Rebuild from fork - #2504
Conversation
Stage 2 of rebuild-from-fork: port zero-risk new files from fork. - Add 20 custom skills (brainstorming, chinese-code-review, mcp-builder, etc.) - Add .agents/rules.md - Add vendors.contrib.ts (DeepSeek/Qwen/Zhipu/Baichuan/MiniMax/Ollama providers) - Add CHANGELOG.md from fork Verified: agent-core-v2 typecheck passes.
Phase 3 of rebuild: migrate low-risk modules from fork. - .gitignore: add bak-corrupt and omo run-continuation exclusions - packages/klient/Dockerfile: removed (fork deletion) - packages/klient/scripts/run-docker-e2e.sh: mode 100755 to 100644 - packages/pi-tui/native darwin-modifiers.node (arm64/x64): mode 100755 to 100644 - packages/pi-tui/test/key-tester.ts: mode 100755 to 100644 - plugins/official/kimi-datasource/bin/kimi-datasource.mjs: mode 100755 to 100644
Phase 4 of rebuild: migrate agent-core env-param and recorder modules. Replace 'provider instanceof KimiChatProvider/AnthropicChatProvider' with runtime 'provider.name' guards plus narrowed KimiProviderApi/AnthropicProviderApi interfaces accessed via kimiApi()/anthropicApi() helpers. Drops the imports of the concrete provider classes so custom fork providers are not forced to subclass them. Mirrors fork customizations in llm-request-recorder.ts and kimi-env-params.ts.
Phase 5 of rebuild: migrate kimi-web fork customizations. - App.vue: remove auth gate, LoginDialog, and OAuth callbacks; add provider management props/events to Sidebar, SettingsDialog, and ProviderManager - ProviderManager.vue: add edit mode, provider type presets, i18n labels; remove OAuth login buttons - useModelProviderState.ts: add updateProvider; stub OAuth functions to no-op - providerPresets.ts (new): shared PROVIDER_TYPES with 9 vendor presets - i18n (en/zh): add provider types, MCP, skills, and common button labels - ConversationPane.vue: add git-refresh event forwarding - Supporting typecheck fixes: api/types.ts, client.ts, usePageTitle.ts, useKimiWebClient.ts, SettingsDialog.vue
Phase 6: Port dev script flags from fork. dev:server adds --dangerous-bypass-auth --log-level info; dev:kap-server and dev:kap-server:multi add --dangerous-bypass-auth. Both flags are native to official main (cli/sub/web/run.ts). SKIPPED from fork patch (broken/inconsistent in fork): kimi-tui.ts enterStartupWizardState references method never implemented in auth-flow.ts; native/ directory deletion (34 files) would break imports in main.ts, clipboard-native.ts, web/run.ts.
Phase 7: Port oauth changes from fork for generic provider model discovery. identity.ts: createKimiDefaultHeaders adds includeDeviceHeaders param (default true) to suppress X-Msh-* headers on non-Kimi providers. Merged with official MoonshotAI#2382 platform field. open-platform.ts: OpenPlatformDefinition adds providerType field; GENERIC_MODEL_FALLBACKS (30+ CN models); toGenericModelInfo(); fetchGenericOpenAIModels() via /v1/models; applyOpenPlatformConfig uses providerType ?? 'kimi'. refreshProviderModels.ts: section 2.6 Generic OpenAI-compatible providers refresh branch for type 'openai'/'openai_responses'. index.ts: export fetchGenericOpenAIModels. Typecheck: @moonshot-ai/kimi-code-oauth PASS.
…eset, disableAuth default rest-modelCatalog: add 7 OpenAI-compatible vendor wire types (deepseek/qwen/zhipu/baichuan/minimax/ollama/custom) registered via vendors.contrib.ts in agent-core-v2. modelCatalog: deleteProvider now resets a global default_model pointing at one of the deleted provider's models (the alias no longer exists, a later /auth readiness check would fail to resolve it). start: disableAuth now defaults to true (unauthenticated access — the web UI connects without a token). Pass false to enforce the bearer token. dangerousBypassAuth is always true on the registered routes. The non-loopback warn is gated on exposureClass. Phase 8 part 1: no-dependency kap-server files. sessions.ts (exec/git actions) and fs.ts (write action) deferred to phase 9.5 (depend on agent-core-v2 IGitService + fsWriteRequestSchema).
…, vendors.contrib wiring git/gitService: IGitService adds listBranches(cwd) (git branch --format) and checkout(cwd, branch); GitService implements both via runCommand + gitUnavailable error. Inserted after findWorkTree (official main added findWorkTree after the fork's base, so the fork's hunk context was stale). index.ts: import vendors.contrib (the file existed from d91c401 but was never wired into the side-effect block, so the vendor definitions were not registered). Export IGitService from app/git/git so kap-server sessions route can consume it. workspaceFs/fs.ts: add fsWriteRequestSchema ({path, content}) and fsWriteResponseSchema ({path, size}); add write() to IWorkspaceFsService. Ported from the fork's session/sessionFs/fs.ts, adapted to the current workspace/workspaceFs location (official MoonshotAI#2366 Workspace domain refactor moved sessionFs to workspaceFs). workspaceFs/fsService.ts: implement write() via hostFs.writeText with errnoCode-based error mapping (EACCES/EPERM -> FS_PERMISSION_DENIED, EISDIR -> FS_IS_DIRECTORY, ENOENT/ENOTDIR -> FS_PATH_NOT_FOUND), matching the mkdir() pattern in the same file. The fork's sessionFs used Error2 OS_FS_* code checks; workspaceFs uses raw errno strings, so the catch was adapted. test: update 4 IGitService mocks in fsService.test.ts with listBranches/checkout stubs. typecheck @moonshot-ai/agent-core-v2 PASS
…ckout actions
fs.ts: add 'write' action (POST /sessions/{id}/fs:write) backed by IWorkspaceFsService.write via fsWriteRequestSchema. FS_PERMISSION_DENIED added to the route error map (write throws it on EACCES/EPERM). handleWrite follows handleMkdir's resolveFs(core, sessionId) pattern.
sessions.ts: add 3 session actions. exec (POST /sessions/{id}:exec) runs a shell command in the session cwd via node:child_process — non-zero exit and timeout are successful results (code null when killed). git-branches (POST /sessions/{id}:git-branches) lists local branches via IGitService.listBranches. git-checkout (POST /sessions/{id}:git-checkout) switches branch via IGitService.checkout. All three use ISessionLifecycleService.resume + ISessionContext.cwd.
Adaptation: the fork used ErrorCodes.INTERNAL_ERROR (not in agent-core-v2's ErrorCodes); switched to ErrorCodes.INTERNAL (CoreErrors 'internal'). IGitService was added to agent-core-v2 in the prior commit (phase 9).
typecheck @moonshot-ai/kap-server PASS
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c28807232a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| app.addHook('onRequest', hostCheck.onRequest); | ||
| app.addHook('onRequest', createOriginHook({ allowedOrigins })); | ||
| if (opts.disableAuth !== true) { | ||
| if (opts.disableAuth === false) { |
There was a problem hiding this comment.
When startServer() is called without disableAuth (the normal production/test default for direct embedders), this condition now skips createAuthHook, so protected REST routes and WS upgrades are accepted without any token; the existing disableAuth option and --dangerous-bypass-auth flow are opt-out semantics, and callers that omit the option will not realize they opened every route. The same block also registers /meta with dangerousBypassAuth: true unconditionally, so even disableAuth: false is reported incorrectly.
Useful? React with 👍 / 👎.
| const result = await execCommandAsync(body.command, { | ||
| cwd, | ||
| timeout: body.timeoutMs, | ||
| }); |
There was a problem hiding this comment.
When kap-server is bound to a LAN/public host without allowRemoteTerminals, terminal routes are deliberately not mounted (enableTerminals is false), but this new exec session action is mounted unconditionally with the rest of /sessions and runs execChildProcess for any REST client that can reach a session. That bypasses the remote-terminal exposure guard and gives arbitrary shell execution even in configurations where terminal access was supposed to be disabled.
Useful? React with 👍 / 👎.
| if (input.apiKey !== undefined) body['api_key'] = input.apiKey; | ||
| if (input.baseUrl !== undefined) body['base_url'] = input.baseUrl; | ||
| if (input.defaultModel !== undefined) body['default_model'] = input.defaultModel; | ||
| const data = await this.http.patch<WireProvider>(`/providers/${encodeURIComponent(id)}`, body); |
There was a problem hiding this comment.
Clicking the new Edit/Save path always calls PATCH /providers/{id}, but the kap-server model catalog only registers PUT /providers/{provider_id} for provider replacement, with a different response envelope ({ provider }) and required model list. Against the bundled server this edit request returns not-found/method-not-allowed, so users cannot save provider API key/base URL/default model changes from the new UI.
Useful? React with 👍 / 👎.
| @@ -1,27 +0,0 @@ | |||
| # syntax=docker/dockerfile:1.7 | |||
There was a problem hiding this comment.
Removing this Dockerfile breaks the documented pnpm --filter @moonshot-ai/klient docker:e2e workflow: packages/klient/scripts/run-docker-e2e.sh still builds with -f "${PACKAGE_DIR}/Dockerfile", so the command fails before any e2e suite starts. Restore the Dockerfile or update the runner to stop referencing it.
AGENTS.md reference: packages/klient/AGENTS.md:L64-L66
Useful? React with 👍 / 👎.
…ng analysis) 从 fork-customizations.patch 补回 4 个二开文档： - AGENTS.md：恢复 fork 中文版（120 行），替换官方英文版（88 行） - kimi-binding-analysis.md：新增 fork 绑定分析与解绑方案文档（505 行） - packages/agent-core-v2/CHANGELOG.md：三方合并，保留官方 0.3.0 + 插入 fork 0.2.1（sessionFs write、IGitService branches/checkout） - packages/kap-server/CHANGELOG.md：三方合并，保留官方 0.2.0 + 插入 fork 0.1.1（session exec/git-branches/git-checkout、fs write）
1 participant
Related Issue
Resolve #(issue_number)
Problem
What changed
Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.