Commit Graph
261 Commits
Author SHA1 Message Date
Magolor 2f9d5d083c Show server-masked credential previews by Unicode code point 2026-11-06 16:59:29 +08:00
Magolor 5e39b7dcb5 fix(settings): hide unavailable API key reveal controls 2026-11-06 16:59:28 +08:00
Magolor ef3a02167a fix(settings): preserve saved API key mask length 2026-11-06 16:59:27 +08:00
Magolor 1fa3a9d191 fix(settings): explain saved-key actions and environment fallback 2026-11-06 16:59:26 +08:00
Magolor 7d81a91577 fix(settings): keep saved-key editing within the existing input 2026-11-06 16:59:00 +08:00
Magolor 86247d664b fix(settings): protect saved keys and preserve clear failure state 2026-11-06 16:58:59 +08:00
Magolor 334a76ef88 fix(settings): show masked saved keys and restore environment auth 2026-11-06 16:58:49 +08:00
Yichen Jiang d0290409f9 Merge branch 'master' into turtle/add-gemini-protocol-5881f01a9a7f 2026-11-06 11:05:41 +08:00
TurtleandLegGasai d2c00f2554 feat(llm-pi-ai): support the Gemini protocol for custom model APIs
Add pi-ai's google-generative-ai protocol to hand-declared routes, read
Gemini's native model listing during discovery, and offer it as "Gemini
API" in the Custom model API form.

Refs #7978

Co-authored-by: LegGasai <[email protected]>
2026-11-05 19:41:07 +08:00
brickmaker 001f153172 docs(desktop): refine uninstall cleanup paths 2026-11-05 17:54:51 +08:00
brickmaker 5991a206e4 docs(desktop): add unified uninstall cleanup guide (#7878)
* docs(desktop): add unified uninstall cleanup guide

* docs(desktop): address uninstall guide review fixes

* docs(desktop): restore original cleanup commands and desktop labels

* docs(desktop): clarify optional cleanup and simplify guide

* docs: remove desktop uninstall link from development guide
2026-11-05 08:19:27 +00:00
turtle1999 d047e2c5f9 feat(plugin-market): define index order and optional popularity metadata 2026-11-05 00:49:59 +08:00
Turtle b685ec0ddb Merge remote-tracking branch 'origin/master' into turtle/retry-policy-ui-fb23c6dee798
# Conflicts:
#	docs/event-producer-consumer.md
#	docs/event-producer-consumer.zh.md
2026-11-03 17:11:52 +08:00
Turtle d8dae1ad95 docs(llm): raise third-party adapter codes through LlmError.fromFailure 2026-11-03 16:48:18 +08:00
Dudu-0223 a3baa4d6e4 Merge remote-tracking branch 'origin/master' into feat/sdk-team-mode
# Conflicts:
#	docs/persistence-schema.json
2026-11-03 13:29:41 +08:00
imccyu 06bf7ce024 Revert "fix(settings): show saved API keys and preserve environment detection…"
This reverts commit 9bb49604b63bb5d50e879bcf63c9f5cb2afbd737.
2026-11-03 12:33:44 +08:00
Dudu-0223 e180fce05a feat(team): enable new root Team mode through Cordis configuration 2026-11-03 12:09:30 +08:00
Magolor 8d0c3b4633 fix(settings): show saved API keys and preserve environment detection (#7695)
* fix(settings): show saved API keys in provider editors

* test(settings): retain DeepSeek environment detection states

* fix(settings): classify saved-key reads and align browser expectations

* test(settings): cover saved keys under derived references

* test(settings): verify saved endpoints and keys on provider requests

* fix(settings): preserve credential drafts without changing authentication
2026-11-02 15:00:19 +08:00
Magolor d9ed1e4e28 feat(schedule): unify task creation and editing (#7567)
* feat(schedule): unify task creation and editing

* refactor(schedule): remove obsolete editor helper exports

* fix(schedule): address unified editor review

* fix(schedule): avoid a conflict notice during save refresh

* test(schedule): use unified editor in zoom picker checks

* fix(schedule): preserve drafts through conflict recovery

* docs(schedule): match the linked-session control labels

* fix(schedule): restore the latest linked session after conflicts

* docs(schedule): clarify unsaved draft lifetime

* fix(schedule): align conflict feedback with the detail layout

* fix(schedule): fit editors to pane width and guide empty fields

* fix(schedule): preserve task list and complete field examples

* fix(schedule): keep required-field feedback in the editor

* fix(schedule): align editor content and action gutters

* fix(schedule): wrap localized actions in narrow editors
2026-10-30 20:19:47 +08:00
ZiyaandMagolor 341ea6eea4 feat(schedule): integrate standalone tasks with the existing WebUI (#6189)
* feat(schedule): manage Host tasks with typed timing and delivery targets

* fix(schedule): align task creation button halves

* refactor(schedule): remove obsolete Session reminder runtime

* refactor(schedule): simplify task UI and preserve keyboard navigation

* fix(schedule): address task delivery and interface review findings

* test(schedule): normalize bundle module paths on Windows

* fix(schedule): cover reserved targets and trim unrelated changes

* refactor(schedule): minimize task management changes after rebase

* test(schedule): align rebased fixtures and documentation records

* test(schedule): refresh SDK scenarios added on master

---------

Co-authored-by: Magolor <[email protected]>
2026-10-29 18:11:48 +08:00
LogosVeritas 0c78c4c710 fix(sdk): return RunResult after native command activity 2026-10-28 21:14:21 +08:00
LogosVeritas 5771a93f2e fix(sdk): harden command examples and run wheel regressions 2026-10-26 10:19:06 +08:00
LogosVeritas e122cfb627 feat(sdk): route native commands through run 2026-10-26 00:53:20 +08:00
imccyu 261f2db185 Merge master into DSH 0.2.1 navigation and model listing sync 2026-10-22 23:22:35 +08:00
Yichen Jiang c48f8523f2 feat(llm): follow the official /models listing on the DeepSeek API-key route (#6944)
* refactor(llm-deepseek): share the /models listing machinery

Move the account route's `/models` request and decoding, its
credential-scoped listing cache, and listed-catalog resolution with the
version gate into the shared DeepSeek Messages library, so a second
route can follow the same listing. Names drop the account prefix, the
cache takes each access's endpoint settings with the call, and it gains
`invalidate()` for a forced reload. `isBuiltInCatalog()` recognizes the
catalog an uncustomized `models` setting resolves to.

The account route keeps its behavior; only its imports and the
override diagnostic wording ("model listing") change.

* feat(llm-deepseek-api-key): follow the official /models listing

While `models` equals the built-in catalog and the Messages origin is
https://api.deepseek.com, `deepseek-official` serves the official
`GET /models` listing, authenticated with the API key in `x-api-key`.
Loading, refresh, fallback, merging, and the client-version gate match
the account route: the first access waits up to `modelsTimeoutMs`, a
listing older than `modelsMaxAgeMs` refreshes in the background on the
next access, a failure keeps the last good listing or the built-in
catalog, and listed models this build cannot serve are refused before
network I/O.

A customized `models` list replaces the catalog and requests nothing.
Switching between a customized catalog and the listing discards the
cached listing, so Restore defaults reloads it on the next access.

Suites that boot the route on the official endpoint now answer the
listing themselves instead of reaching the network.

* docs: describe the official route model listing

Document when `deepseek-official` follows the official `/models`
listing, its timing fields, customization precedence, and the forced
reload after Restore defaults in the API-key README, the shared
transport README, and the provider guide. Record the decision in a new
Agent Note, keep the account note's statement of where the shared
listing code lives current, and regenerate the configuration catalog.

* test(llm-deepseek-api-key): pin the once-per-listing hidden-entry diagnostic

* docs: regenerate module and event graphs for the shared listing

* fix(llm-deepseek-api-key): report credential failures on the model request

On the official endpoint, `connect` waited for the listing view, whose
credential lookup rethrew a malformed key or a credential-store failure
before the agent loop recorded the prompt. A failed lookup now resolves
the connection from the current listing view, so `resolveAuth` reports
the failure on the model request and the turn keeps the prompt and the
failed attempt. A caller abort still rejects.

* docs(llm-deepseek-api-key): name which hidden listing entries are logged

* test: keep unit suites off the official model listing

Suites that boot the DeepSeek routes with a dummy or inherited key now
request `GET https://api.deepseek.com/models` on the official endpoint.
A unit-lane setup file rejects that request at once, so such a suite
serves the built-in catalog instead of reaching production or waiting
out the listing deadline on a network that never answers; suites that
exercise the listing answer `fetch` themselves. Other requests pass
through unchanged.

* feat(llm-deepseek): read tool_update from the model listing

Both DeepSeek routes now take a listed model's Messages tool update mode
from `api_capabilities.anthropic_messages.tool_update`, alongside the
system prompt mode. `in-history` and `addition-only` replace the
bundled mode; any other value reads as `leading-only` and removes it.
An absent or `null` mode keeps the bundled one, so a listing that does
not declare the field leaves `deepseek-flash` on `addition-only`.

`system_prompt_update: null` likewise keeps the bundled mode now; it
previously read as `leading-only`, which a serializer writing empty
values as null would have turned into a cache-unfriendly downgrade.

* fix(llm-deepseek): sync the built-in context window with the official listing

The official `/models` listing declares a 1,048,576-token context window
for `deepseek-flash` and `deepseek-v4-pro`; the built-in catalog said
1,000,000, a decimal-versus-binary mismatch. Both built-in entries now
carry the listed value, so offline starts and listing failures size the
context the same way the listing does. The Models page shows the exact
count for these rows, since 1,048,576 has no decimal K/M spelling.

`defaultContextWindow`, the fallback for model ids the catalog does not
describe, stays 1,000,000.

* test(llm-deepseek-api-key): reject the stubbed listing request with an Error

* test(cli): keep the built SDK smoke off the official model listing

The SDK profile's initialize now resolves the deepseek-official catalog,
which requests GET https://api.deepseek.com/models on the official
endpoint. With the smoke's fixture key that request answers 401 and the
route warns on stderr, so the test's empty-stderr assertion failed in the
e2e and snapshots lanes. Point the run at a loopback mock and assert it
received no model call.

* test(llm-deepseek): compose the malformed-key turn without the native executor

release/dsh-0.2.1 predates @deepseek-ai/dsh-tool-executor-native; its tool
runtime executes tools itself. Compose the official-route turn the way
account-routing.spec.ts does on this branch.

* fix(llm-deepseek-api-key): gate nothing when the credential lookup fails

The listing cache switches scope only after it reads a credential, so a
failed lookup left `connect` serving the previous credential's listing.
After a key whose listing refuses a model was replaced by a malformed one,
`admit` refused that model with CLIENT_UPGRADE_REQUIRED before the turn
recorded the prompt, instead of `resolveAuth` reporting the credential
error on the request. Serve the built-in catalog without listing gates
when the lookup fails.

* test(llm-deepseek-api-key): pin the once-per-listing diagnostic across request preparation

The hidden-entry diagnostic test repeated the same discovery assertion to
prove a second pass reports nothing new, which read as a duplicate. Assert
the single warning after the request preparations instead; they resolve
the same listing, so dropping the per-listing deduplication still fails
the test.

* docs(llm-deepseek-api-key): note that a list matching an earlier built-in catalog counts as customized

Customization is judged against the running version's built-in catalog,
so a saved `models` list equal to an earlier version's catalog stops
following the listing once the built-in catalog changes, until Restore
defaults. Record the consequence in the Agent Note and the README's known
limitations.
2026-10-22 20:42:19 +08:00
Turtle 5b0e089f40 fix(plugin-market): present custom plugin markets as custom plugin indexes 2026-10-22 20:19:30 +08:00
Magolor ec387796af fix(settings): address model reorder review findings 2026-10-21 21:57:08 +08:00
Turtle 589790d6e9 Merge remote-tracking branch 'origin/master' into turtle/plugin-market-entry-8303d8c92886
# Conflicts:
#	apps/web/tests/inspector-late-enable.e2e.ts
#	packages/experimental/inspector-profile/README.i18n.yaml
#	packages/experimental/inspector-profile/README.md
2026-10-21 15:12:43 +08:00
_Kerman 62a1075fe7 Merge remote-tracking branch 'origin/master' into xtr/session-model-selection
# Conflicts:
#	docs/persistence-schema.json
2026-10-21 13:56:41 +08:00
Turtle 11589ed104 feat(web): list custom plugin markets on the main experimental list
Developer Tools moves to the More page.
2026-10-21 13:34:13 +08:00
Turtle f7a69f8421 docs(preset): describe plugin management in Standard mode 2026-10-21 12:36:18 +08:00
_Kerman 8b79a1ddcc Merge origin/master into xtr/session-model-selection 2026-10-20 17:22:59 +08:00
Turtle 5c4c743ff3 Merge pull request #6300 from deepseek-harness/turtle/model-picker-defaults-c7775e2d3040
feat(ui-settings-models): open model picker on the configured models
2026-10-20 12:17:05 +08:00
_Kerman c18f5bd3c0 Merge remote-tracking branch 'origin/master' into xtr/session-model-selection
# Conflicts:
#	docs/capability-seams.i18n.yaml
#	docs/capability-seams.md
#	docs/capability-seams.zh.md
#	docs/config-catalog.md
#	docs/config-catalog.zh.md
#	docs/event-producer-consumer.md
#	docs/event-producer-consumer.zh.md
#	docs/module-graph.md
#	docs/module-graph.zh.md
#	docs/persistence-catalog.i18n.yaml
#	docs/persistence-catalog.md
#	docs/persistence-catalog.zh.md
#	docs/persistence-schema.json
#	packages/api/session-controller/src/types.ts
#	packages/bundle/base/package.json
#	packages/bundle/headless/README.i18n.yaml
#	packages/bundle/headless/README.md
#	packages/bundle/headless/README.zh.md
#	packages/bundle/headless/package.json
#	packages/bundle/headless/tsconfig.json
#	packages/subagent/tool-subagent/tests/model-selection-settings.spec.ts
#	scripts/type-equiv.manifest.json
2026-10-19 11:30:55 +08:00
turtle1999 4292020410 feat(plugin-market-generator): skip packages and versions marked private
A manifest with "private": true keeps its version out of the index. A Git
package that is private on the default branch is not listed at all, and the
generator warns when every bundle package of a repository is private. The
cache version is bumped so cached private releases are rebuilt.
2026-10-19 11:27:56 +08:00
Turtle cd77df1e7b Merge remote-tracking branch 'origin/master' into turtle/model-picker-defaults-c7775e2d3040 2026-10-18 15:00:16 +08:00
_Kerman b670701e5a Merge remote-tracking branch 'origin/master' into xtr/session-model-selection 2026-10-16 15:42:50 +08:00
Tianyi Cui cfb65d3bb2 fix: validate the Node 24.9 runtime floor 2026-10-15 23:33:49 +08:00
_Kerman 7aaa6b3c5a refactor(agent): deprecate the agent/request hook 2026-10-15 20:00:19 +08:00
Turtle 72a607dfee fix(ui-settings-models): open model picker on the configured models
The fetched-model picker now starts with the configured models checked and
Update list adds newly checked candidates and removes unchecked configured
ones. Configured models the provider does not list stay. Select all and
Deselect all change only visible candidates so a hidden configured model is
not removed unseen.

Refs #6290
2026-10-15 19:52:23 +08:00
Yichen Jiang a0a04158f8 fix(models): keep reasoning edits with their model and mirror pi-ai refusals
The reasoning-level editor kept the levels it switched off, its row order,
and typed text in component state, while the model list keys rows by
position, so deleting a row handed that state to the next model: turning
the survivor's switch on wrote the deleted model's levels into it. The
editor now renders only from the model; rows follow the stored order,
switching on always starts from the defaults, and only the focused field
keeps its typed text until the field is left.

The reasoning check moves out of the shared model validator into the two
cards whose rows edit it, so DeepSeek and catalog routes are untouched,
and it now mirrors every pi-ai refusal: a valueless field, a missing value
on a level besides off, and an empty value. A refused value marks its
field, and leaving that field repairs it with the level name.

The Providers guide now points custom model API users to the page before
the YAML, and both package READMEs describe the new behavior.
2026-10-15 14:53:56 +08:00
turtle1999 434dc116f0 feat(plugin-market-generator): add a reference index generator
Generate a validated format-1 plugin market index from a list of npm package
names and https Git repository URLs, without running package code.

- List every non-deprecated npm bundle version, and Git versions at release
  tags and the default branch, each with its engines.dsh range.
- Read display fields, keywords, homepage, and icons the way DSH reads
  installed plugins; inline small icons up to the format's 32 KiB limit.
- Cache results per immutable input and rewrite output only when it changes.
2026-10-15 05:37:54 +08:00
turtle1999 b227127d62 fix(plugin-market): keep the Installed tab panel and list the markets bundle under More
The Installed tab panel now wraps its loading, unavailable, and empty states.
Custom plugin markets joins the bundles the More page holds back until the
profile enables them, and the repository field and its directory rule are
documented.
2026-10-15 05:37:44 +08:00
turtle1999 ab3bb74550 feat(plugin-market): carry a plugin's source repository
Indexes may give each plugin an optional repository: the web URL of its
source repository and the package directory inside it. The Discover entry
page links it as Source code, and the plugin_market tool returns it.
2026-10-15 05:37:44 +08:00
turtle1999 3de3a977e0 feat(plugin-market): add the Custom plugin markets bundle and Discover tab
Read configured plugin market indexes on the Host, search them with fuzzy
multilingual matching, and install a chosen version from the Plugins page.

- dsh-plugin-market-index validates format-1 indexes and builds install
  arguments; inline icons are capped at 32 KiB.
- The pluginMarket service fetches configured http(s) URLs, parses bodies in
  a Worker Thread, caches documents, and pages filtered, ordered results with
  installation status and engines.dsh compatibility.
- Discover is an opt-in experimental bundle; the Plugins page gains a
  plugins.tab slot and confirmed installs.
- The plugin_market tool lists indexes, plugins, and versions for Creator mode.
- Plugin compatibility reads engines.dsh before DSH peer dependencies.
2026-10-15 05:37:44 +08:00
Turtle 56c5cf84a1 Merge pull request #6170 from deepseek-harness/turtle/rescue-profile-overwrite-2aaffdd2f31b
Make --from-default-profile replace an existing custom profile
2026-10-14 12:35:08 +08:00
Magolor 7110b615eb fix(llm): 生成提供方元数据并显示凭据检测状态 (#6106)
* fix(llm): generate provider metadata and clarify credential hints

* fix(settings): shorten credential hints and mark detected sources in green

* fix(llm): verify staged provider metadata and document regeneration

* fix(provider-metadata): reconcile authentication hints and key controls

* test(user-text): calibrate ratio headroom across unmatched workloads

* test(gates): include provider metadata in hygiene expectations

* fix(models): hide authentication hints for entered keys
2026-10-14 12:29:31 +08:00
Turtle 8843c37e37 Make --from-default-profile replace an existing custom profile
Repeated rescue runs such as `dsh rescue --from-default-profile web` failed
because the target profile already existed. The option now assembles a fresh
template copy in a staging directory, moves it over the target, and deletes the
previous profile; a failed move restores it.
2026-10-14 11:56:17 +08:00
LogosVeritas 00a007d833 Merge branch 'master' into feature/minimal-compact-image 2026-10-13 10:32:01 +08:00
Magolor 5249d9a4ce fix: prefer saved credentials and use environment keys in headless (#5483)
* ui: show locked API key environment reference

* fix(ui-settings-models): skip unused pi-ai credential reference

* fix(ui-settings-models): show active provider auth source

* test(llm): cover provider auth check failures

* docs(ui-settings-models): clarify active provider authentication

* test(web): update model key copy snapshots

* fix(ui-settings-models): clarify native authentication source hint

* fix: address PR 5483 review feedback

* docs(llm): state empty auth lookup behavior

* fix: refresh auth hints with credential snapshots

* fix: require credential refresh revision

* test: cover auth status projection

* fix: refresh catalog and browser expectations after rebase

* fix: keep auth status projection internal and explicit

* fix: preserve credential source checks with signed-in account rows

* test: pin Models authentication instead of inheriting host keys

* fix: prioritize stored credentials across providers

* fix: use one environment fallback hint

* docs: refresh credential contract

* docs: refresh config catalog

* test: align provider hint verification

* fix: use provider-native auth hints and endpoints

* fix: cover oauth-capable provider auth hints

* fix: show canonical endpoint defaults

* fix: avoid misleading endpoint fallback

* fix: label catalog endpoint defaults

* fix: shorten auth hints with hover details

* fix: clarify native auth resolution

* test: align DeepSeek endpoint hint

* fix: pair help button corner shape

* fix: address credential precedence review

Record the stored-credential precedence in a superseding Agent Note and
an upgrade guide, and align the credentials subsystem page, package
READMEs, and JSDoc with the order file > launch env > $cwd/.env >
$DSH_HOME/.env.

Report each pi-ai route's catalog endpoint and native-auth environment
names through the provider directory, check the names against the
installed pi-ai resolvers, and remove the llm/checkAuth and credential
describe operations that no Models page code calls.

Restore the route-derived key reference and the home expansion that
reads the home directory only for a leading ~.

* fix: clarify model authentication guidance

* fix: explain native provider OAuth requirements

* fix: keep authentication guidance method neutral

* fix: show credential reference source in model editor

* fix: use environment authentication in headless profile

* fix: validate headless authentication and current provider metadata

* test: retain authentication guidance coverage with account catalog updates

* test: retain writable Models credentials with the pinned environment
2026-10-13 10:10:06 +08:00