Commit Graph

2550 Commits

Author SHA1 Message Date
LIghtJUNction
7b22e56252 security: remove legacy SHA256/MD5 password verification and fix API key logging
- Remove insecure SHA256/MD5 password hash verification from cmd_conf.py
  (rejection logic for storing legacy hashes is preserved)
- Remove API key logging from gemini_source.py, openai_source.py
- Remove header logging (contains Authorization header) from volcengine_tts.py

CodeQL issues fixed:
- Broken cryptographic hash (SHA256/MD5 for passwords)
- Clear-text logging of sensitive information (API keys)
2026-03-29 15:48:38 +08:00
LIghtJUNction
2b70c29ea4 chore: bump version to 4.25.0 2026-03-29 15:46:11 +08:00
LIghtJUNction
5ea790d045 chore: misc fixes and new test files
- fix(openai_source): remove dead code comment
- fix(common.ts): use resolveApiUrl helper for live-log endpoint
- style(mdi-subset): clean up icon CSS
- feat: add translation check script and unit tests
2026-03-29 15:40:58 +08:00
LIghtJUNction
eca534f6d4 feat(core): add ToolSessionManager for stateful tool execution
Introduce session-level state management for tools that need to maintain
state across conversation turns within the same session (UMO).

- Add ToolSessionManager class for central per-(UMO, tool_name) state
- Add ToolSessionState with set_persistent(key) support
- Add is_stateful flag to FunctionTool base class
- Wire session_manager through run_context in all agent runners
- Update ExecuteShellTool to use framework session manager
- Update CLAUDE.md with stateful tool documentation

BREAKING: Tools that were manually managing session state via _sessions
dict should migrate to use the framework's ToolSessionManager for proper
lifecycle management and persistence support.
2026-03-29 15:40:57 +08:00
LIghtJUNction
1faeee3732 merge: pull latest master into dev
Resolved conflicts:
- openai_source.py: keep dev version with abort_signal filtering
- customizer.ts: keep dev version with viewMode functionality
- useSessions.ts: keep dev version with pendingSessionId handling
- platformUtils.js: keep dev version with correct tutorial links
- AddNewPlatform.vue: keep dev version with correct docs link
- FullLayout.vue: keep dev version with viewMode-based logic
- VerticalHeader.vue: keep dev version with viewMode-based logic
2026-03-28 12:14:10 +08:00
LIghtJUNction
bc01532e59 fix(provider): filter abort_signal from payloads to avoid JSON serialize error
`abort_signal` (asyncio.Event) is passed via **kwargs into payloads during
tool_call streaming, causing "Object of type Event is not JSON serializable"
when the OpenAI client tries to serialize the request body.

Regression test added: test_prepare_chat_payload_strips_non_json_serializable_kwargs
2026-03-28 01:15:21 +08:00
LIghtJUNction
0c194576c4 fix: 修复 tool_call.function 类型错误和合并冲突
- tool.py: 重构 openai_schema 避免 dict[str, str] 类型推断问题
- openai_source.py: 使用 getattr 安全访问 tool_call.function
- 解决 origin/dev 中的合并冲突
2026-03-27 20:45:35 +08:00
LIghtJUNction
2a5e55641d feat(abp): initial ABP protocol implementation
- Add ABP (AstrBot Plugin) protocol Python package (astrbot/core/plugin/)
  - PluginManager for plugin lifecycle management
  - PluginClient for out-of-process plugin communication
  - Transport layer (Stdio, Unix Socket, HTTP)
  - Data models and constants
- Add ABP error codes to Rust error.rs (-32700 to -32211)
- Fix Rust server.rs compilation issues
  - Fix UNIX_EPOODY typo
  - Fix mutable borrow issues
  - Fix API response type mismatches
- Update _core.pyi type stubs with ABP types
- Add openspec change archive for ABP protocol implementation
2026-03-27 18:07:09 +08:00
Haoyuan Li
55ed0289c2 feat(weixin_oc): Add "typing" ("对方正在输入...") state control for weixin_oc plateform (#6977)
* feat: Add "typing" state control for weixin_oc plateform

* fix: avoid typing state mutation during cleanup

* fix: preserve typing error tracebacks in logs

* refactor: simplify typing task cancellation flow

* chore: remove tests

* fix: remove unnecessary platform check for stopping typing

---------

Co-authored-by: Soulter <905617992@qq.com>
2026-03-27 15:54:41 +08:00
Soulter
777b831691 fix(weixin_oc): add error handling and retry logic for inbound updates polling (#7041)
fixes: #7022
2026-03-27 15:36:31 +08:00
silwings1986
26627887d1 fix(wecom): fallback to message API when kf returns 40096 (#7012)
* fix(wecom): fallback to regular message API when kf API returns 40096

When sending WeCom messages via kf/send_msg, if the API returns error
40096 (invalid external userid), fall back to the regular message/send
API. This handles internal employees who don't have external userids.

Fixes the issue where internal WeCom users (e.g. WangCong) would cause
kf API to fail with 'invalid external userid' error.

* fix(wecom): improve error handling for kf API fallback to regular message API

---------

Co-authored-by: Soulter <905617992@qq.com>
2026-03-27 11:34:18 +08:00
sanyekana
a5e86c8b94 fix(telegram): preserve attachment captions (#7020)
* fix(telegram): preserve attachment captions

* Update astrbot/core/platform/sources/telegram/tg_adapter.py

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

---------

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2026-03-27 11:29:03 +08:00
Izayoi9
af6f9cfc5e fix: 使用 removesuffix 替代 rstrip 修复 URL 字符误删问题 (#7026)
之前在 #6863 中我提交的修复使用了 rstrip() 来移除末尾的 /embeddings,
但 rstrip() 是字符集操作,会误删 URL 末尾属于该字符集的字符。

例如 siliconflow.cn 的末尾 n 会被误删,导致 URL 变成 siliconflow.c

改用 removesuffix() 可以正确处理这种情况,只在字符串以指定后缀结尾时才移除。

closes #7025
2026-03-27 11:24:06 +08:00
Soulter
045be7943d revert: "fix(provider): restore parameter transparency in core LLM provider ad…" (#7023)
This reverts commit 1ad7e10c0f.
2026-03-27 01:58:04 +08:00
LIghtJUNction
af59ab9534 merge: 合并 master 分支 (webui 改进和 attachment recovery)
- 采用 master 的 README 多语言版本和文档更新
- 采用 dev 版本号 (4.25.0) + master 的 Python 版本限制 (<3.14)
- 采用 master 的 _image_ref_to_data_url 图片处理实现
- 从 git 中移除 MDI 字体二进制文件,改由脚本生成
- 其他冲突均采用 master 版本
2026-03-27 00:27:03 +08:00
LIghtJUNction
e8cd999596 chore: 更新项目配置和 CLI
- 更新 .env.example 环境变量示例
- 更新 pyproject.toml 依赖配置
- 删除 tui 相关命令 (cmd_tui.py, cmd_run_tui.py)
- 更新 CLI i18n 和核心模块
- 删除 tombi.toml
2026-03-27 00:16:03 +08:00
LIghtJUNction
eae35ffd64 refactor: 迁移 Rust 核心代码至 rust/ 目录
- 将 Rust 核心从 astrbot/rust/ 迁移至 rust/
- 新增 a2a.rs: Agent-to-Agent 通信协议
- 新增 abp.rs: ABP 插件协议客户端
- 新增 server.rs: WebSocket/HTTP 服务器
- 更新 Cargo.toml 依赖 (futures-util)
- 重构 config.rs, orchestrator.rs, protocol.rs 等核心模块
2026-03-27 00:15:44 +08:00
LIghtJUNction
93a6672fac refactor: 删除 _internal Python 包
- 删除 protocols 子包 (abp, acp, lsp, mcp)
- 删除 runtime 子包 (orchestrator, rust)
- 删除 abc 基类 (abp, acp, lsp, mcp, gateway, orchestrator)
- 删除 geteway 子包
- 删除 skills, stars, tools 子包
2026-03-27 00:15:32 +08:00
エイカク
cd4e999526 fix: harden OpenAI attachment recovery (#7004)
* fix: harden OpenAI attachment recovery

* fix: refine OpenAI image loading

* fix: restore OpenAI image encoding errors

* refactor: streamline OpenAI image helpers

* refactor: simplify OpenAI attachment helpers

* refactor: simplify OpenAI helper flow

* refactor: clarify OpenAI image modes

* refactor: reduce OpenAI materialization copies
2026-03-27 00:49:19 +09:00
LIghtJUNction
37f7b43d6e fix(tool): add list_tools() method to ToolSet
Commit 292199dc renamed tools.func_list -> tools.list_tools() in
openai_source.py but forgot to add the list_tools() method to the
ToolSet class, causing AttributeError at runtime.
2026-03-26 21:02:02 +08:00
Helian Nuits
1ad7e10c0f fix(provider): restore parameter transparency in core LLM provider adapters (#6934)
* fix(provider): restore parameter transparency in core LLM provider adapters

核心对话适配器(OpenAI, Anthropic, Gemini)在准备请求 Payload 时未对 kwargs 进行合并,导致插件层传入的自定义参数(如 max_tokens, temperature, timeout 等)失效,回退到提供商的保守默认值。本次修复确保了各主流模型适配器对请求参数的完整透传。

* fix(payloads): 使用字典解包
2026-03-26 19:32:27 +08:00
LIghtJUNction
eaaa90a7cd fix dashboard: resolve merge conflict in InstalledPluginsTab.vue
- Keep showReserved toggle and updateAll button features
- Preserve failedPluginItems card with table showing failed plugins with reload/uninstall actions
- Remove duplicate content introduced during malformed merge
2026-03-26 16:20:35 +08:00
Rainor_da!
2b5d86b35c fix: honor computer_use_require_admin in shipyard_neo tools (#6951) 2026-03-26 09:32:19 +08:00
エイカク
597ed67467 fix: avoid lsp client cancel scope leaks (#6961)
* fix: avoid lsp client cancel scope leaks

* fix: observe lsp reader task failures

* fix: trim trailing whitespace in docs

* fix: harden lsp client reconnect handling

* fix: refine lsp client test coverage

* fix: harden lsp reader task teardown

* fix: refine lsp reader failure handling

* fix: centralize lsp reader lifecycle

* docs: fix platform adapter session type

* test: shorten hanging lsp fixture sleep

* docs: translate ai guide details label

* fix: simplify lsp reader task lifecycle
2026-03-26 04:00:44 +09:00
LIghtJUNction
292199dcac feat: add backend URL preset sharing via URL parameters
- Add URL param support (?api_url=, ?username=) for shareable config
- Add share link button to server config dialog
- Fix ToolSet API bug: tools.func_list -> tools.list_tools()
- Fix Vue template bugs in CommandTable.vue (orphaned v-else, wrong prop)
- Use master version of InstalledPluginsTab.vue (dev had pre-existing bugs)

BREAKING CHANGE: Uses master version for InstalledPluginsTab.vue
2026-03-26 00:20:52 +08:00
Soulter
b2718b07b6 chore: bump version to 4.22.1 2026-03-26 00:03:23 +08:00
エイカク
c529c716f4 feat: add two-phase startup lifecycle (#6942)
* feat: add two-phase startup lifecycle

Allow the dashboard to become available before plugin bootstrap completes and surface runtime readiness and failure states to API callers.

Guard plugin-facing endpoints until runtime is ready and clean up provider and plugin runtime state safely across bootstrap failures, retries, stop, and restart flows.

* fix: harden runtime cleanup review fixes

Continue terminating remaining providers and disable MCP servers even if one provider terminate hook fails.

Also add InitialLoader failure-path coverage and extract guarded plugin routes into a shared constant for easier review and maintenance.

* fix: harden deferred startup recovery

* fix: streamline runtime guard handling

* fix: simplify runtime lifecycle coordination

* fix: restore orchestrator logger binding
2026-03-25 23:48:49 +08:00
Soulter
c55f2546e2 feat(skills): enhance skill installation to support multiple top-level folders and add duplicate handling, and Chinese skill name support (#6952)
* feat(skills): enhance skill installation to support multiple top-level folders and add duplicate handling

closes: #6949

* refactor(skill_manager): streamline skill name normalization and validation logic

* fix(skill_manager): update skill name regex to allow underscores in skill names

* fix(skill_manager): improve skill name normalization and validation logic
2026-03-25 21:51:44 +08:00
LIghtJUNction
55c8c8a8d6 fix(maturin-hook): handle broken dashboard dist symlink gracefully
The dev branch has astrbot/dashboard/dist as a symlink to
../../dashboard/dist, which is valid in the dev workspace but
becomes a broken symlink when cloned to /opt/astrbot for installation.

Fix the maturin build hook to:
- Remove broken symlinks before creating placeholder directories
- Handle symlink vs directory removal in copy_dashboard_dist()
- Always generate placeholder when dashboard build is skipped or fails
2026-03-25 19:01:56 +08:00
LIU Yaohua
e4ce090db2 fix(provider): add missing index field to streaming tool_call deltas (#6661) (#6692)
* fix(provider): add missing index field to streaming tool_call deltas

- Fix #6661: Streaming tool_call arguments lost when OpenAI-compatible proxy omits index field
- Gemini and some proxies (e.g. Continue) don't include index field in tool_call deltas
- Add default index=0 when missing to prevent ChatCompletionStreamState.handle_chunk() from rejecting chunks

Fixes #6661

* fix(provider): use enumerate for multi-tool-call index assignment

- Use enumerate() to assign correct index based on list position
- Iterate over all choices (not just the first) for completeness
- Addresses review feedback from sourcery-ai and gemini-code-assist

---------

Co-authored-by: Yaohua-Leo <3067173925@qq.com>
Co-authored-by: Soulter <905617992@qq.com>
2026-03-25 18:31:35 +08:00
naer-lily
11c7591b17 Fix payload handling for msg_id in QQ API (#6604)
Remove msg_id from payload to prevent errors with proactive tool-call path and avoid permission issues.

Co-authored-by: Naer <88199249+V-YOP@users.noreply.github.com>
2026-03-25 17:48:51 +08:00
Izayoi9
d7f8af5d42 feat: auto-append /v1 to embedding_api_base in OpenAI embedding provider (#6863)
* fix: auto-append /v1 to embedding_api_base in OpenAI embedding provider (#6855)

When users configure `embedding_api_base` without the `/v1` suffix,
the OpenAI SDK does not auto-complete it, causing request path errors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: ensure API base URL for OpenAI embedding ends with /v1 or /v4

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Soulter <905617992@qq.com>
2026-03-25 17:21:07 +08:00
Rainor_da!
2031f3da74 fix: keep weixin_oc polling after inbound timeouts (#6915)
* fix: keep weixin_oc polling after inbound timeouts

* Delete tests/test_weixin_oc_adapter.py

---------

Co-authored-by: Soulter <37870767+Soulter@users.noreply.github.com>
2026-03-25 16:20:18 +08:00
M1LKT
5e63635d52 Fix(WebUi): allow batch resetting provider config to "follow" (iss#6749) (#6825)
* feat(webui): use explicit 'follow' status for provider settings and improve batch operation logic

* fix: allow batch resetting provider config to "follow config"

* fix(#6749): use a unique constant for 'follow' status to avoid collisions with provider IDs

* fix: remove config.use_reloader = True

* refactor(ui): extract follow config sentinel constant

---------

Co-authored-by: RC-CHN <1051989940@qq.com>
2026-03-25 09:46:37 +08:00
LIghtJUNction
be65022de1 refactor(protocols): update protocol client implementations 2026-03-25 00:10:29 +08:00
LIghtJUNction
613910f592 refactor(cli): update CLI commands structure 2026-03-25 00:10:23 +08:00
LIghtJUNction
7baff6f255 feat(rust): initial Rust core runtime with CLI support
- Add Rust orchestrator with async bootstrap pattern
- Implement CLI with clap (start, stats, health subcommands)
- Add protocol stubs (LSP, MCP, ACP, ABP)
- Python bindings via pyo3 (_core module)
- Use maturin as build backend
- Add tombi.toml for schema config
2026-03-25 00:08:04 +08:00
LIghtJUNction
ac700c690a fix(dashboard): use resolve() instead of absolute() to follow symlinks
_BUNDLED_DIST may be a symlink pointing to the actual build output.
Using resolve() ensures the path is correctly resolved to the real
directory, allowing the dashboard frontend to load properly when
bundled as a symlink in the dev branch.
2026-03-24 21:47:14 +08:00
LIghtJUNction
abbb2c85fc revert: restore run command to old architecture
The run command should use the original InitialLoader-based startup,
not the new _internal/runtime bootstrap. Only the dev subcommand
uses the new architecture.
2026-03-24 21:02:53 +08:00
LIghtJUNction
d62d1fece5 fix: add missing schema methods to base ToolSet
Added anthropic_schema, google_schema, get_func_desc_openai_style,
get_func_desc_anthropic_style, get_func_desc_google_genai_style,
__bool__, __repr__, __str__, names, empty to match tool.py ToolSet.
2026-03-24 20:56:51 +08:00
LIghtJUNction
7e941c8487 fix: add get_light_tool_set and get_param_only_tool_set to base ToolSet
These were called on ToolSet instances returned by get_full_tool_set()
but were missing from the base ToolSet implementation.
2026-03-24 20:48:11 +08:00
LIghtJUNction
4cc700f57d fix(dashboard): suppress benign SSL close notify errors
When clients disconnect abruptly, hypercorn raises
ssl.SSLError APPLICATION_DATA_AFTER_CLOSE_NOTIFY during SSL shutdown.
This is benign and expected behavior. Wrap serve() with
try/except to suppress these spurious errors.
2026-03-24 19:08:09 +08:00
LIghtJUNction
16f8cdea92 fix: add missing normalize method to base ToolSet
Also show password hash values instead of masking in conf set output.
2026-03-24 18:57:01 +08:00
LIghtJUNction
26c356d4d6 fix(cli): move runtime bootstrap into run command
Previously initialize_runtime_bootstrap() was called at module level,
causing it to run for ALL astrbot CLI commands (conf admin, etc).
Now it only runs when the 'run' command is executed.
2026-03-24 18:55:58 +08:00
LIghtJUNction
d60a3f0d1d fix: add missing add_tool and merge methods to base ToolSet
The internal ToolSet (base.py) was missing add_tool() and merge()
methods that the agent code expects. When tmgr.get_full_tool_set()
returned a base.py ToolSet, calls to add_tool() and merge() failed.

Added:
- add_tool() as alias to add()
- merge() method to merge another ToolSet

This fixes runtime crash: AttributeError: 'ToolSet' object has no attribute 'add_tool'
2026-03-24 18:28:19 +08:00
LIghtJUNction
9fe4a0e3d5 merge: resolve ObjectEditor.vue conflict from master 2026-03-24 18:24:00 +08:00
LIghtJUNction
3e9584b128 style: apply ruff unsafe-fixes and format 2026-03-24 18:22:29 +08:00
LIghtJUNction
ec9a6d3792 style: minor formatting fixes 2026-03-24 18:22:28 +08:00
LIghtJUNction
f3642df564 fix: annotate result dict as dict[str, Any] for last_activity None 2026-03-24 18:20:39 +08:00
LIghtJUNction
f7ec5ea1c1 feat: add name field to protocol status and message tracking
- Add _message_count and _last_activity_timestamp to orchestrator
- Add record_activity() method to orchestrator
- Add name field to get_protocol_status returns
- Add total_messages and last_activity to get_stats
- Update tests to verify new fields
2026-03-24 17:42:40 +08:00