Commit Graph
100 Commits
Author SHA1 Message Date
Xubin Ren a0684978fb feat(api): add fixed-session OpenAI-compatible endpoint
Expose OpenAI-compatible chat completions and models endpoints through a single persistent API session, keeping the integration simple without adding multi-session isolation yet.
2026-03-29 14:48:52 +00:00
Xubin Ren c8c520cc9a docs: update providers information 2026-03-28 13:28:56 +00:00
Xubin Ren 17d21c8e64 docs: update news section for v0.1.4.post6 release 2026-03-27 15:18:31 +00:00
Xubin Ren aebe928cf0 docs: update v0.1.4.post6 release news 2026-03-27 15:17:22 +00:00
Xubin Ren a42a4e9d83 docs: update v0.1.4.post6 release news 2026-03-27 15:16:28 +00:00
Xubin Ren c15f63a320 chore: bump version to 0.1.4.post6 2026-03-27 14:42:19 +00:00
Xubin Ren 9652e67204 Merge remote-tracking branch 'origin/main' into advisory-email-fix 2026-03-27 14:28:40 +00:00
Xubin RenandXubin Ren f8c580d015 test(telegram): cover network error logging 2026-03-27 22:17:01 +08:00
Xubin RenandXubin Ren e464a81545 fix(feishu): only stream visible cards 2026-03-27 21:59:11 +08:00
Xubin RenandXubin Ren cf25a582ba fix(channel): stop delta coalescing at stream boundaries 2026-03-27 21:43:57 +08:00
Xubin Ren ace3fd6049 feat: add default OpenRouter app attribution headers 2026-03-27 11:40:23 +00:00
Xubin RenandXubin Ren 5bf0f6fe7d refactor: unify agent runner lifecycle hooks 2026-03-27 12:41:17 +08:00
Xubin RenandXubin Ren e7d371ec1e refactor: extract shared agent runner and preserve subagent progress on failure 2026-03-27 02:49:43 +08:00
Xubin Ren 33abe915e7 fix telegram streaming message boundaries 2026-03-26 02:35:12 +00:00
Xubin RenandXubin Ren f0f0bf02d7 refactor(channel): centralize retry around explicit send failures
Make channel delivery failures raise consistently so retry policy lives in ChannelManager rather than being split across individual channels. Tighten Telegram stream finalization, clarify sendMaxRetries semantics, and align the docs with the behavior the system actually guarantees.
2026-03-25 22:37:11 +08:00
Xubin RenandXubin Ren 3f71014b7c fix(agent): use configured timezone when registering cron tool
Read the default timezone from the agent context when wiring the cron tool so startup no longer depends on an out-of-scope local variable. Add a regression test to ensure AgentLoop passes the configured timezone through to cron.

Made-with: Cursor
2026-03-25 22:07:14 +08:00
Xubin RenandXubin Ren fab14696a9 refactor(cron): align displayed times with schedule timezone
Make cron list output render one-shot and run-state timestamps in the same timezone context used to interpret schedules. This keeps scheduling logic and user-facing time displays consistent.

Made-with: Cursor
2026-03-25 22:07:14 +08:00
Xubin RenandXubin Ren 4a7d7b8823 feat(cron): inherit agent timezone for default schedules
Make cron use the configured agent timezone when a cron expression omits tz or a one-shot ISO time has no offset. This keeps runtime context, heartbeat, and scheduling aligned around the same notion of time.

Made-with: Cursor
2026-03-25 22:07:14 +08:00
Xubin RenandXubin Ren 13d6c0ae52 feat(config): add configurable timezone for runtime context
Add agent-level timezone configuration with a UTC default, propagate it into runtime context and heartbeat prompts, and document valid IANA timezone usage in the README.
2026-03-25 22:07:14 +08:00
Xubin RenandXubin Ren b5302b6f3d refactor(provider): preserve extra_content verbatim for Gemini thought_signature round-trip
Replace the flatten/unflatten approach (merging extra_content.google.*
into provider_specific_fields then reconstructing) with direct pass-through:
parse extra_content as-is, store on ToolCallRequest.extra_content, serialize
back untouched.  This is lossless, requires no hardcoded field names, and
covers all three parsing branches (str, dict, SDK object) plus streaming.
2026-03-25 10:00:29 +08:00
Xubin Ren 263069583d fix(provider): accept plain text OpenAI-compatible responses
Handle string and dict-shaped responses from OpenAI-compatible backends so non-standard providers no longer crash on missing choices fields. Add regression tests to keep SDK, dict, and plain-text parsing paths aligned.
2026-03-25 01:22:21 +00:00
Xubin Ren 7b31af2204 docs: update news section 2026-03-24 18:11:50 +00:00
Xubin Ren c3031c9cb8 docs: update news section about litellm 2026-03-24 18:11:03 +00:00
Xubin RenandXubin Ren 3dfdab704e refactor: replace litellm with native openai + anthropic SDKs
- Remove litellm dependency entirely (supply chain risk mitigation)
- Add AnthropicProvider (native SDK) and OpenAICompatProvider (unified)
- Merge CustomProvider into OpenAICompatProvider, delete custom_provider.py
- Add ProviderSpec.backend field for declarative provider routing
- Remove _resolve_model, find_gateway, find_by_model (dead heuristics)
- Pass resolved spec directly into provider — zero internal lookups
- Stub out litellm-dependent model database (cli/models.py)
- Add anthropic>=0.45.0 to dependencies, remove litellm
- 593 tests passed, net -1034 lines
2026-03-25 01:58:48 +08:00
Xubin Ren 38ce054b31 fix(security): pin litellm and add supply chain advisory note 2026-03-24 15:55:43 +00:00
Xubin RenandXubin Ren d25985be0b fix(filesystem): clarify optional tool argument handling
Keep the mypy-friendly optional execute signatures while returning clearer errors for missing arguments and locking that behavior with regression tests.

Made-with: Cursor
2026-03-24 11:49:10 +08:00
Xubin Ren a96dd8babb Merge branch 'main' into feat/channel_enhancement
Keep the channel enhancements aligned with the current codebase while preserving a simpler product surface. This keeps QQ, Feishu, Telegram, and WhatsApp improvements together, removes the extra Telegram-only tool hint toggle, and makes WhatsApp mention-only groups actually work.
2026-03-24 03:33:44 +00:00
Xubin Ren 14763a6ad1 fix(provider): accept canonical and alias provider names consistently 2026-03-24 03:03:59 +00:00
Xubin Ren d454386f32 docs(weixin): clarify source-only installation in README 2026-03-24 02:51:50 +00:00
Xubin Ren 186357e80c Merge branch 'main' into fix/workspace-scoped-cron-store
Keep cron state workspace-scoped while only migrating legacy jobs into the default workspace. This preserves seamless upgrades for existing installs without polluting intentionally new workspaces.
2026-03-24 02:41:58 +00:00
Xubin Ren 1d58c9b9e1 docs: update channel table and add plugin dev note 2026-03-23 17:17:10 +00:00
Xubin RenandXubin Ren 25288f9951 feat(whatsapp): add outbound media support via bridge 2026-03-24 01:11:33 +08:00
Xubin RenandXubin Ren bef88a5ea1 docs: require explicit channel login command 2026-03-24 01:11:33 +08:00
Xubin RenandXubin Ren d164548d9a docs(weixin): add setup guide and focused channel tests 2026-03-24 01:11:33 +08:00
Xubin RenandXubin Ren 0ca639bf22 fix(cli): use discovered class for channel login 2026-03-24 01:11:33 +08:00
Xubin RenandXubin Ren 2056061765 refine heartbeat session retention boundaries 2026-03-24 00:33:43 +08:00
Xubin RenandXubin Ren 20494a2c52 refactor command routing for future plugins and clearer CLI structure 2026-03-23 16:48:42 +08:00
Xubin Ren 9f19297056 Merge remote-tracking branch 'origin/main' into advisory-email-fix
Made-with: Cursor

# Conflicts:
#	nanobot/config/schema.py
2026-03-23 05:06:00 +00:00
Xubin RenandXubin Ren aba0b83a77 fix(memory): reserve completion headroom for consolidation
Trigger token consolidation before prompt usage reaches the full context window so response tokens and tokenizer estimation drift still fit safely within the model budget.

Made-with: Cursor
2026-03-23 11:54:44 +08:00
Xubin Ren 8f5c2d1a06 fix(cli): stop spinner after non-streaming interactive replies 2026-03-23 03:28:10 +00:00
Xubin RenandXubin Ren 9d5e511a6e feat(streaming): centralize think-tag filtering and add Telegram streaming
- Add strip_think() to helpers.py as single source of truth
- Filter deltas in agent loop before dispatching to consumers
- Implement send_delta in TelegramChannel with progressive edit_message_text
- Remove duplicate think filtering from CLI stream.py and telegram.py
- Remove legacy fake streaming (send_message_draft) from Telegram
- Default Telegram streaming to true
- Update CHANNEL_PLUGIN_GUIDE.md with streaming documentation

Made-with: Cursor
2026-03-23 10:20:41 +08:00
Xubin RenandXubin Ren f2e1cb3662 feat(cli): extract streaming renderer to stream.py with Rich Live
Move ThinkingSpinner and StreamRenderer into a dedicated module to keep
commands.py focused on orchestration. Uses Rich Live with manual refresh
(auto_refresh=False) and ellipsis overflow for stable streaming output.

Made-with: Cursor
2026-03-23 10:20:41 +08:00
Xubin RenandXubin Ren bd621df57f feat: add streaming channel support with automatic fallback
Provider layer: add chat_stream / chat_stream_with_retry to all providers
(base fallback, litellm, custom, azure, codex). Refactor shared kwargs
building in each provider.

Channel layer: BaseChannel gains send_delta (no-op) and supports_streaming
(checks config + method override). ChannelManager routes _stream_delta /
_stream_end to send_delta, skips _streamed final messages.

AgentLoop._dispatch builds bus-backed on_stream/on_stream_end callbacks
when _wants_stream metadata is set. Non-streaming path unchanged.

CLI: clean up spinner ANSI workarounds, simplify commands.py flow.
Made-with: Cursor
2026-03-23 10:20:41 +08:00
Xubin RenandXubin Ren e79b9f4a83 feat(agent): add streaming groundwork for future TUI
Preserve the provider and agent-loop streaming primitives plus the CLI experiment scaffolding so this work can be resumed later without blocking urgent bug fixes on main.

Made-with: Cursor
2026-03-23 10:20:41 +08:00
Xubin Ren 931cec3908 Merge remote-tracking branch 'origin/main' into pr-1109
Resolve conflict in context.py: keep main's build_messages which already
merges runtime context into user message (achieving the same cache goal).
The real value-add from this PR is the second cache breakpoint in
litellm_provider.py.

Made-with: Cursor
2026-03-22 06:14:18 +00:00
Xubin RenandXubin Ren 1c71489121 fix(agent): count all message fields in token estimation
estimate_prompt_tokens() only counted the `content` text field, completely
missing tool_calls JSON (~72% of actual payload), reasoning_content,
tool_call_id, name, and per-message framing overhead. This caused the
memory consolidator to never trigger for tool-heavy sessions (e.g. cron
jobs), leading to context window overflow errors from the LLM provider.

Also adds reasoning_content counting and proper per-message overhead to
estimate_message_tokens() for consistent boundary detection.

Made-with: Cursor
2026-03-22 12:19:44 +08:00
Xubin RenandXubin Ren 48c71bb61e refactor(agent): unify process_direct to return OutboundMessage
Merge process_direct() and process_direct_outbound() into a single
interface returning OutboundMessage | None. This eliminates the
dual-path detection logic in CLI single-message mode that relied on
inspect.iscoroutinefunction to distinguish between the two APIs.

Extract status rendering into a pure function build_status_content()
in utils/helpers.py, decoupling it from AgentLoop internals.

Made-with: Cursor
2026-03-22 00:39:38 +08:00
Xubin Ren a8176ef2c6 fix(cli): keep direct-call rendering compatible in tests
Only use process_direct_outbound when the agent loop actually exposes it as an async method, and otherwise fall back to the legacy process_direct path. This keeps the new CLI render-metadata flow without breaking existing test doubles or older direct-call implementations.

Made-with: Cursor
2026-03-21 16:07:14 +00:00
Xubin Ren e430b1daf5 fix(agent): refine status output and CLI rendering
Keep status output responsive while estimating current context from session history, dropping low-value queue/subagent counters, and marking command-style replies for plain-text rendering in CLI. Also route direct CLI calls through outbound metadata so help/status formatting stays explicit instead of relying on content heuristics.

Made-with: Cursor
2026-03-21 15:52:10 +00:00
Xubin Ren 4d1897609d fix(agent): make status command responsive and accurate
Handle /status at the run-loop level so it can return immediately while the agent is busy, and reset last-usage stats when providers omit usage data. Also keep Telegram help/menu coverage for /status without changing the existing final-response send path.

Made-with: Cursor
2026-03-21 15:21:32 +00:00
Xubin Ren 570ca47483 Merge branch 'main' into pr-1985 2026-03-21 09:48:09 +00:00
Xubin RenandXubin Ren e87bb0a82d fix(mcp): preserve schema semantics during normalization
Only normalize nullable MCP tool schemas for OpenAI-compatible providers so optional params still work without collapsing unrelated unions. Also teach local validation to honor nullable flags and add regression coverage for nullable and non-nullable schemas.

Made-with: Cursor
2026-03-21 14:35:47 +08:00
Xubin Ren 9f10ce072f Merge PR #2304: feat(agent): implement native multimodal tool perception
Add native image content blocks for read_file and web_fetch, preserve the multimodal tool-result path through the agent loop, and keep session history compact with image placeholders. Also harden web_fetch against redirect-based SSRF bypasses and add regression coverage for image reads and blocked private redirects.
2026-03-21 05:39:17 +00:00
Xubin Ren 445a96ab55 fix(agent): harden multimodal tool result flow
Keep multimodal tool outputs on the native content-block path while
restoring redirect SSRF checks for web_fetch image responses. Also share
image block construction, simplify persisted history sanitization, and
add regression tests for image reads and blocked private redirects.

Made-with: Cursor
2026-03-21 05:34:56 +00:00
Xubin Ren 834f1e3a9f Merge branch 'main' into pr-2304 2026-03-21 04:14:40 +00:00
Xubin RenandXubin Ren 32f4e60145 refactor(providers): hide oauth-only providers from config setup
Exclude openai_codex alongside github_copilot from generated config,
filter OAuth-only providers out of the onboarding wizard, and clarify in
README that OAuth login stores session state outside config. Also unify
the GitHub Copilot login command spelling and add regression tests.

Made-with: Cursor
2026-03-21 03:20:59 +08:00
Xubin RenandXubin Ren 542455109d fix(email): preserve fetched messages across IMAP retry
Keep messages already collected in the current poll cycle when a stale
IMAP connection dies mid-fetch, so retrying once does not drop emails
that were already parsed and marked seen. Add a regression test covering
a mid-cycle disconnect after the first message succeeds.

Made-with: Cursor
2026-03-21 03:00:39 +08:00
Xubin RenandXubin Ren 09ad9a4673 feat(cron): add run history tracking for cron jobs
Record run_at_ms, status, duration_ms and error for each execution,
keeping the last 20 entries per job in jobs.json. Adds CronRunRecord
dataclass, get_job() lookup, and four regression tests covering
success, error, trimming and persistence.

Closes #1837

Made-with: Cursor
2026-03-21 02:28:35 +08:00
Xubin Ren 1c39a4d311 refactor(tools): keep exec enable without configurable deny patterns
Made-with: Cursor
2026-03-20 17:46:08 +00:00
Xubin Ren dc1aeeaf8b docs: document exec tool enable and denyPatterns
Made-with: Cursor
2026-03-20 17:24:40 +00:00
Xubin Ren 3825ed8595 merge origin/main into pr-1824
- wire tools.exec.enable and deny_patterns into the current AgentLoop
- preserve the current WebSearchTool config-based registration path
- treat deny_patterns=[] as an explicit override instead of falling back
  to the default blacklist
- add regression coverage for disabled exec registration and custom deny
  patterns

Made-with: Cursor
2026-03-20 17:21:42 +00:00
Xubin RenandXubin Ren aacbb95313 fix(agent): preserve external cancellation in message loop
Made-with: Cursor
2026-03-20 19:27:26 +08:00
Xubin RenandXubin Ren fc1ea07450 fix(custom_provider): truncate raw error body to prevent huge HTML pages
Made-with: Cursor
2026-03-20 19:12:09 +08:00
Xubin RenandXubin Ren f44c4f9e3c refactor: remove deprecated memory_window, harden wizard display 2026-03-20 18:46:13 +08:00
Xubin RenandXubin Ren c3a4b16e76 refactor: optimize onboard wizard - mask secrets, remove emoji, reduce repetition
- Mask sensitive fields (api_key/token/secret/password) in all display
  surfaces, showing only the last 4 characters
- Replace all emoji with pure ASCII labels for consistent cross-platform
  terminal rendering
- Extract _print_summary_panel helper, eliminating 5x duplicate table
  construction in _show_summary
- Replace 3 one-line wrapper functions with declarative _SETTINGS_SECTIONS
  dispatch tables and _MENU_DISPATCH in run_onboard
- Extract _handle_model_field / _handle_context_window_field into a
  _FIELD_HANDLERS registry, shrinking _configure_pydantic_model
- Return FieldTypeInfo NamedTuple from _get_field_type_info for clarity
- Replace global mutable _PROVIDER_INFO / _CHANNEL_INFO with @lru_cache
- Use vars() instead of dir() in _get_channel_info for reliable config
  class discovery
- Defer litellm import in model_info.py so non-wizard CLI paths stay fast
- Clarify README Quick Start wording (Add -> Configure)
2026-03-20 18:46:13 +08:00
Xubin RenandXubin Ren c138b2375b docs: refine spawn workspace guidance wording
Adjust the spawn tool description to keep the workspace-organizing hint while
avoiding language that sounds like the system automatically assigns a dedicated
working directory for subagents.

Made-with: Cursor
2026-03-20 13:30:21 +08:00
Xubin RenandXubin Ren dd7e3e499f fix: separate Telegram connection pools and add timeout retry to prevent pool exhaustion
The root cause of "Pool timeout" errors is that long-polling (getUpdates)
and outbound API calls (send_message, send_photo, etc.) shared the same
HTTPXRequest pool — polling holds connections indefinitely, starving sends
under concurrent load (e.g. cron jobs + user chat).

- Split into two independent pools: API calls (default 32) and polling (4)
- Expose connection_pool_size / pool_timeout in TelegramConfig for tuning
- Add _call_with_retry() with exponential backoff (3 attempts) on TimedOut
- Apply retry to _send_text and remote media URL sends
2026-03-19 16:15:41 +08:00
Xubin Ren 214bf66a29 docs(readme): clarify nanobot is unrelated to crypto 2026-03-18 15:18:38 +00:00
Xubin RenandXubin Ren 4b052287cb fix(telegram): validate remote media URLs 2026-03-18 23:12:11 +08:00
Xubin RenandXubin Ren 728d4e88a9 fix(providers): lazy-load provider exports 2026-03-18 22:01:29 +08:00
Xubin Ren 4e40f0aa03 docs: MiniMax gifts to the nanobot community 2026-03-18 05:09:03 +00:00
Xubin RenandXubin Ren 5bd1c9ab8f fix(cron): preserve exact intervals in list output 2026-03-18 12:39:06 +08:00
Xubin RenandXubin Ren 8cf11a0291 fix: preserve image paths in fallback and session history 2026-03-17 22:37:09 +08:00
Xubin RenandXubin Ren 7086f57d05 test(feishu): cover media msg_type mapping 2026-03-17 17:05:13 +08:00
Xubin RenandXubin Ren 41d59c3b89 test(feishu): cover heading and table markdown rendering 2026-03-17 16:51:02 +08:00
Xubin RenandXubin Ren 91ca82035a feat(slack): add default done reaction on completion 2026-03-17 16:19:08 +08:00
Xubin RenandXubin Ren 49fc50b1e6 test(custom): cover empty choices response handling 2026-03-17 14:24:55 +08:00
Xubin Ren 499d0e1588 docs(readme): update multi-instance onboard examples 2026-03-17 05:58:13 +00:00
Xubin Ren b2a550176e feat(onboard): align setup with config and workspace flags 2026-03-17 05:42:49 +00:00
Xubin Ren 40a022afd9 fix(onboard): use configured workspace path on setup 2026-03-17 05:01:34 +00:00
Xubin Ren c4cc2a9fb4 Merge remote-tracking branch 'origin/main' into pr-1136 2026-03-17 04:42:01 +00:00
Xubin Ren db37ecbfd2 fix(custom): support extraHeaders for OpenAI-compatible endpoints 2026-03-17 04:28:24 +00:00
Xubin Ren 84565d702c docs: update v0.1.4.post5 release news 2026-03-16 15:28:41 +00:00
Xubin Ren df7ad91c57 docs: update to v0.1.4.post5 release 2026-03-16 15:27:40 +00:00
Xubin Ren 337c4600f3 bump version to 0.1.4.post5 2026-03-16 15:11:15 +00:00
Xubin Ren dbe9cbc78e docs: update news section 2026-03-16 14:27:28 +00:00
Xubin RenandXubin Ren 2eceb6ce8a fix(cli): pause spinner cleanly before printing progress output 2026-03-16 22:17:29 +08:00
Xubin RenandXubin Ren 92f3d5a8b3 fix: keep truncated session history tool-call consistent 2026-03-16 17:25:30 +08:00
Xubin Ren 94b5956309 perf: background post-response memory consolidation for faster replies 2026-03-16 09:06:05 +00:00
Xubin Ren 46b19b15e1 perf: background post-response memory consolidation for faster replies 2026-03-16 09:01:11 +00:00
Xubin Ren 6d63e22e86 Merge remote-tracking branch 'origin/main' into pr-1961
Made-with: Cursor

# Conflicts:
#	.gitignore
2026-03-16 08:47:28 +00:00
Xubin RenandXubin Ren b29275a1d2 refactor(/new): background archival with guaranteed persistence
Replace fire-and-forget consolidation with archive_messages(), which
retries until the raw-dump fallback triggers — making it effectively
infallible. /new now clears the session immediately and archives in
the background. Pending archive tasks are drained on shutdown via
close_mcp() so no data is lost on process exit.
2026-03-16 16:40:09 +08:00
Xubin RenandXubin Ren 6e2b6396a4 security: add SSRF protection, untrusted content marking, and internal URL blocking 2026-03-16 15:05:26 +08:00
Xubin RenandXubin Ren d6df665a2c docs: add contributing guide and align CI with nightly branch 2026-03-16 11:13:46 +08:00
Xubin RenandXubin Ren 5d1528a5f3 fix(heartbeat): inject shared current time context into phase 1 2026-03-16 10:52:26 +08:00
Xubin RenandXubin Ren d684fec27a Replace load_skill tool with read_file extra_allowed_dirs for builtin skills access
Instead of adding a separate load_skill tool to bypass workspace restrictions,
extend ReadFileTool with extra_allowed_dirs so it can read builtin skill paths
while keeping write/edit tools locked to the workspace. Fixes the original issue
for both main agent and subagents.

Made-with: Cursor
2026-03-15 23:21:02 +08:00
Xubin RenandXubin Ren c4628038c6 fix: handle image_url rejection by retrying without images
Replace the static provider-level supports_vision check with a
reactive fallback: when a model returns an image-unsupported error,
strip image_url blocks from messages and retry once. This avoids
maintaining an inaccurate vision capability table and correctly
handles gateway/unknown model scenarios.

Also extract _safe_chat() to deduplicate try/except boilerplate
in chat_with_retry().
2026-03-15 22:32:34 +08:00
Xubin RenandXubin Ren 196e0ddbb6 fix(openrouter): revert custom_llm_provider, always apply gateway prefix 2026-03-15 10:52:36 +08:00
Xubin RenandXubin Ren 350d110fb9 fix(openrouter): remove litellm_prefix to prevent double-prefixed model names
With custom_llm_provider kwarg handling routing, the openrouter/ prefix
caused model names like anthropic/claude-sonnet-4-6 to become
openrouter/anthropic/claude-sonnet-4-6, which OpenRouter API rejects.
2026-03-15 10:52:36 +08:00
Xubin RenandXubin Ren 5ccf350db1 test(litellm_kwargs): add regression tests for PR #2026 OpenRouter kwargs injection 2026-03-15 10:52:36 +08:00