赵月辉 / fastgpt-migrated

* feat: gate app api keys by auth option

* openapi doc

* appopenapi

* doc

* doc

* apikey

* ui

* i18n

* doc

* max openapi

---------

Co-authored-by: archer <545436317@qq.com>

* feat(chat): improve like feedback animation

* feat(chat): refine agent plan choice selection

* fix(chat): correct like feedback click typing

* fix(chat): narrow like feedback icon props

* fix(chat): keep choice toggle below options

* fix(chat): tighten choice toggle height

* fix(chat): render choice toggle as compact text button

* fix(chat): remove choice toggle wrapper spacing

* fix(chat): prevent choice highlight clipping

* fix(chat): add choice toggle hover background

* fix(chat): smooth choice collapse layout

* fix(chat): restore choice highlight shadow

* fix(chat): adjust choice width and toggle spacing

* fix(chat): avoid duplicate choice toggle spacing

* fix(chat): apply action hover lift consistently

* feat(markdown): add quick replies feature and related styling

- Introduced a new QuickReplies component to render quick reply options in the Markdown renderer.
- Updated Markdown component to support quick replies with new props for enabling the feature and handling click events.
- Enhanced styling for code blocks containing quick replies to ensure proper display.
- Added utility functions to parse and validate quick replies content.
- Integrated quick replies context in ChatBox to manage state and interactions.

This update enhances user interaction by allowing quick replies directly within the chat interface.

* refactor(markdown): streamline quick replies integration and context management

* perf: quick reply

* add user select

---------

Co-authored-by: archer <545436317@qq.com>

* adapt old version config

* fix: log

* fix: ts

* fix: align openapi output option types

* doc

* perf: http repalce

* doc

* doc

* fix(mcp): only fall back to legacy SSE transport on a 4xx Streamable HTTP error

The MCP client caught any Streamable HTTP connection error and immediately
retried with the legacy HTTP+SSE transport. For a Streamable-HTTP-only server,
a failure unrelated to protocol support (network error, 5xx, or an error after
a successful initialize) was masked by a misleading SSE error such as
"Non-200 status code (405)", hiding the real root cause.

Follow the MCP spec's backwards-compatibility flow: fall back to SSE only when
the server rejects the Streamable HTTP request with a 4xx (e.g. 404/405),
which signals it does not speak Streamable HTTP. Other errors now surface
as-is, and when the SSE fallback also fails both errors are reported.

* test(mcp): cover conditional SSE fallback behavior

Update the fallback test to use a 4xx StreamableHTTPError and add cases for:
non-HTTP errors and 5xx not triggering fallback, and both errors being
surfaced when the SSE fallback also fails.

* perf: code

* perf: code

---------

Co-authored-by: archer <545436317@qq.com>

* fix: preserve system tool child icons

* fix: scope child tool icon detail lookup

collaborators

Add `isPrivateResourceByCollaborators` utility to correctly handle
collaborator deduplication for inherited permissions and update related
modules to use the new helper.

- Disable tooltip rendering for tool lists until user interaction
- Blur active elements when navigating between folders to prevent focus
  issues

* fix: enhance Playground visibility configuration with new grid layout and switch components

* refactor: update layout and styling for various components to improve responsiveness and usability

* perf: ui

* perf: tool response none

* doc

* doc

* hide auth switch in community version

---------

Co-authored-by: archer <545436317@qq.com>

* fix(agent): pass uploaded file urls to tools

* perf: inject prompt

* test: update agent file reminder assertions

* test: update read files output assertions

---------

Co-authored-by: archer <545436317@qq.com>

* perf: invalid quote filter

* doc

* perf: user edit

* fxi: template

* fix: tempalte init

* refactor(core): optimize system tool input/output schema management

- Use `JSONSchema` instead of `InputConfig` for system tool I/O
  definitions
- Centralize JSON Schema to Node I/O conversion utilities
- Cleanup redundant type definitions and schema properties across
  packages

* refactor(global): improve workflow JSON schema mapping and tool catalog

- Update `getJsonSchemaPropertyFromValueType` to handle complex types
  like `arrayObject` and `chatHistory` properly instead of falling back
  to default types.
- Refactor `getEnumValuesFromNodeInput` to correctly collect enum values
  from different input configurations.
- Update `useToolCatalog` to use `nodeInputs2JsonSchema` for consistent
  schema generation across tools and nodes.
- Add comprehensive test cases to verify JSON schema conversion for
  various value types and enum sources.

* fix: strip admin plugin IO schemas

Admin plugin detail does not consume input/output schemas, so omit them from the admin response type to tolerate plugins that return null schemas.\n\nAdd regression coverage for parent and child tool details with null schemas.

* feat(openapi): allow app-level API Key display and restrict scope

- Expose raw API Key in app-level listing to support key replication
- Restrict app-level API Key usage to chat completion endpoints only
- Add COPY_API_KEY audit event for tracking key access
- Implement API Key request path validation for security enforcement

* feat(openapi): support API key auth proxy for team members

- Add `authProxy` configuration to team-level API keys.
- Implement `ChatCompletionAuthProxy` schema for optional identity
  delegation in chat completion requests.
- Add `resolveChatCompletionEffectiveTmbId` to handle proxy logic,
  ensuring members exist within the key's team.
- Update `authChatCompletionHeaderRequest` to integrate identity
  proxying while maintaining strict security boundaries for chat access.
- Add internationalization support for the new feature in settings.

* feat(openapi): distinguish global and app API keys

- Update documentation to clarify the distinction between Global and App
  API keys.
- Enforce `authProxy` permissions: only allow team owners to enable
  `authProxy` on Global API Keys.
- Restrict `authProxy` usage to Global API Keys; App API Keys do not
  support this feature.
- Migrate API key management UI to `MyModalV2`.
- Add test coverage for API key update permissions.

* fix(openapi): update new API key tip copy

* fix(openapi): copy API key without modal

* fix(openapi): address API key review comments

* fix(openapi): ensure API key copy audit completes

- Add `status` field to system tool schemas and definitions.
- Implement `isSelectableToolStatus` to restrict tools displayed in the
  creation/selection list to those with 'Normal' status.
- Update `getSystemToolTemplates` API to filter root tools and toolset
  children based on their status.
- Add unit tests to verify tool filtering logic.

* refactor(core): optimize system tool input/output schema management

- Use `JSONSchema` instead of `InputConfig` for system tool I/O
  definitions
- Centralize JSON Schema to Node I/O conversion utilities
- Cleanup redundant type definitions and schema properties across
  packages

* refactor(app): optimize SecretInputModal UI and logic

- Migrate to updated MyModal component and refactor layout
- Update input styling and placeholder logic
- Add missing input controller for 'input' type fields

* refactor(global): improve workflow JSON schema mapping and tool catalog

- Update `getJsonSchemaPropertyFromValueType` to handle complex types
  like `arrayObject` and `chatHistory` properly instead of falling back
  to default types.
- Refactor `getEnumValuesFromNodeInput` to correctly collect enum values
  from different input configurations.
- Update `useToolCatalog` to use `nodeInputs2JsonSchema` for consistent
  schema generation across tools and nodes.
- Add comprehensive test cases to verify JSON schema conversion for
  various value types and enum sources.

* perf: get tool client code

* chore: avoid schema loading for tool display metadata

* perf: tool throw error

---------

Co-authored-by: archer <545436317@qq.com>

* feat: add httpFullError output handling and localization support

* refactor: remove ensureHttp468Outputs, rely on template output merge

* perf: http code

* doc

* fix: test

---------

Co-authored-by: archer <545436317@qq.com>

* fix: interactive

* fix: test

* Update repository.ts

* refactor(fastgpt): update default fastgpt-ide-agent image to ghcr.io

* fix: action

* perf: modal

* fix: openapi

Refactor tool selector and modal layout to improve responsiveness and
consistency. Update grid structures, adjust padding and sizing, and
streamline component interaction flows.

* perf: chat title generation

* fix: ts

* test: align sandbox proxy secret validation error

* perf: zero point

问题 (#7006):

通过 API Key 调用知识库更新接口（api/core/dataset/update）返回 403
unAuthorization。API Key 可正常使用 list/create/delete，唯独 update 报错。

根因:

update.ts 中 authDataset/authUserPer 调用缺少 authApiKey: true。
parseHeaderCert() 默认 authApiKey=false，API Key 鉴权分支不会被执行，
请求走到末尾被拒绝。

对比其他端点:
- create.ts — authDataset({ authApiKey: true, ... }) ✓
- collection/create.ts — authDataset({ authApiKey: true, ... }) ✓
- collection/list.ts — authDataset({ authApiKey: true, ... }) ✓
- update.ts — authDataset 和 authUserPer 均缺少 authApiKey ✗

改动:

update.ts 四处调用各添加 authApiKey: true:
1. authDataset 主入口 Read 权限检查 (L88)
2. authDataset 移动目标文件夹 Manage 权限检查 (L109)
3. authDataset 移动源文件夹 Manage 权限检查 (L122)
4. authUserPer 移动至/从根目录的团队创建权限检查 (L132)

测试:

新增 projects/app/test/api/core/dataset/update.test.ts:
- token 认证更新数据集
- API Key 认证更新数据集

Fixes #7006

Signed-off-by: DadaVinqi <DadaVinqi@users.noreply.github.com>
Co-authored-by: DadaVinqi <DadaVinqi@users.noreply.github.com>

feat(sandbox): migrate to standalone Rust proxy and implement stateless WSS gateway with dynamic file sync (#7034)

* feat(sandbox): implement stateless WSS gateway, Rust agent-proxy service, and interactive terminal

- Implement stateless WSS gateway for agent-sandbox connection.
- Migrate WSS proxy to a standalone Rust service.
- Integrate interactive PTY terminal and clean up obsolete APIs.
- Add unit & integration tests for Rust proxy & agent with CI workflow.
- Unify proxy secrets under AGENT_SANDBOX_PROXY_SECRET.
- Implement fine-grained session ticket permissions & enhance proxy log security.

* refactor(sandbox): upgrade agent & proxy to Rust 2024, optimize file operations, and support connection limiting

- Implement dynamic file change sync with debounce and robust connection limiting.
- Upgrade Rust dependencies, split ide agent modules and enhance file access security.
- Optimize Docker build targets, configure default Sealos image, and implement native file operations.
- Support dynamic gateway hostnames, add proxy ping keepalive, and refine terminal resize checks.
- Upgrade to Rust 2024, secure workspace operations, and refine adapter helpers.

* feat(skill): redesign skill detail page with split layout and refine sandbox editor styling

* refactor(sandbox): optimize edit-debug hot-reload and skip S3 pull on cold-start

- Refine edit-debug sandbox hot-reload and auto resume logic.
- Skip S3 pull on cold-start when volume exists and fix OpenSandbox getInfo.

* feat(sandbox): implement cold archive and restore, unify file limits, and relax proxy secret

* style(skill): adjust chatbox and input layout padding for skill detail page

* feat(sandbox): add archive migration API and restore   support for empty or archived workspaces

refactor(sandbox): enhance workspace archiving/restore, zip safety, and websocket stability

* feat(sandbox): migrate archived records across providers, adjust probe timeout and command limits

* feat(skill): add preview empty state, disable sending before sandbox ready, and unify error handling

* refactor(skill): simplify export, fix import encoding, and use default LLM

* feat(sandbox): ensure zip availability and track archiving failures

* feat(sandbox): refactor workspace fs watcher with debouncer, improve terminal styling, and add archive progress tracking

- rust ide agent: Integrate notify-debouncer-full to debounce workspace file system events and broadcast batches with sequential numbers to handle lagged events.
- frontend/sandbox: Remove client-side debounce in favor of backend debouncing, refine workspace file tree refreshing, and adjust terminal background and horizontal padding.
- archive: Introduce onProgress callback for resource archiving and utilize it in initSandboxArchive API to log real-time progress and errors.

* docs(skill): comprehensive user guides for agent skills

* refactor(sandbox): improve TS safety, simplify markdown frontmatter, and support sandboxToolMap info

* fix: update pro modal titles in multiple languages for consistency

* feat: add commercial dataset type handling and pro modal integration

* perf: pro modal ui

---------

Co-authored-by: archer <545436317@qq.com>