Merge remote-tracking branch 'origin/main' into canary

.github/workflows/release-desktop-stable.yml

@@ -236,7 +236,8 @@ jobs:
         if: runner.os == 'Linux'
         run: |
           npm run desktop:package:app
-          tar -czf apps/desktop/release/lobehub-renderer.tar.gz -C out .
+          test -d apps/desktop/dist/renderer
+          tar -czf apps/desktop/release/lobehub-renderer.tar.gz -C apps/desktop/dist/renderer .
         env:
           UPDATE_CHANNEL: stable
           UPDATE_SERVER_URL: ${{ secrets.UPDATE_SERVER_URL }}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/lobehub",
-  "version": "2.1.35",
+  "version": "2.1.37",
   "description": "LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",

src/services/discover.ts

@@ -42,6 +42,29 @@ class DiscoverService {
   private _isRetrying = false;
   private _tokenRefreshPromise: Promise<void> | null = null;
 
+  private isMarketTrustedClientEnabled = (): boolean => {
+    if (typeof window === 'undefined' || !window.global_serverConfigStore) return false;
+    try {
+      const state = window.global_serverConfigStore.getState();
+      return state.serverConfig.enableMarketTrustedClient || false;
+    } catch {
+      return false;
+    }
+  };
+
+  safeInjectMPToken = async () => {
+    // If trusted client is enabled, authentication is handled by backend
+    // No need to inject M2M token from client side
+    if (this.isMarketTrustedClientEnabled()) return;
+
+    try {
+      await this.injectMPToken();
+    } catch (error) {
+      // Log error but don't block the request
+      console.warn('Failed to inject MP token, continuing without it:', error);
+    }
+  };
+
   // ============================== Assistant Market ==============================
   getAssistantCategories = async (
     params: CategoryListQuery & { source?: AssistantMarketSource } = {},
@@ -77,7 +100,7 @@ class DiscoverService {
   };
 
   getAssistantList = async (params: AssistantQueryParams = {}): Promise<AssistantListResponse> => {
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const locale = globalHelpers.getCurrentLanguage();
     return lambdaClient.market.getAssistantList.query(
@@ -129,7 +152,7 @@ class DiscoverService {
   };
 
   getMcpList = async (params: McpQueryParams = {}): Promise<McpListResponse> => {
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const locale = globalHelpers.getCurrentLanguage();
     return lambdaClient.market.getMcpList.query({
@@ -141,7 +164,7 @@ class DiscoverService {
   };
 
   getMCPPluginList = async (params: MCPPluginListParams): Promise<McpListResponse> => {
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const locale = globalHelpers.getCurrentLanguage();
 
@@ -192,7 +215,7 @@ class DiscoverService {
     const allow = userGeneralSettingsSelectors.telemetry(useUserStore.getState());
 
     if (!allow) return;
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const reportData = {
       errorCode: success ? undefined : errorCode,
@@ -218,7 +241,7 @@ class DiscoverService {
 
     if (!allow) return;
 
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     lambdaClient.market.reportCall.mutate(cleanObject(reportData)).catch((reportError) => {
       console.warn('Failed to report call:', reportError);
@@ -229,7 +252,7 @@ class DiscoverService {
     const allow = userGeneralSettingsSelectors.telemetry(useUserStore.getState());
     if (!allow) return;
 
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const payload = cleanObject({
       ...eventData,
@@ -250,7 +273,7 @@ class DiscoverService {
 
     if (!allow) return;
 
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     lambdaClient.market.reportAgentInstall.mutate({ identifier }).catch((reportError) => {
       console.warn('Failed to report agent installation:', reportError);
@@ -261,7 +284,7 @@ class DiscoverService {
     const allow = userGeneralSettingsSelectors.telemetry(useUserStore.getState());
     if (!allow) return;
 
-    await this.injectMPToken();
+    await this.safeInjectMPToken();
 
     const payload = cleanObject({
       ...eventData,

src/services/marketApi.ts

@@ -242,7 +242,7 @@ export class MarketApiService {
     pageSize: number;
     total: number;
   }> {
-    await discoverService.injectMPToken();
+    await discoverService.safeInjectMPToken();
 
     return lambdaClient.market.skill.searchSkill.query(params);
   }

src/services/mcp.test.ts

@@ -57,7 +57,7 @@ vi.mock('@/utils/electron/ipc', () => ({
 
 vi.mock('./discover', () => ({
   discoverService: {
-    injectMPToken: vi.fn().mockResolvedValue(undefined),
+    safeInjectMPToken: vi.fn().mockResolvedValue(undefined),
     reportPluginCall: vi.fn().mockResolvedValue(undefined),
   },
 }));

src/services/mcp.ts

@@ -35,7 +35,7 @@ class MCPService {
     payload: ChatToolPayload,
     { signal, topicId }: { signal?: AbortSignal; topicId?: string },
   ) {
-    await discoverService.injectMPToken();
+    await discoverService.safeInjectMPToken();
 
     const { pluginSelectors } = await import('@/store/tool/selectors');
     const { getToolStoreState } = await import('@/store/tool/store');