src/renderer/src/components/settings/ModelScopeMcpSync.vue (2)

151-155: Coerce and clamp options before invoking presenter

Ensure numbers are in the expected domain and avoid passing reactive objects directly (copying avoids accidental mutations downstream).

-    // 调用简化的同步API，所有的格式转换和导入都在服务端处理
-    const result = await llmP.syncModelScopeMcpServers(props.provider.id, syncOptions)
+    // 调用简化的同步API，所有的格式转换和导入都在服务端处理
+    const allowedSizes = new Set([10, 25, 50, 100])
+    const size = Number(syncOptions.page_size) || 50
+    const pageSize = allowedSizes.has(size) ? size : 50
+    const pageNumber = Math.max(1, Number(syncOptions.page_number) || 1)
+    const opts = { page_number: pageNumber, page_size: pageSize }
+    const result = await llmP.syncModelScopeMcpServers(props.provider.id, opts)

---

121-126: Ensure provider props include required fields
LLM_PROVIDER defines id, name, and apiType but does not include apiKey. If this component needs provider.apiKey, please update one of the following:

• Extend the shared type in src/shared/presenter.d.ts:

   export type LLM_PROVIDER = {
     id: string
     name: string
     apiType: string

• apiKey: string
  }

- Or narrow the props in `ModelScopeMcpSync.vue` to explicitly require `apiKey`:
```ts
const props = defineProps<{
  provider: Pick<LLM_PROVIDER, 'id'> & { apiKey: string }
}>()

Files to update:

• src/shared/presenter.d.ts
• src/renderer/src/components/settings/ModelScopeMcpSync.vue

src/main/presenter/deeplinkPresenter/index.ts (5)

265-289: Fix potential TDZ crash in waitForTabReady (clearTimeout before initialization).

clearTimeout(timeoutId) can be executed before timeoutId is initialized, throwing due to TDZ. Hoist and guard.

   private async waitForTabReady(tabId: number): Promise<void> {
     return new Promise((resolve) => {
       let resolved = false
+      let timeoutId: ReturnType<typeof setTimeout> | null = null
       const onTabReady = (readyTabId: number) => {
         if (readyTabId === tabId && !resolved) {
           resolved = true
           console.log(`[Deeplink] Tab ${tabId} renderer is ready`)
           eventBus.off('tab:renderer-ready', onTabReady)
-          clearTimeout(timeoutId)
+          if (timeoutId) clearTimeout(timeoutId)
           resolve()
         }
       }

       eventBus.on('tab:renderer-ready', onTabReady)

-      const timeoutId = setTimeout(() => {
+      timeoutId = setTimeout(() => {
         if (!resolved) {
           resolved = true
           eventBus.off('tab:renderer-ready', onTabReady)
           console.log(`[Deeplink] Timeout waiting for tab ${tabId}, proceeding anyway`)
           resolve()
         }
       }, 3000)
     })
   }

---

315-334: Support 'http' MCP server type to match shared types and avoid rejecting valid configs.

Shared MCPServerConfig allows 'http', but this block rejects anything except 'stdio'/'sse'. This breaks deeplinks for HTTP MCP servers.

-        let determinedType: 'sse' | 'stdio' | null = null
+        let determinedType: 'sse' | 'stdio' | 'http' | null = null
...
-        if (serverConfig.type) {
-          if (serverConfig.type === 'stdio' || serverConfig.type === 'sse') {
+        if (serverConfig.type) {
+          if (serverConfig.type === 'stdio' || serverConfig.type === 'sse' || serverConfig.type === 'http') {
             determinedType = serverConfig.type
             // Validate required fields based on explicit type
             if (determinedType === 'stdio' && !determinedCommand) {
               console.error(
                 `Server ${serverName} is type 'stdio' but missing required 'command' field`
               )
               continue
             }
-            if (determinedType === 'sse' && !determinedUrl) {
-              console.error(`Server ${serverName} is type 'sse' but missing required 'url' field`)
+            if ((determinedType === 'sse' || determinedType === 'http') && !determinedUrl) {
+              console.error(`Server ${serverName} is type '${determinedType}' but missing required 'url' field`)
               continue
             }
           } else {
             console.error(
-              `Server ${serverName} provided invalid 'type' value: ${serverConfig.type}, should be 'stdio' or 'sse'`
+              `Server ${serverName} provided invalid 'type' value: ${serverConfig.type}, should be 'stdio' | 'sse' | 'http'`
             )
             continue
           }

---

368-379: Treat 'http' like network type for defaults and field mapping.

Network types ('sse'/'http') should get network icon and baseUrl mapping.

           icons: determinedType === 'stdio' ? '🔌' : '🌐', // Different default icons
...
-          command: determinedType === 'stdio' ? determinedCommand! : defaultConfig.command!,
-          baseUrl: determinedType === 'sse' ? determinedUrl! : defaultConfig.baseUrl!
+          command: determinedType === 'stdio' ? determinedCommand! : defaultConfig.command!,
+          baseUrl: determinedType === 'sse' || determinedType === 'http' ? determinedUrl! : defaultConfig.baseUrl!

Also applies to: 398-401

---

383-391: Guard env merging against undefined and invalid JSON.

Spreading undefined throws and JSON.parse can fail. Default to {} and parse safely, otherwise one bad server aborts the whole install.

-          env: {
-            ...(typeof defaultConfig.env === 'string'
-              ? JSON.parse(defaultConfig.env)
-              : defaultConfig.env),
-            ...(typeof serverConfig.env === 'string'
-              ? JSON.parse(serverConfig.env)
-              : serverConfig.env)
-          },
+          env: {
+            ...((typeof defaultConfig.env === 'string'
+              ? JSON.parse(defaultConfig.env)
+              : defaultConfig.env) || {}),
+            ...((typeof serverConfig.env === 'string'
+              ? (() => {
+                  try { return JSON.parse(serverConfig.env as string) } catch {
+                    console.warn(`Invalid env JSON for server ${serverName}, ignoring`)
+                    return {}
+                  }
+                })()
+              : serverConfig.env) || {})
+          },

---

403-407: Redact secrets from logs when printing server configs.

env, headers, tokens may appear in finalConfig. Avoid logging full config.

-        console.log(
-          `Preparing to install MCP server: ${serverName} (type: ${determinedType})`,
-          finalConfig
-        )
+        console.log(
+          `Preparing to install MCP server: ${serverName} (type: ${determinedType})`,
+          { ...finalConfig, env: '[redacted]' }
+        )

src/main/presenter/threadPresenter/index.ts (1)

1480-1491: Align startStreamCompletion signature across implementation and tests

All thread-presenter calls have been updated to pass the new eventId and optional parameters in the correct order, and the LlmProviderPresenter implementation exactly matches the ILlmProviderPresenter interface. However, the unit tests for llmProviderPresenter.startStreamCompletion are still using the old three-parameter form and will fail to compile/run.

Please update the test cases in

• test/main/presenter/llmProviderPresenter.test.ts (around lines 172, 218, 258, 364, 412)
  to pass at least the required fourth argument eventId (and any additional optional args as needed), for example:

- const stream = llmProviderPresenter.startStreamCompletion(
-   'mock-openai-api',
-   messages,
-   'mock-gpt-thinking',
- )
+ const stream = llmProviderPresenter.startStreamCompletion(
+   'mock-openai-api',
+   messages,
+   'mock-gpt-thinking',           // modelId
+   `test-event-${Date.now()}`,    // eventId
+   /* temperature? */,            // if needed
+   /* maxTokens? */,              // if needed
+   /* enabledMcpTools? */,
+   /* thinkingBudget? */,
+   /* reasoningEffort? */,
+   /* verbosity? */
+)

src/main/presenter/configPresenter/modelDefaultSettings.ts (1)

878-899: Verify the rename from o1-mini to o1-pro.

The model entry has been renamed from o1-mini to o1-pro with different parameters. This is a breaking change for existing configurations using the o1-mini identifier.

This rename could break existing user configurations. Please verify:

1. Is this rename intentional?
2. Are there migration strategies in place for users who have o1-mini configured?
3. Should both entries exist to maintain backward compatibility?

#!/bin/bash
# Check for any references to o1-mini in the codebase
rg -n "o1-mini" --type ts --type json -g "!node_modules/**" -g "!dist/**"

src/renderer/src/components/settings/ModelScopeMcpSync.vue (4)

135-139: Type syncOptions to prevent accidental type drift

Explicitly typing syncOptions guards against v-model induced string values and keeps the contract with the presenter clear.

-// 同步选项
-const syncOptions = reactive({
+// 同步选项
+type SyncOptions = {
+  page_number: number
+  page_size: number
+}
+const syncOptions = reactive<SyncOptions>({
   page_number: 1,
   page_size: 50
 })

---

84-89: Add role and live-region to error message for a11y

Screen readers won’t announce updates unless marked as alerts or live regions.

-      <div
-        v-if="errorMessage"
-        class="p-2 bg-destructive/10 border border-destructive/20 rounded text-xs text-destructive"
-      >
+      <div
+        v-if="errorMessage"
+        role="alert"
+        aria-live="polite"
+        class="p-2 bg-destructive/10 border border-destructive/20 rounded text-xs text-destructive"
+      >

---

58-61: Announce sync results to assistive tech

Make the results region live so changes (imported/skipped/errors) are announced.

-      <div v-if="syncResult" class="flex items-center gap-1 text-xs">
+      <div v-if="syncResult" class="flex items-center gap-1 text-xs" aria-live="polite">

---

157-159: Gate console logging behind DEV or switch to a user-facing toast

Avoid noisy logs in production builds.

-    if (result.imported > 0) {
-      console.log('MCP servers imported successfully:', result)
-    }
+    if (result.imported > 0 && import.meta.env.DEV) {
+      console.debug('MCP servers imported successfully:', result)
+    }

.oxlintrc.json (1)

10-15: Glob patterns likely only ignore root-level dirs; consider making them repo-wide

If you intend to ignore these folders anywhere in the repo (monorepo/packages/examples), prefer **/dir/** over dir/**. Current patterns only ignore at repo root.

Apply this diff if global ignore is desired:

-    "build/**",
-    "resources/**",
-    "scripts/**",
-    "runtime/**",
-    "docs/**",
-    "test/**"
+    "**/build/**",
+    "**/resources/**",
+    "**/scripts/**",
+    "**/runtime/**",
+    "**/docs/**",
+    "**/test/**"

build/nsis-installer.nsh (4)

77-83: Preserve and restore $5 since it’s now used for redist arch

If you adopt arch-aware redist detection, $5 is used. Preserve it like the other registers.

Apply this diff:

   Push $0
   Push $1
   Push $2
   Push $3
-  Push $4
+  Push $4
+  Push $5
@@
   ContinueInstall:
+    Pop $5
     Pop $4
     Pop $3
     Pop $2
     Pop $1
     Pop $0

Also applies to: 123-128

---

84-96: Edge: Aborting without popping preserved registers is safe here but can be balanced

Because Abort exits the installer init, the leaked stack entries won’t be observed. Still, popping before Abort keeps the stack balanced in case of future macro reuse.

If you want to be thorough, pop the saved registers just before each Abort.

---

98-121: Optional: verify the downloaded VC++ installer’s Authenticode signature

Relying solely on HTTPS and a redirect link is weaker than verifying signature. If feasible, add a signature check (e.g., via a WinVerifyTrust plugin) before ExecWait.

Do you plan to bundle or allow using a signature verification plugin (e.g., WinVerifyTrust) in your NSIS toolchain? If yes, I can draft the snippet.

---

19-75: Architecture detection approach is reasonable

Using ${RunningX64} plus env var probing for ARM64 is pragmatic and should work across common configurations. If future Windows versions change env var semantics, we can revisit with System::Call to GetNativeSystemInfo/IsWow64Process2.

scripts/generate-i18n-types.js (1)

12-12: Regex change LGTM; small hardening: safely quote non-identifier keys

The simplified character classes are equivalent. Consider JSON-stringifying non-identifier keys to handle embedded quotes safely.

-  return /^[a-zA-Z$][a-zA-Z0-9_$]*$/.test(key) ? key : `'${key}'`
+  return /^[a-zA-Z$][a-zA-Z0-9_$]*$/.test(key) ? key : JSON.stringify(key)

src/renderer/src/i18n/zh-TW/settings.json (1)

443-444: Consistency + punctuation polish for zh-TW

• Use 「設定」 instead of 「設置」 for zh-TW consistency.
• Use the ideographic comma 「、」 to separate model names inside full-width parentheses.

Apply this diff:

-    "settingsApplied": "設置已應用",
-    "bedrockLimitTip": "* 僅支援 Anthropic Claude（包括 Opus，Sonnet，Haiku 模型）"
+    "settingsApplied": "設定已套用",
+    "bedrockLimitTip": "* 僅支援 Anthropic Claude（包括 Opus、Sonnet、Haiku 模型）"

package.json (1)

60-62: Align AWS SDK client versions to minimize duplicate deps

Bedrock and Bedrock Runtime clients are on different patch levels. Aligning them helps avoid duplicate smithy packages and reduces install size.

Apply this diff:

-    "@aws-sdk/client-bedrock": "^3.840.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.842.0",
+    "@aws-sdk/client-bedrock": "^3.842.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.842.0",

src/renderer/src/i18n/ko-KR/settings.json (1)

228-228: Unify terminology and fix grammar

• Prefer “서비스 제공업체” (already used elsewhere) over “프로바이더” for consistency.
• Past tense is more natural for “settings applied”.

Apply this diff:

-    "search": "프로바이더 플랫폼 검색…",
+    "search": "서비스 제공업체 검색…",

-    "settingsApplied": "설정이 적용됩니다",
+    "settingsApplied": "설정이 적용되었습니다",

Also applies to: 443-443

src/renderer/src/i18n/zh-TW/artifacts.json (1)

41-42: Typography: use ellipsis character

Use the single-character ellipsis 「…」 to match common zh-TW typography. Optional stylistic tweak.

Apply this diff:

-  "sanitizingSvg": "正在淨化SVG內容...",
-  "svgSanitizationFailed": "SVG內容未通過安全驗證"
+  "sanitizingSvg": "正在淨化SVG內容…",
+  "svgSanitizationFailed": "SVG內容未通過安全驗證"

src/renderer/src/i18n/ja-JP/artifacts.json (1)

41-42: Natural Japanese phrasing + ellipsis

• Prefer “サニタイズ中…” for ongoing action.
• Fix grammar: 「のセキュリティ検証に失敗しました」.

Apply this diff:

-  "sanitizingSvg": "SVGコンテンツの浄化...",
-  "svgSanitizationFailed": "SVGコンテンツにセキュリティ検証に失敗しました"
+  "sanitizingSvg": "SVGコンテンツをサニタイズ中…",
+  "svgSanitizationFailed": "SVGコンテンツのセキュリティ検証に失敗しました"

src/renderer/src/i18n/zh-CN/artifacts.json (1)

39-42: SVG sanitization i18n keys added — LGTM with minor zh-CN phrasing/spacing nitpicks

The strings are clear. For zh-CN typography, adding a space around “SVG” improves readability.

Apply this diff for the three keys:

-  "sanitizingSvg": "正在净化SVG内容...",
-  "svgSanitizationFailed": "SVG内容未通过安全验证",
-  "noSvgContent": "没有可用的SVG内容"
+  "sanitizingSvg": "正在净化 SVG 内容...",
+  "svgSanitizationFailed": "SVG 内容未通过安全验证",
+  "noSvgContent": "没有可用的 SVG 内容"

src/renderer/src/components/icons/ModelIcon.vue (1)

154-169: Consolidate dark-mode invert logic and avoid repeated toLowerCase calls

Minor cleanup to reduce repetition and make it easier to append future providers.

Apply this diff to simplify the computed block:

 const invert = computed(() => {
-  if (!props.isDark) {
-    return false
-  }
-  if (
-    props.modelId.toLowerCase() === 'openai' ||
-    props.modelId.toLowerCase().includes('openai-responses') ||
-    props.modelId.toLowerCase().includes('openrouter') ||
-    props.modelId.toLowerCase().includes('ollama') ||
-    props.modelId.toLowerCase().includes('grok') ||
-    props.modelId.toLowerCase().includes('groq') ||
-    props.modelId.toLowerCase().includes('github') ||
-    props.modelId.toLowerCase().includes('moonshot') ||
-    props.modelId.toLowerCase().includes('lmstudio') ||
-    props.modelId.toLowerCase().includes('aws-bedrock')
-  ) {
-    return true
-  }
-  return false
+  if (!props.isDark) return false
+  const id = props.modelId.toLowerCase()
+  if (id === 'openai') return true
+  const invertKeys = [
+    'openai-responses',
+    'openrouter',
+    'ollama',
+    'grok',
+    'groq',
+    'github',
+    'moonshot',
+    'lmstudio',
+    'aws-bedrock',
+  ]
+  return invertKeys.some((k) => id.includes(k))
 })

src/renderer/src/i18n/ru-RU/settings.json (1)

443-445: Fix Russian phrasing: past-tense toast and Bedrock tip grammar

• “settingsApplied” should be past tense to match other locales (“Settings applied”).
• Bedrock tip: use singular verb with the brand or clarify subject.

-    "settingsApplied": "Применяются настройки",
-    "bedrockLimitTip": "* Поддерживает только Anthropic Claude (включая модели Opus, Sonnet, Haiku)"
+    "settingsApplied": "Настройки применены",
+    "bedrockLimitTip": "* Поддерживается только Anthropic Claude (включая модели Opus, Sonnet, Haiku)"

src/renderer/src/i18n/zh-CN/settings.json (1)

443-445: Bedrock tip punctuation for zh-CN

Use the ‘、’ list separator inside full-width parentheses for zh-CN.

-    "bedrockLimitTip": "* 仅支持 Anthropic Claude（包括 Opus，Sonnet，Haiku 模型）"
+    "bedrockLimitTip": "* 仅支持 Anthropic Claude（包括 Opus、Sonnet、Haiku 模型）"

src/renderer/src/i18n/ko-KR/artifacts.json (1)

40-42: Polish Korean phrasing and typographic ellipsis for clarity and correctness

• Prefer “콘텐츠” over “컨텐츠”.
• Use progressive form “정화 중…” and the ellipsis character “…” for UI status.
• Slightly refine failure phrasing.

Apply this diff:

-  "noSvgContent": "사용 가능한 SVG 컨텐츠가 없습니다",
-  "sanitizingSvg": "SVG 컨텐츠 정화 ...",
-  "svgSanitizationFailed": "SVG 컨텐츠는 보안 검증에 실패했습니다"
+  "noSvgContent": "사용 가능한 SVG 콘텐츠가 없습니다",
+  "sanitizingSvg": "SVG 콘텐츠 정화 중…",
+  "svgSanitizationFailed": "SVG 콘텐츠가 보안 검증을 통과하지 못했습니다"

src/main/presenter/llmProviderPresenter/baseProvider.ts (1)

33-33: Clarify time unit in constant name

Suffix with “_MS” and use numeric separators for readability. Keeps the value intact.

Apply this diff:

-  protected static readonly DEFAULT_MODEL_FETCH_TIMEOUT = 12000 // 提升到12秒作为通用默认值
+  protected static readonly DEFAULT_MODEL_FETCH_TIMEOUT_MS = 12_000 // 提升到12秒作为通用默认值

Note: If you apply this rename, also update references (see next comment).

src/renderer/src/i18n/en-US/artifacts.json (1)

39-42: Use Unicode ellipsis and “Failed to …” phrasing in i18n artifacts
Align with project typography and failure-style across all locales:

• Update src/renderer/src/i18n/en-US/artifacts.json:

  -  "copyImageFailedDesc": "Could not copy image to clipboard.",
  -  "sanitizingSvg": "Sanitizing SVG content...",
  +  "copyImageFailedDesc": "Failed to copy image to clipboard",
  +  "sanitizingSvg": "Sanitizing SVG content…",

• In every other artifacts.json (ru-RU, zh-TW, zh-HK, zh-CN, ko-KR, ja-JP, fa-IR, fr-FR), locate the sanitizingSvg entry and replace any ASCII ellipsis (... or ...) with the single Unicode ellipsis character (…) for consistent typography.

src/renderer/src/i18n/zh-HK/artifacts.json (1)

40-42: Add spacing around “SVG 內容” for consistency with existing keys

Elsewhere in this locale (e.g., “SVG 預覽”), “SVG” is spaced from Chinese text. Align these three new strings to that convention.

-  "noSvgContent": "沒有可用的SVG內容",
-  "sanitizingSvg": "正在淨化SVG內容...",
-  "svgSanitizationFailed": "SVG內容未通過安全驗證"
+  "noSvgContent": "沒有可用的 SVG 內容",
+  "sanitizingSvg": "正在淨化 SVG 內容...",
+  "svgSanitizationFailed": "SVG 內容未通過安全驗證"

src/renderer/src/i18n/fa-IR/artifacts.json (1)

40-42: Polish Persian translations for clarity and naturalness

These read a bit unnatural. Suggested improvements below maintain the intended meaning and better match common UI phrasing.

-  "noSvgContent": "بدون محتوای SVG در دسترس نیست",
-  "sanitizingSvg": "تصفیه محتوای SVG ...",
-  "svgSanitizationFailed": "محتوای SVG تأیید امنیتی را شکست داد"
+  "noSvgContent": "هیچ محتوای SVG در دسترس نیست",
+  "sanitizingSvg": "در حال پاک‌سازی محتوای SVG…",
+  "svgSanitizationFailed": "محتوای SVG در تأیید امنیتی پذیرفته نشد"

src/renderer/src/i18n/zh-HK/settings.json (1)

228-229: Unify provider search phrasing and punctuation; refine Bedrock tip list punctuation

• Use “服務商” consistently (drop “平台”) to align with the rest of this section.
• Use the same ellipsis style across the file (this file mostly uses “...”, not “…”).
• Prefer the Chinese list separator “、” inside full-width brackets.

-    "search": "搜尋服務商平台…",
+    "search": "搜尋服務商...",
@@
-    "settingsApplied": "設置已應用",
-    "bedrockLimitTip": "* 僅支持 Anthropic Claude（包括 Opus，Sonnet，Haiku 模型）"
+    "settingsApplied": "設置已應用",
+    "bedrockLimitTip": "* 僅支持 Anthropic Claude（包括 Opus、Sonnet、Haiku）"

Follow-up: there’s broader inconsistency in this file between “搜索” and “搜尋”, and “設定” vs “設置”. If desired, I can run through the file to normalize zh‑HK terminology in one pass.

Also applies to: 443-445

src/renderer/src/components/settings/ModelConfigDialog.vue (2)

399-401: Align contextLength max validation with the input max and i18n

The input uses a max of 10,000,000 and the i18n message also references 10,000,000, but validation allows up to 100,000,000. Align to 10,000,000 to avoid confusion.

-  } else if (config.value.contextLength > 100_000_000) {
+  } else if (config.value.contextLength > 10_000_000) {

---

492-499: Tighten detection of “supportsReasoningEffort” to valid enum values

A plain null/undefined check can produce false positives if an empty string sneaks in. Consider validating against the allowed set.

-const supportsReasoningEffort = computed(() => {
-  return config.value.reasoningEffort !== undefined && config.value.reasoningEffort !== null
-})
+const supportsReasoningEffort = computed(() => {
+  const v = config.value.reasoningEffort
+  return v === 'minimal' || v === 'low' || v === 'medium' || v === 'high'
+})

src/main/presenter/sqlitePresenter/tables/conversations.ts (1)

117-160: Insert: use SQL NULL for enabled_mcp_tools instead of string "NULL"

Minor correctness: storing the literal string "NULL" makes the column a non-null “NULL” string. Prefer actual SQL NULL.

-      settings.enabledMcpTools ? JSON.stringify(settings.enabledMcpTools) : 'NULL',
+      settings.enabledMcpTools ? JSON.stringify(settings.enabledMcpTools) : null,

src/main/presenter/deeplinkPresenter/index.ts (1)

295-304: Add size guard before decoding Base64 JSON to avoid memory blowups.

A very large code param could spike memory usage.

     try {
+      // Basic size guard (Base64 inflates ~33%)
+      if (jsonBase64.length > 1_500_000) {
+        console.error('MCP config payload too large')
+        return
+      }
       // 解码 Base64 并解析 JSON
       const jsonString = Buffer.from(jsonBase64, 'base64').toString('utf-8')

src/main/lib/svgSanitizer.ts (2)

59-66: Honor allowScripts option (currently ignored).

Option exists but scripts are always stripped. Either remove the option or gate removal by it. Gating keeps defaults secure and makes the option meaningful.

-      // 2. Remove script tags and their content
-      sanitized = this.removeScriptTags(sanitized)
+      // 2. Remove script tags and their content
+      if (!this.options.allowScripts) {
+        sanitized = this.removeScriptTags(sanitized)
+      }

---

288-291: Case-insensitive validation of opening tag.

Use a regex to accept <svg in any case and with attributes.

-    if (!output.trim().startsWith('<svg')) {
+    if (!/^\s*<svg\b/i.test(output)) {
       return false
     }

src/shared/presenter.d.ts (1)

132-135: Reduce duplication of union types with type aliases.

'minimal' | 'low' | 'medium' | 'high' and 'low' | 'medium' | 'high' appear multiple times. Consider centralizing to type ReasoningEffort and type Verbosity to keep types DRY.

Example:

export type ReasoningEffort = 'minimal' | 'low' | 'medium' | 'high'
export type Verbosity = 'low' | 'medium' | 'high'

Also applies to: 153-156

src/renderer/src/components/TitleView.vue (1)

261-274: Avoid as any when updating store config.

Prefer a properly typed payload (e.g., a Partial<CONVERSATION_SETTINGS> in the store method) to keep type guarantees.

If updating the store signature isn’t possible now, consider a local helper with a typed shape to avoid any.

src/renderer/src/components/settings/OllamaProviderSettingsDetail.vue (2)

27-35: Disable autocomplete for API key input.

Helps prevent accidental storage/fill of secrets.

           <Input
             :id="`${provider.id}-apikey`"
             v-model="apiKey"
             :type="showApiKey ? 'text' : 'password'"
             :placeholder="t('settings.provider.keyPlaceholder')"
             style="padding-right: 2.5rem !important"
+            autocomplete="off"
+            autocapitalize="off"
+            spellcheck="false"
             @blur="handleApiKeyChange(String($event.target.value))"
             @keyup.enter="handleApiKeyEnter(apiKey)"
           />

---

37-41: Minor accessibility and form-safety tweaks to the toggle button.

Explicitly set type="button" and add an aria-label.

-          <Button
+          <Button
             variant="ghost"
             size="sm"
             class="absolute right-2 top-1/2 transform -translate-y-1/2 h-7 w-7 p-0 hover:bg-transparent"
+            type="button"
+            :aria-label="showApiKey ? t('settings.provider.hideKey') : t('settings.provider.showKey')"
             @click="showApiKey = !showApiKey"
           >

src/renderer/src/i18n/en-US/settings.json (1)

443-445: Nit: polish Bedrock tip phrasing for clarity.

Minor wording improvement for end-user clarity.

Apply:

-    "bedrockLimitTip": "* Only Anthropic Claude supported (including Opus, Sonnet, Haiku models)"
+    "bedrockLimitTip": "* Only Anthropic Claude models are supported (Opus, Sonnet, Haiku)"

src/renderer/src/components/settings/ProviderApiConfig.vue (1)

45-67: Good UX addition; add small security & a11y tweaks and avoid inline !important.

• Disable autocomplete/spellcheck for API keys.
• Provide an aria-label for the eye button.
• Replace inline padding with a utility class to avoid !important.

Apply:

-        <Input
+        <Input
           :id="`${provider.id}-apikey`"
           :model-value="apiKey"
           :type="showApiKey ? 'text' : 'password'"
           :placeholder="t('settings.provider.keyPlaceholder')"
-          style="padding-right: 2.5rem !important"
+          class="pr-10"
+          autocomplete="off"
+          autocapitalize="off"
+          spellcheck="false"
           @blur="handleApiKeyChange($event.target.value)"
           @keyup.enter="$emit('validate-key', apiKey)"
           @update:model-value="apiKey = String($event)"
         />
         <Button
           variant="ghost"
           size="sm"
           class="absolute right-2 top-1/2 transform -translate-y-1/2 h-7 w-7 p-0 hover:bg-transparent"
           @click="showApiKey = !showApiKey"
+          :aria-label="showApiKey ? 'Hide API key' : 'Show API key'"
         >

src/renderer/src/components/settings/AnthropicProviderSettingsDetail.vue (1)

56-77: Consistent API key visibility toggle; add a11y and disable autocomplete.

Mirror the ProviderApiConfig improvements for consistency:

• Turn off autocomplete/spellcheck on the key field.
• Add aria-label to the toggle button.
• Use utility padding instead of inline !important.

Apply:

-          <Input
+          <Input
             :id="`${provider.id}-apikey`"
             v-model="apiKey"
             :type="showApiKey ? 'text' : 'password'"
             :placeholder="t('settings.provider.keyPlaceholder')"
-            style="padding-right: 2.5rem !important"
+            class="pr-10"
+            autocomplete="off"
+            autocapitalize="off"
+            spellcheck="false"
             @blur="handleApiKeyChange(String($event.target.value))"
             @keyup.enter="handleApiKeyEnter(apiKey)"
           />
           <Button
             variant="ghost"
             size="sm"
             class="absolute right-2 top-1/2 transform -translate-y-1/2 h-7 w-7 p-0 hover:bg-transparent"
             @click="showApiKey = !showApiKey"
+            :aria-label="showApiKey ? 'Hide API key' : 'Show API key'"
           >

src/main/presenter/devicePresenter/index.ts (1)

464-507: Consider moving the size limit to a configuration constant.

The 1MB size limit is hardcoded in the method. Consider extracting it to a constant at the class level for better maintainability and configurability.

Apply this refactor to improve maintainability:

 export class DevicePresenter implements IDevicePresenter {
+  private static readonly MAX_SVG_SIZE = 1024 * 1024 // 1MB
+
   static getDefaultHeaders(): Record<string, string> {

   ...

   async sanitizeSvgContent(svgContent: string): Promise<string | null> {
     try {
       console.log('Sanitizing SVG content, length:', svgContent.length)

       // 基本输入验证
       if (!svgContent || typeof svgContent !== 'string') {
         console.warn('Invalid SVG content provided')
         return null
       }

       // 长度限制检查
-      if (svgContent.length > 1024 * 1024) {
-        // 1MB limit
+      if (svgContent.length > DevicePresenter.MAX_SVG_SIZE) {
         console.warn('SVG content exceeds size limit')
         return null
       }

src/main/presenter/threadPresenter/index.ts (1)

1470-1491: Reduce duplication when plucking conversation settings before streaming.

You repeat the same destructuring in three places. Consider a tiny helper to fetch the latest conversation + settings bundle to keep the call sites cleaner and reduce drift if the interface evolves again.

Also applies to: 1588-1597, 3676-3685

src/renderer/src/stores/settings.ts (1)

1557-1565: Consider secure storage for long-lived cloud credentials.

ElectronStore persists in plaintext. If possible, back these with the OS keychain (e.g., keytar) and only cache ephemeral tokens/settings in ElectronStore.

src/renderer/src/components/artifacts/SvgArtifact.vue (1)

76-89: Avoid double-sanitizing on mount (watch with immediate already covers it).

The immediate watch triggers sanitize on mount; onMounted triggers it again. Remove one to avoid redundant calls.

-onMounted(() => {
-  if (props.block.content) {
-    sanitizeSvgContent(props.block.content)
-  }
-})

src/main/presenter/llmProviderPresenter/providers/ollamaProvider.ts (1)

496-506: Gate reasoning_effort behind a backend‐capability check
Passing reasoning_effort whenever modelConfig.reasoningEffort is set can trigger 4xx errors on Ollama builds that don’t recognize it. We should only spread that option if the target build actually supports it.

Suggestions:

• Maintain a list or map of models that support reasoning_effort (keyed by modelId) and only spread when modelConfig.reasoningEffort && supportedByModel(modelId, 'reasoning_effort').
• If the Ollama client offers a metadata or “listModels” endpoint, inspect each model’s capabilities for "reasoning_effort".
• As a fallback, catch a 4xx response and retry the request without the unsupported field.

Location to update:
• src/main/presenter/llmProviderPresenter/providers/ollamaProvider.ts around lines 503–506.

src/main/presenter/llmProviderPresenter/providers/openAICompatibleProvider.ts (1)

541-541: Same concern with GPT-5 detection pattern.

The same includes('gpt-5') pattern is used here for determining max_completion_tokens. This should be consistent with the logic at Line 220.

Consider extracting this logic into a helper method to maintain consistency:

+  private isGPT5Model(modelId: string): boolean {
+    return modelId.startsWith('gpt-5') || modelId.includes('/gpt-5');
+  }
+
   // Then use it in both places:
-      modelId.includes('gpt-5')
+      this.isGPT5Model(modelId)

src/renderer/src/components/settings/ModelProviderSettings.vue (1)

196-207: Consider case sensitivity in provider filtering.

The filterProviders function performs case-insensitive filtering, which is good. However, consider trimming the search query to handle accidental spaces.

 const filterProviders = (providers: LLM_PROVIDER[]) => {
-  if (!searchQuery.value.trim()) {
+  const query = searchQuery.value.trim()
+  if (!query) {
     return providers
   }
-  const query = searchQuery.value.toLowerCase().trim()
+  const lowerQuery = query.toLowerCase()
   return providers.filter(
     (provider) =>
-      t(provider.name).toLowerCase().includes(query) ||
-      provider.id.toLowerCase().includes(query) ||
-      (provider.apiType && provider.apiType.toLowerCase().includes(query))
+      t(provider.name).toLowerCase().includes(lowerQuery) ||
+      provider.id.toLowerCase().includes(lowerQuery) ||
+      (provider.apiType && provider.apiType.toLowerCase().includes(lowerQuery))
   )
 }

src/main/presenter/llmProviderPresenter/providers/awsBedrockProvider.ts (8)

96-100: Inconsistent language in error messages and logs

The codebase mixes Chinese and English in error messages and console logs. For better maintainability and international usability, consider standardizing on one language (preferably English for system logs).

-      console.error('获取AWS Bedrock Anthropic模型列表出错:', error)
+      console.error('Failed to fetch AWS Bedrock Anthropic models:', error)

-    console.log('从API获取模型列表失败，使用默认模型配置')
+    console.log('Failed to fetch models from API, using default model configuration')

---

168-169: Localization inconsistency in error messages

Similar to the previous comment, the error message uses Chinese while most of the codebase uses English.

-        return { isOk: false, errorMsg: '未初始化 AWS Bedrock SDK' }
+        return { isOk: false, errorMsg: 'AWS Bedrock SDK not initialized' }

---

186-186: Use the instance's default model instead of hardcoding

The check method hardcodes this.defaultModel but it's better to use the actual model being configured to ensure the check is valid for the specific model being used.

---

200-200: Standardize error message language

-      return { isOk: false, errorMsg: `API 检查失败: ${errorMessage}` }
+      return { isOk: false, errorMsg: `API check failed: ${errorMessage}` }

---

640-640: Remove or guard debug console.log statements

Debug logging statements should be removed or wrapped in a debug flag check before production deployment.

-    console.log('modelConfig', modelConfig, modelId)
+    // Only log in debug mode
+    if (process.env.DEBUG) {
+      console.log('modelConfig', modelConfig, modelId)
+    }

---

676-678: Consider making thinking budget configurable

The thinking budget is hardcoded to 1024 tokens. Consider making this configurable through modelConfig for better flexibility.

       if (modelId.includes('claude-3-7')) {
-        payload.thinking = { budget_tokens: 1024, type: 'enabled' }
+        payload.thinking = { 
+          budget_tokens: modelConfig.thinkingBudget || 1024, 
+          type: 'enabled' 
+        }
       }

---

794-795: Consolidate error handling for JSON parsing

There are nested try-catch blocks with similar error messages for JSON parsing. Consider consolidating the error handling.

             try {
               // Try to parse complete JSON
               const jsonStr = accumulatedJson.trim()
               if (jsonStr && (jsonStr.startsWith('{') || jsonStr.startsWith('['))) {
-                try {
-                  const jsonObject = JSON.parse(jsonStr)
-                  if (jsonObject && typeof jsonObject === 'object') {
-                    currentToolInputs = { ...currentToolInputs, ...jsonObject }
-                  }
-                } catch (e) {
-                  console.error('解析完整JSON失败:', e)
-                }
+                const jsonObject = JSON.parse(jsonStr)
+                if (jsonObject && typeof jsonObject === 'object') {
+                  currentToolInputs = { ...currentToolInputs, ...jsonObject }
+                }
               }
             } catch (e) {
-              console.error('处理累积JSON失败:', e)
+              console.error('Failed to parse accumulated JSON:', e)
             }

Also applies to: 798-799

---

910-915: Standardize error messages in stream error handling

       console.error('AWS Bedrock Claude coreStream error:', error)
       yield {
         type: 'error',
-        error_message: error instanceof Error ? error.message : '未知错误'
+        error_message: error instanceof Error ? error.message : 'Unknown error'
       }