@steerable/agent-shell 0.6.15

package/dist/storage/insights-redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactInsightText(value: unknown, limit: number): string;
+export declare function toolNamesOnly(raw: unknown): string[];

package/dist/storage/insights-redact.js

@@ -0,0 +1,30 @@
+const SECRET = /(sk-[A-Za-z0-9_\-]{8,}|api[_-]?key\s*[:=]\s*\S+|bearer\s+[A-Za-z0-9._\-]{8,})/gi;
+const WIN_HOME = /[A-Za-z]:\\(?:Users|home)\\[^\\\s]+/gi;
+const UNIX_HOME = /\/(?:Users|home)\/[^/\s]+/g;
+export function redactInsightText(value, limit) {
+    if (typeof value !== 'string' || !value)
+        return '';
+    let text = value.replace(/\u0000/g, '');
+    text = text.replace(SECRET, '[redacted]');
+    text = text.replace(WIN_HOME, 'C:\\Users\\[redacted]');
+    text = text.replace(UNIX_HOME, '/Users/[redacted]'); // shell-neutral:allow — 脱敏替换目标，非机器路径
+    if (text.length > limit)
+        return `${text.slice(0, limit)}…`;
+    return text;
+}
+export function toolNamesOnly(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const names = [];
+    for (const item of raw.slice(0, 40)) {
+        if (typeof item === 'string' && item.trim())
+            names.push(item.trim().slice(0, 64));
+        else if (item && typeof item === 'object') {
+            const rec = item;
+            const name = rec.name ?? rec.tool;
+            if (typeof name === 'string' && name.trim())
+                names.push(name.trim().slice(0, 64));
+        }
+    }
+    return names;
+}

package/dist/storage/insights-settings.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Product-insight consent + install identity. Pure logic (no sqlite/electron)
+ * so vitest can cover the three separate confirmation flags.
+ *
+ * - shareBehavior: 行为事件可否自动上传
+ * - shareConversation: 问答可否自动上传
+ * - shareProfile: 用户资料可否自动上传
+ * 三者默认全关。关掉的种类仍写入本地 outbox，用户可导出后手动发给开发者。
+ *
+ * 遥测端点（3.1 起产品注入）：优先级 用户设置 apiBase > 环境变量
+ * DEEPPATH_INSIGHTS_API_BASE > 产品注入（product.json insightsApiBase）。
+ * 三者皆空 = 无上报端点（中性 shell 默认），flush 直接跳过。
+ */
+export interface InsightsProfile {
+    displayName: string;
+    email: string;
+    company: string;
+    note: string;
+}
+export interface InsightsSettings {
+    installId: string;
+    shareBehavior: boolean;
+    shareConversation: boolean;
+    shareProfile: boolean;
+    /** ISO time of first consent prompt answer; empty = not prompted yet. */
+    promptedAt?: string;
+    /** Optional override. Empty = env DEEPPATH_INSIGHTS_API_BASE or 产品注入端点。 */
+    apiBase?: string;
+    profile: InsightsProfile;
+}
+export declare const DEFAULT_INSIGHTS_PROFILE: InsightsProfile;
+export declare function isUuid(value: unknown): value is string;
+export declare function normalizeInsightsApiBase(raw: unknown): string | undefined;
+/**
+ * 解析遥测端点：用户设置 > 环境变量 > 产品注入。皆空返回 ''（调用方
+ * 视为空端点 = 遥测未配置，跳过上报）。
+ */
+export declare function resolveInsightsApiBase(settings: InsightsSettings | null | undefined, envBase?: string | null): string;
+export declare function mergeInsightsProfile(raw?: Partial<InsightsProfile> | null): InsightsProfile;
+export declare function mergeInsightsSettings(settings?: InsightsSettingsPatch | null, generateId?: () => string): InsightsSettings;
+export declare function insightsNeedsPrompt(settings: InsightsSettings | null | undefined): boolean;
+export type InsightKind = 'event' | 'turn' | 'profile';
+/** PATCH-style input: flags optional, profile fields individually optional. */
+export type InsightsSettingsPatch = Partial<Omit<InsightsSettings, 'profile'>> & {
+    profile?: Partial<InsightsProfile>;
+};
+export declare function canAutoUpload(settings: InsightsSettings, kind: InsightKind): boolean;
+export declare function rowsEligibleForAutoUpload<T extends {
+    kind: InsightKind;
+}>(settings: InsightsSettings, rows: T[]): {
+    upload: T[];
+    skipped: number;
+};

package/dist/storage/insights-settings.js

@@ -0,0 +1,92 @@
+import { randomUUID } from 'crypto';
+import { getProductConfig } from '../product-config.js';
+export const DEFAULT_INSIGHTS_PROFILE = {
+    displayName: '',
+    email: '',
+    company: '',
+    note: '',
+};
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function isUuid(value) {
+    return typeof value === 'string' && UUID_RE.test(value.trim());
+}
+export function normalizeInsightsApiBase(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const trimmed = raw.trim().replace(/\/+$/, '');
+    if (!trimmed)
+        return undefined;
+    try {
+        const url = new URL(trimmed);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            return undefined;
+        return trimmed;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * 解析遥测端点：用户设置 > 环境变量 > 产品注入。皆空返回 ''（调用方
+ * 视为空端点 = 遥测未配置，跳过上报）。
+ */
+export function resolveInsightsApiBase(settings, envBase) {
+    return (normalizeInsightsApiBase(settings?.apiBase) ||
+        normalizeInsightsApiBase(envBase) ||
+        normalizeInsightsApiBase(getProductConfig().insightsApiBase) ||
+        '');
+}
+function asBool(value) {
+    return value === true;
+}
+function asTrimmed(value, max) {
+    if (typeof value !== 'string')
+        return '';
+    return value.trim().slice(0, max);
+}
+export function mergeInsightsProfile(raw) {
+    const incoming = raw ?? {};
+    return {
+        displayName: asTrimmed(incoming.displayName, 128),
+        email: asTrimmed(incoming.email, 191),
+        company: asTrimmed(incoming.company, 191),
+        note: asTrimmed(incoming.note, 500),
+    };
+}
+export function mergeInsightsSettings(settings, generateId = () => randomUUID()) {
+    const incoming = settings ?? {};
+    const installId = isUuid(incoming.installId) ? incoming.installId.trim().toLowerCase() : generateId();
+    const promptedAt = typeof incoming.promptedAt === 'string' && incoming.promptedAt.trim()
+        ? incoming.promptedAt.trim()
+        : undefined;
+    return {
+        installId,
+        shareBehavior: asBool(incoming.shareBehavior),
+        shareConversation: asBool(incoming.shareConversation),
+        shareProfile: asBool(incoming.shareProfile),
+        promptedAt,
+        apiBase: normalizeInsightsApiBase(incoming.apiBase),
+        profile: mergeInsightsProfile(incoming.profile),
+    };
+}
+export function insightsNeedsPrompt(settings) {
+    return !settings?.promptedAt;
+}
+export function canAutoUpload(settings, kind) {
+    if (kind === 'event')
+        return settings.shareBehavior;
+    if (kind === 'turn')
+        return settings.shareConversation;
+    return settings.shareProfile;
+}
+export function rowsEligibleForAutoUpload(settings, rows) {
+    const upload = [];
+    let skipped = 0;
+    for (const row of rows) {
+        if (canAutoUpload(settings, row.kind))
+            upload.push(row);
+        else
+            skipped += 1;
+    }
+    return { upload, skipped };
+}

package/dist/storage/llm-settings.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Pure LLM-settings defaults/migration logic, split out of `storage/index.ts`
+ * so it can be unit-tested without touching `better-sqlite3` / `electron`
+ * (importing `storage/index.ts` eagerly constructs a `LocalStore`, which
+ * calls `app.getPath()` and loads the Electron-ABI-compiled native module —
+ * neither works under plain Node/vitest).
+ */
+/**
+ * OpenAI 兼容旗标的宿主覆盖（wire 形状与框架 compat.py 的
+ * `OpenAICompatFlags.from_dict` 对齐——camelCase 键、未知键在框架侧
+ * fail loud）。字段全部可选：缺省 = 不覆盖，由框架按 baseUrl 主机名
+ * 自动探测（PROVIDER_COMPAT_HOSTS）兜底。旗标词汇表由 sidecar 的
+ * `compat.describe` RPC 服务化，设置页按它渲染，不在前端硬编码键名。
+ */
+export interface OpenAICompatOverrides {
+    supportsUsageInStreaming?: boolean;
+    maxTokensField?: 'max_tokens' | 'max_completion_tokens';
+    supportsReasoningEffort?: boolean;
+    supportsTemperature?: boolean;
+    reasoningDeltaFields?: string[];
+    reasoningEchoField?: string;
+    supportsForcedToolChoice?: boolean;
+    /**
+     * thinking 模式下带 tool_calls 的 assistant 消息即使没产出思考，也必须
+     * 回传 reasoning 字段（空串）——DeepSeek 缺键即 400；框架按 baseUrl
+     * 自动为 api.deepseek.com 打开，这里只是允许设置页显式覆盖。
+     */
+    echoEmptyReasoningForToolCalls?: boolean;
+    cachedTokensFields?: string[];
+}
+/**
+ * 厂商参数预制（框架 llm.presets）的宿主选择。缺省 / `{enabled: true}` =
+ * 自动：框架按 baseUrl 主机名 + 模型名匹配注册表，填充厂商文档最优的
+ * temperature/top_p/top_k 等（显式请求字段永远优先）；`enabled: false` =
+ * 整层关闭；`override` = 钉死一条显式预制（设置页从 sidecar 的
+ * `presets.describe` 选条目）。wire 形状与框架 `ProviderPreset.from_dict`
+ * 对齐——camelCase 键、未知键在框架侧 fail loud。
+ */
+export interface ProviderPresetOverride {
+    temperature?: number;
+    topP?: number;
+    maxTokens?: number;
+    reasoningEffort?: string;
+    extraBody?: Record<string, unknown>;
+}
+export interface ProviderPresetsChoice {
+    enabled?: boolean;
+    override?: ProviderPresetOverride;
+}
+export type LlmProvider = 'ollama' | 'openai-compat' | 'anthropic' | 'google' | 'openai-responses';
+export interface LlmSettings {
+    provider: LlmProvider;
+    /**
+     * 设置页选中的服务商目录 id（deepseek / anthropic / custom 等）。
+     * 缺省时由 baseUrl 主机名回推。只影响表单回显，不进 sidecar wire。
+     */
+    vendorId?: string;
+    model: string;
+    baseUrl?: string;
+    apiKey?: string;
+    /** 缺省 = 自动：命中厂商预制时用预制值，否则不下发（厂商服务端默认）。 */
+    temperature?: number;
+    systemPrompt?: string;
+    maxTotalTokens?: number;
+    /** 见 OpenAICompatOverrides；仅 openai-compat provider 生效。 */
+    compat?: OpenAICompatOverrides;
+    /** 见 ProviderPresetsChoice；仅 openai-compat / openai-responses 生效。 */
+    presets?: ProviderPresetsChoice;
+    /**
+     * 本地命令（local_exec_shell）的默认超时（秒）。不设 = 用内置默认
+     * （headless 30s / 可见终端 60s）。带 "gui" 的启动命令不受它限制——
+     * 超时后按"已启动、仍在运行"处理，见 local-executor.isGuiLaunchCommand。
+     */
+    execTimeoutSeconds?: number;
+}
+export declare const DEFAULT_SYSTEM_PROMPT: string;
+export declare const OPENAI_COMPAT_DEFAULTS: LlmSettings;
+export declare const EXPIRED_BAKED_API_KEY = "sk-b1383d225ee44f118ad99e359ec9e5d8";
+/** 已存设置是否还挂着作废的出厂内置 key。 */
+export declare function llmSettingsCarryExpiredBakedKey(s: LlmSettings): boolean;
+export declare const OLLAMA_DEFAULTS: LlmSettings;
+export declare function sanitizeLlmProvider(raw: unknown): LlmProvider;
+export declare function sanitizeVendorId(raw: unknown): string | undefined;
+/** Sidecar `agent.chat.stream` 的 provider 字段。 */
+export declare function sidecarWireProvider(provider: LlmProvider): string;
+export declare function usesOpenAiCompatExtras(provider: LlmProvider): boolean;
+/** Ollama OpenAI 兼容面在 /v1；本机设置存的是 daemon 根路径。 */
+export declare function listingBaseUrl(provider: LlmProvider, baseUrl: string | undefined): string | undefined;
+/** The vendor listing URL sidecar will GET (must match gateway_catalog.listing_request). */
+export declare function vendorModelsListUrl(provider: LlmProvider, baseUrl: string): string;
+export declare const DEFAULT_LLM_SETTINGS: LlmSettings;
+export declare function llmSettingsMatchOllamaDefaults(s: LlmSettings): boolean;
+/**
+ * Merge a (possibly partial-looking, but typed as complete) incoming
+ * `LlmSettings` against the preset for *its own* `provider`, not always
+ * against the OpenAI-compat/DeepSeek preset.
+ *
+ * Previously `setLlmSettings` always merged against
+ * `{...DEFAULT_LLM_SETTINGS, ...settings}` (`DEFAULT_LLM_SETTINGS` ==
+ * `OPENAI_COMPAT_DEFAULTS`). Switching the provider to Ollama without
+ * explicitly clearing `apiKey` left the baked-in DeepSeek key sitting in the
+ * merged Ollama settings, since a key that's simply absent from `settings`
+ * doesn't shadow the spread base — it silently falls through to whatever
+ * `apiKey` the base object happens to carry.
+ */
+export declare function mergeLlmSettings(settings: LlmSettings): LlmSettings;
+/**
+ * 把设置页/POST 体里的 compat 载荷收敛成合法的 `OpenAICompatOverrides`：
+ * 只保留框架 `from_dict` 认识的键、按旗标种类校正类型，空数组与非法值
+ * 丢弃（缺省 = 不覆盖）。框架侧对未知键 fail loud，这里先收敛一遍，
+ * 让设置页的旧版本载荷不会因为框架新增旗标而报错。
+ */
+export declare function sanitizeCompatOverrides(input: unknown): OpenAICompatOverrides | undefined;
+/**
+ * 把设置页/POST 体里的 presets 载荷收敛成合法的 `ProviderPresetsChoice`：
+ * 与 sanitizeCompatOverrides 同一纪律——只保留框架 `ProviderPreset.from_dict`
+ * 认识的键、按类型校正，非法值丢弃（缺省 = 自动匹配）。框架侧对未知键
+ * fail loud，这里先收敛一遍。
+ */
+export declare function sanitizePresetsChoice(input: unknown): ProviderPresetsChoice | undefined;

package/dist/storage/llm-settings.js

@@ -0,0 +1,233 @@
+/**
+ * Pure LLM-settings defaults/migration logic, split out of `storage/index.ts`
+ * so it can be unit-tested without touching `better-sqlite3` / `electron`
+ * (importing `storage/index.ts` eagerly constructs a `LocalStore`, which
+ * calls `app.getPath()` and loads the Electron-ABI-compiled native module —
+ * neither works under plain Node/vitest).
+ */
+import { getBrand } from '../brand.js';
+export const DEFAULT_SYSTEM_PROMPT = `你是 ${getBrand().agentName}，${getBrand().tagline}，优先给出可执行建议并在需要时调用本地工具。`;
+// ─── Per-provider 预设 ──────────────────────────────────────────────────────
+// 每套预设描述"用户切到该 provider 时一组合理的开箱即用值"。两套预设地位
+// 对等——挑哪个当 first-install 默认由下面 DEFAULT_LLM_SETTINGS 显式声明。
+//
+// 前端设置页的服务商列表由 sidecar catalog.describe 提供；这里只保留
+// 切 provider 时的连接缺省。
+// OpenAI 兼容预设：指向 DeepSeek 官方 API。API Key 默认留空——不再打包
+// 内置 key：打包进客户端 = 任何拿到 .exe 的人都能解出来，且 key 过期后
+// 新用户开箱即 401（0.0.35 事故）。新用户由设置页引导填自己的 key。
+export const OPENAI_COMPAT_DEFAULTS = {
+    provider: 'openai-compat',
+    vendorId: 'deepseek',
+    model: 'deepseek-chat',
+    baseUrl: 'https://api.deepseek.com',
+    // temperature 缺省 = 自动：命中厂商预制（llm.presets）时用厂商文档最优
+    // 值，未命中则不下发。设置页可切手动。
+    systemPrompt: DEFAULT_SYSTEM_PROMPT,
+    maxTotalTokens: 60000,
+};
+// 0.0.35 及之前打包进客户端的内置 DeepSeek key（已作废，上游返回 401）。
+// 保留常量仅作迁移指纹：老安装的已存设置若还带着它，升级后静默清空，
+// 否则用户永远拿着一把死 key，报 401 也不知道为什么。
+export const EXPIRED_BAKED_API_KEY = 'sk-b1383d225ee44f118ad99e359ec9e5d8';
+/** 已存设置是否还挂着作废的出厂内置 key。 */
+export function llmSettingsCarryExpiredBakedKey(s) {
+    return !!s.apiKey && s.apiKey === EXPIRED_BAKED_API_KEY;
+}
+// Ollama 预设：用户切到 Ollama provider 时的默认连接参数（指向本机默认端口
+// + 常用的 llama3.1:8b 镜像）。同时也充当"判断老安装是否还停留在出厂 Ollama
+// 配置"的迁移指纹——见 llmSettingsMatchOllamaDefaults。
+export const OLLAMA_DEFAULTS = {
+    provider: 'ollama',
+    vendorId: 'ollama',
+    model: 'llama3.1:8b',
+    baseUrl: 'http://127.0.0.1:11434',
+    systemPrompt: DEFAULT_SYSTEM_PROMPT,
+    maxTotalTokens: 60000,
+};
+const BARE_PROVIDER_DEFAULTS = {
+    provider: 'openai-compat',
+    model: '',
+    systemPrompt: DEFAULT_SYSTEM_PROMPT,
+    maxTotalTokens: 60000,
+};
+export function sanitizeLlmProvider(raw) {
+    if (raw === 'ollama' ||
+        raw === 'openai-compat' ||
+        raw === 'anthropic' ||
+        raw === 'google' ||
+        raw === 'openai-responses') {
+        return raw;
+    }
+    return 'openai-compat';
+}
+export function sanitizeVendorId(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const id = raw.trim();
+    return id || undefined;
+}
+/** Sidecar `agent.chat.stream` 的 provider 字段。 */
+export function sidecarWireProvider(provider) {
+    switch (provider) {
+        case 'ollama':
+            return 'ollama';
+        case 'anthropic':
+            return 'anthropic';
+        case 'google':
+            return 'google';
+        case 'openai-responses':
+            return 'openai-responses';
+        default:
+            return 'openai_compat';
+    }
+}
+export function usesOpenAiCompatExtras(provider) {
+    return provider === 'openai-compat' || provider === 'openai-responses';
+}
+/** Ollama OpenAI 兼容面在 /v1；本机设置存的是 daemon 根路径。 */
+export function listingBaseUrl(provider, baseUrl) {
+    if (!baseUrl)
+        return undefined;
+    const trimmed = baseUrl.replace(/\/+$/, '');
+    if (provider === 'ollama' && !trimmed.endsWith('/v1')) {
+        return `${trimmed}/v1`;
+    }
+    return trimmed;
+}
+/** The vendor listing URL sidecar will GET (must match gateway_catalog.listing_request). */
+export function vendorModelsListUrl(provider, baseUrl) {
+    const base = listingBaseUrl(provider, baseUrl) ?? baseUrl.replace(/\/+$/, '');
+    if (provider === 'anthropic') {
+        return base.endsWith('/v1') ? `${base}/models` : `${base}/v1/models`;
+    }
+    if (provider === 'google') {
+        if (base.endsWith('/models'))
+            return base;
+        if (base.includes('/v1beta'))
+            return `${base}/models`;
+        return `${base}/v1beta/models`;
+    }
+    return `${base}/models`;
+}
+// 全新安装的出厂默认。当前选 OpenAI 兼容（DeepSeek）—— Windows 用户大多没装
+// 过 Ollama，开箱用云端 API 失败率最低。
+export const DEFAULT_LLM_SETTINGS = OPENAI_COMPAT_DEFAULTS;
+// 用作迁移指纹：老安装用户停留在出厂 Ollama 默认（从未改过任何一项），新
+// 版本启动时静默迁移到新默认。任意一项被改过就视为"用户已自定义"，不动。
+//
+// 之前漏了 maxTotalTokens：只要 provider/model/baseUrl/apiKey/temperature/
+// systemPrompt 都命中出厂值，哪怕用户特意把 maxTotalTokens 调大/调小过，也
+// 会被这次静默迁移覆盖回默认值——这里补齐，让指纹覆盖 LlmSettings 的全部字段。
+export function llmSettingsMatchOllamaDefaults(s) {
+    return (s.provider === OLLAMA_DEFAULTS.provider &&
+        s.model === OLLAMA_DEFAULTS.model &&
+        s.baseUrl === OLLAMA_DEFAULTS.baseUrl &&
+        !s.apiKey &&
+        // 0.3 是出厂默认改为"自动"之前的遗留值：当时保存过的安装会把 0.3
+        // 持久化下来，指纹必须继续认它，否则老用户丢失静默迁移。
+        (s.temperature === undefined || s.temperature === null || s.temperature === 0.3) &&
+        (s.systemPrompt === OLLAMA_DEFAULTS.systemPrompt || !s.systemPrompt) &&
+        (s.maxTotalTokens === OLLAMA_DEFAULTS.maxTotalTokens ||
+            s.maxTotalTokens === undefined ||
+            s.maxTotalTokens === null));
+}
+/**
+ * Merge a (possibly partial-looking, but typed as complete) incoming
+ * `LlmSettings` against the preset for *its own* `provider`, not always
+ * against the OpenAI-compat/DeepSeek preset.
+ *
+ * Previously `setLlmSettings` always merged against
+ * `{...DEFAULT_LLM_SETTINGS, ...settings}` (`DEFAULT_LLM_SETTINGS` ==
+ * `OPENAI_COMPAT_DEFAULTS`). Switching the provider to Ollama without
+ * explicitly clearing `apiKey` left the baked-in DeepSeek key sitting in the
+ * merged Ollama settings, since a key that's simply absent from `settings`
+ * doesn't shadow the spread base — it silently falls through to whatever
+ * `apiKey` the base object happens to carry.
+ */
+export function mergeLlmSettings(settings) {
+    const base = settings.provider === 'ollama'
+        ? OLLAMA_DEFAULTS
+        : settings.provider === 'openai-compat'
+            ? OPENAI_COMPAT_DEFAULTS
+            : { ...BARE_PROVIDER_DEFAULTS, provider: settings.provider };
+    const merged = { ...base, ...settings };
+    if (!settings.vendorId)
+        merged.vendorId = base.vendorId;
+    return merged;
+}
+const COMPAT_BOOL_KEYS = [
+    'supportsUsageInStreaming',
+    'supportsReasoningEffort',
+    'supportsTemperature',
+    'supportsForcedToolChoice',
+    'echoEmptyReasoningForToolCalls',
+];
+const COMPAT_LIST_KEYS = ['reasoningDeltaFields', 'cachedTokensFields'];
+const COMPAT_STRING_KEYS = ['reasoningEchoField'];
+/**
+ * 把设置页/POST 体里的 compat 载荷收敛成合法的 `OpenAICompatOverrides`：
+ * 只保留框架 `from_dict` 认识的键、按旗标种类校正类型，空数组与非法值
+ * 丢弃（缺省 = 不覆盖）。框架侧对未知键 fail loud，这里先收敛一遍，
+ * 让设置页的旧版本载荷不会因为框架新增旗标而报错。
+ */
+export function sanitizeCompatOverrides(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    const record = input;
+    const out = {};
+    for (const key of COMPAT_BOOL_KEYS) {
+        if (typeof record[key] === 'boolean')
+            out[key] = record[key];
+    }
+    if (record.maxTokensField === 'max_tokens' || record.maxTokensField === 'max_completion_tokens') {
+        out.maxTokensField = record.maxTokensField;
+    }
+    for (const key of COMPAT_LIST_KEYS) {
+        const value = record[key];
+        if (Array.isArray(value)) {
+            const list = value.map((v) => String(v).trim()).filter(Boolean);
+            if (list.length > 0)
+                out[key] = list;
+        }
+    }
+    for (const key of COMPAT_STRING_KEYS) {
+        const value = record[key];
+        if (typeof value === 'string' && value.trim())
+            out[key] = value.trim();
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * 把设置页/POST 体里的 presets 载荷收敛成合法的 `ProviderPresetsChoice`：
+ * 与 sanitizeCompatOverrides 同一纪律——只保留框架 `ProviderPreset.from_dict`
+ * 认识的键、按类型校正，非法值丢弃（缺省 = 自动匹配）。框架侧对未知键
+ * fail loud，这里先收敛一遍。
+ */
+export function sanitizePresetsChoice(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    const record = input;
+    const out = {};
+    if (typeof record.enabled === 'boolean')
+        out.enabled = record.enabled;
+    if (record.override && typeof record.override === 'object' && !Array.isArray(record.override)) {
+        const raw = record.override;
+        const override = {};
+        if (typeof raw.temperature === 'number')
+            override.temperature = raw.temperature;
+        if (typeof raw.topP === 'number')
+            override.topP = raw.topP;
+        if (typeof raw.maxTokens === 'number')
+            override.maxTokens = raw.maxTokens;
+        if (typeof raw.reasoningEffort === 'string' && raw.reasoningEffort) {
+            override.reasoningEffort = raw.reasoningEffort;
+        }
+        if (raw.extraBody && typeof raw.extraBody === 'object' && !Array.isArray(raw.extraBody)) {
+            override.extraBody = raw.extraBody;
+        }
+        if (Object.keys(override).length > 0)
+            out.override = override;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}

package/dist/storage/local-store-singleton.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The `localStore` singleton's friendly handling of a held write lease.
+ *
+ * `createLocalStore` turns a `StoreAlreadyOwnedError` into a readable dialog
+ * + exit instead of a raw stack. The single-instance lock (single-instance.ts)
+ * already stops a second OS process earlier; this is the deeper kernel-lock
+ * backstop for the cases it cannot reach (a bypassed lock, two userData dirs
+ * pointed at one database, a crashed-then-relaunched app racing its own
+ * cleanup).
+ *
+ * This lives in its own module — and takes an injectable constructor — so the
+ * error-mapping path is testable in a plain-node vitest worker. Importing
+ * `storage/index.ts` constructs the real `LocalStore`, which loads
+ * better-sqlite3 (Electron ABI) and cannot resolve outside Electron; this
+ * module imports only the error class, so it loads anywhere. `dialog`/`app`
+ * are loaded lazily for the same reason.
+ */
+/** The slice of electron's app/dialog the friendly exit uses. */
+interface ElectronExit {
+    app: {
+        exit(code: number): void;
+    };
+    dialog: {
+        showErrorBox(title: string, message: string): void;
+    };
+}
+export declare function createLocalStore<T>(construct: () => T, loadElectron?: () => Promise<ElectronExit>, exitProcess?: (code: number) => void): T;
+export {};

package/dist/storage/local-store-singleton.js

@@ -0,0 +1,38 @@
+/**
+ * The `localStore` singleton's friendly handling of a held write lease.
+ *
+ * `createLocalStore` turns a `StoreAlreadyOwnedError` into a readable dialog
+ * + exit instead of a raw stack. The single-instance lock (single-instance.ts)
+ * already stops a second OS process earlier; this is the deeper kernel-lock
+ * backstop for the cases it cannot reach (a bypassed lock, two userData dirs
+ * pointed at one database, a crashed-then-relaunched app racing its own
+ * cleanup).
+ *
+ * This lives in its own module — and takes an injectable constructor — so the
+ * error-mapping path is testable in a plain-node vitest worker. Importing
+ * `storage/index.ts` constructs the real `LocalStore`, which loads
+ * better-sqlite3 (Electron ABI) and cannot resolve outside Electron; this
+ * module imports only the error class, so it loads anywhere. `dialog`/`app`
+ * are loaded lazily for the same reason.
+ */
+import { StoreAlreadyOwnedError } from './write-lease.js';
+export function createLocalStore(construct, loadElectron = () => import('electron'), exitProcess = (code) => process.exit(code)) {
+    try {
+        return construct();
+    }
+    catch (err) {
+        if (err instanceof StoreAlreadyOwnedError) {
+            void loadElectron()
+                .then(({ app, dialog }) => {
+                dialog.showErrorBox('无法启动', '另一个实例正在运行并占用本地数据库。请先关闭该实例，再重新打开应用。');
+                app.exit(1);
+            })
+                .catch(() => exitProcess(1));
+            // Unreachable once electron resolves (app.exit ends the process); the
+            // rethrow is the non-electron fallback so a plain-node import still
+            // fails loud rather than returning a half-built store.
+            throw err;
+        }
+        throw err;
+    }
+}

package/dist/storage/message-order.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The single ordering key for a chat's messages, shared by the read and the
+ * regenerate cut so "after" means the same thing to both.
+ *
+ * Every writer stores `new Date(...).toISOString()`, whose fixed-width UTC form
+ * sorts lexicographically exactly as it sorts chronologically, so the raw text
+ * is the key. Wrapping it in SQLite's `datetime()` truncates to whole seconds
+ * and collapses sub-second writes into a tie group with no defined order;
+ * `rowid` then settles exact-timestamp ties toward insertion order.
+ *
+ * Sub-second writes are normal here, not an edge case: a mid-turn steer lands
+ * milliseconds after the message it interrupts, and `replaceChatMessages`
+ * synthesizes a whole branch projection at `base + i` milliseconds.
+ */
+export declare const MESSAGE_ORDER_DESC = "created_at DESC, rowid DESC";
+/** Ascending form of {@link MESSAGE_ORDER_DESC}, for transcript order. */
+export declare const MESSAGE_ORDER_ASC = "created_at ASC, rowid ASC";
+/**
+ * Predicate selecting the message bound to `?2` in chat `?3` plus everything
+ * ordered after it under {@link MESSAGE_ORDER_DESC}. An unknown id makes the
+ * subquery NULL, so nothing matches and no rows are touched.
+ *
+ * Placeholders are positional: the caller binds (chatId, messageId, chatId).
+ */
+export declare const MESSAGE_CUT_FROM_ID = "(created_at, rowid) >= (\n            SELECT created_at, rowid FROM chat_messages WHERE id = ? AND chat_id = ?\n          )";

package/dist/storage/message-order.js

@@ -0,0 +1,27 @@
+/**
+ * The single ordering key for a chat's messages, shared by the read and the
+ * regenerate cut so "after" means the same thing to both.
+ *
+ * Every writer stores `new Date(...).toISOString()`, whose fixed-width UTC form
+ * sorts lexicographically exactly as it sorts chronologically, so the raw text
+ * is the key. Wrapping it in SQLite's `datetime()` truncates to whole seconds
+ * and collapses sub-second writes into a tie group with no defined order;
+ * `rowid` then settles exact-timestamp ties toward insertion order.
+ *
+ * Sub-second writes are normal here, not an edge case: a mid-turn steer lands
+ * milliseconds after the message it interrupts, and `replaceChatMessages`
+ * synthesizes a whole branch projection at `base + i` milliseconds.
+ */
+export const MESSAGE_ORDER_DESC = 'created_at DESC, rowid DESC';
+/** Ascending form of {@link MESSAGE_ORDER_DESC}, for transcript order. */
+export const MESSAGE_ORDER_ASC = 'created_at ASC, rowid ASC';
+/**
+ * Predicate selecting the message bound to `?2` in chat `?3` plus everything
+ * ordered after it under {@link MESSAGE_ORDER_DESC}. An unknown id makes the
+ * subquery NULL, so nothing matches and no rows are touched.
+ *
+ * Placeholders are positional: the caller binds (chatId, messageId, chatId).
+ */
+export const MESSAGE_CUT_FROM_ID = `(created_at, rowid) >= (
+            SELECT created_at, rowid FROM chat_messages WHERE id = ? AND chat_id = ?
+          )`;