kiku-agent 1.2.0 → 1.3.1

package/server/web-chat/routes/clarifyConfigRoute.js

@@ -39,6 +39,7 @@ export async function handleClarifyAnalyticsRoute(req, res, options = {}) {
 }
 
 export async function handleClarifyConfigRoute(req, res, options = {}, action = 'get') {
+  if (!isWebChatAdmin(req)) return sendError(res, 401, 'Admin API key required');
   try {
     const config = getConfig();
     
@@ -48,8 +49,6 @@ export async function handleClarifyConfigRoute(req, res, options = {}, action =
         config: config.getConfig(),
       });
     }
-
-    if (!isWebChatAdmin(req)) return sendError(res, 401, 'Admin API key required');
     
     if (action === 'reset') {
       const newConfig = config.reset();

package/server/web-chat/routes/exportRoute.js

@@ -1,5 +1,6 @@
 import { normalizeWebSessionId } from '../core/connection.js';
 import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import { PACKAGE_VERSION } from '../../agent/version.js';
 
 export async function handleExportRoute(req, res) {
   let body;
@@ -19,7 +20,7 @@ export async function handleExportRoute(req, res) {
       exportedAt: new Date().toISOString(),
       sessionId: normSessionId,
       messages: history,
-      metadata: { app: '鞠婧祎', version: '1.0.0' }
+      metadata: { app: '鞠婧祎', version: PACKAGE_VERSION }
     };
     res.writeHead(200, {
       'Content-Type': 'application/json; charset=utf-8',

package/server/web-chat/routes/lanDiscoveryRoute.js

@@ -0,0 +1,90 @@
+import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import { scanLan, mapServerTypeToProvider } from '../../agent/lanDiscovery.js';
+import { isPrivateIPv4 } from '../../agent/sanitizer.js';
+import { resolveClientIp, isWebChatAdmin } from '../core/security.js';
+import {
+  getProvider,
+  getUnifiedProviderCatalog,
+  savePersistedProviderBaseUrl,
+  setActiveProvider,
+} from '../../agent/config.js';
+import { currentAgent, setCurrentAgent } from '../core/connection.js';
+
+function lanDiscoveryAllowed(req) {
+  if (String(process.env.KIKU_ALLOW_REMOTE_LAN_DISCOVERY || '').toLowerCase() === 'true') return true;
+  if (isWebChatAdmin(req)) return true;
+  const ip = resolveClientIp(req);
+  return ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+}
+
+export async function handleLanDiscoveryRoute(req, res) {
+  if (!lanDiscoveryAllowed(req)) {
+    return sendError(res, 403, 'LAN discovery is restricted to the local machine. Set KIKU_ALLOW_REMOTE_LAN_DISCOVERY=true to allow other devices.');
+  }
+  try {
+    const urlObj = new URL(req.url, 'http://localhost');
+    const subnetsParam = urlObj.searchParams.get('subnets');
+    const portsParam = urlObj.searchParams.get('ports');
+    const options = {};
+    if (subnetsParam && subnetsParam.trim()) {
+      options.subnets = subnetsParam.split(',').map(s => s.trim()).filter(Boolean);
+    }
+    if (portsParam && portsParam.trim()) {
+      options.ports = portsParam.split(',').map(Number).filter(p => Number.isInteger(p) && p >= 1 && p <= 65535);
+    }
+    const result = await scanLan(options);
+    sendJson(res, 200, { status: 'ok', ...result });
+  } catch (err) {
+    sendError(res, 400, err.message);
+  }
+}
+
+export async function handleLanApplyRoute(req, res) {
+  if (!lanDiscoveryAllowed(req)) {
+    return sendError(res, 403, 'LAN discovery is restricted to the local machine. Set KIKU_ALLOW_REMOTE_LAN_DISCOVERY=true to allow other devices.');
+  }
+
+  let body;
+  try {
+    body = await parseJsonBody(req, 16 * 1024);
+  } catch (err) {
+    return sendError(res, 400, `Invalid JSON body: ${err.message}`);
+  }
+
+  const host = String(body.host || '').trim();
+  const port = Number(body.port);
+  const model = typeof body.model === 'string' && body.model.trim() ? body.model.trim() : null;
+  const serverType = String(body.serverType || 'openai-compatible').toLowerCase();
+
+  if (!/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(host) || !isPrivateIPv4(host)) {
+    return sendError(res, 400, 'host must be a private IPv4 address discovered by the LAN scan');
+  }
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return sendError(res, 400, 'port must be an integer between 1 and 65535');
+  }
+
+  const provider = mapServerTypeToProvider(serverType);
+  if (!getProvider(provider)) {
+    return sendError(res, 400, `Unknown provider "${provider}"`);
+  }
+
+  const baseUrl = `http://${host}:${port}/v1`;
+  savePersistedProviderBaseUrl(provider, baseUrl);
+  setActiveProvider(provider, { model, baseUrl });
+
+  if (currentAgent?.client) {
+    try {
+      currentAgent.client.switchProvider(provider, { model: model || undefined, baseUrl });
+      setCurrentAgent(currentAgent);
+    } catch {}
+  }
+
+  const catalog = getUnifiedProviderCatalog();
+  sendJson(res, 200, {
+    status: 'ok',
+    applied: { provider, baseUrl, model },
+    activeProvider: catalog.activeProvider,
+    activeBaseUrl: catalog.activeBaseUrl,
+    activeModel: catalog.activeModel,
+  });
+}

package/server/web-chat/routes/newsRoute.js

@@ -1,5 +1,32 @@
 import { socialUpdatesData } from '../../../src/data/socialUpdatesData.js';
 import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import { searchNews } from '../../agent/webSearch.js';
+import { rankNewsItems } from '../../agent/newsIntelligence.js';
+
+const LIVE_TIMEOUT_MS = 6000;
+
+async function fetchLiveItems(query, days) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), LIVE_TIMEOUT_MS);
+  try {
+    const result = await searchNews(query, 12);
+    if (result?.status !== 'success') return [];
+    const cutoff = days > 0 ? new Date(Date.now() - days * 86400000) : null;
+    return rankNewsItems(result.results || [], { cutoff })
+      .filter(item => !cutoff || !item.date || item.date.getTime() >= cutoff.getTime())
+      .map(item => ({
+        title: item.title,
+        summary: item.snippet || '',
+        date: item.date ? item.date.toISOString().slice(0, 10) : null,
+        platform: item.tierLabel || 'news',
+        url: item.url,
+      }));
+  } catch {
+    return [];
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
 export async function handleNewsRoute(req, res) {
   let body = {};
@@ -8,12 +35,13 @@ export async function handleNewsRoute(req, res) {
   } catch {}
 
   const { query = 'จวีจิ้งอี Ju Jingyi', days = 30 } = body;
-  let newsItems = [];
-  const source = 'social';
 
+  const liveItems = await fetchLiveItems(String(query || 'จวีจิ้งอี Ju Jingyi'), Number(days) || 30);
+
+  let socialItems = [];
   try {
     const cards = socialUpdatesData?.douyin?.cards || socialUpdatesData?.cards || [];
-    newsItems = cards.map(c => ({
+    socialItems = cards.map(c => ({
       title: c.title || c.titleCn,
       summary: c.captionTh || c.captionCn || c.content,
       date: c.date,
@@ -22,12 +50,14 @@ export async function handleNewsRoute(req, res) {
     }));
   } catch {}
 
+  const items = [...liveItems, ...socialItems.slice(0, 6)];
   sendJson(res, 200, {
     status: 'ok',
     query,
     days,
-    items: newsItems.slice(0, 10),
-    source,
-    count: newsItems.length
+    items: items.slice(0, 12),
+    liveCount: liveItems.length,
+    source: liveItems.length > 0 ? 'live+social' : 'social',
+    count: items.length
   });
 }

package/server/web-chat/routes/providerRoute.js

@@ -0,0 +1,87 @@
+import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import {
+  getUnifiedProviderCatalog,
+  getProviderBaseUrl,
+  setActiveProvider,
+  savePersistedProviderBaseUrl,
+  getProvider,
+} from '../../agent/config.js';
+import { currentAgent, setCurrentAgent } from '../core/connection.js';
+import { LLMClient } from '../../agent/llmClient.js';
+
+export async function handleProviderGetRoute(req, res) {
+  try {
+    const catalog = getUnifiedProviderCatalog();
+    sendJson(res, 200, {
+      status: 'ok',
+      activeProvider: catalog.activeProvider,
+      activeBaseUrl: catalog.activeBaseUrl,
+      activeModel: catalog.activeModel,
+      localEndpoints: catalog.localEndpoints,
+      providers: catalog.providers,
+    });
+  } catch (err) {
+    sendError(res, 500, err.message);
+  }
+}
+
+export async function handleProviderUpdateRoute(req, res) {
+  let body;
+  try {
+    body = await parseJsonBody(req);
+  } catch (err) {
+    return sendError(res, 400, `Invalid JSON body: ${err.message}`);
+  }
+  try {
+    const provider = String(body.provider || body.activeProvider || '').toLowerCase().trim() || null;
+    const model = typeof body.model === 'string' && body.model.trim() ? body.model.trim() : null;
+    const baseUrl = typeof body.baseUrl === 'string' && body.baseUrl.trim() ? body.baseUrl.trim().replace(/\/+$/, '') : null;
+
+    if (baseUrl && !provider) {
+      return sendError(res, 400, 'Provider is required when setting a baseUrl');
+    }
+
+    if (baseUrl && provider) {
+      const pDef = getProvider(provider);
+      if (!pDef) return sendError(res, 400, `Unknown provider "${provider}"`);
+      try {
+        new URL(baseUrl);
+      } catch {
+        return sendError(res, 400, `Invalid baseUrl "${baseUrl}"`);
+      }
+      savePersistedProviderBaseUrl(provider, baseUrl);
+    }
+
+    let catalog;
+    if (provider) {
+      const pDef = getProvider(provider);
+      if (!pDef) return sendError(res, 400, `Unknown provider "${provider}"`);
+      setActiveProvider(provider, { model, baseUrl });
+      if (currentAgent?.client) {
+        try {
+          currentAgent.client.switchProvider(provider, { model: model || undefined, baseUrl: baseUrl || undefined });
+          setCurrentAgent(currentAgent);
+        } catch {}
+      } else if (baseUrl || model) {
+        try {
+          const client = new LLMClient({ provider, model: model || undefined, baseUrl: baseUrl || getProviderBaseUrl(provider) });
+          void client;
+        } catch {}
+      }
+      catalog = getUnifiedProviderCatalog();
+    } else {
+      catalog = getUnifiedProviderCatalog();
+    }
+
+    sendJson(res, 200, {
+      status: 'ok',
+      activeProvider: catalog.activeProvider,
+      activeBaseUrl: catalog.activeBaseUrl,
+      activeModel: catalog.activeModel,
+      localEndpoints: catalog.localEndpoints,
+      providers: catalog.providers,
+    });
+  } catch (err) {
+    sendError(res, 500, err.message);
+  }
+}

package/server/web-chat/routes/staticRoute.js

@@ -26,16 +26,48 @@ const MIME_TYPES = {
 };
 
 export function handleStaticRoute(req, res, pathname, port) {
-  if (pathname === '/favicon.ico' || pathname === '/favicon.svg') {
-    const svgIcon = `<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🌸</text></svg>`;
-    res.writeHead(200, {
-      'Content-Type': 'image/svg+xml',
-      'Cache-Control': 'public, max-age=86400, immutable'
-    });
-    res.end(svgIcon);
+  const rawUrl = req?.url || '';
+  let currentPath = pathname;
+  if (!currentPath && rawUrl) {
+    try {
+      currentPath = new URL(rawUrl, 'http://localhost').pathname;
+    } catch {
+      currentPath = rawUrl;
+    }
+  }
+  currentPath = currentPath || '/';
+
+  const rawContainsTraversal = rawUrl.includes('..') || /%2e/i.test(rawUrl);
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(currentPath);
+  } catch {
+    decodedPath = currentPath;
+  }
+  const decodedContainsTraversal = decodedPath.includes('..') || decodedPath.includes('\0');
+
+  if (rawContainsTraversal || decodedContainsTraversal) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('403 Forbidden: Access denied');
     return true;
   }
 
+  if (currentPath === '/favicon.ico') {
+    let icoPath = path.join(PUBLIC_DIR, 'favicon.ico');
+    if (!fs.existsSync(icoPath)) {
+      const cwdPath = path.join(process.cwd(), 'public', 'favicon.ico');
+      if (fs.existsSync(cwdPath)) icoPath = cwdPath;
+    }
+    if (fs.existsSync(icoPath)) {
+      res.writeHead(200, {
+        'Content-Type': 'image/x-icon',
+        'Cache-Control': 'public, max-age=86400, immutable'
+      });
+      res.end(fs.readFileSync(icoPath));
+      return true;
+    }
+  }
+
   if (pathname === '/sw.js' || pathname === '/service-worker.js') {
     let swPath = path.join(PUBLIC_DIR, 'sw.js');
     if (!fs.existsSync(swPath)) {
@@ -72,13 +104,29 @@ self.addEventListener('fetch', (event) => {
     return true;
   }
 
-  if (pathname.startsWith('/fonts/') || pathname.startsWith('/images/') || pathname === '/manifest.json' || pathname === '/robots.txt') {
-    const safePath = path.normalize(pathname).replace(/^(\.\.[\/\\])+/, '');
-    let filePath = path.join(PUBLIC_DIR, safePath);
+  if (currentPath.startsWith('/fonts/') || currentPath.startsWith('/images/') || currentPath === '/manifest.json' || currentPath === '/robots.txt') {
+    const targetDir = fs.existsSync(PUBLIC_DIR) ? PUBLIC_DIR : path.join(process.cwd(), 'public');
+    const targetDirCanonical = path.resolve(targetDir);
+    const targetDirPrefix = targetDirCanonical + path.sep;
+
+    const relativePath = currentPath.replace(/^\/+/, '');
+    const resolvedPath = path.resolve(targetDirCanonical, relativePath);
+
+    if (!resolvedPath.startsWith(targetDirPrefix) && resolvedPath !== targetDirCanonical) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('403 Forbidden: Access denied');
+      return true;
+    }
+
+    let filePath = resolvedPath;
     if (!fs.existsSync(filePath)) {
-      const cwdPath = path.join(process.cwd(), 'public', safePath);
-      if (fs.existsSync(cwdPath)) filePath = cwdPath;
+      const cwdPublic = path.resolve(process.cwd(), 'public');
+      const cwdPath = path.resolve(cwdPublic, relativePath);
+      if (cwdPath.startsWith(cwdPublic + path.sep) && fs.existsSync(cwdPath)) {
+        filePath = cwdPath;
+      }
     }
+
     if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
       const ext = path.extname(filePath).toLowerCase();
       res.writeHead(200, {
@@ -90,7 +138,7 @@ self.addEventListener('fetch', (event) => {
     }
   }
 
-  if (pathname === '/' || pathname === '/chat' || pathname.startsWith('/chat/') || pathname === '/index.html') {
+  if (currentPath === '/' || currentPath === '/chat' || currentPath.startsWith('/chat/') || currentPath === '/index.html') {
     res.writeHead(200, {
       'Content-Type': 'text/html; charset=utf-8',
       'Cache-Control': 'no-cache, no-store, must-revalidate'

package/server/web-chat/routes/statusRoute.js

@@ -1,5 +1,6 @@
 import { toolsSchema } from '../../agent/tools.js';
-import { resolveAgentConnection } from '../core/connection.js';
+import { resolveAgentConnection, currentAgent } from '../core/connection.js';
+import { config, CLOUD_PROVIDERS, getProviderBaseUrl, getUnifiedProviderCatalog } from '../../agent/config.js';
 import { getAgentMemorySnapshot } from '../core/memorySnapshot.js';
 import { sendJson, sendError } from '../core/errorHandler.js';
 import { extractApiKey } from '../core/security.js';
@@ -8,17 +9,30 @@ export async function handleStatusRoute(req, res, urlObj, port) {
   try {
     const queryProvider = urlObj.searchParams.get('provider');
     const queryModel = urlObj.searchParams.get('model');
-    const queryApiKey = extractApiKey(req);
+    const queryApiKey = extractApiKey(req);
     const querySessionId = urlObj.searchParams.get('sessionId');
+    const queryBaseUrl = urlObj.searchParams.get('baseUrl');
 
     const conn = await resolveAgentConnection({
       provider: queryProvider,
       model: queryModel,
       apiKey: queryApiKey,
       sessionId: querySessionId,
+      baseUrl: queryBaseUrl || undefined,
     });
 
     const totalTools = conn.agent?.getAllToolsSchema?.().length || toolsSchema.length;
+    const serverDefaultProvider = currentAgent?.client?.provider || config.activeProvider || 'lmstudio';
+    const serverDefaultModel = currentAgent?.client?.model || config.providers?.[serverDefaultProvider]?.model || 'google/gemma-4-e4b';
+    const serverDefaultProviderName = currentAgent?.client?.providerName || (CLOUD_PROVIDERS?.[serverDefaultProvider]?.name) || serverDefaultProvider;
+    const serverDefaultBaseUrl = currentAgent?.client?.baseUrl || getProviderBaseUrl(serverDefaultProvider);
+    let localEndpoints = null;
+    let providerCatalog = null;
+    try {
+      const catalog = getUnifiedProviderCatalog();
+      localEndpoints = catalog.localEndpoints;
+      providerCatalog = catalog.providers;
+    } catch {}
 
     sendJson(res, 200, {
       status: 'ok',
@@ -32,6 +46,13 @@ export async function handleStatusRoute(req, res, urlObj, port) {
       activeLoadedModel: conn.resolution?.activeLoadedModel || conn.model,
       loadedModels: conn.models || [],
       usedFallback: conn.usedFallback || false,
+      serverDefaultProvider,
+      serverDefaultModel,
+      serverDefaultProviderName,
+      serverDefaultBaseUrl,
+      localEndpoints,
+      providers: providerCatalog,
+      hasServerAgent: Boolean(currentAgent),
       error: conn.error || null,
       capabilities: {
         reactAgent: Boolean(conn.agent),

package/server/web-chat/routes/vramRoute.js

@@ -0,0 +1,22 @@
+import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import { buildHardwareReport, computeVramEstimate, parseEstimateRequest } from '../../agent/vramService.js';
+
+export async function handleSystemHardwareRoute(req, res) {
+  try {
+    const report = await buildHardwareReport();
+    return sendJson(res, 200, { status: 'success', data: report });
+  } catch (err) {
+    return sendError(res, 500, err.message || 'Hardware probe failed');
+  }
+}
+
+export async function handleEstimateVramRoute(req, res, urlObj) {
+  try {
+    const body = req.method === 'POST' ? await parseJsonBody(req) : {};
+    const request = parseEstimateRequest(body, urlObj?.searchParams || null);
+    const estimate = await computeVramEstimate(request);
+    return sendJson(res, 200, { status: 'success', data: estimate });
+  } catch (err) {
+    return sendError(res, 500, err.message || 'VRAM estimation failed');
+  }
+}