9 commits

Author	SHA1	Message	Date
Haozhe	a23ff56358	feat(kap-server): add POST /workspaces/{id}/add-dir endpoint (#3451)	2026-09-02 12:47:15 +08:00
liruifengv	2bf7ed22d7	feat(auth): split model readiness from sign-in state in /api/v1/auth (#3293) ... * feat(auth): split model readiness from sign-in state in /api/v1/auth GET /api/v1/auth now reports models_ready (the default model resolves against the configured catalog, providerless and env-injected models included) instead of the compound ready flag, and no longer carries default_model — config values are served by /config alone. The v1 summary schema follows. OAuth managed-model refreshes now heal a lost default model: the refresh snapshot includes defaultModel, so an unchanged catalog with a missing default still lands the write-back branch and re-selects one. The refresh also rebases onto a fresh config read after the remote fetch, so a model or thinking change made during the fetch is no longer overwritten. The shared discovery refresh path (scheduler, POST /providers/{id}:refresh) heals the default the same way. Config changes are now published to WS clients on every write path: a debounced+trailing publisher bridges IConfigService section changes to ConfigChanged with camelCase changedFields and a full config projection, and the broadcaster forwards event.config.changed and event.model_catalog.changed (both previously published but never delivered). All three event types are registered in the event unions, so session_event parsing and AsyncAPI describe them. BREAKING CHANGE: GET /api/v1/auth drops the ready and default_model fields in favor of models_ready; event.config.changed's changedFields is now camelCase domain names instead of the raw snake_case request keys (v1 summary schema follows). * fix(kap-server): expose the session model in session list projections GET /api/v1/sessions hardcoded agent_config.model to '' and the v2 projection had no model field at all, so clients could only learn a session's model via the post-select /status read — which races the WS replay and often never lands. SessionFacts now carries the live session's model (same source as the snapshot route), toWireSession emits it, and the v2 activity domain gains a nullable model field. * fix(kap-server): gate prompt submission on the effective session model The submit gate called ensureReady() with no override, so it only ever validated config.default_model: a session with a bound model (or a prompt carrying one) was rejected with 40113 whenever default_model was missing or dangling. Pass the effective model (request model, then the agent profile's bound model, falling back to default_model inside ensureReady) on both the prompt submit and btw routes. * fix(agent-core-v2): honor defaultProvider in model readiness resolution resolveModelForReady stopped at the flat baseUrl fallback, so a model that omits provider/providerId and relies on the configured defaultProvider resolved at runtime (ModelCatalog.resolveProviderContext falls back to it) while /api/v1/auth reported models_ready:false and the send gate rejected the prompt. Mirror the runtime order (providerId -> provider -> defaultProvider -> flat baseUrl) and pass the configured default provider from both readiness callers. * fix(kap-server): redact inline model credentials from config responses toConfigResponse only redacted the providers section, so a model's inline apiKey/oauth rode GET /config verbatim and, via the new event.config.changed publisher, every WS connection plus the persistent event journal. Project the models section the same way: strip credential fields and report has_api_key. * fix(agent-core-v2): honor defaultProvider in ensureReady credential checks The readiness phase learned the defaultProvider fallback, but the credential phase right after still derived the provider only from the model's explicit fields: a model omitting provider/providerId passed readiness yet missed the default provider's apiKey/OAuth material and prompts failed with auth.token_missing. Mirror the same provider chain (providerId -> provider -> defaultProvider) when resolving credentials. * fix(kap-server): validate the model a profile bind will select at the prompt gate The gate validated the session's current model even for a prompt that switches profile without a model — but bind falls back to defaultModel in that case, so a stale session model drew a misleading 40113 before bind could run. Gate on bind's selection order instead: the request's explicit model, then the default on a profile switch, then the session's bound model. * fix(kap-server): redact inline service credentials from config responses The earlier redaction covered providers and models, but toConfigResponse still passed the services section through verbatim: inline or env-injected apiKey, oauth references, and credential-bearing customHeaders rode GET /config and, via the event.config.changed publisher, every WS connection plus the persistent event journal. Project services the same way: strip apiKey/oauth into has_api_key and report only the header names as custom_header_keys (the MCP envKeys/headerKeys convention). * fix(kap-server): keep unlisted config domains through event validation The config.changed broadcaster returned the zod-parsed config, which strips domains absent from configResponseSchema (mcp, identity, model_catalog, image, tools, token_counting): changedFields named them while the advertised full snapshot no longer matched GET /api/v1/config. Make the response projection passthrough (defineRoute validates only requests, so REST responses are unaffected). * fix(agent-core-v2): use the exact configured key for model readiness lookups resolveModelForReady trimmed the model id before the models-table lookup while ModelCatalog and ensureReady use the configured string as an exact record key: a whitespace-padded default_model was reported ready and then crashed the submit gate with an internal error instead of 40113, and a legitimate key containing spaces was reported dangling. Trim only rejects blank values now; the lookup always uses the raw key. * fix(protocol): keep unlisted config domains in the shared event projection The shared configResponseSchema stripped domains it does not enumerate (mcp, identity, model_catalog, image, tools, token_counting, subagent, secondary_model), so event.config.changed parsed through agentEventSchema named them in changedFields while omitting their values. Make the shared projection passthrough like the kap-server-local one. * fix(agent-core-v2): use the exact default_provider key in readiness checks The defaultProvider fallback trimmed the configured value before the providers-table lookup while ProviderService and ModelCatalog use the configured string verbatim: a whitespace-padded default_provider could build successfully yet report not-ready (40113), or report ready for a provider runtime resolution cannot find. Trim only rejects blank values; the lookup uses the raw key. * chore: sync web dist from code-app Rebuild the bundled web UI against this branch's /auth contract (models_ready, no ready/default_model): the previous bundle still read the old fields and stayed in the not-ready flow against this server. code-app: 000d2594ff3e95b553be326126bab3f939b62944 * Revert "chore: sync web dist from code-app" This reverts commit 9400a24a03863b3e8b780dda251540f824f02f3a. * fix(oauth): rebase the default selection after the refresh fetch A provider refresh snapshots the config before the remote catalog fetch; when the user selects a default model while the fetch is in flight, the stale snapshot's empty default made an otherwise unchanged catalog enter the write path and the self-heal persisted the generated default over the user's newer selection. Each branch now re-reads and rebases the default/thinking selection after its fetch, before cloning, comparing, or writing. * style(kap-server): pass optional custom_header_keys without conditional spread	2026-08-28 15:53:56 +08:00
liruifengv	692bb0a409	feat(kap-server): add task detach action to move foreground tasks to background (#3273) ... * feat(kap-server): add task detach action to move foreground tasks to background * test(kimi-code-sdk): normalize v2-only parentToolCallId in task parity projections * fix(agent-core-v2): distinguish user-initiated detach in tool result text * feat(agent-core-v2): mention user-initiated backgrounding in the bash tool description * feat(agent-core-v2): use a client-agnostic background-task panel hint in the bash tool description * ci: retrigger checks * feat(agent-core-v2): client-agnostic human_shell_hint and a detached_by_user marker in tool results * fix(protocol,docs): declare parent_tool_call_id in the shared task schema and document the detach action * style: remove added comments	2026-08-27 15:38:21 +08:00
wenhua020201-arch	db792c34ce	docs: rework web guide, interaction and getting-started pages (#3260) ... * docs: rework web guide, interaction and getting-started pages (zh/en) * docs: rename guides/server to guides/web to match the reworked page * docs: neutralize screenshot workspace names and sync en web guide to zh * docs: trim web UI screenshot to a single neutral workspace	2026-08-26 17:00:57 +08:00
Haozhe	dceb3fd634	docs: sync recent CLI releases into guides and reference pages (#3195)	2026-08-24 15:59:50 +08:00
Haozhe	cd2d91020a	docs: document detailed parameters for all server API endpoints (#3155) ... * docs: document detailed parameters for all server API endpoints * docs: correct model alias id and skill attachment shapes in server api reference	2026-08-21 15:05:38 +08:00
Haozhe	15da84606a	feat(kap-server): add workspace-grouped sessions view and lifecycle events (#3114) ... GET /api/v2/sessions gains view=by_workspace: one request returns every workspace with a matching session, each carrying its first group.page_size sessions under the requested sort plus the workspace's full matching total, with group-level page_token pagination (40922 on condition drift). Groups key on the alias-canonical workspace id, so legacy split buckets of one physical directory merge into a single group, matching the v1 alias semantics. meta.has_prompt filters sessions by prompt presence (the v1 exclude_empty equivalent) in both views. The flat view and v1 routes stay byte-compatible. The global WS stream now fans out event.session.archived (live and cold paths; payload carries the session id and workspace_id) and event.workspace.created/updated/deleted, published by the core IWorkspaceService on every mutation path including the implicit createOrTouch on session creation. kimi-inspect consumes the grouped projection as a single-column workspace/session tree in the chat view; the session pane merges into the right dock as the Session tab. The server API reference (en + zh) documents the new parameters, the grouped response, and the new events.	2026-08-20 13:45:38 +08:00
liruifengv	eaa3969dd3	feat(kap-server): add page mode, updated_before, and batch archive/restore to v2 sessions (#2983) ... * feat(kap-server): add page-number mode and total to GET /api/v2/sessions The v2 session list gains a stateless 1-based `page` parameter beside the opaque page_token cursor for admin-style lists that jump arbitrarily: each request stays a full independent snapshot, no token is minted, and `page` + `page_token` together fail 40001. Every response now carries `total` (the filtered/sorted set size) in both pagination modes. * feat(kap-server): add meta.updated_before filter to GET /api/v2/sessions Symmetric with meta.updated_after (inclusive boundary, Unix ms), applied at the edge over the drained set and bound into the page_token query fingerprint like every other condition. * feat(kap-server): add POST /api/v2/sessions:archive and :restore batch endpoints Batch archive/restore for session-management views: { ids } (non-empty, ≤5000 unique after dedup) answers per-item results in input order with succeeded/failed counts — only a body validation failure fails the whole request, and an unknown id folds into its own item as 40401. The live/cold split keeps the batch cheap: a session with a live handle goes through the full ISessionLifecycleService chain (agents drain, scope teardown, mirror drain), while a cold session is never materialized — the new setColdSessionArchived helper in agent-core-v2 patches the persisted state.json (archived/archivedAt, updatedAt preserved, mirroring setArchived's touchUpdatedAt: false semantics), mirrors the flipped summary into the read-model queue, and republishes the same event.session.archived bus event the live lifecycle emits (:restore publishes nothing, matching the live restore). Hot items run with bounded concurrency and the batch ends with one shared ISessionIndexMirror.drain(). * docs(server-api): document v2 sessions page mode, total, updated_before, and batch archive/restore * fix(kap-server): deep-import workspace lifecycle symbols in the v2 sessions route CI's tsgo/rolldown (Linux) fail to bind liveHandlerForSession and IWorkspaceLifecycleService through the agent-core-v2 package-root barrel even though it re-exports them; the same files use the established deep-import pattern already used for the git domain. * fix(kap-server): inline the live-handler lookup in the batch route The previous deep imports still fail to resolve on CI's Linux toolchain (tsgo TS2307, rolldown MISSING_EXPORT) while every other module path from the same package binds fine. Keep the route self-contained: the hot-path lookup is a five-line loop over IWorkspaceLifecycleService's handlers (mirrors agent-core-v2's liveHandlerForSession), and the tests assert non-materialization behaviorally via the live map instead of importing the same two symbols for spies. * fix(kap-server): drive the batch hot path through getLiveSessionById The phantom only hits the workspaceLifecycle-group symbols in these two files on CI's Linux toolchain; getLiveSessionById is observed to bind fine there. It returns the session's live scope directly (no resume), which is exactly what the batch hot path needs. * refactor(kap-server): move the batch live/cold split into agent-core-v2 setSessionArchivedBatch owns the split next to the cold patch: live sessions go through the full lifecycle chain via the workspace handler accessor (the v1-proven resolution path), cold sessions through the direct write. The route becomes a thin wire-code adapter, and the batch tests assert the live chain behaviorally (disposal, events, index) instead of spying through scope accessors. * fix(agent-core-v2): import sessionLookup relatively from coldSessionArchive The '#/app/workspaceLifecycle/*' specifier resolves from src/ and src/app/* files on CI's Linux toolchain but not from src/workspace/sessionLifecycle/ (tsgo TS2307, rolldown follows); a relative import bypasses the package-imports mapping. * fix(agent-core-v2): migrate the batch hot path to ISessionManager Main's workspace/session DI refactor removed the workspaceLifecycle lookup modules; the live branch now goes through the App-level ISessionManager (the same entry the v1 action route uses post-refactor) with getLiveSessionById from the new sessionManager lookup. * feat(kap-server): add the id,archived item projection to GET /api/v2/sessions fields=id,archived trims each item to { id, archived } for select-all-matching flows (the session admin page's Gmail-style select-all). Only that projection gets the relaxed page_size ceiling (10000); unknown fields, non-pair subsets, and include=git combinations are 40001, and the projection binds into the page_token fingerprint so shapes never flip mid-pagination. * fix(agent-core-v2): serialize the batch cold write against in-flight resumes Codex review on #2983: while a resume is in flight the live registry hides the handle, so the batch route could classify the session as cold and its direct write would race the materializing metadata service (its stale in-memory document wins the next write, silently un-archiving the session after the endpoint reported success). The batch now settles the resume first: SessionManager registers the whole resume promise synchronously at the App level (controllerForSession is async, so the controller's own resuming map learns about it a few microtasks late) and whenResumeSettled awaits it before classification — a settled resume lands the item on the live chain, a failed one falls back to the cold path. Also folds the module header down to the package's external-role comment convention. * fix(agent-core-v2): publish SessionArchived as an Event2 class in cold archive * fix(agent-core-v2): serialize batch archive/restore with session lifecycle transitions * fix(agent-core-v2): serialize session delete with the lifecycle chain * fix(agent-core-v2): mirror the persisted metadata on cold archive, not the index summary * docs(agent-core-v2): bring sessionManager comments and new tests to package conventions * fix(agent-core-v2): normalize legacy session metadata before the cold archive write * fix(kap-server): serialize the v1 single-session archive with the lifecycle chain * chore: drop changesets for internal-only protocol work * fix(agent-core-v2): encode cold-archived metadata for v1 readers * fix(agent-core-v2): serialize fork and createChild with the source session's chain * refactor(agent-core-v2): chain every session lifecycle method and hand batch sections unguarded ops * fix(agent-core-v2): propagate failed resumes to the next settle * fix(agent-core-v2): roll back the unannounced handle when a resume fails mid-materialization * fix(agent-core-v2): read and migrate the legacy session-meta location on cold archive * fix(agent-core-v2): serialize explicit-id session creation with the lifecycle chain create() with a caller-supplied sessionId bypassed the per-session chain, so a concurrent batch archive could classify the half-created session as cold and write archived state that the live metadata service later overwrites. Creation now queues on the target id's chain whenever an explicit id is present. Also type the resume-failure maps as Error and normalize at the catch site, satisfying only-throw-error. * style(kap-server): strip comments from the session routes per the no-comments convention * fix(agent-core-v2): serialize explicit fork and child target ids on the lifecycle chain fork() and createChild() with a newSessionId locked only the source id, so a batch archive of the target could slip into the creation window: the index already knows the half-created session, the batch writes archived state to its document, and the fork's in-memory metadata later overwrites it. Both operations now acquire the deduped, sorted key set so multi-key sections always take locks in one deterministic order.	2026-08-18 13:57:37 +08:00
Haozhe	dc8db90cdd	docs(server): add local server guide and API reference (#2839) ... * docs(server): add local server guide and API reference * docs(server): qualify binary endpoint HTTP semantics	2026-08-12 12:29:09 +08:00