DEV Community

邱敬幃 Pardn Chiu
邱敬幃 Pardn Chiu

Posted on

Agenvoy@v0.24.14 - Enhance command validation, session flow, and provider documentation

#ai #agents #agenvoy #go

pardnchiu/Agenvoy

v0.24.13 -> v0.24.14

Summary

Expands the cloud provider catalogue with two non-streaming completion backends and splits the shared HTTP client to host streaming and non-streaming transports side by side. Adds TUI ergonomics for manual summary regeneration and a guarded session-reset flow that aborts when the summary refresh itself fails. Hardens shell command execution with an AST validator that blocks dynamic-binary bypass vectors previously missed by token-level scanning.

翻譯

擴充雲端 provider 選單，新增兩個非串流 completion backend，並把共用 HTTP client 重整為串流／非串流雙軌並存。TUI 加入手動 summary 重生命令與帶守門的 session reset 流程：summary refresh 失敗即中止而不清空歷史。Shell 指令執行改走 AST 驗證器，封堵舊版 token 掃描漏掉的動態 binary 繞過路徑。

Changes

FEAT

  • Add Grok (xAI) and DeepSeek provider support with non-streaming HTTP client [db2a3d4]
  • Redesign summary prompt and add manual summary regeneration command [5008d70]
  • Add session reset flow and improve summary handling [c699cf3]

翻譯

  • 新增 Grok（xAI）與 DeepSeek 兩個 provider；provider.NewHTTPClient 從固定回 SSE-friendly client 重整為串流／非串流雙軌（非 SSE backend 不再被 ResponseHeaderTimeout=10s 誤殺長 body 場景），既有五個雲端 provider 的 new.go 同步換新簽章；CLI selectAgent 與 buildAgentRegistry 接入新 provider entry，configs/jsons/providors/{deepseek,grok}.json 落 manifest
  • 重寫 summary_prompt.md 與 summary_context.md：key_decisions 嚴格限定 "locked-in concluded outcomes"，避免 tentative leaning 被當 binding；TUI 新增 /summary 指令，async + spinner 走 exec.ForceSummary 立即觸發 summary.Generate（等同 on-demand cron pass）；summary.extract 強化 timestamp 抽取，覆蓋更多歷史訊息格式
  • TUI /reset 兩階段 popup confirm（force summary.Generate → session.ResetHistoryKeepSummary），summary refresh 失敗即 abort 不清歷史，避免最近未 summarize 對話被吞；新增 internal/agents/exec/reset.go／internal/session/reset.go 邏輯，clear history.json／tool_calls/／action.log 與 DBSessionHist::*，保留 summary.json／bot.md／status.json／tool_errors/；summary.Generate 改回 error return 供 reset 路徑判斷

SECURITY

  • Add shell command validation for run_command [7e765e1]

翻譯

  • 新增 internal/tools/runCommandShell.go::validateShellScript，對 sh -c／bash -c 走 mvdan.cc/sh/v3/syntax AST walker：每個 CallExpr 取真正的 binary 比對白名單，shell builtin（cd／echo／test／export／控制流）放行，bypass vector（eval／exec／source／.／command）視為非白名單拒絕，dynamic command（$var／$(…)／${…}）拒絕，nested sh -c／bash -c 遞迴驗證 inner script；舊版 strings.Fields(argv[2])[0] 對 cd X && cmd／VAR=v cmd／管線後段全破且通過後第二段沒查，已淘汰；bash -c 也走此 gate（舊版只擋 sh -c 是漏洞）

Scope

  • internal/agents/provider/grok/, internal/agents/provider/deepseek/ — FEAT (new non-streaming providers)
  • internal/agents/provider/provider.go — UPDATE (split streaming and non-streaming HTTP client factory)
  • internal/agents/provider/{claude,copilot,gemini,nvidia,openai}/new.go — UPDATE (adopt new HTTP client signature)
  • configs/jsons/providors/ — ADD (deepseek.json, grok.json)
  • cmd/app/addProvider.go, cmd/app/buildAgentRegistry.go, configs/configs.go, internal/runtime/cli/selectAgent.go — UPDATE (wire new providers)
  • configs/prompts/ — UPDATE (summary_prompt.md, summary_context.md, system_prompt.md)
  • internal/agents/summary/ — UPDATE (extract.go, generate.go)
  • internal/session/ — FEAT, UPDATE (reset.go, summary.go)
  • internal/agents/exec/reset.go — FEAT
  • internal/runtime/tui/ — FEAT (commandReset.go, commandSummary.go, cmdSelector.go, handlerCommand.go, update.go)
  • internal/tools/runCommandShell.go — SECURITY (new AST shell validator)
  • internal/tools/runCommand.go — UPDATE (route sh -c/bash -c through validator)
  • internal/filesystem/path.go — UPDATE
  • go.mod, go.sum — CHORE (add mvdan.cc/sh/v3)

Generated by SKILL

Top comments (0)