Class-level list vars caused cross-instance sharing. Tests expecting
isolated registration containers failed. Move to __init__ and add the
reset_runtime_registrations helper that tests depend on.
InitialLoader.start now calls lifecycle.initialize() (not initialize_core).
Updated test mocks and assertions accordingly. 3 tests remain that assume
a split-phase bootstrap_runtime call that no longer exists in the current
InitialLoader.
Real bash subprocess via PersistentShellSession binds stdin/stdout to the
creating event loop. pytest-asyncio's per-function loop switching caused
'Future attached to a different loop' errors. Mock the session instead.
Also remove the unused session-level cleanup fixture and patch.
This function was dropped during merge, causing ImportError in
test_upload_filename_sanitization.py and breaking upload handling.
Re-implemented with null-byte removal, path traversal stripping,
fakepath prefix removal, and empty-fallback to UUID.
BaseDatabase added 5 new abstract methods (list_sdk_platform_message_history,
delete_platform_message_before, delete_platform_message_after,
delete_all_platform_message_history, find_platform_message_history_by_idempotency_key)
but SQLiteDatabase did not implement them, causing TypeError on startup.
All methods follow the existing codebase patterns using async SQLAlchemy sessions
with the delete/select helpers.
* feat: add inline message editing and regeneration functionality for webui
- Implemented inline editing for user messages in the chat component.
- Added a regenerate menu for retrying messages with different models.
- Enhanced message handling to include llm_checkpoint_id for better tracking.
- Updated localization files to include new actions for retrying and model selection.
- Introduced tests for checkpoint message handling and chat route functionality.
* feat: thread mode in webui
* feat: enhance message editing functionality to allow only the latest user message to be edited
* feat: add error handling and user feedback for thread creation in chat component
* feat: add thread count display and localization support in chat component
* feat: add RefsSidebar component and integrate reference management in chat UI
* feat: improve message editing validation and cleanup for bot messages
* feat: enhance checkpoint message handling with binding and dumping functionality
# Conflicts:
# astrbot/core/agent/message.py
# astrbot/core/agent/runners/tool_loop_agent_runner.py
# astrbot/core/astr_main_agent.py
# astrbot/core/db/sqlite.py
# astrbot/core/pipeline/process_stage/method/agent_sub_stages/internal.py
# astrbot/core/platform/sources/webchat/webchat_adapter.py
# astrbot/dashboard/routes/chat.py
# astrbot/dashboard/routes/live_chat.py
# dashboard/src/components/chat/Chat.vue
# dashboard/src/components/chat/ChatInput.vue
# dashboard/src/components/chat/ChatMessageList.vue
# dashboard/src/components/chat/ProviderModelMenu.vue
# dashboard/src/components/shared/StyledMenu.vue
# dashboard/src/composables/useMessages.ts
# dashboard/src/i18n/locales/ru-RU/features/chat.json
- clearStaged({ revokeUrls: false }) to preserve blob URLs during send
- File type icon helpers (fileTypeStyles, fileExtension, filePresentation)
- CSS transitions for input container and textarea
- File dedup via SHA-256 signature in useMediaHandling
- Replace LocalShellComponent's one-shot subprocess.run() with a
PersistentShellSession that wraps a long-running bash process per UMO.
cd/export/source now persist naturally within a conversation.
- Support background task execution via nohup.
- Remove unused ToolSessionManager / ToolSessionState (dead code,
never wired to any consumer).
- Fix performance benchmark: separate throughput and memory measurement
so tracemalloc doesn't distort timing (was 7x slower).
- Optimize bool validation in CommandFilter with frozenset + isinstance
short-circuit.
* fix(core): security fix - restrict send_message_to_user to current session only
Closes#7822
SECURITY: Remove the user-controlled 'session' parameter from the
send_message_to_user tool. Previously, a regular user could ask the
LLM to send messages to any arbitrary session (group chat) by
providing a crafted session string, which is a high-risk
vulnerability.
Changes:
- Remove 'session' parameter from tool schema (LLM can no longer
propose it)
- Always use context.context.event.unified_msg_origin as the target
session
- Update description to clearly state that messages can only be sent
to the current user's session
* fix: restore session param but restrict to admin only
- Re-add the parameter removed in the original PR
- Non-admin users can only send to their own session (current_session)
- Admin users can send to any session via the param
- Uses from computer_tools.util (same pattern as fs.py)
- Ref: https://github.com/AstrBotDevs/AstrBot/issues/7822
Co-authored-by: Soulter <soulter@astrbot.app>
* Update message_tools.py
---------
Co-authored-by: AstrBot <bot@astrbot.app>
* feat(shell): add background command execution with output redirection and timeout support
* feat(shell): update timeout parameter to be optional in shell execution methods
* feat(shell): set default timeout for shell execution to 10,000,000 milliseconds
* feat(shell): set default timeout to 300s for shell execution
* feat(shell): reorder timeout parameter in ExecuteShellTool configuration
* feat(shell): implement background command execution with detached shell command support
Co-authored-by: Copilot <copilot@github.com>
* test(shell): remove obsolete test for background shell command output redirection
* fix: reorder import statements in shell.py for consistency
* fix: wrap command in parentheses for background output redirection
---------
Co-authored-by: Copilot <copilot@github.com>
* feat: add one-line deploy script (deploy-cli.sh) and update cli.md
- Add docs/scripts/deploy-cli.sh for one-command deployment (Linux/macOS/WSL)
- Update docs/zh/deploy/astrbot/cli.md to reference local script
- Replace non-existent https://astrbot.app/deploy.sh with raw.githubusercontent.com URL
- Add local run tip and WSL-based Windows support
* fix: address PR review feedback for deploy-cli.sh
- Replace sort -V with Python-native version check (macOS BSD compat)
- Bump Python requirement from >=3.10 to >=3.12 (match pyproject.toml)
- Detect current directory as project root (avoid nested clone)
- Handle existing non-git directory explicitly
- Add curl dependency check
- Support ASTRBOT_REPO and ASTRBOT_DIR env vars for forks/mirrors
- Update cli.md version description to match
* feat: add Windows PowerShell deploy script and update docs
- Add deploy-cli.ps1 for Windows native environment (PowerShell 7+)
- Update cli.md to document Windows one-liner deployment
- Add local script execution instructions for both bash and ps1
* refactor: standardize log messages and improve clarity in various modules
Co-authored-by: Copilot <copilot@github.com>
* docs: 移除一行命令快速部署部分，简化安装说明
* feat: 添加脚本以复制部署 CLI 文件并更新构建命令
* refactor: 更新日志消息以提高可读性，统一英文提示信息
---------
Co-authored-by: Soulter <905617992@qq.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Weilong Liao <37870767+Soulter@users.noreply.github.com>
