTOR_NAMES, list_connector_profiles, normalize_connector_config
 from ..connector_runtime import build_discovered_target, infer_connector_transport
 from ..home import repo_root
@@ -1192,6 +1196,14 @@ Use **Test** when the file exposes runtime dependencies.
             return "gpt-5.4"
         return str(raw_model).strip()
 
+    @staticmethod
+    def _codex_effective_model(config: dict) -> str:
+        requested = ConfigManager._codex_requested_model(config)
+        profile = ConfigManager._codex_profile_name(config)
+        if profile and not ConfigManager._codex_should_inherit_model(requested):
+            return "inherit"
+        return requested
+
     @staticmethod
     def _codex_profile_name(config: dict) -> str:
         raw_profile = config.get("profile")
@@ -1233,10 +1245,11 @@ Use **Test** when the file exposes runtime dependencies.
 
         temp_home = tempfile.TemporaryDirectory(prefix="ds-codex-probe-")
         temp_root = Path(temp_home.name)
-        for filename in ("auth.json",):
-            source_path = expanded / filename
-            if source_path.exists():
-                copy2(source_path, temp_root / filename)
+        materialize_codex_runtime_home(
+            source_home=expanded,
+            target_home=temp_root,
+            profile=profile,
+        )
         write_text(temp_root / "config.toml", adapted_text)
         return str(temp_root), warning, temp_home
 
@@ -1361,6 +1374,7 @@ Use **Test** when the file exposes runtime dependencies.
         resolved_binary = resolve_runner_binary(binary, runner_name="codex")
         profile = self._codex_profile_name(config)
         requested_model = self._codex_requested_model(config)
+        effective_model = self._codex_effective_model(config)
         raw_reasoning_effort = config.get("model_reasoning_effort")
         requested_reasoning_effort = (
             str(raw_reasoning_effort).strip()
@@ -1376,9 +1390,9 @@ Use **Test** when the file exposes runtime dependencies.
             "resolved_binary": resolved_binary,
             "config_dir": str(config.get("config_dir") or "~/.codex"),
             "profile": profile,
-            "model": requested_model or "inherit",
+            "model": effective_model or "inherit",
             "requested_model": requested_model or "inherit",
-            "effective_model": requested_model or "inherit",
+            "effective_model": effective_model or "inherit",
             "approval_policy": str(config.get("approval_policy") or "on-request"),
             "sandbox_mode": str(config.get("sandbox_mode") or "workspace-write"),
             "reasoning_effort": reasoning_effort,
@@ -1416,9 +1430,17 @@ Use **Test** when the file exposes runtime dependencies.
             env["CODEX_HOME"] = prepared_home
             if profile_config_warning:
                 compatibility_warnings.append(profile_config_warning)
+        metadata = provider_profile_metadata_from_home(env.get("CODEX_HOME") or config_dir, profile=profile)
+        if metadata.get("requires_openai_auth") is False:
+            env.pop("OPENAI_API_KEY", None)
+            env.pop("OPENAI_BASE_URL", None)
         prompt = "Reply with exactly HELLO."
         if reasoning_effort_warning:
             compatibility_warnings.append(reasoning_effort_warning)
+        if profile and effective_model == "inherit" and not self._codex_should_inherit_model(requested_model):
+            compatibility_warnings.append(
+                f"Codex profile `{profile}` is provider-backed. DeepScientist is probing it with `model: inherit`."
+            )
         base_warnings: list[str] = list(compatibility_warnings)
 
         def run_probe_once(model_for_command: str) -> tuple[list[str], subprocess.CompletedProcess[str] | None, subprocess.TimeoutExpired | None]:
@@ -1445,7 +1467,7 @@ Use **Test** when the file exposes runtime dependencies.
                 return command, None, exc
             return command, result, None
 
-        command, result, timeout_error = run_probe_once(requested_model)
+        command, result, timeout_error = run_probe_once(effective_model)
         if timeout_error is not None:
             details.update(
                 {

package/src/deepscientist/daemon/api/handlers.py

@@ -17,6 +17,11 @@ from ...quest import QuestService
 from ...shared import generate_id, read_json, read_text, resolve_within, run_command, sha256_text, utc_now
 from ...runners import RunRequest
 
+_COPILOT_LEAD_MESSAGE = (
+    "我是 DeepScientist，任何事情都可以找我帮忙。"
+    "你可以让我读论文、改代码、看实验、整理思路，或者直接开始执行一个任务。"
+)
+
 
 class ApiHandlers:
     def __init__(self, app: "DaemonApp") -> None:
@@ -73,6 +78,8 @@ class ApiHandlers:
         runtime_payload = {
             "surface": "quest",
             "version": DEEPSCIENTIST_VERSION,
+            "homePath": str(self.app.home),
+            "auth": self.app.browser_auth_runtime_payload(),
             "supports": {
                 "productApis": False,
                 "socketIo": False,
@@ -158,9 +165,87 @@ npm --prefix src/ui run build</pre>
             "daemon_id": self.app.daemon_id,
             "managed_by": self.app.daemon_managed_by,
             "pid": os.getpid(),
+            "auth_enabled": self.app.browser_auth_enabled,
             "sessions": self.app.sessions.snapshot(),
         }
 
+    def auth_login(self, body: dict | None = None) -> tuple[int, dict, str] | tuple[int, dict]:
+        if not self.app.browser_auth_enabled:
+            payload = {
+                "ok": True,
+                "authenticated": True,
+                "auth_enabled": False,
+            }
+            return 200, {"Content-Type": "application/json; charset=utf-8"}, json.dumps(payload, ensure_ascii=False)
+
+        candidate = str(((body or {}) if isinstance(body, dict) else {}).get("token") or "").strip()
+        if not candidate:
+            return 400, {
+                "ok": False,
+                "message": "Token is required.",
+                "auth_required": True,
+                "auth_enabled": True,
+            }
+        if not self.app.browser_auth_matches(candidate):
+            return 401, {
+                "ok": False,
+                "message": "Invalid token.",
+                "auth_required": True,
+                "auth_enabled": True,
+            }
+        payload = {
+            "ok": True,
+            "authenticated": True,
+            "auth_enabled": True,
+            "token_masked": self.app.masked_browser_auth_token(),
+        }
+        return (
+            200,
+            {
+                "Content-Type": "application/json; charset=utf-8",
+                "Cache-Control": "no-store, max-age=0, must-revalidate",
+                "Set-Cookie": self.app._browser_auth_cookie_header(candidate),
+            },
+            json.dumps(payload, ensure_ascii=False),
+        )
+
+    def auth_token(self) -> dict:
+        return {
+            "ok": True,
+            "auth_enabled": self.app.browser_auth_enabled,
+            "token": self.app.browser_auth_token,
+            "token_masked": self.app.masked_browser_auth_token(),
+        }
+
+    def auth_rotate(self, body: dict | None = None) -> tuple[int, dict, str] | tuple[int, dict]:
+        if not self.app.browser_auth_enabled:
+            payload = {
+                "ok": True,
+                "auth_enabled": False,
+                "rotated": False,
+                "token": None,
+                "token_masked": None,
+            }
+            return 200, {"Content-Type": "application/json; charset=utf-8"}, json.dumps(payload, ensure_ascii=False)
+
+        rotated = self.app.rotate_browser_auth_token()
+        payload = {
+            "ok": True,
+            "auth_enabled": True,
+            "rotated": True,
+            "token": rotated,
+            "token_masked": self.app.masked_browser_auth_token(),
+        }
+        return (
+            200,
+            {
+                "Content-Type": "application/json; charset=utf-8",
+                "Cache-Control": "no-store, max-age=0, must-revalidate",
+                "Set-Cookie": self.app._browser_auth_cookie_header(rotated),
+            },
+            json.dumps(payload, ensure_ascii=False),
+        )
+
     def system_update(self) -> dict:
         return self.app.system_update_status()
 
@@ -324,6 +409,33 @@ npm --prefix src/ui run build</pre>
             return 400, {"ok": False, "message": str(exc)}
         except RuntimeError as exc:
             return 409, {"ok": False, "message": str(exc)}
+        workspace_mode = (
+            str(startup_contract.get("workspace_mode") or "").strip().lower()
+            if isinstance(startup_contract, dict)
+            else ""
+        )
+        if workspace_mode in {"copilot", "autonomous"}:
+            quest_root = self.app.quest_service._quest_root(snapshot["quest_id"])
+            self.app.quest_service.update_research_state(quest_root, workspace_mode=workspace_mode)
+            if workspace_mode == "copilot":
+                self.app.quest_service.append_message(
+                    snapshot["quest_id"],
+                    "assistant",
+                    _COPILOT_LEAD_MESSAGE,
+                    source="deepscientist",
+                )
+                self.app.quest_service.update_runtime_state(
+                    quest_root=quest_root,
+                    status="idle",
+                    display_status="idle",
+                )
+                self.app.quest_service.set_continuation_state(
+                    quest_root,
+                    policy="wait_for_user_or_resume",
+                    anchor="decision",
+                    reason="copilot_mode",
+                )
+            snapshot = self.app.quest_service.snapshot(snapshot["quest_id"])
         payload: dict[str, object] = {"ok": True, "snapshot": snapshot}
         if auto_start:
             startup = self.app.submit_user_message(
@@ -474,11 +586,12 @@ npm --prefix src/ui run build</pre>
 
     def quest_session(self, quest_id: str) -> dict:
         snapshot = self.app.quest_service.snapshot_fast(quest_id)
-        for kind in ("details", "canvas"):
+        for kind in ("details", "canvas", "git_canvas"):
             try:
                 self.app.quest_service.prime_projection(quest_id, kind)
             except Exception:
                 continue
+        self.app.schedule_latest_quest_terminal_prewarm(quest_id)
         return {
             "ok": True,
             "quest_id": quest_id,
@@ -496,7 +609,7 @@ npm --prefix src/ui run build</pre>
         tail = tail_raw in {"1", "true", "yes", "on"}
         format_name = ((query.get("format") or ["both"])[0] or "both").lower()
         session_id = ((query.get("session_id") or [f"quest:{quest_id}"])[0] or f"quest:{quest_id}")
-        payload = self._fresh_quest_service().events(
+        payload = self.app.quest_service.events(
             quest_id,
             after=after,
             before=before,
@@ -1028,6 +1141,15 @@ npm --prefix src/ui run build</pre>
             node["optimization_candidate_count"] = candidate_count_by_branch.get(ref, 0)
         return payload
 
+    def git_canvas(self, quest_id: str) -> dict:
+        quest_root = self._fresh_quest_service()._quest_root(quest_id)
+        payload = self.app.quest_service.git_commit_canvas(quest_id)
+        research_state = self.app.quest_service.read_research_state(quest_root)
+        active_workspace_branch = str(research_state.get("current_workspace_branch") or "").strip() or None
+        payload["active_workspace_ref"] = active_workspace_branch
+        payload["workspace_mode"] = str(research_state.get("workspace_mode") or "copilot").strip() or "copilot"
+        return payload
+
     def git_log(self, quest_id: str, path: str) -> dict:
         query = self.parse_query(path)
         ref = ((query.get("ref") or [""])[0] or "").strip()
@@ -1390,10 +1512,7 @@ npm --prefix src/ui run build</pre>
             mime_type = mimetypes.guess_type(file_path.name)[0] or "application/octet-stream"
             content = quest_service._read_git_bytes(quest_root, revision, relative)
             return 200, self._asset_headers(mime_type), content
-        path, _writable, _scope, _source_kind = quest_service._resolve_document(
-            quest_service._quest_root(quest_id),
-            document_id,
-        )
+        path, _writable, _scope, _source_kind = quest_service.resolve_document(quest_id, document_id)
         if not path.exists() or not path.is_file():
             return 404, {"Content-Type": "text/plain; charset=utf-8"}, b"Not Found"
         mime_type = mimetypes.guess_type(path.name)[0] or "application/octet-stream"

package/src/deepscientist/daemon/api/router.py

@@ -9,6 +9,9 @@ ROUTES: list[tuple[str, re.Pattern[str], str]] = [
     ("GET", re.compile(r"^/metis/agent/api/health$"), "lingzhu_health"),
     ("POST", re.compile(r"^/metis/agent/api/sse$"), "lingzhu_sse"),
     ("GET", re.compile(r"^/(?P<spa_path>(?!api(?:/|$)|metis(?:/|$)|ui(?:/|$)|assets(?:/|$)).+)$"), "spa_root"),
+    ("POST", re.compile(r"^/api/auth/login$"), "auth_login"),
+    ("GET", re.compile(r"^/api/auth/token$"), "auth_token"),
+    ("POST", re.compile(r"^/api/auth/rotate$"), "auth_rotate"),
     ("GET", re.compile(r"^/api/health$"), "health"),
     ("GET", re.compile(r"^/api/system/update$"), "system_update"),
     ("POST", re.compile(r"^/api/system/update$"), "system_update_action"),
@@ -63,6 +66,7 @@ ROUTES: list[tuple[str, re.Pattern[str], str]] = [
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/metrics/timeline$"), "metrics_timeline"),
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/baselines/compare$"), "baseline_compare"),
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/git/branches$"), "git_branches"),
+    ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/git/canvas$"), "git_canvas"),
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/git/log$"), "git_log"),
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/git/compare$"), "git_compare"),
     ("GET", re.compile(r"^/api/quests/(?P<quest_id>[^/]+)/git/commit$"), "git_commit"),