糖包 v1.2.1

糖包 v1.2.1

本地优先、私密可控的 AI 工作空间。

v1.2.1 迎来了桌面宠物：一只常驻桌面的精灵伙伴，会跟随糖码的运行状态做出反应；同时完成一轮覆盖全文检索、MCP 审批记忆、快捷键自定义、输入短语库与糖馆编辑体验的日常打磨；糖码的任务执行获得一轮底层提速，并新增执行耗时画像帮助定位瓶颈；底层代码与发布流程也完成了清理加固。

重点更新

糖码执行提速

糖码的任务执行完成一轮底层优化：同样的任务，步骤更少、每步更快、出字更早。

• 并行执行：同一轮里的多个只读操作（读文件、搜索代码、浏览目录等）并发执行，不再逐个排队；
• 更快出字：发出任务后更快看到首个响应——外部工具清单与技能扫描改为后台进行，不再阻塞请求；超大的项目记忆文件会自动精简后注入；
• 上下文瘦身：读取大文件时自动按需截断并支持分段续读，避免超大文件拖慢后续每一步；
• 更省的开销：事件记录与上下文计算改为增量与批量处理，长回答不再产生大量零散写入；外部工具清单保持稳定排序，模型供应商的前缀缓存得以命中，重复上下文不再全价重算；
• 执行耗时画像：用量统计新增「首字延迟」；任务运行记录提供分段耗时（模型调用、工具执行、审批等待、记录写入）与连接重试次数，时间花在哪里一目了然。

桌面宠物

全新的桌宠模块：一只透明置顶的精灵小窗常驻桌面，不占据任务栏，也不打扰正常操作。

• 九种动作状态：待机、左右走动、挥手、跳跃、失败、等待、走动与回顾，均为手绘精灵帧动画；
• 与糖码联动：任务运行、工具调用、等待审批与运行失败时，桌宠会做出对应动作并以气泡提示关键状态；
• 两种位置模式，随时切换：
  • 固定位置——拖到哪放到哪，位置自动记忆，重启后保持；
  • 自由漫游——在全屏范围内散步，会水平走动、跳跃换行，走向与动作实时匹配；悬停或拖动时自动暂停；
• 缩放范围 0.4–2.5，窗口随缩放自动扩展，画面始终完整；
• 点击穿透：鼠标不在桌宠上时直接操作下层应用，悬停本体即可互动、拖拽与打开右键菜单（换桌宠、复位位置、置顶、隐藏）；
• 自定义导入：选择一个包含精灵图（webp / png / jpg，文件名任意）的文件夹即可，格子规格可在 meta.json 中自定义，行尾空白帧自动忽略，动画不会闪烁；
• 设置 → 桌宠：所有桌宠以画廊形式预览与选择（首帧静态图 + 名称，点击切换），支持大小调节、位置复位与保持置顶；画廊中导入的桌宠可随时移除——悬停卡片出现移除按钮，确认后连同素材一并删除，删除正在使用的桌宠会自动切回内置伙伴（内置桌宠不可移除）；
• 托盘菜单与顶栏爪印按钮均可快速显示/隐藏；界面支持中英文。

快捷键自定义

设置 → 帮助新增快捷键卡：应用内与全局快捷键均支持点击录入自定义组合键，自动检测冲突、一键恢复默认，帮助面板的键位清单实时跟随当前设置；同时修复了部分安装版本中自定义快捷键不生效的问题。

MCP 审批记忆

MCP 工具的审批弹窗新增两个选项：

• 本会话不再询问：本次运行内同一工具不再重复审批；
• 永久允许此工具：写入全局授权规则，后续调用自动放行。

设置 → 提示词新增「已授权工具」清单，可随时查看与撤销；同时修复了此前 MCP 工具调用未按默认进入审批流程的问题，以及旧版本中点过「总是允许」的授权规则失效、导致重复弹窗的问题。

检索与输入效率

• 本地全文检索升级至 SQLite FTS5：会话内容检索显著提速，短查询与通配符语法保持兼容；
• 输入框新增快捷短语库：常用提示词一键插入；短语弹层向上展开并限高滚动，不再遮挡或超出窗口。

糖馆

• 修复角色编辑器的输入焦点被界面重建抢走的问题：新建与编辑角色时不再需要反复点击输入框；
• 角色卡导出：单张角色卡可导出为标准 JSON；新增「导出全部」将整库打包为合集文件，可随时重新导入，头像与世界书完整保留，方便备份与分享。

界面与体验

• 设置 → 外观新增界面语言切换（中文 / English），核心界面完成中英双语覆盖；
• 快捷短语、桌宠等新增界面元素与整体中性风格保持一致，四视口布局均已回归验证；
• 糖绘生图修复：下拉所选模型即实际调用模型，显示与调用保持一致。

数据、隐私与安全

• 桌宠与角色卡等新增数据均保存在设备本地；导入的桌宠素材仅存本机，请使用可自由分发的素材；
• Skills 默认阻断网络出站，只有明确允许的配置才开放网络；
• 工具调用、文件写入、命令执行和 MCP 调用沿用统一权限与审批边界，MCP 审批结果可按会话或全局持久化。

质量与交付

• 完成底层代码清理：移除历史遗留的重复实现，关键行为以回归测试固化；
• 发布前完成系统化验证：自动化测试全量通过、真实 SQLite 通道回归、四视口界面冒烟测试，并以自动校验脚本核对安装包与源码一致性，防止旧包误发。

升级说明

• 安装包：tangbao-1.2.1-setup.exe；
• 数据目录沿用 v1.2.0 结构，升级不迁移数据；桌宠相关设置在首次使用时初始化；
• better-sqlite3 使用 Electron ABI，开发者重新安装依赖后请运行 npm run rebuild:electron。

完整安装与配置说明见 README.md。Skills 文档见 SKILLS.md，数据结构见 DATA_MODEL.md。

糖包 Tangbao v1.2.0 · 多角色群聊 × MCP 工具扩展 × 应用内更新

糖包 Tangbao v1.2.0

本地优先、私密可控的 AI 工作空间。
把对话、创作、开发与知识工作，收进一个安静而高效的桌面环境。

v1.2.0 是一次重要的版本升级：工作区从单一对话工具，扩展为覆盖开发、创作、文档、角色与工具协作的完整桌面环境；同时完成了运行时与本地数据能力的系统升级。

三项重点

多角色群聊

糖馆支持创建由多个角色组成的独立群聊。角色按成员顺序协作发言，可以选择沉默；每条发言保留成员归属，生成过程中头像会跟随当前发言的成员。群聊上下文能够清晰区分说话人与点名对象，让多方对话保持条理。

对已经产生的多轮内容，可以只重新生成指定成员的发言，其余成员的回复原样保留，不必从头再来。

MCP 工具扩展

糖码支持接入标准 Model Context Protocol（MCP）服务器，把本地工具或团队内部服务带入 AI 编程工作流。支持 stdio 与 HTTP 两种传输方式；在设置中登记 server 后，点击「测试连接」即可确认可用性。来自不同 server 的工具以 mcp__服务id__工具名 的形式提供给糖码，首次调用默认需要审批；项目根目录也可以放置官方格式的 .mcp.json，项目配置自动覆盖全局配置。

详细的 server 配置示例见 README「糖码与 MCP」。

应用内更新

设置 → 帮助新增应用更新入口：检查新版本、下载更新，并在准备完成后一键安装。从本版起，后续升级不再需要手动下载安装包。

工作区与效率

• 用量统计：新增仪表盘，按模型查看调用次数、成功率、token 用量与平均延迟，支持最近 7 天、30 天或全部范围。
• 快捷键体系：新建会话、搜索、命令面板、切换设置与模块切换均有统一键位（Ctrl/Cmd+N / F / K / , / 1~8）；Ctrl/Cmd+=、-、0 以及 Ctrl+滚轮可缩放界面。
• 全文检索：结果直接展示命中位置附近的片段，长文档中也能快速定位目标内容。
• 参数可配：上下文压缩策略与糖馆检索预算从固定值开放为可调参数，长期使用更从容。
• 独立小窗：自定义模块支持独立窗口打开，同一模块可以多开，子窗口完整参与任务栏管理。

浮窗与视觉

• 浮窗装配开放十项独立开关，默认呈现最简洁形态；位置、尺寸与透明度记忆不受影响。
• 全新的几何像素字启动画面与应用图标；界面控件、间距与字号完成一轮统一收敛，观感更中性、更耐看。
• 联网搜索改用 Electron 网络栈，自动继承系统代理设置，无需额外配置。

数据与隐私

• 会话、设置与本地索引保存在设备上的 SQLite 与文件仓中；API Key 由操作系统密钥库保护，渲染界面不会接触明文。
• Skills 默认阻断网络出站，只有显式允许的技能才开放网络访问。
• 工具调用、文件写入、命令执行与 MCP 调用沿用统一的权限与审批边界。
• 运行时升级至 Electron 34.5.8，本地数据库能力在安装版中完整可用；首次启动新版会初始化本地数据库并同步既有数据。

使用远程模型、联网搜索或远程 MCP 服务时，请求会发送到你主动选择的服务商；请按服务商的隐私政策管理敏感内容。

升级指南

• Windows：下载 tangbao-1.2.0-setup.exe 直接覆盖安装，数据目录自动迁移；建议升级前通过应用内备份保存重要数据。
• v1.1.8 及更早版本请手动下载本版安装包；此后升级均可在 设置 → 帮助 → 检查更新 中完成。
• 安装包体积约 87MB，安装后的完整更新说明见 docs/CHANGELOG-v1.2.0.md。

完整产品介绍见 README.md。糖包以 MIT License 开源发布。

v1.1.8

Tangbao v1.1.8

v1.1.8 is the persistence-integrity, structure, and UI-system release. It fixes a v1.1.6 regression where the image-generation model partition silently reverted to the text group after a restart, completes the main-process domain split (batch F) and the renderer settings split (batch C), and — on the ui-v118 branch — delivers a ground-up neutral-professional UI redesign across every module, renames the 糖馆 module to tavern (with data migration), upgrades the default prompts for chat/糖读/糖馆, and adds work-record bars to 糖读. One SQLite schema migration (v16 → v17) accompanies the persistence fix.

ui-v118 branch: neutral-professional UI system, tavern rename, prompt upgrades

Design system

• New docs/UI-SYSTEM.md as the single-source spec: a neutral professional direction (ZCode/Linear/GitHub-like tool feel) with a dual-theme token rewrite (pure neutral grays), spacing (--sp-1..6), control-height (--ctl-h-sm|md|lg), card-padding and modal-width ladders, and a base component layer (.btn / .field / .card / .row-item / .chip / .mask / .modal).
• Accent-color RGB linkage fixed so all focus rings follow a custom accent; glass-morphism tokens retired and remapped to flat equivalents; decorative keyframes (shine / jello-press / glow-breathe) removed; the body gradient flattened to solid colors.
• Dark-mode P0 fix: an early :root close brace made parsers drop the entire dark variable block; the consistency gate now checks brace balance and dark-block presence.
• Global scrollbar spec unified; 38 font-size px literals moved onto the --fs-* ladder; pill radius banned on buttons; scripts/check-ui-consistency.js (npm run check:ui) enforces 8 FAIL rules so the system cannot regress.

Module-by-module refactor (12 review rounds)

• 糖包 chat: context-usage bar moved into the composer tools row; sidebar action rows merged and tightened; a scroll-to-bottom button available in every module.
• 糖馆 / 糖创: one horizontal card system (.lib-bar, two adaptive rows: icon+name+actions / description+tags); compact session rows with 重命名/删除/清空/导出 on a single row; character-card tags rendered inside the card; bookmark tabs aligned in four states; character-library panelization.
• 糖绘: generation errors shown as compact single-row cards; size icons rendered at true ratio with a unified global sort; the model dropdown lists only models flagged 生图.
• 糖读: preview drawer triple-close (mask / ESC / same-doc guard); operation messages display a file card + instruction instead of full text (display/payload separated).
• 糖码: tool-row buttons unified at the 28px control height, connection status merged into one button, agent view polish, equal-width Plan labels (执行/只读).
• Collapse controls unified across 糖读/糖馆/糖创: 32×32 buttons with 16px chevron SVGs (right = expand, left = collapse; 糖读's rail narrowed to 28px with a 24px toggle).

New: 糖读 work-record bars

Every document parse and every analysis (摘要/要点/翻译/拆解, including per-segment progress for long documents) produces a compact record bar reusing the 糖绘 queue-card pattern: status dot + name + result/failure reason + retry + dismiss. Failures persist as records instead of toast-only; done/canceled records auto-dismiss after 10s and failures after 60s; the list shows at most two rows (scroll for more) so the outline section keeps its space when idle.

Splash screen

Launch shows a hand-crafted pixel wordmark — "TangBao", built from a hard-coded glyph bitmap (square blocks only, no font files bundled, nothing rasterized at runtime) — with a left-to-right gray→white gradient across the columns. It sits on a crisp full-width dark band over an acrylic-blurred backdrop on Windows 11 (solid dark fallback on older systems); both the band and the page veil carry a tint of the user's custom accent color, which the main process reads from settings and passes to the splash at boot. A terminal-style block cursor blinks in that accent beside the wordmark, and about a quarter of the letter blocks shimmer in fast wandering pulses after a quick column-sweep entrance. Blocks are drawn on an integer device-pixel grid, so the letterforms stay perfectly seamless at any DPI. The splash stays on screen for at least three seconds before fading out. The main window is revealed only after the renderer reports boot complete (state restored, first view rendered, theme applied), so users no longer watch an empty frame fill in piece by piece or flash white before dark mode applies. Failsafes keep the app reachable if boot stalls: a 20s timeout and main-frame load failures both force the main window visible; reloads and macOS window recreation never re-trigger the splash.

糖馆 renamed to tavern (with data migration)

• Renamed across the codebase: module id, App.tavern, #tavernView, tavern:* IPC channels, error codes, conversation fields (tavernCharacterId), and file/directory names.
• Load-side migration: providers.tangguan → providers.tavern, settings.tangguanUi → tavernUi, and conversation fields remapped in memory; the module-sessions tangguan.json bucket is adopted into tavern.json automatically on first read (the old file is kept with a .migrated-* suffix for rollback).
• Kept intentionally for data safety: the character-library KV key tangguan:library:v1 (renaming it would orphan every character card), the tangbao-library.json storage filenames, the tg-* CSS class prefix, and a gateway alias accepting the old module id.

Prompt upgrades

• Chat default system prompt: one line → a structured spec (Markdown discipline with language-tagged code blocks, length adaptation to question complexity, honesty about uncertainty, emoji restraint, refusal of real-harm requests).
• 糖馆 roleplay: character conversations now use a neutral roleplay base — the base prompt no longer introduces itself as the 糖包 assistant, so it cannot compete with the persona; the character-card header was upgraded from "reference only" to "your identity & behavior definition"; persona-injection failures are loud (console warn + one-shot toast + debug log of the injected length) and minimal cards (name only) get an identity-lock instruction; the mature-content line neutrally states the dual-permission state (global toggle + per-card permission; no-real-harm and no-minors red lines unconditional).
• AI character draft: the English key-list prompt became a structured Chinese quality spec — ≥120-character descriptions covering appearance/personality/background, 3-6 concrete traits, 80-200-character in-character openers, example-dialogue format, 3-8 tags.
• 糖读 analysis prompts (summary/points/translate/outline) gained concrete quality requirements (what to preserve, ordering, caps, short-document handling).
• settings.prompts entries default to empty strings and fall back to these built-ins, so users without customized prompts pick the upgrades up automatically — no data migration.

Fixes

• Entering an old conversation now reliably lands at the very bottom: the full-rebuild and stamp-guard render paths use a settled scroll (immediate + double animation-frame + 250ms compensation) that covers async avatar/image height growth.
• Data-loss guards: drag-reorder no longer persists empty lists; five acceptStateRevision guards (accounts / customModules / visionModels / agentThreads / projects) plus default-project overwrite protection keep transient partial snapshots from wiping configured fields.
• Stream-watchdog timeouts now truly disconnect: when the 30s first-byte / 90s idle watchdog fires, the renderer aborts the gateway request so the upstream call is cancelled instead of lingering in the background. Previously each timed-out request kept its upstream connection alive (observed: a rate-limited provider holding requests ~180s before answering 429), so orphaned calls stacked up and exhausted the provider's concurrency quota — surfacing as 糖馆 "总是流式空闲超时". The timeout message now also points at provider rate-limiting/congestion instead of implying a local network fault.
• The topbar settings button's hover tooltip said 「API 设置」 although it opens the general settings dialog; it now reads 「设置」.

P0 fix: image model partition flag survives restart

In v1.1.6 the account settings gained a two-group model partition ("对话/文本" vs "生图") driven by an imageModel boolean flag on each model row. Users who flipped a model to the image group and kept the default image options (protocol = auto, strategy = auto, sizes empty) lost the classification on every restart:

• Root cause 1: the startup normalizer applyLoaded rebuilds each model object from a field whitelist (src/renderer/state/state.js). The whitelist carried the older optional image fields (imageProtocol / imageSizeStrategy / imageSizeFormat / imageSizes, added in v1.1.4) but never gained the newer imageModel boolean. A pure-flag row was stripped on load — and the next persist then wrote the stripped version back to disk, making the loss permanent.
• Root cause 2: the SQLite mirror could not represent any image fields at all (account_models had no image columns; both the write path in sqlite-store.js and the read path in migrator.js dropped them). Any load that fell back to SQLite also reverted configured protocol/size settings.

Fix:

• applyLoaded whitelist now round-trips imageModel.
• Schema migration 16 (v16 → v17) adds image_model INTEGER NOT NULL DEFAULT 0 and image_extra TEXT (JSON: protocol / strategy / format / sizes) to account_models; setAccountModels writes them, readState restores them.
• New test file test/agent-runtime/image-partition-persistence.test.js: vm-based applyLoaded round-trip, schema v17 migration + idempotency, and a real-SQLite round-trip wired into the Electron-ABI channel (check:sqlite).

Data note: models whose pure `imag...

糖包 Tangbao v1.1.7

糖包 v1.1.7 — 工程拆分 + 搜索修复 + 连接可靠性

工程（批次 E）

• 渲染层拆分：agent.js 3736 → 2075 行，渲染方法拆为 6 个模块
• 主进程拆分：技能 IPC 独立为 main-skills.js（createMainSkills 工厂模式）
• 测试源码 helper 改目录拼接，27 个测试文件自动覆盖后续拆分

新功能

• 命令面板 Ctrl/Cmd + K（模块切换、设置、本地搜索）
• 糖绘历史分页（20 条/页 + 加载更多）
• 糖馆世界书逐条启停开关

本地搜索修复

• 「全部」范围不再只返回技能结果（scope 白名单逻辑错误）
• 「Skill」类别精确过滤（此前混入全部数据）
• 技能枚举辅助函数经工厂返回值暴露，消除静默失败

LLM 连接可靠性

• 连接超时 30s → 60s（两条供应商路径均生效）
• 连接阶段自动重试最多 5 次（指数退避 1s/2s/4s/8s）；空闲超时/服务端错误不重试

技术债

• 引擎事件落库失败、repo-index git ls-files 失败显式告警（不再静默吞错）

487 项测试全部通过。详见 docs/CHANGELOG-v1.1.7.md

糖包 Tangbao v1.1.6

糖包 v1.1.6 — 性能与数据瘦身 + UI 质感升级

性能

• 切换卡顿根治（持久化移出切换帧、附件外置、SQLite 增量 upsert）
• 性能诊断面板（设置 → 数据）

UI

• 灵动晶莹风格升级（令牌/动效/分层/组件统一 + 语义色令牌）
• 字体体系：本地 JetBrains Mono（代码/数据），中文字体回退，字号令牌化
• 账户模型分区：对话模型与图像生成模型分开配置

糖读增强

• Q&A 历史持久化、停止生成、翻译方向、长文档分段、Word/PPT 解析、文档管理增强

数据可靠性

• 修复流式持久化断线（P0）、SQLite 兜底自愈、恢复脚本双写

487 项测试全部通过。详见 docs/CHANGELOG-v1.1.6.md

糖包 v1.1.5

Tangbao v1.1.5

v1.1.5 is the architecture-slimming and release-automation release. It converges duplicated infrastructure code, splits the agent runtime engine into focused modules, makes version bumps a one-command operation, closes the SQLite test coverage gap under Electron, and aligns the chat gateway's prompt-caching behavior with the runtime's capability checks. No user-facing workflows change; all refactors are behavior-neutral and guarded by the offline benchmark's deterministic output.

Cleanup and hygiene

• Remove the empty legacy js/ and server/ directories and fix five stale path references (index.html, main.js, chat.js, kvstore.js) that still pointed at the pre-1.1.0 layout.
• Ignore .tmp-electron-user-data/ in .gitignore so debug profiles never pollute git status.
• Decouple eval-task-contracts from a machine-bound absolute archive path: the med-007 historical-fixture case now activates via TANGBAO_EVAL_ARCHIVE_DIR and skips gracefully when unset.
• Drop the v1.1.1–v1.1.3 installers from local dist/ (build artifacts only; git was never affected).

Version automation

• check-version.js and check-release.js now derive the version from package.json (single source) instead of hardcoding it; README anchors are tightened to tangbao-<version>-setup.exe.
• New scripts/bump-version.js (npm run bump -- <version>): replaces the explicit anchor list across package files, the role registry, both runtime version constants, both release workflows, and both READMEs in one command. It preserves historical version sections, refuses to rewrite files that are not JSON-round-trip stable, supports --dry-run, warns when the version's CHANGELOG file is missing, and self-verifies via check-version. Releasing no longer requires ~11 manual edits.
• The release contract now also requires the check:sqlite script.

Infrastructure convergence

• New src/infrastructure/http/request-auth.js: tokenEqual / bearerToken / tokenMatches / createTokenChecker / isLoopbackHost are shared by the main-process static server and the agent runtime instead of being maintained twice (security-sensitive dedup), with unit tests covering timing-safe comparison, Bearer extraction, debug-mode bypass, and DNS-rebinding host checks.
• New src/core/util/clone.js and src/infrastructure/util/json.js: clone (tool-registry, module-sessions) and readJson (legacy-context, tangguan store and indexes) now have one implementation each. image-capabilities keeps its local copy because it is a UMD dual-environment module. Atomic-write helpers stay put — their serialization format is coupled to file hash checks.
• New src/application/services/ipc.js: the renderer services' IPC fault-tolerant wrappers (fs, skills, module-sessions) converge on one entry point with per-caller fallbacks and a unified enriched error shape; ipc.js is loaded before other services.
• Renderer search.js delegates to App.escapeHtml; both tangguan-store files carry explicit layering notes.

Agent runtime engine split (behavior-neutral)

The 4158-line agent-runtime-engine.js is now 3700 lines with four new focused modules; all call sites and wire behavior are unchanged, verified by the full test suite and byte-identical offline benchmark output (seed 1337, success rate 0.875):

• agent-server-http.js — HTTP transport layer: server creation, the entry guard chain (loopback Host → OPTIONS → Bearer token), CORS, JSON/SSE send helpers, and body reading, with the runtime-mutable ALLOW_ORIGIN injected as a getter. The business route table stays in the engine.
• tool-runtime.js — the 227-line tool protocol definitions (formerly LEGACY_TOOL_DEFINITIONS, now rightly named TOOL_DEFINITIONS) live next to the registry builder that consumes them, including the multi-root rootId injection.
• search-providers.js — Tavily / Bing / DuckDuckGo providers and the doSearch orchestration (a dead firstAttr helper with zero references was dropped).
• run-registry.js — the runtime state singletons (approvals, decisionsPending, jobs, approvedFiles, runAuthRegistry, sessions) plus killTree / killRunJobs / killRunSessions; the engine destructures the same instances, so no call site changed.

The remaining engine bulk (agent loop, tool implementations, handleAgent) is slated for v1.1.6, as is the renderer/main-process split deferred from this release's stretch batch.

Prompt caching alignment

• The gateway's non-OpenAI chat path now consults capabilities.promptCachingMode before injecting cache_control, matching the runtime's callLLMStream: reasoning-class models (deepseek-r1 / o1 / o3 / thinking, mode off) no longer send cache markers, and the renderer can still force-disable via promptCaching: false.
• Audit confirmed the rest of the planned feature already shipped in v1.1.3/v1.1.4 (adapter-side cache_control injection, cached-token usage normalization, model_call_metrics.cache_json persistence, cache probe and hit-rate/savings panels), so no Schema change was needed — the database stays at Schema v16.

SQLite tests under Electron

• New npm run check:sqlite runs storage-search-metrics under Electron's Node runtime (ELECTRON_RUN_AS_NODE=1, matching native ABI): the four cases that structurally skip in plain-Node npm test now execute for real. The CI ui job (which already rebuilds natives for Electron) runs this step, closing the gap that previously left real database logic covered only by the select 1 ABI smoke.

UI performance and consistency

• Remove backdrop-filter from the three always-visible large surfaces (sidebar, topbar, and every assistant message card). At 88%+ background opacity over a smooth gradient the blur contributed almost nothing visually, but forced a blur recomposite on every stream chunk, scroll, and sidebar update — the main source of visible jank on Windows. Glass blur is retained on small transient overlays (modals, dropdowns, command suggestions, approval bar, memory card) where the cost is negligible.
• Revision after user feedback: assistant message cards were left without a background by the first pass (the glass background shared a line with the removed filter); they now use a solid --panel-bg surface with a visible --border-strong edge, clearly separated from the gradient background and the light-blue user bubble in both themes.
• Unify all monospace rendering on the existing --font-mono token: ten hardcoded font stacks across three different variants (plus one inline style in the agent memory editor) now resolve identically on every platform.
• Tokenize border radii onto the six-step scale (--radius-xs/md/sm/--radius/--radius-lg/--radius-pill): 150 single-value declarations mapped, two new fine-grained tokens (xs/md) added and wired into the appearance radius slider so all corners scale together. Multi-value bubble-tail radii and circles are intentionally untouched.
• Switch-path jank (second revision): estimateTokens gains an LRU memo so re-entering a conversation no longer re-runs o200k BPE over unchanged messages (the context-usage bar and compaction decisions were the largest synchronous task on conversation switch); renderMessages now guards on a content stamp (conversation id + count + content/think length sum + last stream status) so module round-trips reuse the existing DOM; the agent (糖码) view skips its full innerHTML rebuild on module re-entry when a structural stamp (model, project, roots, collapse state, thread, run state) is unchanged — state-change re-renders inside the view are untouched.

Tangbu (image) module upgrade

Full interaction and UI upgrade per 糖绘v1.1.5升级计划.md (planned as five batches, all shipped):

• Closing the edit loop: the lightbox gains "use as reference" (one click feeds a generated or historical image back into the edit flow) plus "copy image" to clipboard. Prompt text and the reference image now survive module round-trips (draft save/restore on re-render), and preset naming uses an inline input instead of a blocking window.prompt.
• Queue feedback: visual task cards (running with live elapsed time, queued with position and removable, failed with full error on hover and retry, canceled); skeleton placeholders match the selected aspect ratio; queue status and result status are separate slots that no longer overwrite each other.
• Lightbox and grid: keyboard control (Esc/arrows), double-click zoom toggle with wheel step zoom (1–4x) and drag panning; grid cards render at the true image aspect ratio (no more fixed-height cropping of tall images); downloads are named by the actual sniffed MIME type; the lightbox shows model/ratio/time metadata.
• History storage overhaul: images move from inline base64 in settings to files under tangbao-data/images/ via new whitelisted main-process IPC (image:saveAsset/readAsset/deleteAsset) — the renderer never gains arbitrary-path file access. Settings keep a lightweight index; legacy inline entries migrate automatically on first open (files written before the index switches, re-runnable); a 500MB directory quota guards runaway growth; on save failure entries fall back to the inline format so no data is lost.
• History management: per-entry delete (removes its files), clear-all with a non-blocking confirm dialog, prompt search, view-all expansion for entries beyond four thumbnails, and per-image compare selection with model/ratio/time difference highlighting. History cap raised 30 → 200.
• First image-module media queries (≤900px / ≤560px): stacked option labels, single-column advanced params, touch-friendlier lightbox navigation, adaptive grid and history layout.

Release gates

Run the following before packaging:

npm test
npm run check:version
npm run check:storage
npm run check:perf
npm run check:electron-abi
npm run check:sqlite
npm run check:ui
npm...

糖包 v1.1.4

Tangbao v1.1.4

v1.1.4 is the module-boundary and reliability release. It adds the Tangguan character workspace, isolates module sessions, expands image-model capability handling, and makes the UI/runtime checks part of the release contract.

Tangguan character workspace

• Add a local character-card library with quick presets for a clear assistant, coding partner, study coach, and companion.
• Add AI draft preview with explicit confirmation before a draft is saved.
• Import and export common Tavern/SillyTavern fields, including character_book.entries, with bounded starter prompts and safe local avatar handling.
• Protect dirty edits and preserve the selected character/session pointer across reloads and replacement.
• Start a character-scoped chat without modifying ordinary Chat conversations. Character background and example dialogue remain style/reference context and do not replace the base prompt.

Controlled retrieval

• Add a character-isolated worldbook with keyword/tag retrieval, priority, recency decay, and a token budget.
• Keep an optional embedding index shape for future adapters, but report keyword mode when no real embedding provider is configured.
• Invalidate retrieval indexes and detail caches after worldbook edits; report corruption without damaging the character library.
• Do not introduce a global document RAG index in this release.

Module isolation

• Move Tangguan and Tangcreate conversations into the versioned tangbao-module-sessions sidecar.
• Keep module-owned providers, histories, deletion actions, empty states, and search boundaries separate from ordinary Chat state.
• Migrate legacy module conversations once while preserving the source state and active UI pointers.
• Keep Tangcreate's create entry available even when catalog search has no matches; task sessions start empty and inherit the live agent configuration.

Image capability adaptation

• Resolve image protocol, legal sizes, response format, and size format by API base plus exact model instead of applying one provider's dimensions globally.
• Add profiles for SenseNova U1/U1 Fast, GPT Image, DALL-E, and Wanx; gpt-image-2 and sensenova-u1-fast start with the common-ratio UI (1:1, 16:9, 9:16, 4:3, 3:4, plus additional ratios), then converge to an explicit provider allow-list when one is returned. Unknown models keep the same fallback without forcing a provider-specific allow-list.
• Preserve custom imageProtocol, imageSizeStrategy, imageSizeFormat, and imageSizes model settings. Normalize x, ×, and * dimensions internally and restore the provider format at the gateway boundary.
• Revalidate sizes when generating, queueing, retrying, or switching models. Learn allowed sizes from provider errors and persist the learned capability by API Base plus exact model.
• Normalize b64_json, Data URL, and remote URL responses. Remote image assets are fetched through the constrained main-process gateway before entering history.

Reliability and runtime

• Create a durable assistant placeholder before the first streaming byte and update it with request ID, sequence, and stream status.
• Preserve partial output on provider errors, timeouts, renderer reloads, and empty results; avoid duplicate stream nodes and redundant context-bar work.
• Protect account configuration from empty/incomplete snapshots: verify state persistence before writing a new secret and restore the previous account on failure.
• Keep multi-root workspaces, scoped writes, continuation/checkpoint recovery, completion gates, subagent boundaries, and redacted run evidence coherent across renderer, preload, main, and runtime layers.
• Keep API keys in the operating-system secret store; exports, backups, logs, traces, search, and character-card files remain redacted.

Storage and compatibility

• Keep the core database at Schema v16; no core SQLite migration is introduced by this release.
• Store module sessions, character data, and retrieval indexes in versioned local sidecars / kv_meta with revision checks, hashes, migration state, and rollback paths.
• Keep existing v1.1.0, v1.1.1, v1.1.2, and v1.1.3 data readable. Legacy root records continue to migrate under activeRoot/tangbao-data.
• Preserve ordinary Chat history while migrating module-owned conversations; uninstall/reinstall does not remove the active data root.

UI and performance

• Add a bounded, memory-only performance ring buffer (120 samples, disabled by default) for boot, module switch, streaming, persistence, IPC, and list metrics.
• Improve module switching, sidebar search, long-list rendering, account-model editing, Tangguan/Tangcreate library rails, and narrow-window layout behavior.
• Keep image ratio controls, model-specific size labels, collapsed rails, vertical bookmarks, and action buttons stable across desktop and compact layouts.

Release gates

Run the following before packaging:

npm test
npm run check:version
npm run check:storage
npm run check:perf
npm run check:electron-abi
npm run check:ui
npm run bench:offline
npm run check:release
git diff --check

The UI smoke suite covers desktop, small-desktop, compact, and narrow. Windows builds target NSIS; macOS builds target DMG and ZIP artifacts with checksums.

Verification snapshot

Verified in the current Windows workspace on 2026-08-15:

• npm test: 464 tests, 459 passed, 5 skipped because the invoking Node runtime cannot load the local better-sqlite3 ABI, 0 failed.
• npm run check:version: passed for version 1.1.4.
• npm run check:storage: passed with Schema v16 and the active/tangbao-data records root.
• npm run check:perf: passed; metrics are memory-only and disabled by default.
• npm run check:electron-abi: passed with Electron 31.7.7 / Node 20.18.0.
• npm run check:ui: passed for all four smoke windows.
• npm run bench:offline: passed with seed 1337, 8 tasks, 7 successes, and success rate 0.875.
• npm run check:release and git diff --check: passed.

Upgrade notes

• Back up the active data root before installing the release.
• The first startup may migrate legacy module sessions into the sidecar; the source state is preserved and the migration records its status.
• Existing API keys remain in the OS secret store. Re-entering a key is only required when the local secret service or encrypted context is unavailable.
• If the native better-sqlite3 ABI does not match the invoking Node runtime, SQLite-specific tests may be skipped; run the Electron ABI check and the Electron UI smoke suite in the release environment.

糖包 v1.1.3 稳定性收尾版

v1.1.3 稳定性收尾版

本版本完成稳定性收尾：

• 修复 SQLite 本地搜索在不同 SQLite 版本下的 scope 兼容问题。
• 修复 v16 agent_run_metrics 未知 Token 的历史数据库兼容和可重复迁移。
• 修复 Cache 指标显式命中率与节省 Token 被归一化丢失的问题。
• 增加 Linux Electron smoke 的沙箱与 Xvfb 运行兼容。
• 保持 1.1.0、1.1.1、1.1.2 历史数据可读。

验证：Node 18/20/22、Electron ABI/UI、Windows NSIS、macOS x64/arm64 构建全部通过。Eval smoke 因未配置在线密钥按 CI 规则跳过。

Windows 安装包附带 SHA-256 校验文件；安装包未签名。

糖包 v1.1.2

糖包 v1.1.2：Agent Engineering Platform

• 完成 Agent Runtime、Tool Registry、Budget、Abort、Error、Usage、Cache Telemetry 和 Trace Viewer 基础能力。
• 增加离线 Benchmark 与统一模型调用指标。
• 修复数据目录迁移后 Windows 密钥上下文不一致导致 API Key 无法读取的问题：启动时会在密钥文件一致时自动恢复旧上下文，并在失败时保留原密钥。
• 安装包：tangbao-1.1.2-setup.exe

Tangbao v1.1.1

糖包 v1.1.1

发布日期：2026-08-09

并行专家 Agent 协作

• explore / test / review 子代理统一返回结构化摘要、发现、证据、检查、步骤、工具数、耗时和错误。
• 支持最多 8 个子任务、最多 3 个并发；并发已满的任务进入队列，不自动重试失败任务。
• 父代理等待全部子任务结束后生成 aggregate；部分成功会明确标记为 degraded/blocked，完成门不会误报完全完成。
• 子代理保持只读，所有文件修改仍由父代理执行。
• 新增 subagent_queued、subagent_summary 事件，实时卡片和历史详情可查看 findings、证据路径、检查结果及失败原因。

持久化与安全

• 复用 SQLite Schema v15 的 Agent Run、事件和 WorkingState；新增只读 agent:runTree(rootRunId) 历史协作树接口。
• 文件事务统一校验真实路径，阻止已有符号链接和新建路径经外部链接越界。
• Skill Runner 在 timeout/abort 后确认子进程退出，避免挂起进程占用并发槽。

发布说明

• 权限模式文档统一为 6 档：plan / default / acceptEdits / auto / bypass / sandbox。
• CI 增加依赖安装、全量 npm test、JS 语法检查和 Electron 构建检查。
• Provider Canary 没有密钥时跳过，不影响离线测试；本版本不自动重试子代理，也不新增 Schema v16。