@xcanwin/manyoyo 8.6.12 → 8.7.1

package/lib/web/server.js

@@ -27,6 +27,8 @@ const { createDeniedNotifier } = require('./denied-notify');
 const { domainRuleAllows } = require('../network-policy');
 const { createPortForwarder } = require('../port-forward');
 const { createContainerManageRoutes, pendingRisks, STALE_PAGE_MESSAGE } = require('./container-manage');
+const { createModelServiceRoutes } = require('./model-services');
+const { thirdPartyCodexModels } = require('../provider-presets');
 const { resolveManageOptions } = require('../container-manage-options');
 const { defaultPolicy, usesProxy } = require('../network-policy');
 const { normalizeMirrors } = require('../runtime-normalizers');
@@ -34,13 +36,15 @@ const { estimateContainerCapacity } = require('../capacity');
 const { extractAgentMessageFromCodexJsonl } = require('../codex-output');
 const { findValueRangeByPath, applyTextReplacements, upsertValueByPath } = require('../json5-text-edit');
 const { resolveRuntimeConfig } = require('../runtime-resolver');
+const { resolveQuickChatPath, expandTemplate } = require('../name-template');
 const { AGENT_ENV_SCHEMA } = require('../init-config');
 const { ensureImagePresent, pullImageProcess } = require('../image-pull');
 const { waitForImport } = require('../offline-import');
-const { baseRawOf, buildAgentConfigRaw, buildPasswordConfigRaw, shouldWriteMirrors, buildMirrorsConfigRaw, buildAgentInstructionsConfigRaw, buildBooleanConfigRaw } = require('../setup-config');
+const { baseRawOf, buildAgentConfigRaw, buildPasswordConfigRaw, shouldWriteMirrors, buildMirrorsConfigRaw, buildAgentInstructionsConfigRaw, buildBooleanConfigRaw, buildSetupSkippedConfigRaw } = require('../setup-config');
 const { createImageAgentProbe } = require('../image-agents');
 const { createAuthStore } = require('./auth-store');
 const webUploads = require('./uploads');
+const webStorage = require('./storage');
 const webSnapshots = require('./snapshots');
 const webRewind = require('./rewind');
 const { listSetupAgents, getConfiguredAgents, buildAgentRunProfile, classifyConnectionResult, redactSecrets, validateSetupPassword, listMirrorPresets } = require('../setup');
@@ -585,6 +589,26 @@ function createWebSessionMessageId() {
     return `${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
 }
 
+// 容器状态类的系统消息（已创建并启动 / 已启动 / 首次命令已执行）只在会话已经有对话时才写：
+// 新会话一建好就写一条，聊天页就不是空的，输入框不再居中；对话中途重建或启动容器时才值得告诉用户
+function appendWebContainerNotice(webHistoryDir, sessionRefOrContainerName, content) {
+    const sessionRef = typeof sessionRefOrContainerName === 'string'
+        ? { containerName: sessionRefOrContainerName, agentId: WEB_DEFAULT_AGENT_ID }
+        : sessionRefOrContainerName;
+    const history = loadWebSessionHistory(webHistoryDir, sessionRef.containerName);
+    const agentSession = getWebAgentSession(history, sessionRef.agentId, { create: true, includeArchived: true });
+    if (agentSession.messages.length) {
+        appendWebSessionMessage(webHistoryDir, sessionRef, 'system', content);
+        return;
+    }
+    // 不写消息，但新建的会话照样要落盘（列表里是真的 AGENT，不是现算出来的）
+    const timestamp = new Date().toISOString();
+    if (!agentSession.createdAt) agentSession.createdAt = timestamp;
+    agentSession.updatedAt = timestamp;
+    history.updatedAt = timestamp;
+    saveWebSessionHistory(webHistoryDir, sessionRef.containerName, history);
+}
+
 function appendWebSessionMessage(webHistoryDir, sessionRefOrContainerName, role, content, extra = {}) {
     const sessionRef = typeof sessionRefOrContainerName === 'string'
         ? { containerName: sessionRefOrContainerName, agentId: WEB_DEFAULT_AGENT_ID }
@@ -758,33 +782,6 @@ function removeWebSessionMessagesFrom(webHistoryDir, sessionRef, messageId) {
     return removed;
 }
 
-// 从页面隐藏 / 取消隐藏某一组（用户消息 + 它的执行过程 + 回复）：只改展示，agent 仍记得
-function setWebSessionTurnHidden(webHistoryDir, sessionRef, userMessageId, hidden) {
-    const history = loadWebSessionHistory(webHistoryDir, sessionRef.containerName);
-    const agentSession = getWebAgentSession(history, sessionRef.agentId, { includeArchived: true });
-    if (!agentSession) {
-        return 0;
-    }
-    const start = agentSession.messages.findIndex(item => item && String(item.id || '') === String(userMessageId) && item.role === 'user');
-    if (start === -1) {
-        return 0;
-    }
-    let end = start + 1;
-    while (end < agentSession.messages.length && agentSession.messages[end].role !== 'user') {
-        end += 1;
-    }
-    for (let i = start; i < end; i += 1) {
-        if (hidden) agentSession.messages[i].hidden = true;
-        else delete agentSession.messages[i].hidden;
-    }
-    agentSession.epoch = messagesView.createEpoch();
-    const timestamp = new Date().toISOString();
-    agentSession.updatedAt = timestamp;
-    history.updatedAt = timestamp;
-    saveWebSessionHistory(webHistoryDir, sessionRef.containerName, history);
-    return end - start;
-}
-
 function setWebSessionAgentPromptCommand(webHistoryDir, containerName, agentPromptCommand) {
     const history = loadWebSessionHistory(webHistoryDir, containerName);
     history.agentPromptCommand = normalizeAgentPromptCommandTemplate(agentPromptCommand, 'agentPromptCommand');
@@ -1030,9 +1027,8 @@ function buildCodexAgentExecCommand(template, prompt, options = {}) {
         }
     }
     // 兼容服务：OPENAI_BASE_URL 在容器里由 shell 展开成 -c openai_base_url=…（codex 不认这个环境变量，见 withCodexBaseUrl）
-    return withCodexBaseUrl(codexTemplate === templateText
-        ? renderAgentPromptCommand(templateText, prompt)
-        : renderAgentPromptCommand(codexTemplate, prompt));
+    // 先给模板加占位再渲染提示词：用户的提示词里写了 model_provider / --model 之类的字也不会让注入失效
+    return renderAgentPromptCommand(withCodexBaseUrl(codexTemplate), prompt);
 }
 
 function prependAgentFlags(commandText, matchPattern, flagSpecs) {
@@ -2978,8 +2974,7 @@ function resolveNowTemplate(value, formatDate) {
     if (typeof value !== 'string') {
         return value;
     }
-    const nowText = typeof formatDate === 'function' ? formatDate() : '';
-    return value.replace(/\{now\}|\$\{now\}/g, nowText);
+    return expandTemplate(value, { now: typeof formatDate === 'function' ? formatDate() : '' }).value;
 }
 
 function validateContainerNameStrict(containerName) {
@@ -3236,7 +3231,7 @@ function buildConfigDefaults(ctx, config) {
     const parsed = toPlainObject(config);
     const defaults = {
         containerName: hasOwn(parsed, 'containerName') ? String(parsed.containerName || '') : '',
-        hostPath: sanitizeDefaultHostPath(pickFirstString(parsed.hostPath, ctx.hostPath)),
+        hostPath: sanitizeDefaultHostPath(pickFirstString(parsed.hostPath)),
         containerPath: pickFirstString(parsed.containerPath),
         imageName: pickFirstString(parsed.imageName, ctx.imageName),
         imageVersion: pickFirstString(parsed.imageVersion, ctx.imageVersion),
@@ -3284,7 +3279,8 @@ function buildConfigDefaults(ctx, config) {
 function buildStaticContainerRuntime(ctx, containerName) {
     return {
         containerName,
-        hostPath: ctx.hostPath,
+        // 只给已存在的容器用；不带 serve 的启动目录，万一容器在这之间被删也不会按它重建
+        hostPath: '',
         containerPath: ctx.containerPath,
         imageName: ctx.imageName,
         imageVersion: ctx.imageVersion,
@@ -3374,7 +3370,8 @@ function buildCreateRuntime(ctx, state, payload) {
         globalFirstConfig,
         runFirstConfig,
         defaults: {
-            hostPath: ctx.hostPath,
+            // 不用 ctx.hostPath（serve 的启动目录）：与前端新建容器对话框一致，按模板在真正创建时才建目录
+            hostPath: DEFAULT_NEW_CONTAINER_PATH_TEMPLATE,
             containerName: `my-${ctx.formatDate()}`,
             // 不用 ctx.containerPath：那是 serve 进程的启动目录（CLI 的 cwd 语义），与用户要挂载的目录无关；
             // 没配置也没传时落到下面的 `|| hostPath`，容器内路径与宿主机路径一致
@@ -3388,6 +3385,11 @@ function buildCreateRuntime(ctx, state, payload) {
         isServerStopMode: false,
         pickConfigValue: pickFirstString,
         resolveContainerNameTemplate: value => resolveNowTemplate(value, ctx.formatDate),
+        // {now} / {quickChatPath} 一次解析只取一个时间：容器名和目录用同一个时间戳
+        templateVars: {
+            now: typeof ctx.formatDate === 'function' ? ctx.formatDate() : undefined,
+            quickChatPath: resolveQuickChatPath(config, { homeDir: ctx.homeDir || os.homedir(), defaultDir: getSetupWorkpath(state) })
+        },
         normalizeCommandSuffix: value => {
             const text = String(value || '').trim();
             return text ? ` ${text}` : '';
@@ -3413,6 +3415,10 @@ function buildCreateRuntime(ctx, state, payload) {
     validateContainerNameStrict(containerName);
 
     const hostPath = resolvedBase.hostPath;
+    // 按模板（{now} / {quickChatPath}）生成的目录：此刻才建
+    if (resolvedBase.hostPathTemplated && !fs.existsSync(hostPath)) {
+        fs.mkdirSync(hostPath, { recursive: true });
+    }
     if (typeof ctx.validateHostPath === 'function') {
         ctx.validateHostPath(hostPath);
     } else {
@@ -4131,9 +4137,26 @@ function getWebNetworkManager(ctx, state) {
 
 // 进入容器前一律检查网络规则（宿主机侧的“本次启动已下发”状态）：文件浏览也会 exec /bin/bash -lc，
 // 里面的 .bashrc 等是 Agent 能改的代码，不能在规则缺失的窗口里跑
+// 只给名字时：容器还在就不需要运行配置；容器已被删掉，且历史里有创建参数，就按它重建（走 buildCreateRuntime 的路径校验）。
+// 不再无条件退回 serve 进程的启动目录：那会让重建的容器挂上 $HOME，并且没有原来的 env 和网络设置；
+// 没有历史也没有容器时直接报错，不再猜参数
+function resolveRuntimeForExistingName(ctx, state, containerName) {
+    if (ctx.containerExists(containerName)) {
+        return buildStaticContainerRuntime(ctx, containerName);
+    }
+    const history = loadWebSessionHistory(state.webHistoryDir, containerName);
+    const snapshot = history.runtimeSnapshot && typeof history.runtimeSnapshot === 'object' ? history.runtimeSnapshot : null;
+    if (!snapshot || !snapshot.hostPath) {
+        throw new Error('这个会话没有建容器的参数，请新建容器');
+    }
+    const createOptions = buildCloneCreateOptionsFromSnapshot(snapshot, history);
+    createOptions.containerName = containerName;
+    return buildCreateRuntime(ctx, state, { createOptions });
+}
+
 async function ensureWebContainer(ctx, state, containerInput, messageSessionRef = null) {
     const runtime = typeof containerInput === 'string'
-        ? buildStaticContainerRuntime(ctx, containerInput)
+        ? resolveRuntimeForExistingName(ctx, state, containerInput)
         : containerInput;
 
     if (!runtime || !runtime.containerName) {
@@ -4203,20 +4226,15 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
             mirrors,
             warn: message => console.warn(message)
         });
-        appendWebSessionMessage(
-            state.webHistoryDir,
-            messageSessionRef || runtime.containerName,
-            'system',
-            `容器 ${runtime.containerName} 已创建并启动。`
-        );
+        appendWebContainerNotice(state.webHistoryDir, messageSessionRef || runtime.containerName, `容器 ${runtime.containerName} 已创建并启动。`);
         if (runtime.first) {
             const firstResult = await runWebFirstCommand(ctx, runtime.containerName, runtime.first);
-            appendWebSessionMessage(
-                state.webHistoryDir,
-                messageSessionRef || runtime.containerName,
-                'system',
-                firstResult.exitCode === 0 ? '首次命令已执行' : formatWebFirstFailure(firstResult, runtime.first)
-            );
+            if (firstResult.exitCode === 0) {
+                appendWebContainerNotice(state.webHistoryDir, messageSessionRef || runtime.containerName, '首次命令已执行');
+            } else {
+                // 失败一律写：用户必须看到
+                appendWebSessionMessage(state.webHistoryDir, messageSessionRef || runtime.containerName, 'system', formatWebFirstFailure(firstResult, runtime.first));
+            }
         }
         return;
     }
@@ -4224,16 +4242,13 @@ async function ensureWebContainer(ctx, state, containerInput, messageSessionRef
     const status = ctx.getContainerStatus(runtime.containerName);
     if (status !== 'running') {
         ctx.dockerExecArgs(['start', runtime.containerName], { stdio: 'pipe' });
-        appendWebSessionMessage(
-            state.webHistoryDir,
-            messageSessionRef || runtime.containerName,
-            'system',
-            `容器 ${runtime.containerName} 已启动。`
-        );
+        appendWebContainerNotice(state.webHistoryDir, messageSessionRef || runtime.containerName, `容器 ${runtime.containerName} 已启动。`);
     }
     await getWebNetworkManager(ctx, state).ensureReady(runtime.containerName);
 }
 
+const DEFAULT_NEW_CONTAINER_NAME_TEMPLATE = 'my-easy-{now}';
+const DEFAULT_NEW_CONTAINER_PATH_TEMPLATE = '{quickChatPath}/{now}';
 const WEB_FIRST_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
 const WEB_FIRST_COMMAND_OUTPUT_CHARS = 500;
 
@@ -5862,12 +5877,47 @@ function sendHtml(res, statusCode, html, extraHeaders = {}, options = {}) {
 }
 
 const SETUP_TEST_TIMEOUT_SECONDS = 60;
-const SETUP_TEST_PROMPT = 'Reply with the single word OK.';
+// 要求真的调一次工具：只回一句 OK 发现不了“能连通但调不了工具”（智谱 + Claude Code 工具搜索就是这样）。
+// 命令文本里没有 42，算出来的结果只会来自真的执行
+const SETUP_TEST_PROMPT = 'Run the shell command `echo mp-$((6*7))` and reply with its exact output only.';
+const SETUP_TEST_EXPECT_OUTPUT = 'mp-42';
 
 function getSetupWorkpath(state) {
     return path.join(path.dirname(path.resolve(state.webConfigPath)), 'work');
 }
 
+// 工作目录根：默认的 ~/.manyoyo/work；配置里的快捷对话目录（serve.quickChat.path）另算，storage 里会先校验再用
+function getStorageRootsConfig(ctx, state) {
+    const extraWorkRoots = [];
+    const configHostPaths = [];
+    try {
+        const parsed = readWebConfigSnapshot(state.webConfigPath).parsed;
+        // 配置里写死的挂载目录（全局与每个 runs.<名>）：删除时算在用；含 {模板} 的每次不同，不算
+        const fixedHostPaths = [parsed && parsed.hostPath, ...Object.values((parsed && parsed.runs) || {}).map(run => run && run.hostPath)];
+        for (const value of fixedHostPaths) {
+            if (typeof value === 'string' && value.trim() && !value.includes('{')) configHostPaths.push(expandHomeAliasPath(value.trim()));
+        }
+        const quickChatPath = parsed && parsed.serve && parsed.serve.quickChat && parsed.serve.quickChat.path;
+        if (typeof quickChatPath === 'string' && quickChatPath.trim()) extraWorkRoots.push(expandHomeAliasPath(quickChatPath.trim()));
+    } catch (e) { /* 配置读不出来就只认默认目录 */ }
+    return {
+        workRoots: [getSetupWorkpath(state)],
+        extraWorkRoots,
+        configHostPaths,
+        homeDir: ctx.homeDir || os.homedir(),
+        dockerExecAsync: ctx.dockerExecAsync || (async (args) => ctx.dockerExecArgs(args))
+    };
+}
+
+async function loadStorageListing(ctx, state) {
+    const listing = await webStorage.buildStorageListing({
+        ...getStorageRootsConfig(ctx, state),
+        historyDir: state.webHistoryDir
+    });
+    state.storageKnownPaths = new Set(listing.rows.map(row => row.path));
+    return listing;
+}
+
 async function inspectSetupImage(ctx, state) {
     const image = `${ctx.imageName}:${ctx.imageVersion}`;
     const pulling = state && state.imagePulls.get(image);
@@ -5917,7 +5967,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
     if (!template) {
         return { category: 'other', message: `${spec.label} 暂不支持连接测试`, detail: '' };
     }
-    const agentCommand = withCodexBaseUrl(renderAgentPromptCommand(template, SETUP_TEST_PROMPT));
+    const agentCommand = renderAgentPromptCommand(withCodexBaseUrl(template), SETUP_TEST_PROMPT);
     const command = `timeout ${SETUP_TEST_TIMEOUT_SECONDS} /bin/bash -lc ${quoteBashSingleValue(agentCommand)}`;
 
     const workpath = getSetupWorkpath(state);
@@ -5955,7 +6005,7 @@ async function runSetupConnectionTest(ctx, state, agent, envMap) {
             })
         ]);
         clearTimeout(timer);
-        return classifyConnectionResult(result, secrets);
+        return classifyConnectionResult(result, secrets, { expectOutput: SETUP_TEST_EXPECT_OUTPUT });
     } catch (e) {
         return classifyConnectionResult({ exitCode: 1, output: e && e.message ? e.message : '' }, secrets);
     } finally {
@@ -6013,8 +6063,10 @@ async function buildSetupStatus(ctx, state) {
     const snapshot = readWebConfigSnapshot(state.webConfigPath);
     const config = snapshot.parseError ? {} : snapshot.parsed;
     const configuredAgents = getConfiguredAgents(config);
+    const setupSkipped = Boolean(config.serve && typeof config.serve === 'object' && config.serve.setupSkipped === true);
     return {
-        needsSetup: configuredAgents.length === 0,
+        needsSetup: configuredAgents.length === 0 && !setupSkipped,
+        setupSkipped,
         configuredAgents,
         serverUser: ctx.authUser,
         // 自动生成（用户看不到）的密码不算“已设置”
@@ -6045,12 +6097,13 @@ function resolveSetupRunInput(ctx, state, payload) {
         if (!hostPath || !path.isAbsolute(hostPath)) {
             throw new Error('hostPath 必须是绝对路径');
         }
-        if (hostPath === getSetupWorkpath(state)) fs.mkdirSync(hostPath, { recursive: true });
         ctx.validateHostPath(hostPath);
     }
+    // 选的就是默认工作目录根：不写进运行配置（新建容器各自建 <根>/<时间> 子目录，见 buildAgentRunProfile）
+    if (hostPath === getSetupWorkpath(state)) hostPath = '';
+    fs.mkdirSync(getSetupWorkpath(state), { recursive: true });
     const profile = buildAgentRunProfile(agent, body.env === undefined ? {} : body.env, {
         existingRun,
-        defaultHostPath: getSetupWorkpath(state),
         hostPath
     });
     return { agent, snapshot, profile };
@@ -6175,7 +6228,7 @@ function buildSessionFallbackApplied(ctx, state, name, history, summary) {
 
     return {
         containerName: name,
-        hostPath: defaults.hostPath || ctx.hostPath || '',
+        hostPath: defaults.hostPath || '',
         containerPath: defaults.containerPath || ctx.containerPath || '',
         imageName: defaults.imageName || ctx.imageName || '',
         imageVersion: defaults.imageVersion || ctx.imageVersion || '',
@@ -6907,6 +6960,23 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 });
             }
         },
+        {
+            // 新建容器对话框的默认值：配置里写了就用配置的，没写就用默认模板
+            // （容器名 my-easy-{now}，宿主机目录与容器内目录 {quickChatPath}/{now}），由前端展开；目录在点“创建”时才建
+            method: 'GET',
+            match: currentPath => currentPath === '/api/system/new-container-defaults' ? [] : null,
+            handler: async () => {
+                const snapshot = readWebConfigSnapshot(state.webConfigPath);
+                const config = snapshot.parseError ? {} : toPlainObject(snapshot.parsed);
+                const hostPathConfigured = Boolean(pickFirstString(config.hostPath));
+                sendJson(res, 200, {
+                    containerName: pickFirstString(config.containerName) || DEFAULT_NEW_CONTAINER_NAME_TEMPLATE,
+                    hostPath: pickFirstString(config.hostPath) || DEFAULT_NEW_CONTAINER_PATH_TEMPLATE,
+                    containerPath: pickFirstString(config.containerPath) || (hostPathConfigured ? '' : DEFAULT_NEW_CONTAINER_PATH_TEMPLATE),
+                    quickChatPath: resolveQuickChatPath(config, { homeDir: ctx.homeDir || os.homedir(), defaultDir: getSetupWorkpath(state) })
+                });
+            }
+        },
         {
             // 系统设置“Agent 环境说明”：内置说明（只读）+ 全局配置里用户追加的说明
             method: 'GET',
@@ -7089,6 +7159,28 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, { saved: true, agent: input.agent, run: sanitizeSensitiveData(input.profile) });
             }
         },
+        {
+            method: 'POST',
+            match: currentPath => currentPath === '/api/setup/skip' ? [] : null,
+            handler: async () => {
+                await readJsonBody(req);
+                const snapshot = readWebConfigSnapshot(state.webConfigPath);
+                if (snapshot.parseError) {
+                    sendJson(res, 400, { error: '当前配置解析失败，无法继续', detail: snapshot.parseError });
+                    return;
+                }
+                let nextRaw;
+                try {
+                    nextRaw = buildSetupSkippedConfigRaw(baseRawOf(snapshot));
+                    parseAndValidateConfigRaw(nextRaw);
+                } catch (e) {
+                    sendJson(res, 400, { error: '配置写入失败', detail: e.message || '' });
+                    return;
+                }
+                writeConfigFileSecure(path.resolve(state.webConfigPath), nextRaw);
+                sendJson(res, 200, { saved: true });
+            }
+        },
         {
             method: 'POST',
             match: currentPath => currentPath === '/api/setup/password' ? [] : null,
@@ -7612,6 +7704,86 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, payload);
             }
         },
+        {
+            // 磁盘占用：宿主机工作目录与已删除容器的历史（体积另走 /size，大目录不拖慢列表）
+            method: 'GET',
+            match: currentPath => currentPath === '/api/storage' ? [] : null,
+            handler: async () => {
+                let listing;
+                try {
+                    listing = await loadStorageListing(ctx, state);
+                } catch (e) {
+                    sendJson(res, 503, { error: '容器运行时不可用，暂时无法判断目录是否还在使用' });
+                    return;
+                }
+                sendJson(res, 200, listing);
+            }
+        },
+        {
+            method: 'GET',
+            match: currentPath => currentPath === '/api/storage/size' ? [] : null,
+            handler: async () => {
+                const target = String(new URL(req.url || '/', 'http://localhost').searchParams.get('path') || '');
+                if (!state.storageKnownPaths || !state.storageKnownPaths.has(target)) {
+                    sendJson(res, 404, { error: '没有这个目录，请刷新列表' });
+                    return;
+                }
+                sendJson(res, 200, await webStorage.directorySize(target));
+            }
+        },
+        {
+            method: 'GET',
+            match: currentPath => currentPath === '/api/storage/files' ? [] : null,
+            handler: async () => {
+                const params = new URL(req.url || '/', 'http://localhost').searchParams;
+                const target = String(params.get('path') || '');
+                if (!state.storageKnownPaths || !state.storageKnownPaths.has(target)) {
+                    sendJson(res, 404, { error: '没有这个目录，请刷新列表' });
+                    return;
+                }
+                const listed = await webStorage.listDirectory(target, params.get('sub') || '');
+                sendJson(res, listed.ok ? 200 : listed.status, listed.ok ? listed : { error: listed.error });
+            }
+        },
+        {
+            method: 'DELETE',
+            match: currentPath => currentPath === '/api/storage/dirs' ? [] : null,
+            handler: async () => {
+                const body = (await readJsonBody(req)) || {};
+                let listing;
+                try {
+                    listing = await loadStorageListing(ctx, state);
+                } catch (e) {
+                    sendJson(res, 503, { error: '容器运行时不可用，不能确认目录没人用，已拒绝删除' });
+                    return;
+                }
+                const removed = await webStorage.removeManagedDirectory(listing, String(body.path || ''), { emptyOnly: body.emptyOnly === true });
+                sendJson(res, removed.ok ? 200 : removed.status, removed.ok ? { removed: true } : { error: removed.error });
+            }
+        },
+        {
+            method: 'DELETE',
+            match: currentPath => currentPath === '/api/storage/histories' ? [] : null,
+            handler: async () => {
+                const body = (await readJsonBody(req)) || {};
+                const name = String(body.name || '');
+                if (!ctx.isValidContainerName(name)) {
+                    sendJson(res, 400, { error: '名称不合法' });
+                    return;
+                }
+                let listing;
+                try {
+                    listing = await loadStorageListing(ctx, state);
+                } catch (e) {
+                    sendJson(res, 503, { error: '容器运行时不可用，不能确认容器已删除，已拒绝清理' });
+                    return;
+                }
+                const removed = await webStorage.removeDeletedHistory(
+                    state.webHistoryDir, listing, name, historyName => removeWebSessionHistory(state.webHistoryDir, historyName)
+                );
+                sendJson(res, removed.ok ? 200 : removed.status, removed.ok ? { removed: true } : { error: removed.error });
+            }
+        },
         {
             // 聊天里的图片：原始请求体，类型只收 png/jpeg/gif/webp，单张 10MB
             method: 'POST',
@@ -7998,27 +8170,6 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, outcome);
             }
         },
-        {
-            method: 'POST',
-            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/messages\/hide$/),
-            handler: async match => {
-                const sessionRef = getValidSessionRef(ctx, res, match[1]);
-                if (!sessionRef) {
-                    return;
-                }
-                const payload = await readJsonBody(req);
-                if (state.agentRuns.has(sessionRef.containerName)) {
-                    sendJson(res, 409, { error: '任务进行中，暂时不能隐藏' });
-                    return;
-                }
-                const changed = setWebSessionTurnHidden(state.webHistoryDir, sessionRef, String(payload.messageId || ''), payload.hidden !== false);
-                if (!changed) {
-                    sendJson(res, 404, { error: '没有找到这一组' });
-                    return;
-                }
-                sendJson(res, 200, { ok: true, count: changed });
-            }
-        },
         {
             // “改动”视图：工作目录所在 git 仓库的改动列表（按需请求，前端不轮询）
             method: 'GET',
@@ -8098,7 +8249,14 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                     containerInfo.defaultCommand
                 );
                 const agentProgram = resolveAgentProgram(effectiveTemplate);
-                const models = await fetchAgentModelCatalogCached(ctx, sessionRef.containerName, agentProgram);
+                let models = null;
+                if (agentProgram === 'codex') {
+                    // 接了第三方时目录里全是 OpenAI 的模型名，改用这家的预设模型
+                    try {
+                        models = thirdPartyCodexModels(readMergedEnv({ homeDir: ctx.homeDir || os.homedir(), dockerExecArgs: ctx.dockerExecArgs }, sessionRef.containerName));
+                    } catch (e) { /* 读不到 env 就走原来的目录探测 */ }
+                }
+                if (!models) models = await fetchAgentModelCatalogCached(ctx, sessionRef.containerName, agentProgram);
                 sendJson(res, 200, {
                     name: buildWebSessionKey(sessionRef.containerName, sessionRef.agentId),
                     agentProgram,
@@ -8533,7 +8691,16 @@ async function handleWebApi(req, res, pathname, ctx, state) {
 
                 const payload = await readJsonBody(req);
                 const removeHistory = payload.removeHistory === true;
+                // 先记下工作目录：历史删掉后就查不到了
+                const removedHistoryInfo = loadWebSessionHistory(state.webHistoryDir, sessionRef.containerName);
+                const workDirHint = (removedHistoryInfo.applied && removedHistoryInfo.applied.hostPath) ||
+                    (removedHistoryInfo.runtimeSnapshot && removedHistoryInfo.runtimeSnapshot.hostPath) || '';
                 const { removedContainer } = removeContainerIdempotent(ctx, sessionRef.containerName);
+                let removedWorkDir = false;
+                if (removeHistory) {
+                    // 连同历史一起删时，顺手清掉空的工作目录（只 rmdir，非空删不动）
+                    removedWorkDir = await webStorage.removeEmptyWorkDir({ hostPath: workDirHint, ...getStorageRootsConfig(ctx, state) }).catch(() => false);
+                }
 
                 if (removeHistory) {
                     const history = loadWebSessionHistory(state.webHistoryDir, sessionRef.containerName);
@@ -8546,6 +8713,7 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, {
                     removed: true,
                     removedHistory: removeHistory,
+                    removedWorkDir,
                     name: buildWebSessionKey(sessionRef.containerName, sessionRef.agentId)
                 });
             }
@@ -8585,6 +8753,28 @@ async function handleWebApi(req, res, pathname, ctx, state) {
         }
     ];
 
+    routes.push(...createModelServiceRoutes({
+        ctx,
+        state,
+        req,
+        res,
+        deps: {
+            sendJson,
+            readJsonBody,
+            decodeSessionName,
+            readSnapshot: () => readWebConfigSnapshot(state.webConfigPath),
+            writeRaw: raw => writeConfigFileSecure(path.resolve(state.webConfigPath), raw),
+            baseRawOf,
+            validateRaw: parseAndValidateConfigRaw,
+            runConnectionTest: (agent, env) => runSetupConnectionTest(ctx, state, agent, env),
+            defaultHostPath: () => getSetupWorkpath(state),
+            listManaged: async () => {
+                const manager = getWebNetworkManager(ctx, state);
+                return typeof manager.listManaged === 'function' ? manager.listManaged() : [];
+            }
+        }
+    }));
+
     routes.push(...createContainerManageRoutes({
         ctx,
         state,