DEV Community: 邱敬幃 Pardn Chiu

Agenvoy@v0.25.11 - Refactor memory management and enhance TUI session startup

邱敬幃 Pardn Chiu — Mon, 01 Jun 2026 18:06:50 +0000

v0.25.10 -> v0.25.11

Summary

Consolidates runtime record-keeping into a managed cleanup subsystem and adds automatic trash purging for stale downloads. TUI session startup flow is adjusted for smoother attach behaviour.

翻譯

將 runtime 紀錄統整至受管理的清理子系統，並為過期下載檔新增自動垃圾桶清除。調整 TUI session 啟動流程以提升 attach 體驗。

Changes

UPDATE

Add periodic download trash cleanup with 30-day TTL and adjust TUI session startup flow (@pardnchiu) [238801b]

翻譯

新增定期下載垃圾桶清理（30 天 TTL）並調整 TUI session 啟動流程

REFACTOR

Move runtime records to managed cleanup package and consolidate error memory (@pardnchiu) [b663252]

翻譯

將 runtime 紀錄移至受管理的清理 package 並整合 error memory

Scope

internal/filesystem/record/ — UPDATE, REFACTOR (download.go, log.go, toolcall.go)
internal/filesystem/path.go — REFACTOR
internal/runtime/scheduler.go — UPDATE, REFACTOR
internal/runtime/tui/ — UPDATE (init.go, update.go, commandSwitch.go)
internal/session/toolError/ — REMOVE
internal/tools/errorMemory/ — REFACTOR
cmd/app/ — REFACTOR (cmdDeamon.go, main.go)

Generated by SKILL

Agenvoy@v0.25.10 - Enhance README and refactor memory storage with documentation update

邱敬幃 Pardn Chiu — Mon, 01 Jun 2026 15:56:59 +0000

pardnchiu/Agenvoy

v0.25.9 -> v0.25.10

Summary

Introduces a three-tier conversation memory architecture — context window, ToriiDB vector search, and SQLite full-text archive — so that no message is ever lost regardless of history compaction or session resets. Trims rarely-used bundled API definitions to reduce tool-discovery noise.

翻譯
引入三層對話記憶架構——上下文視窗、ToriiDB 向量搜尋、SQLite 全文歸檔——確保無論 history 裁剪或 session 重置，任何訊息都不會遺失。移除不常用的內建 API 定義以降低工具探索噪音。

Changes

ADD

Add SQLite-backed history store with FTS5 full-text search, dual-write on every message append, auto-backfill for existing sessions, and compact-safe session_meta.start_at tracking (@pardnchiu) [0442dd9]
Add MaxHistoryBytes runtime limit (default 5 MiB) with auto-compact to 80% on user+assistant pair boundary, including ToriiDB cleanup for entries before the cutoff (@pardnchiu) [0442dd9]
Add mode parameter to search_conversation_history tool: keyword routes to SQLite FTS5 + ToriiDB substring, semantic routes to ToriiDB VSearch (@pardnchiu) [0442dd9]
Add outstanding contributors section to bilingual READMEs (@pardnchiu) [e64098d]

翻譯

新增 SQLite 歷史儲存層，支援 FTS5 全文搜尋、每次 append 雙寫、既有 session 自動回填、compact-safe 的 session_meta.start_at 追蹤
新增 MaxHistoryBytes runtime limit（預設 5 MiB），超過時自動裁剪至 80%（user+assistant pair 邊界），同步清理 ToriiDB 早於裁剪點的 entries
search_conversation_history 工具新增 mode 參數：keyword 走 SQLite FTS5 + ToriiDB 子字串、semantic 走 ToriiDB VSearch
雙語 README 新增傑出貢獻者區段

UPDATE

Update memory system documentation across README (EN/ZH) and Wiki (EN/ZH) to reflect three-tier architecture (@pardnchiu) [83680ff]

翻譯

更新 README（英/中）與 Wiki（英/中）的記憶系統文件，反映三層架構

REMOVE

Remove 5 rarely-used bundled API definitions: nominatim, rest-countries, themealdb, usgs-earthquake, world-bank (@pardnchiu) [83680ff]

翻譯

移除 5 個不常用的內建 API 定義：nominatim、rest-countries、themealdb、usgs-earthquake、world-bank

Scope

internal/session/history/store/ — ADD (store.go, write.go, search.go, migrate.sql)
internal/session/history/ — ADD (compact.go), UPDATE (history.go)
internal/filesystem/ — UPDATE (path.go, runtime.go)
internal/tools/ — UPDATE (searchConversationHistory.go)
internal/session/ — UPDATE (reset.go)
internal/runtime/tui/ — UPDATE (commandRemoveSession.go)
cmd/app/ — UPDATE (cmdDeamon.go, newTUI.go)
extensions/apis/ — REMOVE (5 files)
wiki/ — UPDATE (Memory-System.md, Memory-System.zh.md)
README.md, doc/README.zh.md — ADD, UPDATE
makefile — UPDATE (-tags "fts5")

Generated by SKILL

Agenvoy@v0.25.6 - Refactor session logging and package structure for clarity

邱敬幃 Pardn Chiu — Sat, 30 May 2026 18:04:26 +0000

pardnchiu/Agenvoy

v0.25.5 -> v0.25.6

Summary

Splits session bot configuration and runtime status into dedicated sub-packages, centralizing path helpers and consolidating redundant save functions into a single entry point.

翻譯
將 session bot 設定與 runtime status 拆分為獨立子套件，集中路徑輔助函式並合併冗餘的儲存函式為單一入口。

Changes

REFACTOR

Split session bot and status into dedicated packages [528a66b]
Rework session logging and path handling with pubsub helpers [0c4ab39]

翻譯

將 session bot 與 status 拆分為獨立套件
重構 session logging 與路徑處理，加入 pubsub 輔助

Scope

internal/session/bot/ — REFACTOR (bot.go)
internal/session/status/ — REFACTOR (online.go, status.go)
internal/session/log/ — REFACTOR (format.go, record.go)
internal/filesystem/ — REFACTOR (path.go)
internal/agents/exec/ — REFACTOR (selectAgent.go, systemPrompt.go, execute.go, run.go, execWithSubagent.go)
internal/routes/handler/ — REFACTOR (send.go, status.go)
internal/runtime/tui/ — REFACTOR (multiple files)
cmd/app/ — REFACTOR (cmdDeamon.go)

Generated by SKILL

Agenvoy@v0.25.5 - Refactor TUI command flow and add admin channel support

邱敬幃 Pardn Chiu — Sat, 30 May 2026 07:43:15 +0000

pardnchiu/Agenvoy

v0.25.4 -> v0.25.5

Summary

Routes verification codes from unauthorized chats to a designated admin channel, relaying across messaging runtimes so an operator can authorize new chats out-of-band. Hardens session history so concurrent turns no longer clobber one another and buffers grouped media into a single turn. KuraDB control in the TUI gains an in-place update action.

翻譯
將未授權聊天產生的驗證碼轉發至指定的管理頻道，並跨訊息平台中繼，讓管理者得以在頻外授權新聊天。強化 session 歷史，使並行回合不再互相覆寫，並將群組媒體緩衝為單一回合。TUI 的 KuraDB 控制新增就地更新動作。

Changes

FEAT

Add admin channel relay for verification codes across Telegram and Discord (@pardnchiu) [264b8f1]

翻譯

新增管理頻道驗證碼轉發，跨 Telegram 與 Discord 中繼

FIX

Preserve session history deltas and aggregate grouped media into one buffered turn (@pardnchiu) [c21636c]

翻譯

保留 session 歷史 delta，並將群組媒體聚合為單一緩衝回合

REFACTOR

Add KuraDB update action to the TUI command flow (@pardnchiu) [80fd142]

翻譯

於 TUI 命令流程新增 KuraDB 更新動作

Scope

internal/agents/exec/ — FEAT, FIX (adminChannel.go, execute.go, getSession.go)
internal/runtime/telegram/ — FEAT, FIX (admin.go, filegroup.go, run.go)
internal/runtime/discord/ — FEAT (admin.go, run.go)
internal/runtime/tui/ — FEAT, REFACTOR (commandAdminChannel.go, commandKuradb.go)
internal/session/ — FEAT, FIX (config.go, session.go)
cmd/app/main.go — FEAT

Generated by SKILL

Agenvoy@v0.25.4 - Enhance Gemini auth flow, agent failover, and utility modules

邱敬幃 Pardn Chiu — Fri, 29 May 2026 19:13:56 +0000

pardnchiu/Agenvoy

v0.25.3 -> v0.25.4

Summary

Tightens runtime recovery and consolidates interactive tooling into clearer internal boundaries. It also hardens provider auth and failover behavior while aligning release-generation rules with the actual remote tag source.

翻譯
收斂執行期復原流程，並把互動式工具整理成更清晰的內部邊界。同時加強 provider 驗證與 failover 行為，並讓版本產生規則對齊實際遠端 tag 來源。

Changes

FIX

Fix Gemini auth flow and harden runtime recovery behavior (@pardnchiu) [5fb287f]
Fix agent failover handling and extract prompt-health helper utilities (@pardnchiu) [fccdc12]

翻譯
修正 Gemini 驗證流程，並強化執行期復原行為
修正 agent failover 處理，並抽出 prompt health 輔助工具

REFACTOR

Refactor execution and utility code while updating module dependencies (@pardnchiu) [1edb9fc]
Consolidate user data and log tools into shared modules (@pardnchiu) [50d0bf5]
Extract interactive tools into a dedicated module (@pardnchiu) [b6fdae9]

翻譯
重構執行與工具程式碼，並更新模組相依
整併使用者資料與日誌工具到共用模組
將互動式工具抽離為獨立模組

Scope

cmd/app/ — FIX
configs/prompts/ — FIX
extensions/skills/extension-install/ — REFACTOR
extensions/skills/extension-upload/ — REFACTOR
extensions/skills/version-generate/scripts/ — FIX, REFACTOR
go.mod — REFACTOR
go.sum — REFACTOR
internal/agents/exec/ — FIX, REFACTOR
internal/agents/provider/gemini/ — FIX
internal/agents/provider/openaiCodex/image2/ — REFACTOR
internal/filesystem/ — REFACTOR
internal/routes/handler/chatCompletions/ — FIX
internal/runtime/discord/ — FIX
internal/runtime/kuradb/ — FIX
internal/runtime/telegram/ — FIX
internal/runtime/tui/ — FIX
internal/session/ — FIX
internal/tools/interactive/ — REFACTOR
internal/tools/listLog/ — REFACTOR
internal/tools/ — FIX, REFACTOR
internal/tools/reportError/ — REFACTOR
internal/tools/userData/ — REFACTOR
internal/utils/ — FIX, REFACTOR

Generated by SKILL

Agenvoy@v0.25.3 - Add opus-4-8 model, extension marketplace, and Go bootstrap updates

邱敬幃 Pardn Chiu — Fri, 29 May 2026 07:54:02 +0000

pardnchiu/Agenvoy

v0.25.2 -> v0.25.3

Summary

Registers the latest Opus model in the provider registry. Extends the landing page with a tool-extension marketplace section, and hardens the install and update scripts so the toolchain bootstraps and persists on PATH automatically.

翻譯

於 provider registry 註冊最新的 Opus model。landing page 新增工具擴充市集區塊，並強化安裝與更新腳本，使工具鏈自動 bootstrap 並持久化至 PATH。

Changes

FEAT

Register claude-opus-4-8 in the Claude provider model registry [ddc9b02]
Add tool extension marketplace section to the landing page [ddc9b02]
Auto-bootstrap Go toolchain and persist PATH in install/update scripts [ddc9b02]

翻譯

於 Claude provider model registry 註冊 claude-opus-4-8
新增工具擴充市集區塊至 landing page
install/update 腳本自動 bootstrap Go 工具鏈並持久化 PATH

DOC

Rename /dispatcher to /dispatcher-model and document /summary-model [ddc9b02]

翻譯

將 /dispatcher 改名為 /dispatcher-model 並補上 /summary-model 說明

Scope

configs/jsons/providors/claude.json — FEAT
index.html, static/index.js, static/css/index.css — FEAT
static/scripts/install.sh, static/scripts/update.sh — FEAT
README.md, doc/README.zh.md, wiki/CLI-Reference.md, wiki/CLI-Reference.zh.md — DOC

Generated by SKILL

Agenvoy@v0.25.1 - Add runtime monitoring and enhance warning logging

邱敬幃 Pardn Chiu — Thu, 28 May 2026 17:18:33 +0000

pardnchiu/Agenvoy

v0.25.0 -> v0.25.1

Summary

Adds a startup resource monitor that watches CPU, RAM, and network reachability, escalating threshold breaches to the daemon log. Transient retry, probe, and silent-fallback paths across the daemon now also surface at warn level, so operational issues become visible before they cascade.

翻譯

啟動時加入常駐 resource monitor，盯住 CPU、RAM 與網路連通性，超過門檻即升級至 daemon log。同時把 daemon 內 transient retry、probe 與 silent fallback 路徑統一拉到 warn 級，operational 問題能在 cascade 之前就被看見。

Changes

FEAT

Add runtime monitor for CPU, RAM, and network thresholds (@pardnchiu) [e4dbffc]

翻譯

新增 runtime monitor，週期觀測 CPU、RAM 與網路連通性並在門檻外發 warn

UPDATE

Promote per-attempt transient and silent-fallback paths from Debug/silent to slog.Warn (@pardnchiu) [e4dbffc]

翻譯

把單次重試 / probe / dispatcher attempt / callback miss 與 stub activation、CommitSkillDir、keychain.Delete、OAuth openBrowser 等 silent fallback 路徑統一升至 slog.Warn

CHORE

Bump github.com/pardnchiu/go-bot from v0.3.5 to v0.3.6 (@pardnchiu) [e4dbffc]

翻譯

升級 go-bot 至 v0.3.6

Scope

internal/runtime/monitor/ — FEAT
cmd/app/cmdDeamon.go — FEAT (monitor wire-in)
internal/agents/exec/ — UPDATE (execute.go, selectAgent.go, toolCall.go)
internal/runtime/listener.go — UPDATE
internal/runtime/tui/ — UPDATE (commandDiscord.go, commandTelegram.go)
internal/agents/provider/copilot/login.go — UPDATE
internal/agents/provider/openaiCodex/login.go — UPDATE
internal/filesystem/git.go — UPDATE
internal/tools/executor.go — UPDATE
go.mod — CHORE (go-bot v0.3.6)

Generated by SKILL

Agenvoy@v0.25.0 - Enhance TUI tools with installation, upload, and marketplace support

邱敬幃 Pardn Chiu — Thu, 28 May 2026 17:17:20 +0000

pardnchiu/Agenvoy

v0.24.17 -> v0.25.0

Summary

Adds an end-to-end extension marketplace pipeline so users can publish and install AI-built tools across machines. Supporting layers gain cross-platform dependency installation, structured binary download and multipart upload, persistent publisher identity, and a two-line title/detail popup model for confirmations.

翻譯

加入端到端 extension marketplace 流程，讓使用者跨機器發布與安裝 AI 自生成工具。配套層補上跨平台依賴安裝、結構化二進位下載與 multipart 上傳、持久化發布者身分，以及兩段式 title/detail 確認 popup 模型。

Changes

FEAT

Add tool registry demos and marketplace capability to README (@pardnchiu) [91d50d1]
Add extension install and upload skills for marketplace workflow (@pardnchiu) [4566ef4]
Add registry email tools and improve popup option rendering (@pardnchiu) [42f6749]
Add binary download tool and multipart HTTP upload support (@pardnchiu) [847a550]
Add TUI dependency installer and extension tool loading (@pardnchiu) [d92d375]

翻譯

README 加上 tool registry demo 與 marketplace 能力
新增 extension install 與 upload 兩個 skill 串起 marketplace 流程
新增 registry email 讀寫工具並改善 popup option 渲染
新增 binary 下載工具與 send_http_request multipart 上傳支援
新增 TUI dependency installer 並讓 extension tool 載入既有 runtime

REFACTOR

Add Detail field to ask_user popup and refactor registry email config handling (@pardnchiu) [3e6ee17]

翻譯

ask_user popup 加入 detail 欄位（subtitle），registry email 改走 config raw read/write，Save 端 preserve unknown keys

Scope

extensions/skills/extension-upload/ — FEAT
extensions/skills/extension-install/ — FEAT
internal/tools/installDependence.go — FEAT
internal/tools/downloadFile.go — FEAT
internal/tools/registryEmail.go — FEAT
internal/tools/askUser.go — REFACTOR
internal/toolAdapter/api/send.go — FEAT (multipart)
internal/runtime/pending.go — REFACTOR (Detail field, ExecPayload)
internal/runtime/tui/handlerExecProcess.go — FEAT
internal/runtime/tui/view.go — REFACTOR (popup style, splitOptStyle, truncateRune)
internal/runtime/skill.go — REFACTOR (MatchSkill excludeSkills variadic)
internal/agents/exec/execute.go — REFACTOR (ExecData.ExcludeSkills, BuildSystemPrompts signature)
internal/session/config.go — REFACTOR (Save raw merge preserving unknown keys)
internal/filesystem/path.go — FEAT (ExtensionAPIToolsDir, ExtensionScriptToolsDir)
configs/prompts/system_prompt.md — UPDATE (package install policy guardrails)
configs/jsons/white_list.json — UPDATE (tar, uname, brew, apt, dnf, yum)
README.md — FEAT (2x2 demo grid, marketplace bullet, tool registry row)
doc/README.zh.md — FEAT (mirrored marketplace updates)
.doc/extensions_worker.md — ADD (Cloudflare Worker + R2 + D1 + KV spec)

Generated by SKILL

Agenvoy@v0.24.17 - Refactor CLI to TUI and centralize sandbox configuration

邱敬幃 Pardn Chiu — Wed, 27 May 2026 16:49:29 +0000

pardnchiu/Agenvoy

v0.24.16 -> v0.24.17

Summary

Folds the CLI/run path into a single-shot TUI rendering so daemon-side and interactive flows share one entry. Sandbox policy now loads through the runtime config with a user-extensible whitelist surfaced through a new slash command.

翻譯

把 CLI/run 入口收編進單次跑的 TUI rendering，讓 daemon 與互動式流程共用同一條 entry。Sandbox policy 改由 runtime config 統一管理，並透過新加的 slash 指令補充白名單。

Changes

REFACTOR

Replace legacy CLI flow with single-shot TUI execution (@pardnchiu) [620937f]
Centralize runtime sandbox config and add allow-cmd command (@pardnchiu) [ec7af48]

翻譯

agen cli／agen run 改為單次跑 TUI（auto-submit + 跑完 Enter 退出），順手砍掉 internal/runtime/cli/、promptui、stdin pending fallback；session picker 與 popup 對齊 TUI default
Runtime sandbox／whitelist 從 cmd/app/main.go init() 搬到 filesystem.LoadRuntime，daemon 啟動時 embed 預設 config.json::denied_map／white_list 一次合併；新加 /allow-cmd TUI 指令把使用者 binary 寫進 config.json（強制重啟 Deamon）

Scope

cmd/app/ — REFACTOR
internal/runtime/tui/ — REFACTOR
internal/runtime/cli/ — REMOVE
internal/filesystem/runtime.go — REFACTOR
internal/tools/ — REFACTOR

Generated by SKILL

Agenvoy@v0.24.16 - Refactor CLI commands and enhance TUI model management

邱敬幃 Pardn Chiu — Wed, 27 May 2026 09:11:22 +0000

pardnchiu/Agenvoy

v0.24.15 -> v0.24.16

Summary

Model management lifecycle migrates from standalone CLI subcommands into the TUI surface with first-class OAuth callback handling, closing the split between two entry points. Startup no longer aborts when no provider is registered, letting fresh installs reach the TUI to add their first model. Deprecated CLI commands and accumulated dead helpers across the runtime are swept out.

翻譯

模型管理流程從獨立 CLI 子指令搬進 TUI 介面，OAuth 回呼也納入主控，消除兩套入口分裂。啟動時即使尚未註冊任何 provider 也不再中止，新安裝可順利進到 TUI 加入第一個模型。順手清除被棄用的 CLI 指令與 runtime 各處累積的 dead helpers。

Changes

FEAT

Move model management flow into TUI with OAuth callback support (@pardnchiu) [910dc10]

翻譯

模型管理（add／remove）整套移到 TUI，codex／copilot 走 OAuth callback 在介面內完成登入

REFACTOR

Relax no-model startup flow and harden TUI runtime guards (@pardnchiu) [e8e98ca]
Remove deprecated MCP/session CLI commands and simplify session picker + TUI popup (@pardnchiu) [1604f6b]

翻譯

放寬「啟動時必須有 model」的硬限制；同步補強 TUI runtime guards
移除已棄用的 MCP／session CLI 子指令，session picker 與 TUI popup 簡化

REMOVE

Remove unused helpers and standardize provider HTTP clients (@pardnchiu) [172aaa9]

翻譯

清掉 ParseSkillBytes／LoadFS／Snapshot／FormatInt 等 dead helpers；雲端 provider HTTP client 統一走 provider.NewHTTPClient()

Scope

cmd/app/ — REFACTOR, REMOVE (main.go, cmdDeamon.go, addProvider.go, buildAgentRegistry.go)
internal/agents/provider/ — FEAT, REFACTOR (provider.go, copilot/, openaiCodex/, multiple new.go)
internal/runtime/cli/ — REMOVE (mcp.go, newSession.go, pick.go, remove.go, config.go)
internal/runtime/tui/ — FEAT, REFACTOR (commandModelAdd.go, commnadModelRemove.go, handlerPopup.go, update.go, view.go)
internal/runtime/ — REFACTOR (pending.go, discord/new.go, telegram/new.go, kuradb/run.go)
internal/session/ — REFACTOR (actionLog.go, config.go, session.go)
internal/filesystem/ — REFACTOR (path.go)
internal/utils/ — REFACTOR (utils.go)
makefile — CHORE

Generated by SKILL

Agenvoy@v0.24.14 - Enhance command validation, session flow, and provider documentation

邱敬幃 Pardn Chiu — Tue, 26 May 2026 05:15:34 +0000

pardnchiu/Agenvoy

v0.24.13 -> v0.24.14

Summary

Expands the cloud provider catalogue with two non-streaming completion backends and splits the shared HTTP client to host streaming and non-streaming transports side by side. Adds TUI ergonomics for manual summary regeneration and a guarded session-reset flow that aborts when the summary refresh itself fails. Hardens shell command execution with an AST validator that blocks dynamic-binary bypass vectors previously missed by token-level scanning.

翻譯

擴充雲端 provider 選單，新增兩個非串流 completion backend，並把共用 HTTP client 重整為串流／非串流雙軌並存。TUI 加入手動 summary 重生命令與帶守門的 session reset 流程：summary refresh 失敗即中止而不清空歷史。Shell 指令執行改走 AST 驗證器，封堵舊版 token 掃描漏掉的動態 binary 繞過路徑。

Changes

FEAT

Add Grok (xAI) and DeepSeek provider support with non-streaming HTTP client [db2a3d4]
Redesign summary prompt and add manual summary regeneration command [5008d70]
Add session reset flow and improve summary handling [c699cf3]

翻譯

新增 Grok（xAI）與 DeepSeek 兩個 provider；provider.NewHTTPClient 從固定回 SSE-friendly client 重整為串流／非串流雙軌（非 SSE backend 不再被 ResponseHeaderTimeout=10s 誤殺長 body 場景），既有五個雲端 provider 的 new.go 同步換新簽章；CLI selectAgent 與 buildAgentRegistry 接入新 provider entry，configs/jsons/providors/{deepseek,grok}.json 落 manifest
重寫 summary_prompt.md 與 summary_context.md：key_decisions 嚴格限定 "locked-in concluded outcomes"，避免 tentative leaning 被當 binding；TUI 新增 /summary 指令，async + spinner 走 exec.ForceSummary 立即觸發 summary.Generate（等同 on-demand cron pass）；summary.extract 強化 timestamp 抽取，覆蓋更多歷史訊息格式
TUI /reset 兩階段 popup confirm（force summary.Generate → session.ResetHistoryKeepSummary），summary refresh 失敗即 abort 不清歷史，避免最近未 summarize 對話被吞；新增 internal/agents/exec/reset.go／internal/session/reset.go 邏輯，clear history.json／tool_calls/／action.log 與 DBSessionHist::*，保留 summary.json／bot.md／status.json／tool_errors/；summary.Generate 改回 error return 供 reset 路徑判斷

SECURITY

Add shell command validation for run_command [7e765e1]

翻譯

新增 internal/tools/runCommandShell.go::validateShellScript，對 sh -c／bash -c 走 mvdan.cc/sh/v3/syntax AST walker：每個 CallExpr 取真正的 binary 比對白名單，shell builtin（cd／echo／test／export／控制流）放行，bypass vector（eval／exec／source／.／command）視為非白名單拒絕，dynamic command（$var／$(…)／${…}）拒絕，nested sh -c／bash -c 遞迴驗證 inner script；舊版 strings.Fields(argv[2])[0] 對 cd X && cmd／VAR=v cmd／管線後段全破且通過後第二段沒查，已淘汰；bash -c 也走此 gate（舊版只擋 sh -c 是漏洞）

Scope

internal/agents/provider/grok/, internal/agents/provider/deepseek/ — FEAT (new non-streaming providers)
internal/agents/provider/provider.go — UPDATE (split streaming and non-streaming HTTP client factory)
internal/agents/provider/{claude,copilot,gemini,nvidia,openai}/new.go — UPDATE (adopt new HTTP client signature)
configs/jsons/providors/ — ADD (deepseek.json, grok.json)
cmd/app/addProvider.go, cmd/app/buildAgentRegistry.go, configs/configs.go, internal/runtime/cli/selectAgent.go — UPDATE (wire new providers)
configs/prompts/ — UPDATE (summary_prompt.md, summary_context.md, system_prompt.md)
internal/agents/summary/ — UPDATE (extract.go, generate.go)
internal/session/ — FEAT, UPDATE (reset.go, summary.go)
internal/agents/exec/reset.go — FEAT
internal/runtime/tui/ — FEAT (commandReset.go, commandSummary.go, cmdSelector.go, handlerCommand.go, update.go)
internal/tools/runCommandShell.go — SECURITY (new AST shell validator)
internal/tools/runCommand.go — UPDATE (route sh -c/bash -c through validator)
internal/filesystem/path.go — UPDATE
go.mod, go.sum — CHORE (add mvdan.cc/sh/v3)

Generated by SKILL

Agenvoy@v0.24.13 - Add agent fallback handling and denied-path tracking for file tools

邱敬幃 Pardn Chiu — Mon, 25 May 2026 17:34:10 +0000

pardnchiu/Agenvoy

v0.24.12 -> v0.24.13

Summary

Agent resolution recovers the multi-agent failover path: when dispatcher routing exhausts its retries it now marks the dispatcher dead and falls through to the registry order instead of returning an outright error, so other registered agents still get tried. Skips dispatcher entirely when only one agent is registered. File tools remember per-session permission-denied roots and short-circuit subsequent calls into the same subtree.

翻譯

Agent resolution 復原 multi-agent failover：dispatcher routing 全失敗改回標 dead 並 fall through registry order，其他註冊 agent 仍能接手，不再一次 return error 把整盤判死。註冊表只有單一 agent 時整段跳過 dispatcher 呼叫。File tool 加 per-session denied-path 記憶，重複踩到同個 EACCES subtree 直接 short-circuit。

Changes

FEAT

Add agent fallback handling and denied-path tracking for file tools [22594db]

翻譯

SelectAgentNames dispatcher 3-retry 全失敗改回「標 dead[bot.Name()]=true + warn + fall through registry order」（v0.24.12 的 return error 在 multi-agent setup 會把健康 agent 一起槍斃，已撤回）；加 len(registry.Entries)==1 early return 完全跳過 dispatcher LLM call（單 entry 無路由決策可做）；新增 internal/tools/file/denied/ package（per-session sync.Map，path-component-boundary 前綴比對，Hit/Register/IsPermission API）；六個 file tool（list/read/write/patch/glob/search）handler 入口接 denied.Hit guard、op 失敗時 IsPermission(err) → Register 收錄 EACCES path；list_files 額外 os.Open 預測試以避免 go-pkg reader 的 IgnoreWalkError:true 把 root EACCES 吞成空結果

Scope

internal/agents/exec/selectAgent.go — UPDATE (dispatcher fall-through restored, single-entry skip)
internal/tools/file/denied/denied.go — FEAT (new per-session EACCES cache package)
internal/tools/file/ — UPDATE (list_files, read_file, write_file, patch_file, glob_files, search_files — all six wired to denied cache guard + register on EACCES)

Generated by SKILL