kiku-agent 1.3.1 → 1.3.3

package/server/web-chat/routes/statusRoute.js

@@ -1,73 +1,194 @@
-import { toolsSchema } from '../../agent/tools.js';
-import { resolveAgentConnection, currentAgent } from '../core/connection.js';
-import { config, CLOUD_PROVIDERS, getProviderBaseUrl, getUnifiedProviderCatalog } from '../../agent/config.js';
-import { getAgentMemorySnapshot } from '../core/memorySnapshot.js';
-import { sendJson, sendError } from '../core/errorHandler.js';
-import { extractApiKey } from '../core/security.js';
-
-export async function handleStatusRoute(req, res, urlObj, port) {
-  try {
-    const queryProvider = urlObj.searchParams.get('provider');
-    const queryModel = urlObj.searchParams.get('model');
-    const queryApiKey = extractApiKey(req);
-    const querySessionId = urlObj.searchParams.get('sessionId');
-    const queryBaseUrl = urlObj.searchParams.get('baseUrl');
-
-    const conn = await resolveAgentConnection({
-      provider: queryProvider,
-      model: queryModel,
-      apiKey: queryApiKey,
-      sessionId: querySessionId,
-      baseUrl: queryBaseUrl || undefined,
-    });
-
-    const totalTools = conn.agent?.getAllToolsSchema?.().length || toolsSchema.length;
-    const serverDefaultProvider = currentAgent?.client?.provider || config.activeProvider || 'lmstudio';
-    const serverDefaultModel = currentAgent?.client?.model || config.providers?.[serverDefaultProvider]?.model || 'google/gemma-4-e4b';
-    const serverDefaultProviderName = currentAgent?.client?.providerName || (CLOUD_PROVIDERS?.[serverDefaultProvider]?.name) || serverDefaultProvider;
-    const serverDefaultBaseUrl = currentAgent?.client?.baseUrl || getProviderBaseUrl(serverDefaultProvider);
-    let localEndpoints = null;
-    let providerCatalog = null;
-    try {
-      const catalog = getUnifiedProviderCatalog();
-      localEndpoints = catalog.localEndpoints;
-      providerCatalog = catalog.providers;
-    } catch {}
-
-    sendJson(res, 200, {
-      status: 'ok',
-      server: 'Kiku Web Chatbot',
-      port,
-      connected: conn.ready,
-      state: conn.ready ? 'ready' : (conn.state || 'server_offline'),
-      provider: conn.provider,
-      model: conn.model,
-      activeModel: conn.model,
-      activeLoadedModel: conn.resolution?.activeLoadedModel || conn.model,
-      loadedModels: conn.models || [],
-      usedFallback: conn.usedFallback || false,
-      serverDefaultProvider,
-      serverDefaultModel,
-      serverDefaultProviderName,
-      serverDefaultBaseUrl,
-      localEndpoints,
-      providers: providerCatalog,
-      hasServerAgent: Boolean(currentAgent),
-      error: conn.error || null,
-      capabilities: {
-        reactAgent: Boolean(conn.agent),
-        streaming: true,
-        toolCalling: Boolean(conn.agent),
-        localTools: toolsSchema.length,
-        mcpTools: Math.max(0, totalTools - toolsSchema.length),
-        totalTools,
-        sessionMemory: Boolean(conn.agent),
-        longTermMemory: Boolean(conn.agent?.memory),
-        cachedAgent: conn.cached === true,
-      },
-      memory: getAgentMemorySnapshot(conn.agent, querySessionId)
-    });
-  } catch (err) {
-    sendError(res, 500, err.message);
-  }
-}
+import { credentialFingerprint } from '../core/connection.js';
+import { toolsSchema } from '../../agent/tools.js';
+import { resolveAgentConnection, currentAgent } from '../core/connection.js';
+import { config, CLOUD_PROVIDERS, getProviderBaseUrl, getUnifiedProviderCatalog, getPersistedInferenceSettings, getProvider } from '../../agent/config.js';
+import { getAgentMemorySnapshot } from '../core/memorySnapshot.js';
+import { sendJson, sendError } from '../core/errorHandler.js';
+import { extractApiKey, isWebChatAdmin } from '../core/security.js';
+import { validateInferenceBaseUrl, isTrustedRequest, sanitizeInferenceError } from '../core/urlGuard.js';
+
+// Full /api/status builds an agent and probes the upstream server; dedupe
+// bursts (chat-page poll + settings page) behind a tiny TTL cache.
+const FULL_STATUS_CACHE_TTL_MS = 3_000;
+let fullStatusCache = { key: null, at: 0, payload: null };
+
+function fullStatusCacheKey({ provider, model, baseUrl, apiKey }) {
+  return [provider || 'auto', model || 'auto', baseUrl || '-', credentialFingerprint(apiKey)].join('|');
+}
+
+export async function handleStatusRoute(req, res, urlObj, port) {
+  try {
+    const queryProvider = urlObj.searchParams.get('provider');
+    const queryModel = urlObj.searchParams.get('model');
+    const queryApiKey = extractApiKey(req);
+    const querySessionId = urlObj.searchParams.get('sessionId');
+    const queryBaseUrl = urlObj.searchParams.get('baseUrl');
+    const light = urlObj.searchParams.get('light') === '1';
+
+    if (queryProvider && queryProvider !== 'auto' && !getProvider(queryProvider)) return sendError(res, 400, 'Unknown provider');
+    if (queryBaseUrl) {
+      const guard = await validateInferenceBaseUrl(queryBaseUrl, { trusted: isTrustedRequest(req) });
+      if (!guard.ok) {
+        return sendError(res, 400, `Invalid baseUrl: ${guard.reason}`);
+      }
+    }
+
+    if (light) {
+      return sendJson(res, 200, await buildLightStatus({ port, provider: queryProvider, model: queryModel, baseUrl: queryBaseUrl }));
+    }
+
+    const cacheKey = String(isTrustedRequest(req)) + '|' + querySessionId + '|' + fullStatusCacheKey({ provider: queryProvider, model: queryModel, baseUrl: queryBaseUrl, apiKey: queryApiKey });
+    const now = Date.now();
+    if (fullStatusCache.key === cacheKey && now - fullStatusCache.at < FULL_STATUS_CACHE_TTL_MS) {
+      return sendJson(res, 200, { ...fullStatusCache.payload, cached: true });
+    }
+
+    const conn = await resolveAgentConnection({
+      provider: queryProvider,
+      model: queryModel,
+      apiKey: isWebChatAdmin(req) ? undefined : queryApiKey,
+      callerIsTrusted: isTrustedRequest(req),
+      sessionId: querySessionId,
+      baseUrl: queryBaseUrl || undefined,
+      // Auto-starting LM Studio from a status GET is a side effect; only trusted
+      // (loopback/admin) callers may wake the local engine this way.
+      allowAutoStart: isTrustedRequest(req),
+    });
+
+    const payload = await buildFullStatus({ conn, queryProvider, queryModel, queryApiKey, querySessionId, port });
+    payload.error = payload.error ? sanitizeInferenceError(payload.error, isTrustedRequest(req)) : null;
+    fullStatusCache = { key: cacheKey, at: Date.now(), payload };
+    sendJson(res, 200, payload);
+  } catch (err) {
+    sendError(res, err.statusCode || 502, sanitizeInferenceError(err, isTrustedRequest(req)));
+  }
+}
+
+async function buildLightStatus({ port, provider, model, baseUrl }) {
+  const serverProvider = currentAgent?.client?.provider || config.activeProvider || 'lmstudio';
+  const activeBaseUrl = (typeof baseUrl === 'string' && baseUrl.trim())
+    ? baseUrl.trim().replace(/\/+$/, '')
+    : (currentAgent?.client?.baseUrl || getProviderBaseUrl(provider || serverProvider));
+
+  const connected = Boolean(currentAgent?.client && currentAgent.client.provider === (provider && provider !== 'auto' ? provider : serverProvider) && (!baseUrl || currentAgent.client.baseUrl === baseUrl));
+  let localEndpoints = null;
+  let providerCatalog = null;
+  try {
+    const catalog = getUnifiedProviderCatalog();
+    localEndpoints = catalog.localEndpoints;
+    providerCatalog = catalog.providers;
+  } catch {}
+
+  const serverDefaultModel = currentAgent?.client?.model || config.providers?.[serverProvider]?.model || 'google/gemma-4-e4b';
+  return {
+    status: 'ok',
+    server: 'Kiku Web Chatbot',
+    port,
+    light: true,
+    connected,
+    state: connected ? 'unprobed' : 'unknown',
+    healthVerified: false,
+    provider: serverProvider,
+    model: serverDefaultModel,
+    activeModel: serverDefaultModel,
+    loadedModels: [],
+    usedFallback: false,
+    serverDefaultProvider: serverProvider,
+    serverDefaultModel,
+    serverDefaultProviderName: currentAgent?.client?.providerName || CLOUD_PROVIDERS?.[serverProvider]?.name || serverProvider,
+    serverDefaultBaseUrl: currentAgent?.client?.baseUrl || getProviderBaseUrl(serverProvider),
+    contextLimit: getPersistedInferenceSettings().contextLimit,
+    inference: getPersistedInferenceSettings(),
+    localEndpoints,
+    providers: providerCatalog,
+    hasServerAgent: Boolean(currentAgent),
+    error: null,
+    capabilities: {
+      reactAgent: Boolean(currentAgent),
+      streaming: true,
+      toolCalling: Boolean(currentAgent),
+      localTools: toolsSchema.length,
+      mcpTools: 0,
+      totalTools: toolsSchema.length,
+      sessionMemory: Boolean(currentAgent),
+      longTermMemory: Boolean(currentAgent?.memory),
+      cachedAgent: false,
+      light: true,
+    },
+    mcp: {
+      endpoint: '/mcp',
+      protocolVersion: '2025-11-25',
+      transport: 'streamable-http',
+      online: true,
+    },
+    memory: null,
+  };
+}
+
+async function buildFullStatus({ conn, queryProvider, queryModel, queryApiKey, querySessionId, port }) {
+  const totalTools = conn.agent?.getAllToolsSchema?.().length || toolsSchema.length;
+  const serverDefaultProvider = currentAgent?.client?.provider || config.activeProvider || 'lmstudio';
+  const serverDefaultModel = currentAgent?.client?.model || config.providers?.[serverDefaultProvider]?.model || 'google/gemma-4-e4b';
+  const serverDefaultProviderName = currentAgent?.client?.providerName || (CLOUD_PROVIDERS?.[serverDefaultProvider]?.name) || serverDefaultProvider;
+  const serverDefaultBaseUrl = currentAgent?.client?.baseUrl || getProviderBaseUrl(serverDefaultProvider);
+  let localEndpoints = null;
+  let providerCatalog = null;
+  try {
+    const catalog = getUnifiedProviderCatalog();
+    localEndpoints = catalog.localEndpoints;
+    providerCatalog = catalog.providers;
+  } catch {}
+
+  const isLocal = conn.provider === 'lmstudio' || conn.provider === 'vllm';
+  const rawActive = conn.resolution?.activeLoadedModel || null;
+  const isModelLoaded = isLocal ? Boolean(rawActive) : Boolean(conn.ready);
+  const activeLoadedModel = rawActive || (!isLocal ? conn.model : null);
+  const loadedModels = conn.resolution?.loadedModels || (rawActive ? [rawActive] : (!isLocal ? conn.models || [] : []));
+  const effectiveState = !isModelLoaded && isLocal ? 'server_online_model_not_loaded' : (conn.ready ? 'ready' : (conn.state || 'server_offline'));
+
+  return {
+    status: 'ok',
+    server: 'Kiku Web Chatbot',
+    port,
+    light: false,
+    connected: conn.ready,
+    isModelLoaded,
+    state: effectiveState,
+    provider: conn.provider,
+    model: conn.model,
+    activeModel: conn.model,
+    activeLoadedModel,
+    loadedModels,
+    usedFallback: conn.usedFallback || false,
+    serverDefaultProvider,
+    serverDefaultModel,
+    serverDefaultProviderName,
+    serverDefaultBaseUrl,
+    // Effective engine context-budget (CLI KIKU_CONTEXT_LIMIT env; 0 = unset).
+    // The /settings Context Window slider syncs against this value.
+    contextLimit: getPersistedInferenceSettings().contextLimit,
+    inference: getPersistedInferenceSettings(),
+    localEndpoints,
+    providers: providerCatalog,
+    hasServerAgent: Boolean(currentAgent),
+    error: conn.error || null,
+    capabilities: {
+      reactAgent: Boolean(conn.agent),
+      streaming: true,
+      toolCalling: Boolean(conn.agent),
+      localTools: toolsSchema.length,
+      mcpTools: Math.max(0, totalTools - toolsSchema.length),
+      totalTools,
+      sessionMemory: Boolean(conn.agent),
+      longTermMemory: Boolean(conn.agent?.memory),
+      cachedAgent: conn.cached === true,
+    },
+    mcp: {
+      endpoint: '/mcp',
+      protocolVersion: '2025-11-25',
+      transport: 'streamable-http',
+      online: true,
+    },
+    memory: null
+  };
+}

package/server/web-chat/routes/suggestRoute.js

@@ -1,8 +1,10 @@
 import { executeTool } from '../../agent/tools.js';
 import { CATEGORIZED_SUGGESTIONS, DEFAULT_SUGGESTIONS } from '../ui/scripts/suggestionsData.js';
-import { resolveAgentConnection } from '../core/connection.js';
+import { config, getProvider } from '../../agent/config.js';
+import { isTrustedRequest } from '../core/urlGuard.js';
+import { resolveAgentConnection, currentAgent } from '../core/connection.js';
 import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
-import { extractApiKey } from '../core/security.js';
+import { extractApiKey, isWebChatAdmin } from '../core/security.js';
 
 export async function handleSuggestionsRoute(req, res) {
   sendJson(res, 200, {
@@ -30,6 +32,9 @@ export async function handleAiSuggestRoute(req, res) {
     body = await parseJsonBody(req);
   } catch {}
 
+  const provider = (!body.provider || body.provider === 'auto') ? (currentAgent?.client?.provider || config.activeProvider) : body.provider;
+  if (!getProvider(provider)) return sendError(res, 400, 'Unknown provider');
+  if (!['lmstudio', 'vllm', 'custom'].includes(provider) && !isTrustedRequest(req)) return sendError(res, 403, 'Cloud inference requires local or admin access');
   const { topic = '' } = body;
   const limit = Math.min(Math.max(Number(body.limit) || 5, 2), 8);
   const lang = AI_SUGGEST_LANGS.has(String(body.lang || '').toLowerCase())
@@ -43,7 +48,10 @@ export async function handleAiSuggestRoute(req, res) {
     const conn = await resolveAgentConnection({
       provider: body.provider,
       model: body.model,
-      apiKey,
+      apiKey: isWebChatAdmin(req) ? undefined : apiKey,
+      baseUrl: body.baseUrl,
+      callerIsTrusted: isTrustedRequest(req),
+      allowAutoStart: isTrustedRequest(req),
       sessionId: body.sessionId,
     });
     const controller = new AbortController();

package/server/web-chat/routes/verifyRoute.js

@@ -1,5 +1,6 @@
 import { executeTool } from '../../agent/tools.js';
 import { parseJsonBody, sendJson, sendError } from '../core/errorHandler.js';
+import { extractWordTokens, buildTermFrequencyVector, computeCosineSimilarity } from '../../agent/memory/contextAllocator.js';
 
 export async function handleVerifyRoute(req, res) {
   let body;
@@ -23,10 +24,31 @@ export async function handleVerifyRoute(req, res) {
       ? rawResults
       : Object.values(rawResults || {}).flat().filter(item => typeof item === 'object');
 
-    const hasDirectMatch = flatItems.some(r =>
-      String(r.title || r.name || '').toLowerCase().includes(claim.toLowerCase()) ||
-      String(r.description || r.synopsis || '').toLowerCase().includes(claim.toLowerCase())
-    );
+    const claimLower = claim.toLowerCase().trim();
+    const claimTokens = extractWordTokens(claim);
+    const claimVec = buildTermFrequencyVector(claimTokens);
+
+    let bestScore = 0;
+    for (const r of flatItems) {
+      const title = String(r.title || r.name || r.titleTh || r.titleCn || '').toLowerCase();
+      if (title && (claimLower.includes(title) || title.includes(claimLower))) {
+        bestScore = Math.max(bestScore, 0.8);
+      }
+      const itemText = [
+        r.title || r.name || '',
+        r.titleCn || '',
+        r.titleTh || '',
+        r.role || '',
+        r.year || '',
+        r.description || r.synopsis || ''
+      ].join(' ');
+      const itemTokens = extractWordTokens(itemText);
+      const itemVec = buildTermFrequencyVector(itemTokens);
+      const sim = computeCosineSimilarity(claimVec, itemVec);
+      if (sim > bestScore) bestScore = sim;
+    }
+
+    const hasDirectMatch = bestScore >= 0.25;
 
     result = {
       verdict: hasDirectMatch ? 'PARTIALLY_VERIFIED' : 'UNVERIFIED',

package/server/web-chat/server.js

@@ -1,7 +1,9 @@
+import '../agent/envBootstrap.js';
 import http from 'node:http';
 import { handleWebChatRequest } from './router.js';
-import { currentAgent, setCurrentAgent, webAgentCache } from './core/connection.js';
+import { currentAgent, setCurrentAgent } from './core/connection.js';
 import { config } from '../agent/config.js';
+import { KIKU_DEFAULT_MODEL } from '../agent/modelDefaults.js';
 
 let activeServer = null;
 let activePort = Number(process.env.PORT_WEB_CHAT || 3002);
@@ -25,7 +27,7 @@ export function getWebChatServerStatus() {
     port: activePort,
     url: formatServerUrl(activeHost, activePort),
     provider: currentAgent?.client?.provider || config.activeProvider || 'lmstudio',
-    model: currentAgent?.client?.model || 'google/gemma-4-e4b',
+    model: currentAgent?.client?.model || KIKU_DEFAULT_MODEL,
   };
 }
 
@@ -36,10 +38,9 @@ export function stopWebChatServer() {
       try { activeServer.closeAllConnections(); } catch {}
     }
     activeServer.close(async () => {
-      await Promise.allSettled(
-        Array.from(webAgentCache.values(), connection => connection.agent?.saveSession?.())
-      );
-      webAgentCache.clear();
+      if (currentAgent?.saveSession) {
+        try { await currentAgent.saveSession(); } catch {}
+      }
       activeServer = null;
       resolve(true);
     });