@shawnstack/quickforge 1.7.5 → 1.7.6

package/server/agent-profiles.mjs

@@ -75,7 +75,7 @@ function builtinProfileFromSubagent(definition, override = null) {
     allowedTools: [...definition.allowedTools],
     capabilityPolicy: definition.capabilityPolicy || inferCapabilityPolicy(definition.allowedTools),
     model: modelReferenceSnapshot(override?.model || definition.model),
-    thinkingLevel: 'inherit',
+    thinkingLevel: normalizeAgentProfileThinkingLevel(override?.thinkingLevel || 'inherit'),
     lifecycle: 'builtin',
     managed: true,
     maxRuntimeMs: definition.maxRuntimeMs || DEFAULT_MAX_RUNTIME_MS,
@@ -308,17 +308,36 @@ export async function updateCustomAgentProfile(id, patch) {
   return { ...next, filePath: file, relativePath: `~/.quickforge/agents/${next.name}.md` }
 }
 
-export async function updateBuiltinAgentModelOverride(id, modelInput) {
+export async function updateBuiltinAgentOverrides(id, patch = {}) {
   const current = await getAgentProfile(id)
   if (!current) throw requestError('Agent not found', 404)
-  if (!current.builtin) throw requestError('Only built-in agents support model overrides', 400)
-  const model = validateModelReference(normalizeModelReference(modelInput))
+  if (!current.builtin) throw requestError('Only built-in agents support overrides', 400)
   const overrides = await readStore(BUILTIN_OVERRIDES_STORE).catch(() => ({}))
-  const next = { ...(overrides && typeof overrides === 'object' ? overrides : {}) }
-  if (model.mode === 'fixed') next[current.name] = { model }
-  else delete next[current.name]
+  const base = overrides && typeof overrides === 'object' ? overrides : {}
+  const next = { ...base }
+  const entry = { ...(base[current.name] && typeof base[current.name] === 'object' ? base[current.name] : {}) }
+
+  if (Object.prototype.hasOwnProperty.call(patch, 'model')) {
+    const model = validateModelReference(normalizeModelReference(patch.model))
+    if (model.mode === 'fixed') entry.model = model
+    else delete entry.model
+  }
+  if (Object.prototype.hasOwnProperty.call(patch, 'thinkingLevel')) {
+    const thinkingLevel = normalizeAgentProfileThinkingLevel(patch.thinkingLevel)
+    if (thinkingLevel === 'inherit') delete entry.thinkingLevel
+    else entry.thinkingLevel = thinkingLevel
+  }
+
+  if (Object.keys(entry).length === 0) delete next[current.name]
+  else next[current.name] = entry
   await writeStore(BUILTIN_OVERRIDES_STORE, next)
-  return { ...current, model: modelReferenceSnapshot(model) }
+
+  const definition = subagentDefinitions.find((item) => item.name === current.name)
+  return builtinProfileFromSubagent(definition, next[current.name] || null)
+}
+
+export async function updateBuiltinAgentModelOverride(id, modelInput) {
+  return updateBuiltinAgentOverrides(id, { model: modelInput })
 }
 
 export async function deleteCustomAgentProfile(id) {

package/server/auto-compaction.mjs

@@ -18,6 +18,14 @@ export const DEFAULT_AUTO_COMPACT_SETTINGS = {
   requireConfirmation: true,
 }
 
+/**
+ * 保留尾部（最近回合）的字符预算上限。当会话以工具消息为主、user 回合
+ * 稀疏时，按 keepRecentTurns 从尾部回溯会跨越大量工具消息，导致压缩
+ * 范围过小甚至为空（tailStart 与 compactedUpToIndex 重合）。达到该预算
+ * 时按当前用户轮次起点截断，将更早的完整工具链历史并入压缩范围。
+ */
+export const DEFAULT_MAX_TAIL_CHARS = 40000
+
 const AUTO_COMPACT_MIN_INTERVAL_MS = 30_000
 const AUTO_COMPACT_REJECTION_SUPPRESS_MS = 10 * 60_000
 
@@ -64,11 +72,13 @@ function contentToText(content) {
   }).filter(Boolean).join('\n')
 }
 
+function messageChars(message) {
+  if (!message || typeof message !== 'object') return 0
+  return [message.role || '', contentToText(message.content), safeJson(message.attachments)].join('\n').length
+}
+
 function estimateMessagesChars(messages) {
-  return (Array.isArray(messages) ? messages : []).reduce((total, message) => {
-    if (!message || typeof message !== 'object') return total
-    return total + [message.role || '', contentToText(message.content), safeJson(message.attachments)].join('\n').length
-  }, 0)
+  return (Array.isArray(messages) ? messages : []).reduce((total, message) => total + messageChars(message), 0)
 }
 
 function isUserMessage(message) {
@@ -76,13 +86,26 @@ function isUserMessage(message) {
     && !isCompactSummaryMessage(message)
 }
 
-function tailStartForRecentTurns(messages, keepRecentTurns) {
+function isToolResultMessage(message) {
+  return message?.role === 'toolResult'
+}
+
+export function tailStartForRecentTurns(messages, keepRecentTurns, maxTailChars = DEFAULT_MAX_TAIL_CHARS) {
   const source = Array.isArray(messages) ? messages : []
   let seenUserTurns = 0
+  let tailChars = 0
   for (let index = source.length - 1; index >= 0; index--) {
-    if (!isUserMessage(source[index])) continue
-    seenUserTurns += 1
+    if (isUserMessage(source[index])) seenUserTurns += 1
+    tailChars += messageChars(source[index])
     if (seenUserTurns >= keepRecentTurns) return index
+    // 保留的尾部超过预算：仍按完整用户轮次切分，避免把当前运行中的
+    // assistant/toolResult 链从中间截断，导致压缩线落在一轮对话内部。
+    if (tailChars >= maxTailChars) {
+      for (let turnStart = index; turnStart >= 0; turnStart--) {
+        if (isUserMessage(source[turnStart])) return turnStart
+      }
+      return 0
+    }
   }
   return 0
 }
@@ -145,7 +168,11 @@ export function buildAutoCompactLoopMessages(session, messages) {
   if (!summaryMessage) return messages
   const source = Array.isArray(messages) ? messages : []
   const compactedUpToIndex = Math.min(source.length, Math.max(0, Number(session.contextCompaction?.compactedUpToIndex) || 0))
-  return [summaryMessage, ...source.slice(compactedUpToIndex)]
+  // 防御旧持久化数据：compactedUpToIndex 可能指向 toolResult，跳过开头的孤儿，
+  // 避免压缩后的消息序列以 tool 消息开头（LLM API 会拒绝孤立 tool 消息）
+  let tailStart = compactedUpToIndex
+  while (tailStart < source.length && isToolResultMessage(source[tailStart])) tailStart += 1
+  return [summaryMessage, ...source.slice(tailStart)]
 }
 
 export async function compactSessionInPlace({

package/server/cloud/client.mjs

@@ -60,19 +60,16 @@ export class CloudClient {
 
   health(signal) { return this.request('healthz', { signal }) }
   ready(signal) { return this.request('readyz', { signal }) }
-  registerGuest(input, idempotencyKey, signal) {
-    return this.request('v1/guest/installations', {
-      method: 'POST', body: input, headers: { 'Idempotency-Key': idempotencyKey }, signal,
-    })
-  }
   refresh(refreshToken, signal) {
     return this.request('oauth/token', {
       method: 'POST', body: { grantType: 'refresh_token', refreshToken }, signal,
     })
   }
-  authorizeDevice(token, installationId, clientId = 'quickforge-desktop', signal) {
+  authorizeDevice({ installationId, clientId = 'quickforge-desktop', publicKey, installationName, platform, clientVersion, signal } = {}) {
     return this.request('oauth/device_authorization', {
-      method: 'POST', token, body: { installationId, clientId }, signal,
+      method: 'POST',
+      body: { installationId, clientId, publicKey, installationName, platform, clientVersion },
+      signal,
     })
   }
   exchangeDeviceCode(deviceCode, clientId = 'quickforge-desktop', signal) {

package/server/cloud/config.mjs

@@ -3,7 +3,7 @@ import net from 'node:net'
 const DEFAULT_TIMEOUT_MS = 10_000
 
 function isLoopbackHost(hostname) {
-  const host = String(hostname || '').toLowerCase()
+  const host = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '')
   if (host === 'localhost' || host.endsWith('.localhost')) return true
   const ip = net.isIP(host)
   if (ip === 4) return host.startsWith('127.')
@@ -25,10 +25,11 @@ export function parseCloudBaseUrl(value, _options = {}) {
   if (url.username || url.password || url.search || url.hash) {
     throw new Error('QUICKFORGE_CLOUD_URL must not contain credentials, query parameters, or fragments.')
   }
-  if (url.protocol !== 'https:') {
-    if (!(url.protocol === 'http:' && isLoopbackHost(url.hostname))) {
-      throw new Error('QUICKFORGE_CLOUD_URL must use HTTPS. HTTP is allowed only for loopback addresses.')
-    }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+    throw new Error('QUICKFORGE_CLOUD_URL must use http or https.')
+  }
+  if (url.protocol === 'http:' && !isLoopbackHost(url.hostname)) {
+    throw new Error('QUICKFORGE_CLOUD_URL over HTTP is only allowed for loopback hosts.')
   }
   if (url.pathname.includes('..')) throw new Error('QUICKFORGE_CLOUD_URL contains an unsafe path.')
   url.pathname = `${url.pathname.replace(/\/+$/, '')}/`

package/server/cloud/credential-store.mjs

@@ -1,4 +1,4 @@
-import { generateKeyPair } from 'node:crypto'
+import { generateKeyPair, randomUUID } from 'node:crypto'
 import { promises as fs } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -145,8 +145,15 @@ export function createCloudCredentialStore({
 
   async function ensureInstallation() {
     const current = await read()
-    if (current.publicKey && current.privateKeyPkcs8) return current
-    return update(async (record) => ({ ...record, ...(await generateInstallationKeyPair()) }))
+    if (current.publicKey && current.privateKeyPkcs8 && current.installationId) return current
+    return update(async (record) => {
+      const keyPair = (record.publicKey && record.privateKeyPkcs8) ? {} : await generateInstallationKeyPair()
+      return {
+        ...record,
+        ...keyPair,
+        installationId: record.installationId || randomUUID(),
+      }
+    })
   }
 
   async function rotateInstallation() {

package/server/cloud/identity.mjs

@@ -1,5 +1,4 @@
-import { createHash, randomUUID } from 'node:crypto'
-import { CloudApiError } from './client.mjs'
+import { CloudApiError } from './client.mjs'
 
 const SESSION_INVALID_CODES = new Set(['refresh_token_reused', 'installation_revoked', 'invalid_refresh_token'])
 const DEVICE_PENDING_CODES = new Set(['authorization_pending', 'pending'])
@@ -11,7 +10,6 @@ const DEVICE_NETWORK_CAUSE_CODES = new Set(['ECONNREFUSED', 'ECONNRESET', 'ENETD
 const DEVICE_CLIENT_ID = 'quickforge-desktop'
 const MODEL_CACHE_TTL_MS = 60_000
 const MODEL_CACHE_HARD_TTL_MS = 5 * 60_000
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
 
 function tokenExpiry(expiresIn) {
   const seconds = Number(expiresIn)
@@ -38,15 +36,6 @@ function isDeviceFlowNetworkError(error) {
   return error instanceof TypeError || DEVICE_NETWORK_CAUSE_CODES.has(causeCode)
 }
 
-function registrationHash(record, serviceUrl) {
-  return createHash('sha256').update(JSON.stringify({
-    installationName: record.installationName,
-    platform: record.platform,
-    clientVersion: record.clientVersion,
-    publicKey: record.publicKey,
-    serviceUrl,
-  })).digest('base64url')
-}
 
 export class CloudIdentityManager {
   constructor({ client, store, serviceUrl } = {}) {
@@ -92,45 +81,6 @@ export class CloudIdentityManager {
     }
   }
 
-  async startGuest({ signal } = {}) {
-    let record = await this.store.read()
-    this.assertSessionService(record)
-    if (record.rotateInstallationBeforeRegistration) {
-      record = await this.store.rotateInstallation()
-    } else {
-      record = await this.store.ensureInstallation()
-    }
-    const requestHash = registrationHash(record, this.serviceUrl)
-    let idempotencyKey = record.pendingRegistrationKey
-    if (!UUID_PATTERN.test(idempotencyKey || '') || record.pendingRegistrationHash !== requestHash) {
-      idempotencyKey = randomUUID()
-      await this.store.update((current) => ({
-        ...current,
-        pendingRegistrationKey: idempotencyKey,
-        pendingRegistrationHash: requestHash,
-      }))
-    }
-
-    const tokens = await this.client.registerGuest({
-      installationName: record.installationName,
-      platform: record.platform,
-      clientVersion: record.clientVersion,
-      publicKey: record.publicKey,
-    }, idempotencyKey, signal)
-
-    this.setAccess(tokens)
-    await this.store.update((current) => ({
-      ...current,
-      mode: tokens.identityMode || 'guest',
-      installationId: tokens.installationId,
-      refreshToken: tokens.refreshToken,
-      sessionCloudUrl: this.serviceUrl,
-      pendingRegistrationKey: undefined,
-      pendingRegistrationHash: undefined,
-      pendingDeviceFlow: undefined,
-    }))
-    return this.getStatusWithRemoteSummary(signal)
-  }
 
   async startDeviceFlow({ signal } = {}) {
     let record = await this.store.read()
@@ -138,16 +88,23 @@ export class CloudIdentityManager {
     if (record.mode === 'account' && record.refreshToken) {
       throw new CloudApiError('QuickForge Cloud is already connected to an account.', { status: 409, code: 'cloud_account_already_connected' })
     }
-    if (record.mode === 'local') {
-      await this.startGuest({ signal })
-      record = await this.store.read()
+    if (record.rotateInstallationBeforeRegistration) {
+      record = await this.store.rotateInstallation()
     }
-    if (!record.refreshToken || !record.installationId) {
-      throw new CloudApiError('QuickForge Cloud guest session is required before account sign-in.', { status: 409, code: 'cloud_not_connected' })
+    record = await this.store.ensureInstallation()
+    if (!record.installationId || !record.publicKey) {
+      throw new CloudApiError('QuickForge Cloud installation identity is incomplete.', { status: 409, code: 'cloud_installation_missing' })
     }
     this.assertSessionService(record)
-    const accessToken = await this.access({ signal })
-    const authorization = await this.client.authorizeDevice(accessToken, record.installationId, DEVICE_CLIENT_ID, signal)
+    const authorization = await this.client.authorizeDevice({
+      installationId: record.installationId,
+      clientId: DEVICE_CLIENT_ID,
+      publicKey: record.publicKey,
+      installationName: record.installationName,
+      platform: record.platform,
+      clientVersion: record.clientVersion,
+      signal,
+    })
     const expiresIn = Math.max(1, Number(authorization?.expiresIn) || 600)
     const interval = Math.max(1, Number(authorization?.interval) || 5)
     const pendingDeviceFlow = {
@@ -270,7 +227,7 @@ export class CloudIdentityManager {
         this.setAccess(tokens)
         await this.store.update((current) => ({
           ...current,
-          mode: tokens.identityMode || current.mode || 'guest',
+          mode: tokens.identityMode || current.mode || 'account',
           installationId: tokens.installationId || current.installationId,
           refreshToken: tokens.refreshToken,
           sessionCloudUrl: this.serviceUrl,
@@ -338,7 +295,7 @@ export class CloudIdentityManager {
     if (this.modelsPromise) return this.modelsPromise
     this.modelsPromise = this.withAccessToken((token) => this.client.models(token, signal), { signal })
       .then((response) => {
-        this.modelsCache = Array.isArray(response?.items) ? response.items : []
+        this.modelsCache = Array.isArray(response?.data) ? response.data : (Array.isArray(response?.items) ? response.items : [])
         this.modelsCachedAt = Date.now()
         return this.modelsCache
       })

package/server/cloud/models.mjs

@@ -16,7 +16,7 @@ export function toPublicCloudModel(model) {
     reasoning: Boolean(capabilities.reasoning),
     input: capabilities.vision ? ['text', 'image'] : ['text'],
     contextWindow: Number(model.contextWindow || 128_000),
-    maxTokens: Number(model.maxTokens || 8_192),
+    maxTokens: Number(model.maxTokens || 32_768),
     quickforgeModelSource: CLOUD_SOURCE,
     quickforgeCatalogId: id,
     quickforgeCapabilities: {