Commit Graph
31 Commits
Author SHA1 Message Date
杨慎andwyuc d04a75cbc6 feat(ai): add Xiaomi MiMo V2.6 models [AI-assisted] (#1655)
* feat(ai): add Xiaomi MiMo V2.6 models

* docs(ai): preserve Xiaomi provider references

---------

Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-09-23 13:11:49 +08:00
b0e481eaa5 fix: keep long Grok relay generations alive and inline image bytes (#1364)
Two independent Grok failures seen when the provider is reached through a relay
(a custom base URL) instead of api.x.ai directly:

- lib/ai/providers.ts: a long non-streaming chat completion was cut off by the
  relay with a 504 at its idle timeout (~5 min), because nothing is sent
  upstream until the model has the whole answer. Adding 'grok' to the existing
  streaming-compat path (OPENAI_COMPAT_USE_STREAMING_CHAT=true) keeps bytes
  flowing across the idle window; the SSE is buffered back into a normal JSON
  response for the caller.
  The path is for relays only. usesCustomOpenAIBaseUrl recognises OpenAI's
  origin alone, so Grok's own api.x.ai also read as "custom" and was forced
  onto the compat transport; the provider's native endpoint is now excluded.

- lib/media/adapters/grok-image-adapter.ts: response_format 'url' returns a
  link on the relay's CDN host (imgen.x.ai), which may be unreachable from the
  server's network. The generation then failed at the follow-up fetch through
  /api/proxy-media even though the image had been produced successfully.
  'b64_json' inlines the bytes and removes that second hop.
  Inline bytes declare no media type, so the adapter reports one on
  ImageGenerationResult and returns a typed data URL, which is the shape
  openrouter-image-adapter already uses. Consumers take the type from there:
  agent image persistence records it, the client's stored media row keeps the
  type its data URL states, and classroom-media-generation names the file with
  the matching extension. A JPEG is no longer stored, served or named as a PNG.

The process-wide undici timeout that previously accompanied these changes is
dropped: upstream #1404 now gives LLM calls their own undici headers/body
timeouts, which covers the same failure without raising the defaults globally.

Co-authored-by: ciclou1 <ciclou1@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-09-22 12:04:20 +08:00
wyucandClaude Opus 5 2cbd011c1f feat(token-plan): add TokenDance one-key preset for every modality (#1525)
* feat(token-plan): add TokenDance one-key preset for every modality

TokenDance is a model gateway: chat and images are OpenAI-compatible at
/gateway/v1, and the same key authenticates vendor-protocol routes on the
same host (Ark, MiniMax, Bocha). The preset reuses the existing adapters
with those route prefixes as base URLs, so one key lights up LLM, image,
video, TTS and web search from Settings -> Token Plan.

- providers: add a built-in `tokendance` OpenAI-compatible provider
  (TOKENDANCE_* env prefix, logo, provider name in all locales)
- token-plan: add the TokenDance preset (Seedream image, MiniMax H3 video,
  MiniMax speech TTS, Bocha web search)
- seedream: use a base URL that already ends in a version segment verbatim,
  so gateway routes like `/ark/v3` do not get `/api/v3` appended
- minimax-video: route H3-family models through the v2 task API (content
  array submit, task-envelope poll); connectivity checks for H3 probe auth
  on the v2 query route instead of submitting a billable task
- README: add a one-key quick example and replace the Gemini-specific
  model recommendation with a provider-agnostic setup recommendation

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qrrq9CPwb718mpouz8Y2KL

* fix(token-plan): accept preset web-search base URLs and report H3 dimensions per ratio

- web-search: the client base URL allowlist also accepts the exact base URL
  a built-in token plan preset writes for that provider, derived from
  TOKEN_PLAN_PRESETS. Applying a plan whose web-search route is not an
  official vendor host previously stored a URL that the route rejected with
  400. Any other client URL is still rejected.
- minimax-video: report H3 v2 clip dimensions for 16:9, 9:16, 4:3 and 1:1
  instead of assuming landscape for every non-portrait ratio.
- tests: pin the allowlist for every preset, the 1:1 H3 dimensions, and
  clear TOKENDANCE_* in the provider-config env isolation list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qrrq9CPwb718mpouz8Y2KL

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-09-16 13:28:09 +08:00
RiverandXingJia He 1fe07df8b9 fix(ai): let LLM calls outlive undici's 300s headers timeout (#1404)
* fix(ai): let LLM calls outlive undici's 300s headers timeout

A non-streaming completion only receives response headers once the whole
completion exists, so undici's default 300 s headers timeout bounds total
generation time. Thinking models (GLM-5.x at effort=max, MiniMax M3, …)
routinely exceed that on large prompts — the request then dies with
"Cannot connect to API: Headers Timeout Error" at exactly 300 s and, with
maxRetries 0, the scene never generates (observed on a self-hosted
deployment with glm-5.2 scene generation).

Route every outbound LLM request through an undici Agent with a
15-minute headers/body timeout, attached at the shared transportFetch
seam so the OpenAI-compatible, native OpenAI/Responses, Azure,
Anthropic-compatible and Google transports all inherit it (same
lazy-import dispatcher pattern the Google proxy transport already
uses). Native transports now always install the shared transport
instead of only when the server injects a validating fetch.

* fix(ai): harden the LLM transport timeout fallback

Review follow-ups for the undici headers-timeout fix:

- getLlmDispatcher(): drop the cached promise on rejection so one
  transient undici import/Agent failure can't brick every later call;
  transportFetch falls back to the base transport (no dispatcher) when
  the dispatcher can't be built, warning once per failure episode
- bedrock: install fetch: transportFetch like every other transport
- google proxy: build ProxyAgent with the same headers/body timeout
  budget (http/https proxies; undici's Socks5ProxyAgent drops these
  options for socks5://)
- transportFetch no longer overwrites a caller-supplied dispatcher
- tests: dispatcher failure fallback + retry, bedrock transport,
  caller-dispatcher preservation, google proxy budget

---------

Co-authored-by: XingJia He <hexingjia@mobirit.com>
2026-09-11 02:48:35 +02:00
a99e2007cf feat(providers): add GLM-5.3 and GLM-5.3-Flash support (#1401)
Zhipu released GLM-5.3 (2026-08-19, text flagship) and GLM-5.3-Flash
(2026-08-26, native multimodal, 320B MoE / 18B active). Both serve a
1M-token context with 128K max output and always-on thinking controlled
by reasoning_effort low/high/max — the API rejects thinking
{"type":"disabled"} with code 1210 ("该模型始终思考,不支持关闭思考").

- catalog: glm-5.3 (text) and glm-5.3-flash (vision) entries, 1M/128K
- metadata: glm53Effort capability — effort-only, not toggleable,
  default effort max (same forced-thinking pattern as Fable 5)
- adapter: for non-toggleable GLM models, degrade a "disabled" thinking
  request to the lightest effort instead of sending the API-rejected
  {type:'disabled'}, mirroring the guard in the Anthropic adapter;
  this also un-breaks POST /api/verify-model, which hardcodes
  thinking off

Co-authored-by: XingJia He <hexingjia@mobirit.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-09-10 22:56:37 +02:00
Educator-AIEDandwyuc 6afa5b0af6 fix(ai): share thinking context across bundle evaluations (#1378)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-09-10 21:50:54 +02:00
92d8b32a5a feat(deepseek): register deepseek-v4-flash-vision-exp with vision cap… (#1329)
* feat(deepseek): register deepseek-v4-flash-vision-exp with vision capability

DeepSeek's docs list deepseek-v4-flash-vision-exp as an official model
on the same OpenAI-compatible base URL (https://api.deepseek.com):
1M context, 384K max output, JSON output / tool calls / Responses API /
Anthropic API all supported, priced same as deepseek-v4-flash.

Register it in the deepseek catalog with vision: true so scene
generation can pass document images as vision content parts instead of
silently dropping them for this provider.

* fix(deepseek): register vision model in thinking metadata and update pinned lists

- add deepseek-v4-flash-vision-exp to THINKING_CAPABILITIES (deepseekEffort,
  same as v4-flash per official docs) so the model-metadata drift test passes
- update the pinned deepseekModels list in thinking-config.test.ts to include
  the new model

* docs(env): include deepseek-v4-flash-vision-exp in DEEPSEEK_MODELS example

* Revert "docs(env): include deepseek-v4-flash-vision-exp in DEEPSEEK_MODELS example"

This reverts commit 8040bac441.

* style(deepseek): apply prettier formatting

* test(deepseek): pin vision model capabilities; document vision-exp in env example

Review asks from #1329:
- assert deepseek-v4-flash-vision-exp capabilities (vision: true,
  streaming, tools) so a regression to vision: false fails the suite
- add the model to the DEEPSEEK_MODELS example in .env.example

---------

Co-authored-by: CrazyPandaP <CrazyPandaP@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-09-05 23:11:45 -07:00
wyucandClaude Fable 5 04621578de release: OpenMAIC 1.0.0 — the agent workbench (#1228)
* feat(storage): add an agent-session store with PG backend and layered contracts (#1163)

* feat(storage): add agent-session store with PG backend and layered contracts

* test(storage): avoid BigInt literals for pre-ES2020 root typecheck

* fix(storage): close agent-session store review findings

* docs(storage): align hook ordering and contention-probe claims with the code

* ci: run on the agent-workbench integration branch

* chore(storage): bump to 0.5.0 for the agent-session store

* fix(storage): carry replay compaction across page boundaries

* feat(agent): add the driver model contract and stage route dialect (#1165)

* feat(agent): add the driver model contract and stage route dialect

* fix(agent): validate route context windows and clarify dialect precedence

* feat(agent): adapt the agent-session store and runtime foundations (#1167)

* feat(agent): adapt the agent-session store and runtime foundations

* feat(agent): resolve request owner identity via an anonymous cookie

* docs(agent): document the opt-in compaction default and harden edge cases

* feat(agent): add the background session runner (#1169)

* feat(agent): add the background session runner

* feat(agent): wire the runner into startup behind feature flags

* fix(agent): stop clean interruptions from consuming the attempt budget

* fix(storage): charge the attempt budget for abandoned leases but not clean parks

* docs(storage): document the attempt-charging contract and decouple its tests

* feat(agent): add agent session and owner event streams (#1170)

* feat(agent): add agent session and owner event streams

* fix(agent): close the session-existence oracle and document the owner seam

* feat(agent): add agent session lifecycle routes (#1171)

* feat(agent): add agent session lifecycle routes

* fix(agent): validate session-create input and preserve the owner cookie on errors

* refactor(storage): drop the unused active-stage API from the agent-session contract (#1174)

* refactor(storage): drop the unused active-stage API from the agent-session contract

Tools address stages explicitly on every call, so the store keeps no
mutable session-level stage pointer. Removes resolveActiveStage and
setActiveStage from the store interface, their PG implementations, the
active_stage_changed lifecycle event, the session_active_stage owner
event variant, and the contract tests pinning them. The active_stage_id
column and the DDL check constraint stay untouched for schema
compatibility.

* chore(storage): bump @openmaic/storage to 0.7.0 for the contract removal

* docs: document the agent runtime configuration surface (#1176)

* fix(agent): repair orphaned and late tool results across interruption boundaries (#1180)

* fix(agent): repair orphaned and late tool results across interruption boundaries

A crash, shutdown, or provider failure can leave the durable transcript with
tool calls that have no result, or with results ordered illegally for the
provider. Three failure modes were fixed:

- Orphaned tool calls: a run that died between an assistant tool-call frame
  and its result left a dangling call in the entry tree. Resume no longer
  synthesizes and persists receipts for it: interrupted results are a
  read-time provider view owned by a shared read-boundary repair, which
  returns the original array for a healthy transcript and never mutates the
  tree.

- Late parallel results: a parallel tool can finish while pi unwinds an
  aborted assistant frame, leaving result(A), assistant(aborted), result(B)
  in durable order. Strict providers reject non-contiguous results, so the
  read-boundary repair moves existing results next to their owning assistant
  frame (in call order), omits incomplete unwind frames, and synthesizes
  receipts only for genuinely missing calls.

- Interrupted calls at the write boundary: a call still in flight when the
  run winds down (shutdown, lease loss, cancellation, provider failure) had
  no receipt at all. The runner now tracks in-flight calls from their
  assistant frames and, before the terminal flush, appends an
  interrupted-result receipt for each still-orphaned call through the same
  attempt-fenced write chain, so a lease-stealing zombie never writes and
  the next claim sees a provider-safe transcript.

* test(agent): pin the runner wiring for interruption-boundary tool repair

* feat(agent): add neutral tool foundation libraries (#1184)

* feat(agent): register a web_search tool on the session runner (#1185)

* feat(storage): add a per-session URL trust gate (#1186)

* feat(agent): add the skills system (#1189)

* feat(agent): add the skills system (builtin directories and durable user skills)

* fix(storage): serialize the user-skill quota check-and-insert per owner

Two concurrent creates at the 50-skill boundary both counted 49 rows and
both inserted (READ COMMITTED, no lock), overshooting the quota contract.
The create transaction now takes a per-owner pg_advisory_xact_lock first,
and the same-name idempotency check runs before the count check so an
at-least-once retry of the create that committed as the owner's 50th row
still returns its durable receipt instead of a quota error. The 23505
backstop is retained for writes that do not take the lock.

* fix(agent): share unstorable-character validation and align skill lookup

* feat(agent): add session materials and a fetch_url tool behind the URL trust gate (#1190)

* feat(agent): add session materials and a fetch_url tool behind the URL trust gate

* fix(agent): harden session material fetching

* feat(storage): add an ownership scope to stage documents (#1191)

* feat(agent): add material read and search tools (#1192)

* feat(agent): add stage read and patch tools (#1194)

* feat(agent): add page generation and deck editing tools (#1198)

* test(storage): keep the PG contract suite order-independent (#1200)

* fix(agent): revoke deleted-session URL authority and reject private ISATAP endpoints (#1199)

* fix(storage): revoke deleted session URL authority

* fix(ssrf): reject private ISATAP endpoints in strict fetches

* chore(storage): bump to 0.11.1 for the session-URL authority fix

* feat(agent): add roster and voice registration tools (#1201)

* feat(agent): add folder organisation tools (#1202)

* feat(api): add stage and material HTTP routes (#1203)

* feat(workbench): add the client data layer (#1204)

* feat(workbench): add the client data layer

* docs(workbench): write the ported comments in English

* chore(edit): remove the in-editor agent panel (#1210)

* chore(edit): remove the in-editor agent panel

* style: apply prettier formatting

* fix(agent): report the runtime as unusable without a database (#1207)

* fix(agent): report the runtime as unusable without a database

* style: apply prettier formatting

* feat(agent): add image, video and pptx import tools (#1211)

* feat(workbench): add the agent chat surface (#1205)

* feat(workbench): add the agent chat surface

* docs(workbench): write the ported comments in English

* fix(workbench): label the folder and rename tools on the timeline

* fix(workbench): label the roster and voice tools on the timeline

The reconciliation test iterates every tool the runner registers and
requires a display label of its own. The roster and voice-clone tools
(list_voices, set_roster, clip_audio, register_voice) reached the
integration base with the roster/voice-registration tools but never
gained presentation rows, so they fell through to the default branch
and rendered their wire names. Port their rows from the reference
implementation (labels and i18n keys verbatim) and extend the
reconciliation allowlist with ROSTER_TOOL_NAMES and
VOICE_CLONE_TOOL_NAMES, so a future tool cannot enter the product
without a label.

* feat(agent): add the material extraction lifecycle (#1212)

* feat(storage): add material extraction lifecycle

* feat(agent): execute queued material extraction

* style: apply prettier formatting

* style: satisfy prefer-const in the extraction runner

* test: give material fixtures the extraction lifecycle fields

The media-tools slice and the extraction lifecycle slice were each green
in isolation but never compiled together: the lifecycle made derivedFrom
and extraction required on AgentSessionMaterial while the media-tool
fixtures predate them.

* chore: remove stray task notes

* fix(workbench): label the extraction lifecycle tools on the timeline

* feat(workbench): add the workspace shell (#1206)

* feat(workbench): add the workspace shell

* docs(workbench): write the ported comments in English

* i18n(workbench): align workspace keys across locales

* fix(workbench): adopt the landed data layer and label the extraction tools

- replace the sibling-slice seam stubs with the real data-layer modules
- drop ambient declarations now shadowed by landed files
- port timeline labels for the extraction lifecycle tools from the reference
- align the new i18n keys across all locales

* ci: retrigger

* feat(api): folder routes, stage-meta viewer surfaces, and the material upload contract (#1215)

* fix(storage): restore capability-based stage access

* fix(api): bind document access to request owner

* fix(agent): restore three-state stage access on the tool layer

Port probeStageAccess and the three-state StageAccess (owned / foreign /
missing / tombstoned) and gate every stageId-bearing stage tool on an owned
probe, mirroring the reference per tool:

- move_to_folder, rename_stage, read_stage_outline refuse a non-owned stage
  with the single not-yours message before touching the store.
- The course/DSL toolset and the roster toolset are wrapped by
  withOwnerStageAuthorization: read_stage, patch_stage, grep_stage and every
  writer refuse a foreign stage with the same message and refusal shape.
- Scene preview keeps its own probe and its own refusal text, and is
  registered beside the course toolset (never double-gated).
- The runner injects one probe factory at the three call sites.

Tests: the dsl cross-owner test premise (a foreign stage is readable by id)
encoded an invented capability-read policy that the reference does not have
at the tool layer; it now asserts foreign read/patch/grep are all refused
while the owner still reads. Curriculum cross-owner assertions were already
the reference's and now pass with the probes in place.

* docs: correct per-file test counts in the fidelity report

* test: fix type errors in stage-access fidelity test

* test: adapt media-tool and gate suites to the owner-scoped store seam

* feat(api): add owner-scoped course-folder HTTP routes

Port the reference implementation's /api/folders family (list, create,
rename, delete with ungroup/remove modes, and folder membership) onto the
owner-bound document store, replacing its provider-based auth with the
existing withRequestOwnerId / owner-scoped store seams.

The storage package's folder store grows the pieces the routes need:
DocumentFolder.order (schema column + max+1 assignment + ordering),
renameFolder, deleteFolder(mode) with captured member ids, and
setStageFolder(stageId, folderId | null) with idempotent un-filing.
FolderNameError moves into folder-name-validation.ts (stage-storage re-exports
it, keeping import sites intact).

Every route gates on the configured agent runtime (plain 404 when off or
unconfigured), keeps the reference's machine codes and envelopes, and is
covered by gate tests plus a behavior suite.

* feat(api): add stage-meta viewer surfaces for the classroom

Port the reference implementation's viewer-facing stage state — can-edit /
collected / published / generation-complete — on top of the stage-access
base (stage_meta + tombstones). stage_meta gains published_at and
generation_complete columns plus a stage_bookmarks table; the reference's
deployment-specific origin/claimed_at columns are stripped.

New gated routes: GET /api/stage-meta/[stageId] (per-viewer facts, 404 for
absent/tombstoned, never returns the owner id), GET /api/stages/[id]/status,
POST generation-complete / publish / unpublish (owner-only), POST
/api/bookmarks. The resolver lives in lib/server/stage-access.ts.

Wiring: a fetchStageMeta client with the reference's three-outcome contract,
stage-store isOwner/isBookmarked/readOnly fields (upstream single-user
defaults, no-op until the sidecar answers) plus setViewerAccess, the
classroom apply path computing readOnly = !(isOwner || isBookmarked), the
Stage editability gate, and a sidecar probe after each classroom load. A
sidecar 'absent' answer keeps the editable default here because the
classroom also serves local-only courses; server writes stay owner-enforced.

* feat(api): port the reference material upload contract

Rewrite POST /api/materials to the reference implementation's upload shape
so the workbench uploader (uploadWorkbenchMaterial, which posts no session
id and expects a flat 201 view) works unchanged: owner-scoped upload with
mime normalization/validation (415), per-class size caps checked on the
declared content-length and the streamed body (413), empty body (400),
quota (429), sha256 reserve->store->finalize lifecycle with abandon on
failure, flat { materialId, originalName, bytes, mime, extraction } 201,
and an x-request-id echo.

Adds the owner-scoped material library (owner_material table + quota +
24h lazy sweep, bytes in the host's asset registry as the neutral
replacement for the reference's object-storage byte path) and the material
cap configuration. The session-scoped GET list is left as-is; the
reference's owner-material extraction worker is not ported (the branch's
session-material extraction lifecycle already covers extraction).

Gate tests now cover all 23 persistence routes across the three runtime
env states; the materials behavior suite pins the new contract.

* feat(media): add an optional local ffmpeg media extractor (#1213)

Adds a local ffmpeg/ffprobe pipeline as a second media extraction
provider behind the extractor registry, ported faithfully from the
reference implementation: duration probing, keyframe-safe chunking,
per-chunk ASR with timeout and deadline budgets, and timestamped
transcript assembly.

- Availability probing feeds the registry's candidate selection: the
  provider simply is not a candidate when ffmpeg/ffprobe are absent.
- With neither ffmpeg nor a cloud provider configured, extraction fails
  with an actionable message naming both enablement paths.
- Media materials route through the same extraction lifecycle and lease
  fence as documents; no parallel queue.
- Tests inject the executable resolver so the missing-ffmpeg path is the
  default-tested one; the real pipeline test is skip-if-unavailable.
- @openmaic/storage 0.13.0 -> 0.14.0 (media routing in the material
  lifecycle surface).

* feat(storage): per-scene monotonic revisions via database triggers (#1214)

* feat(storage): per-scene monotonic revisions via database triggers

Restore the reference implementation's freshness granularity: a
per-scene monotonic revision maintained by database triggers, so every
writer (HTTP routes, agent tools, jobs, manual SQL) bumps it without
application cooperation.

- Companion revision tables + trigger functions in the storage package's
  idempotent schema bootstrap, with the lock-order invariant, pg_notify
  wakeup and the suppression switch for batch writers.
- ensureDocumentSchema gained a dollar-quote-aware statement splitter.
- The freshness and manifest routes serve per-scene revisions.
- Mutation-verified: dropping the triggers turns the revision tests red.
- @openmaic/storage 0.13.0 -> 0.14.0.

* fix: forward the freshness manifest through the owner-bound store

* feat(workbench): add the Pro entry points and preserve the mode-transition semantics (#1208)

* feat(workbench): add the Pro entry points

* feat(workbench): preserve Pro mode transition semantics

* fix(workbench): drop ambient declarations shadowed by landed slices

* fix(workbench): drop ambient declarations shadowed by the landed shell

* feat: port workspace shell sibling modules

Port the 16 leaf modules the Pro workspace shell imports but that were only
ambient-declared, replacing the compile-time bridge with real implementations
adapted from the sibling-slice reference: pure workbench helpers (session
title, rail tab, course-chat bootstrap, created-course tabs, course-tabs
memory, workspace navigation, pane navigation, pro-edit sizing,
existing-course minting, first-message session), the neutral brand context and
course-rename server API, the server-action session delete, the home
discovery hook, the classroom pane host with its load-policy leaf, the theme
toggle and floating-layer owner, plus the floating-layer-owner wiring the
dialog/dropdown/tooltip portals stamp.

Also add the workbench-shell locale copy for all 12 locales, port the
reference tests for the ported modules, and drop
types/workbench-sibling-slices.d.ts now that every declaration has a real
implementation.

* docs: keep ported comments in English and deployment-neutral

* docs: announce 1.0.0 and refresh the feature overview (#1216)

* docs: announce 1.0.0 and refresh the feature overview

* docs: finalize 1.0.0 README after feature merge

* fix(agent): control-plane routes answer 404, not 500, without a database

The agent control-plane routes gated only on the runtime flag, so an
enabled-but-unconfigured deployment (flag on, DATABASE_URL empty)
answered 500 from a store that cannot connect. Gate them on the
configured check instead, matching the stage/material routes: the
whole surface is cleanly absent until both the flag and the database
are present. The status probe keeps reporting both bits.

* test: mock both runtime gate exports in the control-plane route suites

* fix(agent): abort in-flight TTS on cancel and bound each provider request with a timeout (#1217)

The generate_tts / scene-tts path checked the runner's AbortSignal between
actions but never created the provider HTTP requests with it, so a session
cancel left a hung synthesis fetch in flight until a restart repaired the
tool result. Thread the signal end-to-end: TTSModelConfig carries an
optional signal, generateTTS combines it with a per-request timeout
(TTS_REQUEST_TIMEOUT_MS, default 30s, ported from the reference runtime's
TTS bounds) via AbortSignal.any, and every provider fetch (openai, azure,
glm, qwen incl. voice-clone + audio download, voxcpm, minimax, doubao,
elevenlabs, lemonade) is created with that signal.

A timeout now fails the tool call with TTSRequestTimeoutError (a clear
retryable error) instead of wedging the session; a caller cancel propagates
as the interruption so the runner settles the session as cancelled without
a restart.

Tests: hung-provider simulation rejects at the timeout with the retryable
error; abort mid-flight aborts the captured request signal and surfaces the
interrupted shape; removing the signal wiring makes the abort tests fail
(red), restoring them turns green.

* fix(workbench): PG-mode home listing via owner stages; keep the interrupted terminal course card (#1218)

Finding 1: with server persistence on, listStages resolved to the generic
GET /api/persistence/documents listing, which the capability model
deliberately answers 403 FORBIDDEN_DOCUMENTS for (reads by id, listings
owner-only). The home/workspace library now lists through the owner-scoped
GET /api/stages surface (same anonymous-owner cookie the workbench uses)
when server persistence is enabled; the server-side 403 is untouched.

Finding 2: a run interrupted (session_interrupted) and repaired
(session_resumed) that ends cancelled before agent_end stranded its pending
classroom sightings, so the timeline's terminal card lost the course the
answer produced. session_end (cancelled) now flushes the pending sightings
into the same course card set agent_end paints, before the stopped caption.

* chore(workbench): remove the bookmark concept and the saved-courses drawer (#1219)

* chore(classroom): remove the bookmark ('collected') concept entirely

The stage-meta viewer port introduced a bookmark surface (stage_bookmarks
table, POST /api/bookmarks, the isBookmarked sidecar field, and a
readOnly rule that let a saved course stay editable). The product has no
such concept, so remove it as a closure:

- delete the /api/bookmarks route and the stage_bookmarks table plus its
  query helpers from the persistence bootstrap
- drop isBookmarked from GET /api/stage-meta/[stageId]
- simplify the classroom read-only rule to readOnly = !isOwner across the
  sidecar client, ownership signal, classroom load, stage store and the
  classroom page
- keep publish/unpublish, generation-complete, isOwner and isPublic
  exactly as they were
- update the gate and stage-meta route suites and the README mentions

The workspace rail's Bookmark glyphs and comments describe the upstream
saved-courses (favorites) section, which is driven by isOwner and renders
no collect affordance; they are kept as unrelated homonyms.

* chore(workbench): remove the saved-courses drawer UI

The first pass removed the bookmark data model but kept the rail's
"Saved courses" drawer, judging it a separate surface driven by
`isOwner === false`. The home/workspace listing is owner-scoped, so that
flag can never occur: `allSaved` is permanently empty and the drawer
(plus the collapsed-rail Bookmark mini-button) is a dead affordance.
Remove it: the SavedDrawer component and its mount, the savedOpen /
savedSection state, the allSaved / matchedSaved derivations, the 'saved'
variant of the course-list renderers, the mini Bookmark glyph, the
drawer-only CSS, and the drawer's i18n keys from all 12 locales. The
courses tab is now exactly one folders tree.

The authored/favorites split in workspace-tree.ts goes with it; the tree
module no longer reads `isOwner`. The discovery course type keeps the
field — the shell still reads it for read-only gating.

Upstream has no collect concept; the drawer could only ever render empty
here. The reference implementation HAS this drawer (its favorites come
from its account system), so this removal is a deliberate upstream
product decision, not a fidelity bug.

* fix(workbench): restore the attach entry, add the rail settings entry, pin all three entry points (#1221)

* fix(workbench): restore the composer attach entry by gating it on the live runtime

The AttachButton's rollout probe read a `materialsEnabled` field that this
branch's /api/agent/runtime never answers (the materials routes gate on the
runtime itself, like the stages), so the gate could never pass and the attach
button never rendered — the Pro launch and chat composers showed only the
@-mention and enhance glyphs.

Substitute the field with the runtime's `enabled` value, which IS the upload
action's precondition: POST /api/materials answers 404 whenever it is false,
so the render condition now equals the action precondition (no dead button).

The button's label (`proMode.attach`) is a user-visible string that becomes
visible again; port the reference implementation's own translations verbatim
into the 11 locales that still carried the Chinese copy.

* feat(workbench): add the settings entry to the rail's bottom-left cluster

The reference's rail foot carries a cluster of utilities (its saved-courses
drawer, the language switcher, the display toggle). This branch removed the
drawer — it could only ever render empty here — and the product decision is
to fill that freed spot with the settings entry.

Add a settings trigger to the foot cluster (expanded rail, beside the
language and display toggles, and on the collapsed strip) and mount the
model/provider SettingsDialog in the rail, wired to the trigger. It is the
same dialog the classic home opens from its header pill; the workspace had no
settings entry of its own, so nothing is duplicated within a surface.

* test(workbench): pin the restored upload, attach, and settings entry points

Covers the three restored entry points:

- the courses-tab upload control: rendered beside the course name filter,
  wired to the discovery hook's ZIP import trigger, disabled while an import
  runs, and gated by the same condition as its action (the courses tab);
- the composer attach control: an actual render of AttachButton under both
  probe answers (visible when the runtime says the upload path is live,
  hidden otherwise), its mounts in the launch and chat composers, the
  branch's runtime-field substitution in the probe, and the reference's own
  `proMode.attach` copy in all 12 locales;
- the settings entry: the trigger in the rail's foot cluster (expanded and
  collapsed), beside the language and display toggles, opening the
  SettingsDialog the rail mounts.

* chore(config): the Pro workbench flag implies the MAIC Editor gate (#1223)

A workbench build without the editor toggle has no way to edit a course:
enabling NEXT_PUBLIC_PRO_WORKBENCH_ENABLED while forgetting
NEXT_PUBLIC_MAIC_EDITOR_ENABLED produced exactly that split-brain bundle.
The workbench IS Pro mode, so its flag now implies the editor gate; the
standalone flag remains for deployments that want the classroom editor
without the workbench. Documents both flags in .env.example.

* fix(agent): wake SSE tails and the runner on durable deltas (streaming fidelity) (#1222)

The Pro workbench chat did not stream: the session/owner SSE routes polled
the durable event log on a 5s/30s clock with no wakeup, so message_update
deltas (written at 150ms cadence) reached the browser in poll-sized blocks
and the thinking strip only mounted after the whole reasoning text had
accumulated.

Port the reference's LISTEN/NOTIFY delta path:

- storage: add in-transaction wake hooks (onSessionEventAppended,
  onOwnerEventAppended, onCancelRequested) so a host queues pg_notify in
  the same transaction as the durable append; align readEventsAfterForReplay
  to rank the bounded page so the first delta after the cursor is always
  kept (the live tail can never starve). Bump @openmaic/storage to 0.18.0.
- app: port the process-wide event-notify bus (dedicated LISTEN client,
  self-check probe, reconnect backoff; notify through the storage
  transaction surface), wire the store hooks, subscribe both SSE routes
  before the initial read with the reference's initializing gate, and give
  the runner one {kind:'session'} subscription whose wake runs the cancel
  check and the message drain. Polls stay as the lossy-NOTIFY backstop.
- lifecycle: start/stop the bus from instrumentation.

Tests: storage hook + compaction contract; route wakeup latency; runner
wakeup wiring with a fake agent; bus unit tests; PG contracts proving a
real append wakes the routes and a live SSE route forwards a message_update
on the wakeup, and that a rolled-back append never wakes. Also fix the
pre-existing park-attempt-budget PG test TRUNCATE (missing CASCADE against
newer FK tables).

* fix(storage): asset writes self-deadlocked against pooled PostgreSQL (#1225)

* fix(storage): refuse the non-transactional byte-write deadlock configuration

A byte store whose plain write() runs on its own pooled connection cannot be
invoked from inside a registry write transaction: after the transaction has
claimed the blob-row lock, that write blocks on the lock the transaction just
took while the transaction waits on the write - a self-deadlock PostgreSQL
cannot detect (one side is idle in transaction).

There is no lock-safe ordering for such a writer: bytes must be written after
the row claim (writing before it lets the collector delete the bytes while the
upsert waits), and any second-connection write after the claim is the
deadlock. The configuration is therefore detected and refused:

- AssetByteStore gains writesOutsideRegistryDatabase?: true, declaring that the
  layer's plain byte operations cannot contend for the registry's row locks.
- PgAssetStore refuses put()/replace() up front (and defends coordinatedWrite)
  when the byte store has no writeWith and does not declare the flag, throwing
  a clear configuration error before any row is claimed.
- The collector mirrors the guard on its delete path (deleteWith or a declared
  out-of-registry layer, else a configuration error).
- The object store declares the flag (its out-of-transaction write remains
  legitimate); the in-registry PostgreSQL byte column provides writeWith /
  deleteWith instead.
- Write transactions (put/replace/remove) set SET LOCAL lock_timeout = 30s so
  any future lock-contention variant fails loudly instead of hanging.

Bumps @openmaic/storage to 0.18.0.

* fix(persistence): forward the transactional byte methods through the lazy asset byte-store wrapper

The no-bucket case of lazyAssetByteStore returned a bare { write, read,
delete } and dropped writeWith/readWith even though the underlying
PgAssetByteStore has them. The registry's hasTransactionalWriter duck check
then failed and put() fell back to the byte store's own pooled connection,
which blocks forever on the blob-row lock the registry transaction just took
when the bytes live in the same PostgreSQL - the production self-deadlock.

The no-bucket layer is statically PgAssetByteStore, so its transaction-pinned
methods are forwarded eagerly (typed against the real signatures via
PgForwardedByteStore). The bucket case keeps its lazy-probing semantics: no
transactional writer exists there, the signed-URL method stays absent or lazy
exactly as documented, and the wrapper now declares writesOutsideRegistryDatabase
so the registry may run the plain write inside its transaction.

New tests pin the wrapper's transactional capability red-to-green and assert
put()/resolve() route byte traffic through the transaction-pinned queryable.

* fix(home): cap the generate-prep ingest drain at 3s so Generate never waits the full server budget

The classic home flow's Generate click drained in-flight ingests for the full
15s server budget. Cap the wait at GENERATE_DRAIN_CAP_MS (3000ms, documented as
a UX bound) and reuse the existing timeout fallback: sources that miss the cap
proceed on the legacy byte path and each late-resolving id is released.

* chore(storage): bump to 0.19.0 over the concurrently landed 0.18.0

* fix(agent): bound every tool call with a timeout; never resurrect a cancelled session (#1226)

* fix(agent): bound every tool call with a global timeout and settle it on cancel

A tool await that neither resolves nor rejects wedges the session forever:
the lease keeps heartbeating and the driver never reaches its next cancel
checkpoint. Race every tool execution (in buildAgent) against a hard budget
(OPENMAIC_AGENT_TOOL_TIMEOUT_MS, default 10 min, per-tool overrides for
known long runners) and against the caller's AbortSignal, so even a
signal-ignoring await cannot keep a cancelled session running.

On timeout the call rejects with AgentToolTimeoutError; the agent loop turns
the rejection into a structured error tool-result the agent can retry or
proceed from, and the abort signal is delivered to the tool's in-flight work
through a derived controller. Zombie-tool updates after settlement are
dropped.

* fix(storage): never re-lease a cancel-requested session; settle it as cancelled on claim

The claim scan treated a session with cancel_requested_at set as a normal
claim candidate: after a restart it re-leased the same session for attempt
N+1 and resumed generating despite the pending cancel. claimNextSession now
settles such candidates as cancelled under the claim lock (status cancelled,
attempt reset, lease and cancel request cleared, terminal session_end event
and owner projection) instead of leasing them, then keeps scanning.

Bump @openmaic/storage to 0.18.0.

* docs: takeaway-style 1.0.0 announcement with bilingual guide links

The 1.0.0 head is now a short takeaway block — badge links to the
official user guides (English and Chinese), five one-line highlights,
and pointers into Features and the workbench setup section — instead of
six dense paragraphs. The detailed provider-neutrality and freshness
notes move into the Features workbench section, phrased database-
neutrally (the announcement no longer names a specific database).
Release date corrected to August 27.

* fix(workbench): restore editor chrome, mode transition, streaming, materials, mentions, folders (#1229)

* fix(workbench): wire workspace folder routes

* fix(editor): restore reference workbench chrome

* fix(workbench): persist composer materials and course refs

* fix(workbench): preserve live reasoning frames

* fix(persistence): back off failed streaming saves

* chore(workbench): retire stale slice seams

* test(editor): cover element pin layer

* chore(storage): bump to 0.21.0 for the user-message ref/material fields

* chore(editor): translate ported code comments to English

* fix(agent): fence durable tool writes and consume cancel requests atomically (#1230)

* fix(agent): enforce provider force-off in agent tools and scrub vendor identity from tool results (#1231)

* fix(materials): serialize per-owner quota reservations and make crashed uploads reclaimable (#1232)

* fix(editor): resolve dock-bar i18n keys, remove dock height drag, wire element referencing (#1233)

* fix(workbench): send the opening session message exactly once with refs intact (#1234)

* feat(editor): port timeline TTS preview single-flight and voice-all state latching (#1235)

* fix(media): restore the reference classic media chain (#1236)

* fix(import): adapt imported PPTX canvas size so decks render without overflow (#1237)

* fix(editor): complete element referencing — renderer DOM contract and GenUI picking aligned with the reference (#1238)

* test(providers): reconcile the provider-config vendor-token debt count after the main merge

The integration line's AK/SK fallback for the managed document provider adds
occurrences that main's allowlist snapshot predates. Same mixed-composition
debt category the group already documents; no new vendor behavior.

* test(providers): reconcile vendor-token debt counts with the integration line

The main-merge brought main's neutrality-guard snapshot next to integration
features it predates (media-extractor fallback chain, local voice-profile
deletion semantics, the enabled-TTS helper). Same debt categories the guard
already documents; counts updated to the guard's own tally and two grouped
entries added. No new vendor behavior.

* fix(agent): carry reasoning through the completions dialect so the thinking strip renders (#1239)

* feat(skills): add Feynman and spiral curriculum methods (#1240)

* feat(agent): port missing reference tools and skills (parity audit) (#1241)

* feat(media): retire asset-registry wiring; media and materials follow the reference byte model (#1242)

* fix(classroom): center adapted canvases in the stage and send back navigation home during generation (#1243)

* feat(settings): skill management with real list, download, delete, and upload (#1244)

* feat(settings): skill management section with real list, detail, and zip download

* feat(skills): owner skill delete and upload across storage, API, and settings

* fixup! feat(settings): skill management section with real list, detail, and zip download

chore: neutralize a reference note in the settings header comment

* fix(media): persist origin-independent classroom-media references from the agent runtime (#1245)

* feat(editor): float the insert toolbar in the outer frame with collapse (#1246)

The insert strip was bounded to the slide card, so it could only ever sit on
top of slide content: the card's overflow clipped it and it could not be parked
in the padding beside the slide. Move it into the studio frame the element
picker's panel already roams (CanvasOverlayPortal + the frame selector), so both
canvas overlays share one bounding container and their handles behave the same.
While picking, the strip rises over the picker and goes inert, which is the
z-order CANVAS_OVERLAY_Z already documents.

Add a fold beside the grip: the chevron collapses the strip to that grip row and
back, with the buttons unmounted rather than hidden. The fold is session-local
state owned by EditShell, next to the drag offset, so a surface swap keeps it;
nothing is persisted. Expanding a strip parked at the bottom edge re-clamps
through the same bounds rule the keyboard move uses.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* fix(workbench): align the chat timeline's left edge with the composer (#1247)

* fix(agent): fence session claims while an ask_user question is outstanding (#1248)

* fix(agent): settle-time rescue tracks real delivery instead of a count offset (#1249)

* fix(persistence): migrate owner_material to oss_key and drop legacy asset_id (#1250)

* docs(readme): surface the 1.0.0 user guide badges at the top (#1253)

* fix(workbench): show newly created folders in the sidebar without reload (#1254)

* docs(readme): add the release version prefix and drop the opt-in framing

* fix(workbench): single-source the chat gutter so timeline and composer share a left edge (#1255)

The transcript and the composer each established their own column: their own
`px-*` gutter and their own `mx-auto w-full max-w-*` centering wrapper. Equal
padding values were never enough, because the two columns are centered inside
different containing blocks — the transcript's is a scroll container, whose
content box is narrower than the composer footer's by the scrollbar's width:

  transcript text left = pad + (pane - 2*pad - scrollbar - measure) / 2
  composer box  left   = pad + (pane - 2*pad             - measure) / 2

The padding cancels out of the difference and what remains is `-scrollbar/2` at
every padding value, so the transcript sat half a scrollbar to the left of the
composer and tuning the two paddings against each other could not move it.

The column is now established once, by the nearest common ancestor of both
(`chatColumn`), and the scroll viewport and the composer footer are siblings
inside it that add no horizontal inset of their own. The cap carries the gutter
on top of the 760px reading measure, so the text column keeps its width. The
handed-over question row drops the padding that indented it past the agent's
prose; framed rows keep their own inner padding, which is what a card's border
sitting on the column edge means.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* fix(workbench): lock pane-embedded classroom to edit mode (#1256)

The workspace right pane painted the full learning chrome — speed control,
play button, learner avatars, mic bar — for a course the agent had just
created, then flipped to edit once the first scene landed.

resolveStageChromeMode treated playback as the DEFAULT branch for a hosted
classroom, so every shortfall fell into it: a course whose tab opens at
stage_link time has no scenes yet, so currentSceneId is null and
isHostedSceneEditable is false. A folded pane parked the playback root
behind the fold and cross-faded it out over the pane on unfold, and a
failed editor chunk dropped into playback permanently.

Lock it at the pane instead of defaulting per entry path:

- WorkbenchPanelProvider — the single element that mounts a classroom into
  the workspace — publishes editPinned (visible && !playback). Every entry
  path passes through it, so none of them decides.
- The hosted resolution can no longer degrade to playback. Start Learning
  (workbenchLearning, new input, split out from pane visibility) is the one
  door; everything else resolves between the neutral loading shell and edit.
- Stage's chrome dispatch is exhaustive on chromeMode, so the playback root
  is no longer the else-branch of a condition about the current scene.

No flicker: chromeMode is resolved during render, and preloadEditor now
answers synchronously (isEditorPreloaded) so a remount with the chunk
already registered paints edit on the first frame. A failed import is no
longer cached forever, so the lock cannot strand the pane.

Standalone classrooms keep their stored mode unchanged.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-27 19:26:25 +08:00
Yizuki_AmeandCursor 13d94a52a1 feat(ai): add Grok 4.6 to the model registry (#1113)
* feat(ai): add Grok 4.6 to the model registry

The Grok picker still topped out at 4.5, so the new flagship ID was not selectable with its documented xhigh reasoning effort.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(docs): stop the docs Next app from loading app instrumentation

Next 16 discovers the repo-root instrumentation.ts from packages/docs, then fails because that file imports app persistence modules. Give the standalone docs app a no-op register() so the Grok catalog docs can build.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 16:59:06 +08:00
Xiao Chengmingandwyuc 859d66ec95 fix(ai): add opt-in streaming chat compatibility (#990)
* fix(ai): add opt-in streaming chat compatibility

* fix(ai): preserve streaming chat metadata

* fix(ai): harden streaming chat compatibility

* fix(ai): isolate primary streamed choice

* fix(ai): propagate streamed chat errors

---------

Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-08-12 14:19:05 +08:00
littlebullGitandwyuc 3d85525665 [codex] Add Amazon Bedrock LLM provider support (#538)
* Enable AWS-hosted text models without exposing ambient credentials

Rebase the Bedrock provider onto current main and close the review-requested security, credential lifecycle, usage attribution, configuration, and metadata gaps.

Constraint: Bedrock may use ambient AWS credentials only when explicitly enabled by the server operator
Rejected: Trust client-supplied provider types | permits built-in keyless IDs to reach Bedrock credentials
Confidence: high
Scope-risk: moderate
Directive: Keep provider ID/type validation at both request resolution and model construction boundaries
Tested: targeted Bedrock/resolver/config/usage tests; TypeScript; ESLint; i18n alignment; production build
Not-tested: Full suite has 27 failures in unchanged quiz/runtime and runtime/chat-storage tests

* Give Bedrock a recognizable provider identity

Use the official AWS architecture service icon so Bedrock no longer falls back to the generic provider cube in settings and model selection.

Constraint: Preserve the AWS-provided artwork without redesigning the service mark
Confidence: high
Scope-risk: narrow
Tested: SVG XML validation; provider unit test; TypeScript; ESLint; production build

---------

Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-08-03 23:10:50 -04:00
12ccd315ea Add Atlas Cloud LLM provider (#948)
* Add Atlas Cloud provider

* Account for Atlas Cloud non-thinking model metadata

* test: verify Atlas Cloud thinking payloads

* style: format Atlas Cloud payload test

* test: type Atlas Cloud fetch mock

---------

Co-authored-by: binyangzhu000-sudo <224954946+binyangzhu000-sudo@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-08-03 08:51:18 -04:00
louis brilliantandwyuc 297e405d63 fix(ai): omit zero SiliconFlow thinking budget (#1035)
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-08-03 04:43:53 -04:00
wyucandClaude Opus 5 97f8585728 refactor(pbl-v2): route runtime agents through the shared LLM entry point (#1006)
* refactor(pbl-v2): route runtime agents through the shared LLM entry point

The five PBL v2 runtime call sites (instructor x2, evaluator, simulator x2)
invoked the AI SDK directly while the other 21 call sites in lib/ and app/ go
through callLLM / streamLLM, so they silently opted out of everything the shared
entry point applies:

- Usage accounting. recordUsage is reached only from the wrappers, so no
  instructor turn, evaluator pass, simulator line or narrator pass was ever
  accounted for - the highest-frequency, longest-context LLM traffic in the
  product. The comment at llm.ts:275, that every server-side call funnels
  through the wrappers, did not hold.
- The LLM_THINKING_DISABLED kill switch, read inside the wrappers only.
- One thinking resolution path. runtime-thinking.ts existed precisely because
  the agents bypassed the wrapper, and it was wired into instructor (x2) and
  evaluator but neither simulator site.

Also fix callLLM recording result.usage, which on a multi-step tool run
(stopWhen) is the final step alone; totalUsage is the aggregate, and the
instructor turn is exactly such a run. streamLLM already preferred the
aggregate.

Thinking semantics are preserved per call site: the teaching turns keep
force-disabling thinking, now through the wrapper's own `thinking` argument,
and keep their existing providerOptions spread, which injectProviderOptions
yields to; the simulator keeps honouring a per-request config, as before. The
one behavioural difference is on native adapters when no thinking config
arrives: the policy now resolves to an explicit lowest/disabled provider option
instead of leaving the model's default in place - which is what the policy
always claimed to do, and what OpenAI-compatible providers already got.
Unifying the wider divergence is a product decision and stays out of scope;
runtime-thinking.ts now documents it, along with the fact that the original
tool_choice justification no longer matches the tree.

A lint guard restricts importing generateText / streamText to lib/ai/llm.ts so
the split cannot grow back. It uses the @typescript-eslint variant of
no-restricted-imports deliberately: flat config replaces a rule's options per
key rather than merging them, and the base rule is already configured for the
lib/choreography and lib/video-export module boundaries.

The runtime-thinking test moves from asserting the retired helper to asserting
what the call site is responsible for, at the provider boundary: an evaluator
turn reaches the provider with a disabled config in the thinking store, does
not leak it, and is accounted for under its own usage source.

Closes #1003

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(pbl-v2): address cross-review findings on the shared-entry migration

Consensus findings from an independent cross-vendor review of cc48ada.

callLLM recorded usage only after validation passed, so with `retries > 0`
every attempt that failed validation went unaccounted, and a result handed back
after the retries were exhausted recorded nothing at all. Each attempt that
reaches that point was billed, so record before validating. Latent today (no
caller passes retryOptions) but it sits in the function this PR already touches.

The simulator's character line now hands its incoming thinking config to
streamLLM instead of resolving providerOptions by hand. The hand-rolled call
covered native adapters only, so a stage-route thinking config was silently
dropped on OpenAI-compatible providers - the wrapper also seeds the thinking
context that their fetch wrapper reads. Native adapters resolve identically:
both paths end in the same normalizeProviderId + buildThinkingProviderOptions.

runtime-thinking.ts documents two things the previous docstring implied away.
On native adapters the constant is a no-op whenever a thinking config does
arrive, because the teaching turns pass their own providerOptions and
injectProviderOptions yields to a caller-set value. And "disabled" is resolved
against each model's catalogued capability, which for some models is not off:
measured against the current catalog, gpt-5.4-pro resolves to effort medium,
gemini-2.5-pro to thinkingBudget -1 (dynamic thinking) and claude-fable-5 to
adaptive/low. Those match the model's own default today, so behaviour is
unchanged, but the policy is weaker than its name suggests.

Tests cover both accounting paths (a retried attempt and an all-attempts-failed
run each record every attempt), and the defensive totalUsage fallback is now
labelled as defensive - ai@6 always reports the aggregate.

The lint guard's scope comment also notes namespace imports, which importNames
cannot see.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(pbl-v2): correct the thinking-policy rationale; stop tests writing the real usage log

Two things, both prompted by probing the live DeepSeek API with the instructing
turn's exact shape rather than reasoning from the tree.

The docstring in runtime-thinking.ts claimed the policy's original justification
had expired, on the grounds that `begin_turn` and the forced `tool_choice` it
used are gone. That reads as an invitation to delete the force-disable, and it
is wrong. Measured against DeepSeek V4 Pro:

  thinking on + tools + stopWhen  -> streams fine, 66 reasoning tokens
  thinking on + forced toolChoice -> still 400, "Thinking mode does not
                                     support this tool_choice"

The incompatibility is bound to a FORCED tool choice, not to tools in general.
Today's turns do not reach it, but anyone who reintroduces a forced tool choice
will, so the policy is a live guard rather than dead weight. It also buys
latency: the same probe reached its first token in 1.4s with thinking off
against 3.0s with DeepSeek's default thinking on, and the teaching turns gain
nothing from thinking while the instructor is the chattiest surface in the
product. The docstring now records the measurements instead of the guess.

Separately: a test run could append to the app's real usage log. Any test that
exercises callLLM / streamLLM reaches `recordUsage` through `recordUsageSafe`
without asking for it, so rows sourced `minimax-auth-test`,
`minimax-thinking-test`, `minimax-fixed-thinking-test` and `serialization-test`
were sitting in the live `data/usage/` file next to production traffic
(tests/ai/minimax-provider.test.ts:58,101,146 and
tests/ai/anthropic-serialization.test.ts:38 — neither predates this PR).
`recordUsage` now returns early under vitest unless the caller asked for a
specific `baseDir`, which is the fix at the boundary rather than in the two
tests that happened to trip it. Storage tests pass an explicit `baseDir` and
tests that assert accounting mock the module, so both keep working; verified by
running all three files and confirming the live file's line count is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* refactor(pbl-v2): drop the hardcoded thinking policy, finishing the unification

The point of this PR is that the PBL v2 runtime reaches the model the same way
everything else does. Keeping a hardcoded `PBL_V2_TEACHING_THINKING` override
inside the agents worked against that: the teaching turns still resolved
thinking through a second, private path, and it produced the awkward edges this
PR had to disclose — an override that silently loses to a caller-set
`providerOptions` on native adapters, and a "disabled" that resolves to
`effort: medium` or `thinkingBudget: -1` (dynamic thinking) on models whose
catalogued capability has no off value.

So the policy is gone. All five sites now pass the incoming request / stage-route
config straight to `streamLLM` / `callLLM`, which is the one place that resolves
provider options and seeds the thinking context. `runtime-thinking.ts` is
deleted, and the hand-rolled `resolveThinkingProviderOptions` calls with it.

What justified keeping it, and why that was not enough:

- The DeepSeek 400 is real — probed live, thinking on + a FORCED `toolChoice`
  still fails with "Thinking mode does not support this tool_choice" — but no
  call site in the tree forces a tool choice, so the policy was guarding a
  scenario that does not exist, at the cost of the entry-point unification. The
  hazard is now a comment where a forced tool choice would be introduced, which
  is where a future author will actually look.
- Thinking costs latency on the teaching turns (~1.4s to ~3.0s first token on a
  thinking-by-default model, measured on DeepSeek V4 Pro). That is a real cost
  but a deployment preference, and it belongs in the `pbl-v2-runtime` stage
  route, not hardcoded in the agent where it overrides whatever that route says.
  Noted at the instructor call site with the numbers.

Behaviour change to be aware of: on OpenAI-compatible providers the teaching
turns no longer force thinking off, so a thinking-by-default model now thinks
unless the route says otherwise — slower first token and reasoning tokens on the
bill. Pin `thinking` off on the stage route to keep the old behaviour.

The runtime-thinking test becomes runtime-llm-entry and asserts the new
invariant at the provider boundary: an incoming config arrives intact, NO config
means no config (a re-added constant would fail this), the global kill switch
still applies, nothing leaks, and the turn is accounted for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(pbl-v2): forward the resolved thinking config to the simulator narrator

Review finding from @cosarah on #1006, and a correct one: the director-narrator
pass was the last site still dropping the resolved config. Both callers passed
`thinkingConfig` into `runDirectorNarratorPass`, but the helper never destructured
it and never handed it to `callLLM`, so the provider silently fell back to the
model default instead of honouring the `pbl-v2-runtime:simulator` route.

Earlier revisions of this PR documented that as pre-existing and deliberately
untouched. That defence stopped holding once the hardcoded thinking policy was
deleted: the PR's invariant became "every PBL v2 site resolves thinking through
the shared entry point, and the deployment decides", and the narrator was the one
site contradicting it.

Coverage per the review: the simulator turn is now driven end to end against a
scenario fixture, asserting that BOTH provider calls — the streamed character
line and the non-streamed narrator pass — see the incoming config, that neither
substitutes one when the request carries none, and that both are accounted for
under their own usage sources. The `['generate','stream']` assertion keeps the
test from silently covering only one of the two calls.

Fault-injected to confirm it bites: dropping the new fourth argument again turns
"forwards an incoming config to the character line AND the narrator" red.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(lint): close the dynamic-import bypass on the LLM entry-point guard

Second review pass from @cosarah on #1006. He is right that the guard was not
airtight, though the picture turned out narrower than described — I checked each
form against eslint instead of reasoning about it:

  import { streamText } from 'ai'   already blocked
  import * as ai from 'ai'          already blocked (ESLint reports a namespace
                                    import when importNames is set)
  require('ai')                     already blocked, by the repo-wide
                                    @typescript-eslint/no-require-imports
  await import('ai')                NOT blocked  <- the real hole
  await import(`ai`)                NOT blocked

So the dynamic form is now covered by a no-restricted-syntax block, in both the
literal and template-literal shapes. That rule key is configured by five earlier
blocks and flat config replaces options per key rather than merging them, so the
new block explicitly ignores those directories rather than silently dropping
their module boundaries. It costs nothing: lib/choreography and lib/video-export
already allowlist their import sources (importing 'ai' there is an error today,
and video-export bans ImportExpression and require outright), and the two
@openmaic packages are built in isolation against @openmaic/dsl with the SDK
nowhere in their dependency graph.

The comment above the guard claimed namespace imports were out of scope because
importNames cannot see them. That was wrong; it now lists what each form is
caught by, and notes that an eslint-disable still defeats all of it — which is
the point, since the bypass then has to be written down where a reviewer sees it.

Verified with a probe file using all five shapes: five errors, one per line.
Injecting `import 'react'` plus an `'ai'` import into lib/choreography still
fails on both pre-existing boundary rules, confirming no clobbering.

Also updates the PR description, which still described the narrator as ignoring
its thinking config — stale since 9bbb720.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(lint): cover the @openmaic packages with the dynamic-import ban

Third review pass from @cosarah on #1006, and he is right again: the guard
ignored packages/@openmaic/renderer and packages/@openmaic/storage, and
`void import('ai')` under the renderer source path passed lint. Reproduced before
fixing.

The previous revision justified those two exclusions by arguing the packages are
built in isolation against @openmaic/dsl with the SDK nowhere in their dependency
graph. That is an argument about why a bypass would not matter, not a rule that
stops one — exactly the kind of reasoning this PR exists to replace with
enforcement.

The two selectors are now a shared AI_SDK_DYNAMIC_IMPORT_BAN spread into both
package blocks, rather than dropping those directories from the repo-wide block's
ignores: they configure no-restricted-syntax for their own `@/` boundary, and
flat config replaces rule options per key, so matching their files would have
silently deleted that boundary.

lib/choreography and lib/video-export stay ignored and stay covered — their
blocks ban EVERY ImportExpression outright, which subsumes this one. That claim is
now checked rather than asserted.

Verified with a `void import('ai')` probe in six production paths — both
@openmaic packages, choreography, video-export, lib/pbl, app/api — one error
each; lib/ai/llm.ts and tests/ stay clean; and an `@/lib/foo` import under the
renderer still fails its own host-path boundary, confirming no clobbering.

Also rewrites the PR description's e2e section, which still described the deleted
thinking policy. The browser run predates that deletion, so its streaming and
accounting evidence stands (the wrapper path is unchanged) but its thinking
observations do not. Replaced with a fresh live probe of the final behaviour: with
no route thinking the instructing turn reports 60 reasoning tokens, with `thinking`
pinned off on the stage route it reports 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(lint): guard every source extension, and pin the coverage matrix in a test

Fourth review pass from @cosarah on #1006. Confirmed before fixing: an
`app/api/**/route.js` containing both a named and a dynamic `'ai'` import passed
lint with exit code 0, because both guard blocks matched only `**/*.{ts,tsx}`
while every module-boundary block in the same file matches
`**/*.{ts,tsx,js,jsx,mjs,cjs}`. Both blocks now match the same set. The repo has
real `.mjs` under scripts/, so this was not hypothetical.

That is the third scope hole review has found in this guard — two @openmaic
package directories, then the extension list — and each one was closed and then
verified by hand, which is the process that produced the next one. So the matrix
is now an executable contract: tests/lint-llm-entry-guard.test.ts runs the real
eslint against the real config over every import form (named, namespace, dynamic,
dynamic-template) × every source extension × nine production paths, asserts the
three deliberate exemptions still pass, and asserts the module boundaries that
share the `no-restricted-syntax` key still fire. A future edit that narrows
`files`, adds an `ignores` entry or swaps the rule key fails CI instead of
quietly reopening the door.

Fault-injected against both earlier findings to prove it bites: narrowing the
scope back to ts/tsx turns the js/jsx/mjs/cjs rows red, and re-adding the two
@openmaic packages to `ignores` turns the dynamic-import rows red. It also treats
an eslint-ignored path as "not covered", so a path that silently stops being
linted cannot masquerade as a pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 14:11:40 +08:00
wyucandtejs1 f78f8599b4 feat(providers): add latest Claude, Gemini, Kimi, and Grok models (#993)
* feat(providers): add latest model catalog entries

Co-authored-by: tejs1 <tejsrelax@gmail.com>

* fix(ai): preserve reasoning settings across provider paths

* fix(providers): define Grok output limits

* fix(kimi): preserve reasoning across tool calls

* fix(kimi): scope reasoning replay to K3

* fix(kimi): gate pi reasoning replay by model

---------

Co-authored-by: tejs1 <tejsrelax@gmail.com>
2026-07-27 14:12:34 +08:00
3b63710376 feat(ai): add Azure OpenAI provider (#916)
* feat(ai): add Azure OpenAI provider

Add deployment-based Azure OpenAI configuration for both client and server-managed setups, normalize Azure portal endpoints, and expose the provider in settings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b0d3a94f-089a-470e-9987-608f1506ca6f

* style: format Azure provider type

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: b0d3a94f-089a-470e-9987-608f1506ca6f

---------

Co-authored-by: MarshellOnMoon <121332425+MarshellOnMoon@users.noreply.github.com>
2026-07-13 23:12:23 +08:00
wyucand杨慎 c8a638a101 feat: support GPT-5.6 model family (#907)
* feat: support GPT-5.6 model family

* test: cover GPT-5.6 SDK validation

* fix: canonicalize GPT-5.6 Sol alias

* fix: complete GPT-5.6 alias lookups

---------

Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
2026-07-13 18:19:40 +08:00
wyuc 8a9cf24a77 Update Doubao Seed model catalog (#827)
Closes #826
2026-07-02 08:02:39 -04:00
3f851bbcce fix(ai): close PROVIDERS/THINKING_CAPABILITIES metadata drift with a guard (#809)
* fix: close PROVIDERS/THINKING_CAPABILITIES metadata drift with a guard

* fix: use toggle-budget thinking capability for SiliconFlow DeepSeek-V3.2

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-07-01 05:20:29 -04:00
wyuc 42ca1407ef feat(ai): add GLM-5.2 and Kimi K2.7 Code (#774) 2026-06-24 13:14:59 +08:00
wyucandClaude Opus 4.8 dcf8a63333 fix(generation): make outline type changes take effect (interactive/PBL no longer downgraded to slide) (#772)
* feat(generation): changeOutlineType total constructor for valid type switches

Switching a scene outline's type in the editor only flipped `type` and left
the new type without its required config, so applyOutlineFallbacks silently
downgraded interactive/pbl back to slide. changeOutlineType returns a new
outline that strips foreign per-type config and seeds the target type's
required config from the shared fields, valid by construction.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* i18n(generation): keys for interactive widget kind and PBL project config

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(editor): make outline type changes take effect with config forms

TypePill now builds a valid outline via changeOutlineType (replace, not
partial-merge) so a type switch drops stale config and seeds the new type's
required config — no longer silently downgraded to slide by applyOutlineFallbacks.
Adds InteractiveConfigDisclosure (widget kind + concept) and PblConfigDisclosure
(topic / description / target skills), mirroring QuizConfigDisclosure, so users
can configure interactive and PBL scenes that previously had no input UI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(editor): move type-specific config under the type pill

The quiz/interactive/PBL config disclosure rendered as a detached chip at the
bottom-left of the card, reading like a stray key point. Pin it to the
bottom-right of the key-points row instead, so it sits directly under the
TypePill it configures (type top-right -> its config bottom-right, same edge),
with key points flowing on the left.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(editor): cascade type config as a connected segment left of the type pill

Replace the standalone config chip with a cascading control in the header: the
type-specific config (quiz count / interactive widget kind / PBL project) renders
as a themed segment joined to the left of the TypePill, the two clipped into one
rounded pill split by a hairline divider. Reads as a single 'config › type'
cascade and groups the config with the selector it refines.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(editor): address cross-review — preserve widget config, drop stale fields

- changeOutlineType: preserve an existing procedural-skill widget config
  instead of replacing it with a seeded simulation (codex P2 — task-engine
  fields were silently dropped on Interactive re-select).
- InteractiveConfigDisclosure.setWidgetType: reset widgetOutline to the shared
  concept only, so switching widget kind drops the previous kind's fields
  (claude P2 — language/gameType/etc. leaked across kinds).
- i18n locale-coverage test now also checks ko-KR and pt-BR.
- Drop a redundant WidgetType cast; add tests for procedural-skill preservation
  and pbl targetSkills dedupe/cap.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(editor): round 2 cross-review nits — procedural-skill label + skill a11y

- InteractiveConfigDisclosure: when an outline carries a preserved
  procedural-skill widget, surface it as the current (selected) kind with its
  own label instead of mislabeling it 'Simulation', and make a same-kind
  re-select a no-op so its task-engine fields are never silently clobbered.
- PBL target-skill remove button uses a dedicated removeSkill aria-label.
- Add widgetProceduralSkill / removeSkill i18n keys (8 locales) + test coverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(generation): make re-selecting the current outline type a no-op

changeOutlineType rebuilt the outline on every type-menu click, so re-selecting
the already-current type dropped fields it doesn't re-seed — legacy
interactiveConfig, or a partial pblConfig whose projectTopic is empty — turning a
harmless click into data loss. Short-circuit same-type selections to return the
outline untouched (codex P2).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(format): prettier --write files left unformatted on main

These 14 agent/edit files (not part of this PR's feature) fail the repo-wide
`prettier . --check` in the required Lint job — they landed on main unformatted,
turning main's CI (and therefore this PR after a branch update) red. Formatting
them here unblocks the required check; pure formatting, no logic changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(lint): suppress intentional set-state-in-effect in reasoning timer

The reasoning timer does a deliberate one-shot setState in its effect to show
the right elapsed value before the first 1s interval tick. main's CI fails the
required Lint job on the new react-hooks/set-state-in-effect rule here; suppress
it with a justification (no behavior change). Unblocks the required check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-23 17:48:07 +08:00
wyuc 1d1ce80e04 feat(maic-agent): editor-agent line (v0) — Pro-mode "Edit with AI" (#777)
Promote the editor-agent line to main: read-then-act editor agent (read_scene_content, regenerate_scene, regenerate_scene_actions, edit_interactive_html), a routable maic-agent model stage, the agent sidebar UI, interactive-scene runtime-error capture, and the timeline/script editor. Cross-reviewed and smoke-verified; see #777.
2026-06-23 16:56:37 +08:00
wyucand杨慎 adf3ba9b7f feat: add Claude Opus 4.8 and MiniMax M3 (#635)
Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
2026-06-02 13:24:57 +08:00
Helck 679130a6b9 feat(ai): add Xiaomi MiMo Token Plan support (#578) 2026-05-17 15:24:30 +08:00
杨慎 b29efe1f1d fix: remove weak Lemonade recommended models (#567)
* fix(lemonade): remove weak recommended models

* test(lemonade): align removed model references
2026-05-13 13:35:46 +08:00
be759a8252 feat: add lemonade to provider (#508)
* feat: add lemonade to provider

* fix(lemonade): correct TTS/ASR model IDs and expand Kokoro voices

- TTS model: kokoro → kokoro-v1
- ASR model: single 'whisper' → 6 Whisper variants (Base/Large-v3/Large-v3-Turbo/Medium/Small/Tiny), default Whisper-Base
- Expand lemonade-tts voices to full Kokoro v1 set (54 voices across en-US/en-GB/zh-CN/ja-JP/es/fr-FR/hi/it-IT/pt-BR)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(lemonade): zh-TW i18n parity, real Kokoro default voice, language code consistency

- zh-TW.json: add missing providerLemonadeTTS/ASR/Image keys
- TTS default voice: 'default' → 'af_heart' (Kokoro expects real voice ID, not placeholder)
- Voice language codes: 'es'/'hi' → 'es-ES'/'hi-IN' for consistency

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(lemonade): add unit tests for image/TTS/ASR adapters and wav-utils

Covers:
- lib/media/adapters/lemonade-image-adapter: request shape, base URL fallback, custom model, optional Bearer auth, error paths, connectivity probe
- lib/audio/tts-providers (lemonade-tts case): request body (model/voice/format), af_heart fallback, optional auth, error path
- lib/audio/asr-providers (lemonade-asr case): WAV-only validation, model/language form fields, "audio is empty" graceful empty result, error propagation, default model fallback
- lib/audio/wav-utils: isWavBlob detection by MIME and filename, normalizeASRUploadAudio pass-through and wav handling

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(lemonade): remove text path fork and harden fallbacks

* style: format lemonade tts files

* i18n: add lemonade voice language labels

* fix(lemonade): align image default model and harden wav detection

* test(lemonade): fix File BlobPart typing

* fix(lemonade): simplify tts voice selection and clear asr test state

* docs: highlight Lemonade support

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: wyuc <wang-yc24@mails.tsinghua.edu.cn>
2026-05-08 13:53:37 +08:00
wyucand杨慎 10b1fc83cf Fix Haiku 4.5 thinking controls (#501)
Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
2026-04-28 12:04:29 +08:00
wyucand杨慎 e613b7578f [codex] add per-model thinking config (#494)
* add per-model thinking config

* Refine thinking model controls

---------

Co-authored-by: 杨慎 <117187635+cosarah@users.noreply.github.com>
2026-04-26 19:41:10 +08:00
wyuc 4754bbae6d support gpt-5.5 api (#487) 2026-04-25 14:37:22 +08:00
wyuc a95aa87bf1 support recent model providers (#481) 2026-04-24 15:29:12 +08:00
wyucandHi-Jiajun 9badd59856 feat: add and expand MiniMax provider support (#182)
Add MiniMax LLM models (M2–M2.7), TTS provider (speech-2.8/2.6/02/01),
image generation (image-01), and video generation (Hailuo 2.3/02,
T2V-01). Unify base URLs to api.minimaxi.com and add MiniMax-specific
base URL normalization for the Anthropic-compatible endpoint.

Co-authored-by: Hi-Jiajun <3138947285@qq.com>
2026-03-30 12:41:43 +08:00