Languages: English · 简体中文 · Español · हिन्दी · العربية · বাংলা · Português · Русский · 日本語 · Deutsch · Français · Bahasa Indonesia · اردو · मराठी · తెలుగు · Türkçe · தமிழ் · 한국어 · Tiếng Việt · Italiano · Polski · Українська · Nederlands · ไทย · ગુજરાતી · Bahasa Melayu · ಕನ್ನಡ · فارسی · Svenska · Čeština
A self-hosted, multi-user local AI Agent Loop Engineering system (desktop + browser + mobile) / Powered By AI Genius Institute,AI光剑.
Introduction · Core Capabilities · Quick Start · Technical Architecture · Contributions
DeepThink, an Open Source Enterprise-grade Autonomous Agent self-evolving superintelligence platform, is a pioneer in the transition from Harness Engineering to the Loop Engineering paradigm and a new generation of AI Infrastructure (AI Infra) for enterprise customers. The DeepThink platform centers on a multi-Agent collaboration framework, fusing AI Coding, Self-Evolving, Full-Stack Observability, Bug Auto-Fix Loop, and Human-Agent Symbiosis to build an enterprise-grade AI system that continuously learns, self-improves, and ultimately grows into a superintelligence:
- AI Autonomous R&D Platform — Agents independently complete the full software development lifecycle, eliminating the need for human engineers on routine coding tasks
- Self-Evolving Agent Engine — Agents continuously learn from errors, absorb knowledge from the codebase, and evolve from user feedback
- Programmer-Agent Collaboration Hub — Every programmer owns a personal "Development Project" containing multiple parallel sessions, with a central scheduler preventing concurrency conflicts
- Enterprise SaaS Platform — Multi-tenant isolation, tiered permissions, elastic billing, and enterprise integrations (Feishu/DingTalk/WeCom/LDAP)
- Superintelligence Incubator — Through continuous evolution, a single Agent ultimately attains the comprehensive capabilities of a full software team
"Let every enterprise own a never-stopping, continuously evolving AI super R&D team — from tool user, to code creator, ultimately growing into a self-replicating superintelligence. Let us walk together on the road to AGI."
- Native Claude Code Powered — Built on the Claude Agent SDK, with the full Claude Code CLI runtime underneath, inheriting all of its capabilities
- Harness & Loop Engineering — Versioned harness manifests (system prompt / subagents / tools / skills) with snapshot / diff / eval / promote / rollback, plus long-running autonomous task loops with per-iteration review and failure re-injection
- Agent-as-a-Service (PaaS) — Create, version, mount, share, and install DB-backed Agent definitions across tenants, with per-user quotas, admin review, and a publishable template marketplace
- Multi-User Isolation — Per-user workspaces, per-user IM channels, an RBAC permission system, invite-code registration, and audit logs; every user has an independent execution environment
- Eight-Channel Unified Routing — Feishu (streaming cards + Reactions), Telegram Bot API, QQ Bot API v2, DingTalk Stream, WeChat iLink, Discord Gateway, WhatsApp (Baileys), and the Web interface — all routed uniformly
- Multi-Engine & Multi-Provider — Pluggable code-agent engines (Claude Code / AtomCode / Codex / OpenCode) and multiple Claude API providers with three load-balancing strategies (round-robin / weighted / failover), automatic health detection and recovery
- Sandboxed Code Execution — Docker + seccomp + cgroups hardened sandbox for Python / Node / shell code execution and Chromium CDP browser automation, exposed to the Agent as MCP tools
- Billing & Usage Statistics — A complete billing system (subscription plans, wallet balance, redemption codes), per-model token usage tracking, and chart visualizations
- Mobile PWA — Deeply optimized for mobile, supports one-tap install to the home screen, fully adapted for iOS / Android
- Internationalized — 29 UI languages with native endonyms and RTL support; the Agent replies in the user's chosen language
The project draws on the containerized architecture of OpenClaw and incorporates the multi-session collaboration ideas from Claude Code's official Cowork: multiple independent Agent sessions work in parallel, each with its own isolated workspace and persistent memory, and results are delivered via IM channels.
A visual walkthrough of DeepThink's core capabilities — what each screen looks like and the value it delivers to the user.
| Channel | Connection | Message Format | Highlights |
|---|---|---|---|
| Feishu | WebSocket long connection | Streaming cards (typewriter effect) | Native streaming render, multi-card auto-split, image/file downloads to workspace, Reaction feedback, group @mention control |
| Telegram | Bot API (Long Polling) | Markdown → HTML | Long-message auto-chunking (3800 chars), images via Vision (base64), document files auto-downloaded to workspace |
| WebSocket (Bot API v2) | Streaming cards / plain text | DM + group @Bot, streaming typewriter (stream_messages), image messages (Vision), pairing-code binding |
|
| DingTalk | Stream protocol long connection | Markdown cards | AI Card streaming typewriter, message deduplication (LRU 1000 / 30min TTL), image downloads (downloadCode / contentUrl), group @mention filtering |
| iLink Bot API (Long Polling) | Plain text (2000 chars) | QR-code scan pairing, CDN image download + AES decryption, typing indicator, auto-reconnect | |
| Discord | discord.js Gateway (WebSocket) | Streaming-edit messages | Guild / DM, attachment handling, 2000-char auto-split, ack Reaction, 500ms throttled streaming-edit replies |
| Baileys (WhatsApp Web protocol) | Markdown → plain text | QR / pairing-code login, multi-file auth state, media (image/video/audio/document) downloads, group participant events | |
| Web | WebSocket real-time | Streaming Markdown | Image paste/drag-upload, virtual scrolling, Mermaid chart rendering, image lightbox |
Each user can independently configure their own IM channels (Feishu app credentials, Telegram Bot Token, QQ Bot credentials, DingTalk Client ID/Secret, WeChat iLink Token, Discord Bot Token, WhatsApp QR) without interfering with each other. Messages are uniformly routed: messages from each channel reply to that channel, and messages from the Web reply on the Web.
DeepThink supports pluggable code-agent engines and multiple API providers for high-availability deployment:
- Pluggable engines — Select per session between Claude Code, AtomCode, Codex, and OpenCode; the Engines page shows a unified availability dashboard and manages each engine's daemon lifecycle
- Three load-balancing strategies — Round-Robin, Weighted, Failover
- Automatic health detection — Consecutive error tracking (3 errors by default marks unhealthy), 5-minute auto-recovery probing
- Per-group provider switching — The monitoring page lets you specify which provider each workspace uses
- OAuth credential support — Supports Claude Code OAuth Tokens, compatible with all authentication methods; sticky provider selection avoids cross-OAuth thinking-block signature failures
- Active session counts — Real-time display of concurrent usage per provider
Built on the Claude Agent SDK; the SDK invokes the full Claude Code CLI underneath.
- Per-user primary workspace — Each user has a fixed primary workspace (admin uses host mode, member uses container mode); IM messages are routed to their respective primary workspaces
- Host mode — Agent runs directly on the host, accessing the local filesystem with zero Docker dependency (default mode for the admin primary workspace)
- Container mode — Docker-isolated execution, non-root user, 40+ preinstalled tools (default mode for the member primary workspace)
- Multi-session concurrency — Up to 20 containers + 5 host processes running simultaneously, session-level queue scheduling
- Script tasks — Scheduled tasks support both Agent and Script execution types; Script mode directly executes shell commands
- Custom working directory — Each session can configure
customCwdto point to a different project - Automatic failure recovery — Exponential-backoff retry (5s → 80s, up to 5 attempts); context-overflow auto-compression with history archiving
Administrators can snapshot, diff, eval, promote, and roll back the model's harness — the full set of system prompt, subagents, tools, and skills — as versioned manifests. Each harness version can be behavior-evaluated with evidence-based judging before promotion, so you can safely evolve an Agent's configuration and instantly roll back a regression.
Long-running autonomous task loops that keep working after you walk away. Six loop modes are supported — goal, loop, schedule, proactive, adaptive, and skill_evolution. Each iteration is reviewed by the SDK and failure reasons are re-injected into the next iteration, closing the self-improvement loop. Loops are driven by slash commands and surface live loop_start / loop_iteration_start / loop_iteration_end / loop_goal_check / loop_review_result / loop_end stream events.
A multi-tenant platform for turning Agents into shareable, installable products:
- DB-backed Agent definitions — Create and version Agent definitions with snapshots, mounts, collaborators, and shares
- Admin review workflow — Per-user quotas and admin approval before publishing
- Install & mount — Install a shared Agent into your own workspace; mount it into a session on demand
- Marketplace — Admin-publishable template marketplace (agent / mcp / skill / kb templates) with browse, rate / review, report, and one-click install, plus idempotent startup seeding
Per-user knowledge bases that ground the Agent in your own documents:
- FTS5 full-text search — Built-in SQLite FTS5 indexing across mounted documents
- Vector embeddings — Optional OpenAI-compatible embedding endpoint for semantic retrieval
- Document extraction — Plain-text extraction from PDF / DOCX / MD / etc. for indexing, plus LibreOffice → PDF preview for Office documents
kb_searchMCP tool — Agents query mounted KBs directly at runtime
A hardened sandbox for running untrusted code and driving a browser, exposed to the Agent as MCP tools:
- Docker + seccomp + cgroups — Hardened isolation with a seccomp profile and resource limits
- Code execution —
sandbox_run_code/sandbox_closefor Python, Node, and shell, in session or single-exec mode - Browser automation —
sandbox_browser_navigate/_click/_type/_screenshot/_evaluatedriving a Chromium CDP target via the in-sandbox forwarder
First-class support for Claude Code Plugins:
- Per-user enable/disable — Each user opts into plugins independently; changes take effect on the next new session (the UI prompts accordingly)
- Immutable content-hashed catalog — Admin scans the host once to build a shared catalog; plugin snapshots are content-addressed and immutable
- Dependency preflight — Best-effort check of
commands/*.mdallowed-toolsand hook commands before materialization, with a manual override table - Runtime materialization — Per-user enabled refs are materialized into versioned
--plugin-dirpaths at spawn time
A dual layer for defining custom Agents:
- Global agents — Edit
~/.claude/agents/*.mddirectly from the Web UI - DB-backed user Agents — Versioned snapshots, workspace mounts, collaborators, and share links
- Host-capability preflight — Validates that the host has the required tools before an Agent runs
A DAG visualization of Agent execution — every node (turn / tool / review / goal_check / skill / subagent) is rendered as a navigable graph with user annotations and client-side rerun / continue-from-here, giving full-stack observability into how an Agent reached its answer.
- Supervisor SubAgent — An opt-in per-chat intent parser that pre-triages incoming messages (
clarify/delegate/auto) before the main Agent runs, reducing wasted work on ambiguous requests - Internationalization — 29 UI languages with native endonyms and RTL flags; the chosen language is injected into Agent prompts so replies match the user's language
Multiple independent conversations are supported within the same workspace, each with its own context and session:
- Conversation tabs — Draggable tab bar; supports creating, renaming, and deleting conversations
- Per-conversation IM binding — Each conversation can independently bind to an IM channel
- Custom Agent definitions — Create custom SubAgents (e.g., code-reviewer, web-researcher), reusing the Claude Agent SDK's
agentsoption - Independent session persistence — Each conversation maintains its own Claude session, fully isolated
The Agent's thinking and execution process is pushed to the frontend in real time across 30+ stream-event types (text, thinking, tool use, hooks, tasks, memory recall, loops, usage, todo, context audit, and more):
- Thinking process — Collapsible Extended Thinking panel, streamed character by character
- Tool-call tracing — Tool name, execution duration, nesting depth, input-parameter summary
- Call-trail timeline — The last tool-call records for quick backtracking
- Hook execution status — PreToolUse / PostToolUse Hook start, progress, and result
- Loop events — Live
loop_iteration_*andloop_review_resultevents for autonomous loops - Streaming Markdown rendering — GFM tables, code highlighting, Mermaid charts, image lightbox
- Share as image — Export messages as shareable images
- Feishu streaming cards — Native typewriter effect, three-tier fallback chain (Streaming → CardKit v1 → Legacy), multi-card auto-split, 100K-char single-element support
- DingTalk / QQ / Discord streaming — Native streaming-card / streaming-edit typewriter effects per channel
Complete subscription and usage billing system (click to expand)
A billing system designed for multi-user deployment, supporting flexible billing modes:
- Subscription plan management — Admins create billing plans, setting price, token quota, and validity period
- User wallet — Each user has an independent balance, supporting top-ups and consumption
- Redemption code system — Create redemption codes with maximum usage counts and expiration times
- Per-model token tracking — Token usage records precise to the model level (input/output/cache)
- Cost calculation — Automatically calculates cost in USD based on model pricing
- Admin console — Plan CRUD, user-balance management, redemption-code management, billing audit logs
- Quota checks — Automatically checks user quota and balance before requests; blocks execution when exceeded
- Token usage breakdown — Input tokens, output tokens, cache read/create tokens, each tracked independently
- Cost calculation — Automatically calculates cost per model, with USD formatting
- Multi-dimensional filtering — Filter flexibly by user, model, and time range (7/14/30/90 days)
- Chart visualization — Bar charts and pie charts showing usage trends and distribution
- Admin view — Admins can view usage data for all users
At runtime the Agent can communicate with the main process via the built-in MCP Server (22 unconditional + 5 conditional):
| Tool | Description |
|---|---|
send_message / send_image / send_file |
Send a message, image, or file to a user/group immediately while running |
schedule_task / list_tasks / update_task |
Create scheduled/recurring/one-time tasks (cron / interval / once); list and update them |
pause_task / resume_task / cancel_task |
Pause, resume, cancel tasks |
register_group |
Register a new group (admin primary workspace only) |
install_skill / uninstall_skill / create_skill |
Install, uninstall, or create a Skill (primary workspace only) |
memory_append / memory_search / memory_get |
Append, full-text-search, and read workspace memory files |
kb_search |
Search mounted knowledge bases (FTS5 + optional vector embeddings) |
sandbox_run_code / sandbox_close |
Run Python / Node / shell code in the hardened sandbox; close a sandbox session |
sandbox_browser_navigate / _click / _type / _screenshot / _evaluate |
Drive a Chromium CDP browser inside the sandbox |
discord_get_server_info / discord_get_channel_info / discord_get_history |
Read Discord server / channel metadata and message history |
- Three scheduling modes — Cron expressions / fixed interval / one-time execution
- Two execution types — Agent (launches a full Claude Agent) / Script (directly executes shell commands)
- Two context modes —
group(executes in a specified session) /isolated(independent isolated environment) - Notification channels — On task completion, notify a specified IM channel (Feishu / Telegram / QQ / DingTalk / WeChat / Discord)
- Full execution logs — Duration, status, result, all managed via the Web interface
The Agent autonomously maintains persistent cross-session memory:
- User global memory —
data/groups/user-global/{userId}/CLAUDE.md; each user has an independent global memory, readable by all sessions - Session memory —
data/groups/{folder}/CLAUDE.md, private to the session - Date memory —
memory/YYYY-MM-DD.md, for time-sensitive information - Conversation archive — PreCompact Hook automatically archives to
conversations/before context compression - Full-text search — Online editing + search from the Web interface
Each workspace can independently configure its own runtime environment:
- Per-workspace MCP Servers — Add stdio or HTTP MCP Servers to a workspace, independent of the global config
- Per-workspace Skills — Install specific Skills for a workspace, enabled on demand
- Per-workspace environment variables — Group-level environment-variable overrides, higher priority than global config
- Shared workspace members — Multiple users can join the same workspace to collaborate
- Cross-group ACL — A pure authorization function governs inter-group IPC routing (folder / user / bound-IM rules) so non-home Agents can safely message bound channels
A flexible mechanism for binding IM channels to workspaces:
- Workspace-level binding — Bind an IM group/DM to a specified workspace or specific conversation
- Feishu topic-group mapping — After binding a Feishu topic group, each topic is automatically mapped to an independent session with its own context; the workspace switches to a vertical topic-list navigation
- Slash-command management —
/bind <target>to bind,/unbindto unbind,/whereto view the current binding,/new <name>to create a new workspace and bind - Web settings management — View and manage all IM bindings from the settings page
- Project-level Skills — Placed in
container/skills/, auto-mounted on all containers - User-level Skills — Placed in
~/.claude/skills/, auto-mounted on all containers - Workspace-level Skills — Install Skills for a specific workspace via the Web interface
- No image rebuild needed; volume mounts + symlinks enable auto-discovery
A complete terminal based on xterm.js + node-pty: WebSocket connection, draggable resizable panel, operate containers directly from the Web interface.
Build Docker images with one click from the Web monitoring page; build logs are streamed in real time via WebSocket — no need to run commands in a terminal manually.
A Progressive Web App optimized for mobile, installable to the home screen from a mobile browser in one tap:
- Native experience — Full-screen mode, standalone app icon, visually indistinguishable from a native app
- Responsive layout — Mobile-first design; chat interface, settings pages, and monitoring panels all adapt to small screens
- iOS / Android adaptation — Safe-area handling, scroll optimization, font rendering, touch interaction
- Always available — Anytime, anywhere; pull out your phone to chat with the AI Agent, check execution status, and manage tasks
- Full file browser — Tree-view directory structure, file-type icons
- File operations — Upload (50MB limit, drag-and-drop supported) / download / delete / create directory
- File preview — Online text-file viewing, image preview + lightbox, Markdown rendering, Office-document → PDF preview
- Security — Path-traversal protection + system-path protection
| Capability | Description |
|---|---|
| User isolation | Each user has an independent primary workspace (home-{userId}), working directory, and IM channel |
| Personalization | Users can customize AI name, avatar emoji / color / uploaded image |
| RBAC | 5 permissions, 4 role templates (admin_full / member_basic / ops_manager / user_admin) |
| Registration control | Open registration / invite-code registration / closed registration |
| Audit logs | 18 event types, full operation tracking |
| Encrypted storage | API keys encrypted with AES-256-GCM; Web API returns only masked values |
| Mount security | Whitelist validation + blacklist pattern matching (.ssh, .gnupg, and other sensitive paths) |
| Terminal permissions | Users can access the Web terminal of their own container (not supported in host mode) |
| Login protection | 5 failures lock for 15 minutes, bcrypt 12 rounds, HMAC Cookie, 30-day session validity |
| Session management | View and delete active login sessions; supports multi-device management |
| CORS / WS defense | Configurable allowed origins; WebSocket upgrade rejects non-allowlisted origins with 403 (CSWSH defense) |
| PWA | One-tap install to the phone home screen, deeply optimized for mobile, use the AI Agent anytime, anywhere |
Before you begin, ensure the following dependencies are installed:
Required
-
Node.js >= 20 — Runs the main service and frontend build
- macOS:
brew install node - Linux: See NodeSource or use
nvm - Windows: Download from the official site
- macOS:
-
Docker — Runs Agents in container mode and the code-execution sandbox (required for member users; admin host-only mode can skip this)
- macOS: OrbStack recommended (lighter), or Docker Desktop
- Linux:
curl -fsSL https://get.docker.com | sh - Windows: Docker Desktop
-
Claude API Key — Official Anthropic or compatible relay services (various Coding Plans); configure it in the Web interface after launch
Optional (only if you want the corresponding IM channel)
- Feishu enterprise self-built app credentials — create at the Feishu Open Platform
- Telegram Bot Token — obtain via @BotFather
- QQ Bot credentials — create at the QQ Open Platform
- DingTalk Bot credentials — create at the DingTalk Open Platform
- WeChat iLink Bot Token
- Discord Bot Token — create at the Discord Developer Portal
- WhatsApp account — scan a QR code on first launch (Baileys protocol)
The Claude Code CLI does not need to be installed manually — the Claude Agent SDK bundled as a project dependency already includes the full CLI runtime, and it is installed automatically on the first
make start.
# 1. Clone the repository
git clone https://github.com/AIGeniusInstitute/deep-think.git
cd deepthink
# 2. One-tap launch (auto-installs dependencies + compiles on first run)
make start
Open: http://localhost:9898
For public access, configure a reverse proxy with nginx/caddy yourselfFollow the setup wizard to complete initialization:
- Create an admin — Customize username and password (no default account)
- Configure Claude API — Fill in the API key and model (relay services supported; multiple providers configurable)
- Configure IM channels (optional) — Feishu / Telegram / QQ / DingTalk / WeChat / Discord / WhatsApp
- Start chatting — Send a message directly from the Web chat page
All configuration is done via the Web interface, with no config files required. API keys are stored AES-256-GCM encrypted.
The admin user defaults to host mode (no Docker needed) and works out of the box. For container mode (used automatically by member users after registration):
# Build the container image
./container/build.sh
# (Optional) Build the hardened sandbox image for code execution + browser automation
make sandbox-buildA container-mode primary workspace (home-{userId}) is created automatically when a new user registers — no extra configuration needed.
-
Go to the Feishu Open Platform and create an enterprise self-built app
-
Under the app's "Event Subscriptions", add:
im.message.receive_v1(receive messages) -
Under the app's "Permission Management", enable the following permissions:
cardkit:card:write(create and update cards)im:chat/im:chat:read/im:chat:readonly(group information)im:message(send messages)im:message.group_at_msg:readonly(receive group @ messages)im:message.group_msg(receive all group messages) — sensitive permission, requires admin approval. Without it, only @-Bot messages are processed in groupsim:message.p2p_msg:readonly(receive private-chat messages)im:resource(get and upload image/file resources)
-
Publish the app version and wait for approval
-
In the DeepThink Web interface, under "Settings → IM Channels → Feishu", fill in the App ID and App Secret
Each user can independently configure Feishu app credentials in their personal settings, enabling per-user Feishu Bots.
Group mention control: By default, groups require @-Bot to respond. Use
/require_mention falseto switch to all-message response (requires theim:message.group_msgpermission).
Feishu topic groups: After binding a Feishu topic group (
chat_mode=topicorgroup_message_type=thread) to a workspace, each topic automatically creates an independent session Agent with its own context and message history. The Web interface switches to a vertical topic list with search and delete support. Unbinding automatically cleans up all topic sessions.
- In Telegram, find @BotFather, send
/newbotto create a Bot - Save the returned Bot Token
- In the DeepThink Web interface, under "Settings → IM Channels → Telegram", fill in the Bot Token
- Group usage: To use the Bot in a Telegram group, send
/mybotsin BotFather → select the Bot → Bot Settings → Group Privacy → Turn off; otherwise the Bot can only receive/command messages
- Go to the QQ Open Platform, scan the QR code with mobile QQ to register and log in
- Create a bot, set the name and avatar
- On the bot management page, get the App ID and App Secret
- In the DeepThink Web interface, under "Settings → IM Channels → QQ", fill in the App ID and App Secret
- Pairing: Generate a pairing code on the settings page, then send
/pair <pairing-code>to the Bot in QQ to complete binding
QQ Bot uses the official API v2 protocol, supporting C2C private chats and group @-Bot messages. In groups, the Bot only receives @-Bot messages. Supports streaming typewriter replies in C2C chats.
- Go to the DingTalk Open Platform and create an enterprise internal app
- Under App Management → Bots & Messaging, enable "Bot Configuration"
- Select Stream mode (not HTTP callback mode) to receive messages
- Get the app's Client ID (AppKey) and Client Secret (AppSecret)
- In the DeepThink Web interface, under "Settings → IM Channels → DingTalk", fill in the Client ID and Client Secret
DingTalk Bot supports both DM and group chats. In groups, the Bot only responds to @-Bot messages. Supports AI Card streaming typewriter effect.
- In the DeepThink Web interface, under "Settings → IM Channels → WeChat", enable the WeChat channel
- Fill in the iLink Bot Token
- Click "Scan to Pair" to generate a QR code
- Scan the QR code with WeChat to complete binding
WeChat messages are limited to 2000 characters; excess content is automatically chunked. Images from the WeChat CDN are downloaded and AES-decrypted before being passed to the Agent.
- Go to the Discord Developer Portal and create an application
- Under the "Bot" tab, create a bot and copy its Token
- Under "OAuth2 → URL Generator", select the
botand (optionally)applications.commandsscopes, pick the required permissions (Send Messages, Read Message History, Attach Files), and open the generated URL to invite the bot to your server - In the DeepThink Web interface, under "Settings → IM Channels → Discord", fill in the Bot Token
Discord supports both guild (server) channels and DMs. Long messages are auto-split at 2000 chars; replies use a 500ms-throttled streaming-edit typewriter effect, and an ack Reaction is added when the Agent starts working.
- In the DeepThink Web interface, under "Settings → IM Channels → WhatsApp", enable the WhatsApp channel
- Click "Generate QR Code"
- Scan the QR code with WhatsApp on your phone (Settings → Linked Devices)
- Wait for the connection to establish
WhatsApp integration uses the community-maintained Baileys library (WhatsApp Web protocol). Login state is persisted with multi-file auth, so you only scan the QR on first launch. Media (image / video / audio / document) messages are downloaded to the workspace. See
docs/channels/whatsapp.mdfor details and risk notes.
In Feishu / Telegram / QQ / DingTalk / WeChat / Discord / WhatsApp, messages starting with / are intercepted as slash commands (unknown commands fall back to being treated as normal messages):
| Command | Alias | Purpose |
|---|---|---|
/list |
/ls |
List all workspaces and conversations |
/status |
- | View the current workspace/conversation status |
/where |
- | View the current binding location and reply policy |
/bind <target> |
- | Bind to a specified workspace or Agent (e.g., /bind myws or /bind myws/a3b) |
/unbind |
- | Unbind back to the default workspace |
/new <name> |
- | Create a new workspace and bind the current group to it |
/recall |
/rc |
AI-summarized recent conversation history |
/clear |
- | Clear the current conversation's session context |
/require_mention |
- | Toggle group response mode: true (require @) or false (respond to all) |
| Mode | Description | Target | Prerequisites |
|---|---|---|---|
| Host mode | Agent runs directly on the host, accessing the local filesystem | Admin primary workspace (folder=main) |
Claude Agent SDK (auto-installed) |
| Container mode | Agent runs isolated in a Docker container, 40+ preinstalled tools | Member primary workspace (folder=home-{userId}) |
Docker Desktop + built image |
The admin primary workspace defaults to host mode; a container-mode primary workspace is auto-created on member registration. You can also switch execution modes manually from the Web interface's session management.
The container image is based on node:22-slim and ships with the following tools:
| Category | Tools |
|---|---|
| AI / Agent | Claude Code CLI, Claude Agent SDK, MCP SDK |
| Browser automation | Chromium, agent-browser |
| Programming languages | Node.js 22, Python 3 (pip / venv), Go |
| Build toolchain | build-essential, cmake, pkg-config |
| Text search | ripgrep (rg), fd-find (fd) |
| Multimedia processing | ffmpeg, ImageMagick, Ghostscript, Graphviz |
| Document conversion | Pandoc, poppler-utils (PDF tools) |
| Database clients | SQLite3, MySQL Client, PostgreSQL Client, Redis Tools |
| Network tools | curl, wget, openssh-client, dnsutils, iputils-ping, lsof |
| Feishu CLI | feishu-cli (prebuilt binary + Skills) |
| Shell | Zsh + Oh My Zsh (ys theme) |
| Others | git, jq, tree, file, shellcheck, zip/unzip, rsync, bc, patch |
flowchart TD
subgraph 接入层
Feishu("飞书<br/>(WebSocket 长连接)")
Telegram("Telegram<br/>(Bot API)")
QQ("QQ<br/>(Bot API v2)")
DingTalk("钉钉<br/>(Stream 长连接)")
WeChat("微信<br/>(iLink Bot API)")
Discord("Discord<br/>(Gateway WS)")
WhatsApp("WhatsApp<br/>(Baileys)")
Web("Web 界面<br/>(React 19 SPA)")
end
subgraph 主进程["主进程 (Node.js + Hono)"]
Router["消息路由<br/>(2s 轮询 + 去重)"]
Queue["并发队列<br/>(20 容器 + 5 宿主机进程)"]
Scheduler["定时调度器<br/>(Cron / 间隔 / 一次性)"]
WS["WebSocket Server<br/>(流式推送 + 终端)"]
Auth["认证 & RBAC<br/>(bcrypt + HMAC Cookie)"]
Config["配置管理<br/>(AES-256-GCM 加密)"]
ProviderPool["提供商池 / 引擎<br/>(Claude/AtomCode/Codex/OpenCode)"]
Billing["计费引擎<br/>(Plan + Wallet + Quota)"]
Harness["Harness / Loop<br/>(版本化 + 自主循环)"]
PaaS["PaaS / Marketplace<br/>(Agent 即服务)"]
end
subgraph 执行层
Host["宿主机进程<br/>(Claude Code CLI)"]
Container["Docker 容器<br/>(agent-runner)"]
Sandbox["沙箱<br/>(代码执行 + 浏览器)"]
end
subgraph Agent["Agent 运行时"]
SDK["Claude Agent SDK<br/>(query 循环)"]
MCP["MCP Server<br/>(27 个工具)"]
Stream["流式事件<br/>(30+ 种类型)"]
end
KB[("知识库<br/>(FTS5 + 向量)")]
DB[("SQLite<br/>(WAL 模式)")]
IPC["IPC 文件通道<br/>(原子读写)"]
Memory["记忆系统<br/>(CLAUDE.md + memory/)"]
Feishu --> Router
Telegram --> Router
QQ --> Router
DingTalk --> Router
WeChat --> Router
Discord --> Router
WhatsApp --> Router
Web --> Router
Router --> Queue
Queue --> ProviderPool
ProviderPool --> Host
ProviderPool --> Container
ProviderPool --> Sandbox
Scheduler --> Queue
Billing --> Queue
Harness --> ProviderPool
PaaS --> ProviderPool
Host --> SDK
Container --> SDK
Sandbox --> SDK
SDK --> MCP
SDK --> Stream
SDK --> KB
MCP --> IPC
IPC --> Router
Stream --> WS
WS --> Web
Router --> DB
Auth --> DB
Billing --> DB
SDK --> Memory
class Feishu,Telegram,QQ,DingTalk,WeChat,Discord,WhatsApp,Web fe
class Router,Queue,Scheduler,WS,Auth,Config,ProviderPool,Billing,Harness,PaaS svc
class DB,KB db
class Host,Container,Sandbox faas
class SDK,MCP,Stream faas
class IPC cfg
class Memory cfg
Data flow: Messages enter the main process from the access layer (8 channels), are deduplicated and routed, then dispatched to the concurrency queue. The queue selects an API key / engine via the provider pool and starts a host process, Docker container, or sandbox. The agent-runner inside the container calls the Claude Agent SDK's query() function. Streaming events (30+ types: thinking, text, tool calls, hooks, tasks, memory recall, loops, usage, etc.) are passed back to the main process via the stdout marker protocol, then broadcast to Web clients via WebSocket or replied to each channel via IM APIs. The MCP Server provides 27 tools over a file-based IPC channel, enabling bidirectional communication between the Agent and the main process. The billing engine checks quota and balance before each request. The Harness/Loop layer snapshots and evolves the Agent's configuration and drives autonomous task loops.
| Layer | Technologies |
|---|---|
| Backend | Node.js 22 · TypeScript 5.9 · Hono · better-sqlite3 (WAL) · ws · node-pty · Pino · Zod 4 |
| Frontend | React 19 · Vite 6 · Zustand 5 · Tailwind CSS 4 · shadcn/ui · Radix UI · Lucide Icons · react-markdown · mermaid · recharts · @dnd-kit · xterm.js · @tanstack/react-virtual · PWA |
| Agent | Claude Agent SDK · Claude Code CLI · MCP SDK · IPC file channels |
| Engines | Claude Code · AtomCode · Codex · OpenCode (pluggable, daemon-managed) |
| PaaS | DB-backed Agent definitions · template marketplace · per-user quotas · admin review |
| Harness / Loop | Versioned harness manifests · autonomous task loops · per-iteration SDK review |
| Sandbox | Docker + seccomp + cgroups · Chromium CDP browser automation |
| Container | Docker (node:22-slim) · Chromium · agent-browser · Python · Go · 40+ preinstalled tools |
| Security | bcrypt (12 rounds) · AES-256-GCM · HMAC Cookie · RBAC · path-traversal protection · mount whitelist · cross-group ACL |
| IM integrations | @larksuiteoapi/node-sdk (Feishu) · grammY (Telegram) · QQ Bot API v2 · dingtalk-stream (DingTalk) · iLink Bot API (WeChat) · discord.js (Discord) · Baileys (WhatsApp) |
All runtime data lives under data/, auto-created at startup — no manual initialization required.
deepthink/
├── src/ # Backend source
│ ├── index.ts # Entry: message polling, IPC listening, container lifecycle
│ ├── web.ts # Hono app, WebSocket, static files
│ ├── routes/ # 28 route modules (auth / groups / files / config / monitor /
│ │ # memory / tasks / skills / admin / browse / agents /
│ │ # mcp-servers / plugins / usage / billing / bug-report /
│ │ # chat-trace / harness / loops / sandbox /
│ │ # agent-definitions / workspace-config / paas-admin /
│ │ # paas-agents / paas-embedding / paas-knowledge-bases /
│ │ # paas-marketplace / paas-share)
│ ├── feishu.ts # Feishu connection factory (WebSocket long connection)
│ ├── feishu-streaming-card.ts # Feishu streaming card (typewriter + three-tier fallback)
│ ├── telegram.ts # Telegram connection factory (Bot API)
│ ├── qq.ts # QQ connection factory (Bot API v2 WebSocket)
│ ├── qq-streaming-card.ts # QQ streaming card (stream_messages typewriter)
│ ├── dingtalk.ts # DingTalk connection factory (Stream protocol)
│ ├── dingtalk-streaming-card.ts# DingTalk AI Card streaming controller
│ ├── wechat.ts # WeChat connection factory (iLink Bot API)
│ ├── whatsapp.ts # WhatsApp connection factory (Baileys)
│ ├── discord.ts # Discord connection factory (discord.js Gateway)
│ ├── discord-streaming-edit.ts # Discord streaming-edit controller
│ ├── im-manager.ts # IM connection pool (per-user seven-channel management)
│ ├── im-safety/ # IM safety primitives (processing lock + stale detector)
│ ├── container-runner.ts # Docker / host process management
│ ├── group-queue.ts # Concurrency control queue
│ ├── provider-pool.ts # Multi-provider load balancing
│ ├── atomcode-daemon-manager.ts# Pluggable engine daemon lifecycle
│ ├── harness-*.ts # Harness Engineering (registry / eval / meta-loop)
│ ├── loop-orchestrator.ts # Loop Engineering orchestrator
│ ├── supervisor.ts # Supervisor SubAgent (intent triage)
│ ├── plugin-*.ts # Claude Code Plugins (catalog / importer / materializer)
│ ├── embedding.ts # KB vector embeddings
│ ├── cross-group-acl.ts # Cross-group IPC authorization
│ ├── office-converter.ts # Office → PDF preview + text extraction
│ ├── i18n-languages.ts # 29-language i18n
│ ├── billing.ts # Billing engine (plans, wallet, quota)
│ ├── runtime-config.ts # AES-256-GCM encrypted config
│ ├── task-scheduler.ts # Scheduled-task scheduler
│ ├── script-runner.ts # Script-task executor
│ ├── file-manager.ts # File security (path-traversal protection)
│ ├── mount-security.ts # Mount whitelist / blacklist
│ └── db.ts # SQLite data layer (Schema v1→v51)
│
├── web/ # Frontend (React + Vite)
│ └── src/
│ ├── pages/ # 26 pages
│ ├── components/ # UI components (chat / settings / billing / monitor / ...)
│ ├── stores/ # 21 Zustand stores
│ └── api/client.ts # Unified API client
│
├── container/ # Agent container
│ ├── Dockerfile # Container image definition
│ ├── build.sh # Build script
│ ├── sandbox/ # Hardened sandbox image (code exec + browser)
│ ├── agent-runner/ # In-container execution engine
│ │ └── src/
│ │ ├── index.ts # Agent main loop + streaming events
│ │ └── mcp-tools.ts # 27 MCP tools
│ └── skills/ # Project-level Skills
│
├── shared/ # Cross-project shared type definitions
│ ├── stream-event.ts # StreamEvent type single source of truth (30+ types)
│ ├── channel-prefixes.ts # IM channel prefix mapping (7 IM channels)
│ └── image-detector.ts # Image MIME detection
│
├── scripts/ # Build helper scripts
│ ├── sync-stream-event.sh # Sync shared/ types to each subproject
│ └── check-stream-event-sync.sh# Validate type-copy consistency
│
├── config/ # Project config
│ ├── default-groups.json # Pre-registered groups
│ ├── mount-allowlist.json # Container mount whitelist
│ └── global-claude-md.template.md # Global CLAUDE.md template
│
├── desktop/ # Desktop Electron shell (macOS / Windows / Linux)
│
├── data/ # Runtime data (auto-created at startup)
│ ├── db/messages.db # SQLite database (WAL mode)
│ ├── groups/{folder}/ # Session working directory (Agent read/write)
│ │ ├── downloads/{channel}/ # IM file downloads (by date subdirectory)
│ │ └── CLAUDE.md # Session-private memory
│ ├── groups/user-global/{id}/ # User global memory directory
│ ├── sessions/{folder}/.claude/# Claude session persistence
│ ├── ipc/{folder}/ # IPC channels (input / messages / tasks)
│ ├── env/{folder}/env # Container environment-variable file
│ ├── memory/{folder}/ # Date memory
│ └── config/ # Encrypted config files
│
└── Makefile # Common commands
make install # Install root project dependencies + compile agent-runner
make install-host-tools # Install external tools needed by host mode (feishu-cli, agent-browser, uv) + refresh builtin-skills cachemake install automatically fixes the executable permission of node-pty's spawn-helper (on macOS arm64, the prebuilt binary occasionally lacks the +x bit, which would break Web-terminal PTY mode).
make dev # Start frontend + backend in parallel (hot reload); auto-installs deps + builds container image on first run
make dev-backend # Start backend only (tsx runs TS directly, no pre-build needed)
make dev-web # Start frontend only (Vite at 5173)
make status # View service status (processes, ports, logs, Docker containers)
make logs # Stream logs live (only effective when manually backgrounded, e.g. make start > /tmp/deepthink.log 2>&1 &)
make stop # Stop the service (pm2 stop if pm2-managed, otherwise kill the port-listener process)make dev auto-detects whether package.json is newer than node_modules and re-runs make install if so; it also ensures the Docker image exists (required for container mode). If pm2 is active on the system, it pauses pm2 first to release the port and restores it on exit.
make build # Compile everything (backend + frontend + agent-runner, includes sync-types)
make build-backend # Backend only
make build-web # Frontend only
make typecheck # Full TypeScript typecheck (backend + frontend + agent-runner)
make typecheck-backend # Backend only
make typecheck-web # Frontend only
make typecheck-agent-runner # agent-runner only
make format # Format code with Prettier
make format-check # Check formatting only (for CI, no file modifications)
make test # Run constraint tests (vitest; required before/after refactoring)
make sync-types # Sync shared/ type definitions to each subproject (stream-event.ts, image-detector.ts, channel-prefixes.ts)
make clean # Clean all build artifacts (dist/, web/dist/, container/agent-runner/dist/)After modifying
shared/stream-event.ts, you must runmake sync-typesto sync to the three subprojects, otherwise types will be inconsistent.make buildandmake typechecktrigger the sync automatically.
make start # One-tap launch for production (foreground blocking, logs to terminal)
make update-sdk # Manually update the Claude Agent SDK in agent-runner + main service to the latest version
make ensure-latest-sdk # Auto-check before startup whether the SDK has a new version (update if so, skip otherwise; built into make start)
make sandbox-build # Build the hardened sandbox image deepthink-sandbox:latest (code execution + browser automation)For background running: make start > /tmp/deepthink.log 2>&1 &, then use make logs to stream logs, make status for process status, and make stop to stop the service.
make admin-create # Create an admin account (USERNAME=xxx [PASSWORD=xxx]; omit PASSWORD for interactive input)
make admin-passwd # Change an admin's password (USERNAME=xxx [PASSWORD=xxx]; clears all of that account's old login sessions)make reset-init # Reset to first-install state (clears database, config, workspaces, memory, sessions, IPC, logs)
make backup # Back up runtime data to deepthink-backup-{date}.tar.gz
make restore # Restore from the latest backup (or make restore FILE=xxx.tar.gz to specify a file)
make migrate-data # Migrate an in-repo legacy ./data directory out to the external DATA_DIR
make reset-initclears the entiredata/directory — use only for testing the setup wizard or starting completely fresh. Use with caution in production.
Package DeepThink as a standalone executable app (macOS .dmg / Windows .exe / Linux .AppImage); see CLAUDE.md §2.6 for details.
make desktop-build # Compile the desktop Electron shell (includes build + sync-types + npm install)
make desktop-fetch-node # Fetch the Node.js binary for the current platform into desktop/dev-resources/node (required before first packaging)
make desktop-rebuild-natives # Recompile native modules (better-sqlite3 etc.) against the bundled Node ABI to avoid runtime ABI mismatch
make desktop-dev # Desktop dev mode: launch the Electron shell loading the local backend
make desktop-pack-mac # Package macOS .dmg (arm64 + x64, must run on macOS)
make desktop-pack-win # Package Windows .exe (must run on a Windows runner)
make desktop-pack-linux # Package Linux AppImage/.deb (must run on a Linux runner)Build artifacts go to desktop/release/, including the main .dmg / .exe / .AppImage file and the .blockmap (for incremental updates).
Cross-platform packaging must run on the corresponding platform's runner (an electron-builder limitation). macOS can produce both arm64 + x64 dmg builds; Windows and Linux can each only run on their native platform.
DeepThink offers two ways to publish to a GitHub Release: manual make release (suitable for quick single-platform releases) and fully automated GitHub Actions (suitable for official version releases, with three platforms built in parallel).
Option 1: Manual release (make release)
Prerequisites: make desktop-pack-* has produced artifacts, a tag has been created and pushed to the remote.
# 1. Create and push a tag
git tag -a v1.0.0 -m "Release v1.0.0"
git push origin v1.0.0
# 2. Build artifacts locally (macOS example)
make desktop-pack-mac
# 3. Publish to GitHub Release (requires: brew install gh && gh auth login)
make release VERSION=v1.0.0
# Delete on accidental release
make release-delete VERSION=v1.0.0Option 2: GitHub Actions fully automated (.github/workflows/release.yml)
Triggered automatically when a v* tag is pushed; three platforms build in parallel and a Release is auto-created. You can also trigger it manually via workflow_dispatch on the GitHub repo's Actions page. To customize release notes, write the content to docs/release-notes/v1.0.0.md before pushing the tag.
make help # List all available make commands with descriptions| Service | Default Port | Description |
|---|---|---|
| Backend | 9898 | Hono + WebSocket |
| Frontend dev server | 5173 | Vite, proxies /api and /ws to the backend (dev mode only) |
Production mode (make start): Only the backend service runs; the frontend is served as static files by the backend. Change the port via the WEB_PORT environment variable:
WEB_PORT=8080 make start
# Open http://localhost:8080Dev mode (make dev): The frontend Vite dev server (5173) and backend (9898) run separately; access 5173 during development. To point the frontend proxy at a non-default backend, set VITE_API_PROXY_TARGET and VITE_WS_PROXY_TARGET.
The following are optional overrides. We recommend using the Web setup wizard to configure the Claude API and IM credentials (encrypted storage).
| Variable | Default | Description |
|---|---|---|
WEB_PORT |
9898 |
Web service port |
ASSISTANT_NAME |
DeepThink |
Assistant display name |
CONTAINER_IMAGE |
deepthink-agent:latest |
Agent container image |
CONTAINER_TIMEOUT |
1800000 (30min) |
Container hard timeout (overridable via Web settings) |
CONTAINER_MAX_OUTPUT_SIZE |
10485760 (10MB) |
Max output size per run (overridable via Web settings) |
IDLE_TIMEOUT |
1800000 (30min) |
Container idle keepalive (overridable via Web settings) |
MAX_CONCURRENT_CONTAINERS |
20 |
Max concurrent containers (overridable via Web settings) |
MAX_CONCURRENT_HOST_PROCESSES |
5 |
Host-process concurrency cap (overridable via Web settings) |
MAX_FILE_SIZE_MB |
50 |
File-size limit (MB) shared by Web uploads and IM downloads (overridable via Web settings) |
MAX_LOGIN_ATTEMPTS |
5 |
Failed-login lockout threshold (overridable via Web settings) |
LOGIN_LOCKOUT_MINUTES |
15 |
Lockout duration in minutes (overridable via Web settings) |
AUTO_COMPACT_WINDOW |
0 (disabled) |
SDK auto-compaction trigger point in tokens; 0 = off (overridable via Web settings) |
TASK_BACKFILL_GRACE_MS |
300000 (5min) |
Late-tolerance window for scheduled tasks after restart (overridable via Web settings) |
TRUST_PROXY |
false |
Trust the X-Forwarded-For header from reverse proxies |
CORS_ALLOWED_ORIGINS |
empty (localhost only) | Allowed origins for public-domain access; required for WebSocket upgrade defense (CSWSH). Comma-separated domains or * |
TZ |
System timezone | Timezone for scheduled tasks |
More runtime parameters (container timeout, concurrency limits, login protection, billing settings, etc.) can be configured under "Settings → System Settings" in the Web interface — no environment variables needed.
CORS_ALLOWED_ORIGINScan be written to the project-root.env(auto-loaded bysrc/load-env.tson startup).
npm run reset:admin -- <username> <new-password>make reset-init
# Or manually:
rm -rf data store groupsIssues and Pull Requests are welcome!
- Fork the repo and clone it locally
- Create a feature branch:
git checkout -b feature/your-feature - Develop and test:
make devto start the dev environment,make typecheckfor type checks - Commit and push to your Fork
- Open a Pull Request against the
mainbranch
Commit messages use Simplified Chinese, in the format: type: description
修复: 侧边栏下拉菜单无法点击
新增: Telegram Bot 集成
重构: 统一消息路由逻辑
The project contains four independent Node.js projects, each with its own package.json and tsconfig.json:
| Project | Directory | Purpose |
|---|---|---|
| Main service | / (root) |
Backend service (28 route modules) |
| Web frontend | web/ |
React SPA (26 pages, 21 stores) |
| Agent Runner | container/agent-runner/ |
In-container / on-host execution engine |
| Desktop shell | desktop/ |
Electron packaging for macOS / Windows / Linux |
Additionally, the shared/ directory holds cross-project shared type definitions (StreamEvent, Channel Prefixes, Image Detector), synced to each subproject at build time via make sync-types.
- English
- 简体中文
- Español
- हिन्दी
- العربية
- বাংলা
- Português
- Русский
- 日本語
- Deutsch
- Français
- Bahasa Indonesia
- اردو
- मराठी
- తెలుగు
- Türkçe
- தமிழ்
- 한국어
- Tiếng Việt
- Italiano
- Polski
- Українська
- Nederlands
- ไทย
- ગુજરાતી
- Bahasa Melayu
- ಕನ್ನಡ
- فارسی
- Svenska
- Čeština
The AI Genius Institute is an independent research blog and intellectual laboratory dedicated to deep thinking on artificial general intelligence, cutting-edge technology deconstruction, and cognitive framework construction. We break free from the shackles of fragmented information and reject superficial AI popularization. With rigorous research perspectives, crystal-clear logical analysis, and forward-looking industry insights, we delve deep into the underlying logic of AI, technological iteration, paradigms of thought, and practical applications—building a high-quality, substance-rich, and intellectually deep cognitive hub for creators, developers, researchers, industry practitioners, and AI enthusiasts.
Donate to AI Genius Institute:
| 微信 | 支付宝 |
|---|---|
![]() |
![]() |




















