@aigentic/ruflo 3.7.0-alpha.69

package/src/ruvocal/src/lib/server/textGeneration/title.ts

@@ -0,0 +1,83 @@
+import { config } from "$lib/server/config";
+import { generateFromDefaultEndpoint } from "$lib/server/generateFromDefaultEndpoint";
+import { logger } from "$lib/server/logger";
+import { MessageUpdateType, type MessageUpdate } from "$lib/types/MessageUpdate";
+import type { Conversation } from "$lib/types/Conversation";
+import { getReturnFromGenerator } from "$lib/utils/getReturnFromGenerator";
+
+export async function* generateTitleForConversation(
+	conv: Conversation,
+	locals: App.Locals | undefined
+): AsyncGenerator<MessageUpdate, undefined, undefined> {
+	try {
+		const userMessage = conv.messages.find((m) => m.from === "user");
+		// HACK: detect if the conversation is new
+		if (conv.title !== "New Chat" || !userMessage) return;
+
+		const prompt = userMessage.content;
+		const modelForTitle = config.TASK_MODEL?.trim() ? config.TASK_MODEL : conv.model;
+		const title = (await generateTitle(prompt, modelForTitle, locals)) ?? "New Chat";
+
+		yield {
+			type: MessageUpdateType.Title,
+			title,
+		};
+	} catch (cause) {
+		logger.error(cause, "Failed while generating title for conversation");
+	}
+}
+
+async function generateTitle(
+	prompt: string,
+	modelId: string | undefined,
+	locals: App.Locals | undefined
+) {
+	if (config.LLM_SUMMARIZATION !== "true") {
+		// When summarization is disabled, use the first five words without adding emojis
+		return prompt.split(/\s+/g).slice(0, 5).join(" ");
+	}
+
+	// Tools removed: no tool-based title path
+
+	return await getReturnFromGenerator(
+		generateFromDefaultEndpoint({
+			messages: [{ from: "user", content: `User message: "${prompt}"` }],
+			preprompt: `You are a chat thread titling assistant.
+Goal: Produce a very short, descriptive title (2–4 words) that names the topic of the user's first message.
+
+Rules:
+- Output ONLY the title text. No prefixes, labels, quotes, emojis, hashtags, or trailing punctuation.
+- Use the user's language.
+- Write a noun phrase that names the topic. Do not write instructions.
+- Never output just a pronoun (me/you/I/we/us/myself/yourself). Prefer a neutral subject (e.g., "Assistant", "model", or the concrete topic).
+- Never include meta-words: Summarize, Summary, Title, Prompt, Topic, Subject, About, Question, Request, Chat.
+
+Examples:
+User: "Summarize hello" -> Hello
+User: "How do I reverse a string in Python?" -> Python string reversal
+User: "help me plan a NYC weekend" -> NYC weekend plan
+User: "请解释Transformer是如何工作的" -> Transformer 工作原理
+User: "tell me more about you" -> About the assistant
+Return only the title text.`,
+			generateSettings: {
+				max_tokens: 24,
+				temperature: 0,
+			},
+			modelId,
+			locals,
+		})
+	)
+		.then((summary) => {
+			const firstFive = prompt.split(/\s+/g).slice(0, 5).join(" ");
+			const trimmed = String(summary ?? "").trim();
+			// Fallback: if empty, return first five words only (no emoji)
+			return trimmed || firstFive;
+		})
+		.catch((e) => {
+			logger.error(e, "Error generating title");
+			const firstFive = prompt.split(/\s+/g).slice(0, 5).join(" ");
+			return firstFive;
+		});
+}
+
+// No post-processing: rely solely on prompt instructions above

package/src/ruvocal/src/lib/server/textGeneration/types.ts

@@ -0,0 +1,28 @@
+import type { ProcessedModel } from "../models";
+import type { Endpoint } from "../endpoints/endpoints";
+import type { Conversation } from "$lib/types/Conversation";
+import type { Message } from "$lib/types/Message";
+import type { Assistant } from "$lib/types/Assistant";
+
+export interface TextGenerationContext {
+	model: ProcessedModel;
+	endpoint: Endpoint;
+	conv: Conversation;
+	messages: Message[];
+	assistant?: Pick<Assistant, "dynamicPrompt" | "generateSettings">;
+	promptedAt: Date;
+	ip: string;
+	username?: string;
+	/** Force-enable multimodal handling for endpoints that support it */
+	forceMultimodal?: boolean;
+	/** Force-enable tool calling even if model does not advertise support */
+	forceTools?: boolean;
+	/** Inference provider preference: "auto", "fastest", "cheapest", or a specific provider name */
+	provider?: string;
+	locals: App.Locals | undefined;
+	abortController: AbortController;
+	/** Autopilot mode — auto-continue tool calls up to autopilotMaxSteps iterations */
+	autopilot?: boolean;
+	/** User-configurable cap on autopilot tool-call loops; server falls back to 30 if undefined */
+	autopilotMaxSteps?: number;
+}

package/src/ruvocal/src/lib/server/textGeneration/utils/prepareFiles.ts

@@ -0,0 +1,88 @@
+import type { MessageFile } from "$lib/types/Message";
+import type { EndpointMessage } from "$lib/server/endpoints/endpoints";
+import type { OpenAI } from "openai";
+import { TEXT_MIME_ALLOWLIST } from "$lib/constants/mime";
+import type { makeImageProcessor } from "$lib/server/endpoints/images";
+
+/**
+ * Prepare chat messages for OpenAI-compatible multimodal payloads.
+ * - Processes images via the provided imageProcessor (resize/convert) when multimodal is enabled.
+ * - Injects text-file content into the user message text.
+ * - Leaves messages untouched when no files or multimodal disabled.
+ */
+export async function prepareMessagesWithFiles(
+	messages: EndpointMessage[],
+	imageProcessor: ReturnType<typeof makeImageProcessor>,
+	isMultimodal: boolean
+): Promise<OpenAI.Chat.Completions.ChatCompletionMessageParam[]> {
+	return Promise.all(
+		messages.map(async (message) => {
+			if (message.from === "user" && message.files && message.files.length > 0) {
+				const { imageParts, textContent } = await prepareFiles(
+					imageProcessor,
+					message.files,
+					isMultimodal
+				);
+
+				let messageText = message.content;
+				if (textContent.length > 0) {
+					messageText = textContent + "\n\n" + message.content;
+				}
+
+				if (imageParts.length > 0 && isMultimodal) {
+					const parts = [{ type: "text" as const, text: messageText }, ...imageParts];
+					return { role: message.from, content: parts };
+				}
+
+				return { role: message.from, content: messageText };
+			}
+			return { role: message.from, content: message.content };
+		})
+	);
+}
+
+async function prepareFiles(
+	imageProcessor: ReturnType<typeof makeImageProcessor>,
+	files: MessageFile[],
+	isMultimodal: boolean
+): Promise<{
+	imageParts: OpenAI.Chat.Completions.ChatCompletionContentPartImage[];
+	textContent: string;
+}> {
+	const imageFiles = files.filter((file) => file.mime.startsWith("image/"));
+	const textFiles = files.filter((file) => {
+		const mime = (file.mime || "").toLowerCase();
+		const [fileType, fileSubtype] = mime.split("/");
+		return TEXT_MIME_ALLOWLIST.some((allowed) => {
+			const [type, subtype] = allowed.toLowerCase().split("/");
+			const typeOk = type === "*" || type === fileType;
+			const subOk = subtype === "*" || subtype === fileSubtype;
+			return typeOk && subOk;
+		});
+	});
+
+	let imageParts: OpenAI.Chat.Completions.ChatCompletionContentPartImage[] = [];
+	if (isMultimodal && imageFiles.length > 0) {
+		const processedFiles = await Promise.all(imageFiles.map(imageProcessor));
+		imageParts = processedFiles.map((file) => ({
+			type: "image_url" as const,
+			image_url: {
+				url: `data:${file.mime};base64,${file.image.toString("base64")}`,
+				detail: "auto",
+			},
+		}));
+	}
+
+	let textContent = "";
+	if (textFiles.length > 0) {
+		const textParts = await Promise.all(
+			textFiles.map(async (file) => {
+				const content = Buffer.from(file.value, "base64").toString("utf-8");
+				return `<document name="${file.name}" type="${file.mime}">\n${content}\n</document>`;
+			})
+		);
+		textContent = textParts.join("\n\n");
+	}
+
+	return { imageParts, textContent };
+}

package/src/ruvocal/src/lib/server/textGeneration/utils/routing.ts

@@ -0,0 +1,21 @@
+import type { EndpointMessage } from "../../endpoints/endpoints";
+
+const ROUTER_REASONING_REGEX = /<think>[\s\S]*?(?:<\/think>|$)/g;
+
+export function stripReasoningBlocks(text: string): string {
+	const stripped = text.replace(ROUTER_REASONING_REGEX, "");
+	return stripped === text ? text : stripped.trim();
+}
+
+export function stripReasoningFromMessageForRouting(message: EndpointMessage): EndpointMessage {
+	const clone = { ...message } as EndpointMessage & { reasoning?: string };
+	if ("reasoning" in clone) {
+		delete clone.reasoning;
+	}
+	const content =
+		typeof message.content === "string" ? stripReasoningBlocks(message.content) : message.content;
+	return {
+		...clone,
+		content,
+	};
+}

package/src/ruvocal/src/lib/server/textGeneration/utils/toolPrompt.ts

@@ -0,0 +1,49 @@
+import type { OpenAiTool } from "$lib/server/mcp/tools";
+
+export function buildToolPreprompt(tools: OpenAiTool[], autopilot?: boolean): string {
+	if (!Array.isArray(tools) || tools.length === 0) return "";
+	const names = tools
+		.map((t) => (t?.function?.name ? String(t.function.name) : ""))
+		.filter((s) => s.length > 0);
+	if (names.length === 0) return "";
+	const now = new Date();
+	const currentDate = now.toLocaleDateString("en-US", {
+		year: "numeric",
+		month: "long",
+		day: "numeric",
+	});
+	const isoDate = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
+	const lines = [
+		`You have access to these tools: ${names.join(", ")}.`,
+		`Today's date: ${currentDate} (${isoDate}).`,
+	];
+
+	if (autopilot) {
+		lines.push(
+			`AUTOPILOT MODE ENABLED — PARALLEL SWARM EXECUTION. Follow these rules STRICTLY:`,
+			`1. NEVER ask for confirmation. Make reasonable assumptions. Proceed immediately.`,
+			`2. ALWAYS call MULTIPLE tools in parallel. If a task needs search + memory + routing, call ALL THREE at once in a single response — not sequentially.`,
+			`3. For complex tasks: spawn a SWARM of parallel tool calls. Example: call search, web_research, memory_search, and hooks_route ALL in one response.`,
+			`4. After getting results, immediately call the NEXT BATCH of tools in parallel. Keep chaining until done.`,
+			`5. If a tool fails, try alternatives immediately — do not report failure and stop.`,
+			`6. Only provide a final text response when ALL work is done and you have nothing left to execute.`,
+			`7. NEVER explain what you plan to do. Just DO IT by calling tools.`,
+			`8. Maximize parallel execution: if you can call 3+ tools at once, DO IT. Sequential is only for dependencies.`,
+		);
+	} else {
+		lines.push(
+			`IMPORTANT: Do NOT call a tool unless the user's request requires capabilities you lack (e.g., real-time data, image generation, code execution) or external information you do not have. For tasks like writing code, creative writing, math, or building apps, respond directly without tools. When in doubt, do not use a tool.`,
+		);
+	}
+
+	lines.push(
+		`PARALLEL TOOL CALLS: When multiple tool calls are needed and they are independent of each other (i.e., one does not need the result of another), call them all at once in a single response instead of one at a time. Only chain tool calls sequentially when a later call depends on an earlier call's output.`,
+		`SEARCH: Use 3-6 precise keywords. For historical events, include the year the event occurred. For recent or current topics, use today's year (${now.getFullYear()}). When a tool accepts date-range parameters (e.g., startPublishedDate, endPublishedDate), always use today's date (${isoDate}) as the end date unless the user specifies otherwise. For multi-part questions, search each part separately.`,
+		`ANSWER: State only facts explicitly in the results. If info is missing or results conflict, say so. Never fabricate URLs or facts.`,
+		`INTERACTIVE APPS: When asked to build an interactive application, game, or visualization without a specific language/framework preference, create a single self-contained HTML file with embedded CSS and JavaScript.`,
+		`If a tool generates an image, you can inline it directly: ![alt text](image_url).`,
+		`If a tool needs an image, set its image field ("input_image", "image", or "image_url") to a reference like "image_1", "image_2", etc. (ordered by when the user uploaded them).`,
+		`Default to image references; only use a full http(s) URL when the tool description explicitly asks for one, or reuse a URL a previous tool returned.`,
+	);
+	return lines.join(" ");
+}

package/src/ruvocal/src/lib/server/urlSafety.ts

@@ -0,0 +1,77 @@
+import { Address4, Address6 } from "ip-address";
+import { isIP } from "node:net";
+
+const UNSAFE_IPV4_SUBNETS = [
+	"0.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+].map((s) => new Address4(s));
+
+function isUnsafeIp(address: string): boolean {
+	const family = isIP(address);
+
+	if (family === 4) {
+		const addr = new Address4(address);
+		return UNSAFE_IPV4_SUBNETS.some((subnet) => addr.isInSubnet(subnet));
+	}
+
+	if (family === 6) {
+		const addr = new Address6(address);
+		// Check IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1)
+		if (addr.is4()) {
+			const v4 = addr.to4();
+			return UNSAFE_IPV4_SUBNETS.some((subnet) => v4.isInSubnet(subnet));
+		}
+		return addr.isLoopback() || addr.isLinkLocal();
+	}
+
+	return true; // Unknown format → block
+}
+
+/**
+ * Synchronous URL validation: checks protocol and hostname string.
+ */
+export function isValidUrl(urlString: string): boolean {
+	try {
+		const url = new URL(urlString.trim());
+		const hostname = url.hostname.toLowerCase();
+		// Allow HTTP for localhost/loopback/Docker-internal (dev & local MCP bridge)
+		if (
+			hostname === "localhost" ||
+			hostname === "127.0.0.1" ||
+			hostname === "::1" ||
+			hostname === "host.docker.internal"
+		) {
+			return url.protocol === "http:" || url.protocol === "https:";
+		}
+		// Allow HTTP for Docker-internal service names (no dots = private network)
+		if (!hostname.includes(".") && url.protocol === "http:") {
+			return true;
+		}
+		if (url.protocol !== "https:") {
+			return false;
+		}
+		// If the hostname is a raw IP literal, validate it
+		const cleanHostname = hostname.replace(/^\[|]$/g, "");
+		if (isIP(cleanHostname)) {
+			return !isUnsafeIp(cleanHostname);
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Assert that a resolved IP address is safe (not internal/private).
+ * Throws if the IP is internal. Used in undici's custom DNS lookup
+ * to validate IPs at connection time (prevents TOCTOU DNS rebinding).
+ */
+export function assertSafeIp(address: string, hostname: string): void {
+	if (isUnsafeIp(address)) {
+		throw new Error(`Resolved IP for ${hostname} is internal (${address})`);
+	}
+}

package/src/ruvocal/src/lib/server/usageLimits.ts

@@ -0,0 +1,30 @@
+import { z } from "zod";
+import { config } from "$lib/server/config";
+import JSON5 from "json5";
+
+const sanitizeJSONEnv = (val: string, fallback: string) => {
+	const raw = (val ?? "").trim();
+	const unquoted = raw.startsWith("`") && raw.endsWith("`") ? raw.slice(1, -1) : raw;
+	return unquoted || fallback;
+};
+
+// RATE_LIMIT is the legacy way to define messages per minute limit
+export const usageLimitsSchema = z
+	.object({
+		conversations: z.coerce.number().optional(), // how many conversations
+		messages: z.coerce.number().optional(), // how many messages in a conversation
+		messageLength: z.coerce.number().optional(), // how long can a message be before we cut it off
+		messagesPerMinute: z
+			.preprocess((val) => {
+				if (val === undefined) {
+					return config.RATE_LIMIT;
+				}
+				return val;
+			}, z.coerce.number().optional())
+			.optional(), // how many messages per minute
+	})
+	.optional();
+
+export const usageLimits = usageLimitsSchema.parse(
+	JSON5.parse(sanitizeJSONEnv(config.USAGE_LIMITS, "{}"))
+);

package/src/ruvocal/src/lib/stores/autopilotStore.svelte.ts

@@ -0,0 +1,175 @@
+/**
+ * Autopilot Store — Svelte 5 runes-based store for managing autopilot Web Worker state.
+ *
+ * Provides reactive state for autopilot groups, tasks, and text content.
+ * Communicates with AutopilotWorker and DetailFetchWorker via postMessage.
+ *
+ * ADR-037 Part 2+3: Parallel Task UI + Web Workers
+ */
+
+import type { GroupState, AutopilotUIUpdate } from "$lib/workers/autopilotWorker";
+import type { DetailWorkerOutgoing } from "$lib/workers/detailFetchWorker";
+
+export interface AutopilotState {
+	active: boolean;
+	maxSteps: number;
+	groups: GroupState[];
+	textContent: string;
+	error: string | null;
+	totalSteps: number;
+	totalTasks: number;
+	duration: number;
+	paused: boolean;
+	pauseReason: string | null;
+}
+
+const defaultState: AutopilotState = {
+	active: false,
+	maxSteps: 20,
+	groups: [],
+	textContent: "",
+	error: null,
+	totalSteps: 0,
+	totalTasks: 0,
+	duration: 0,
+	paused: false,
+	pauseReason: null,
+};
+
+let state = $state<AutopilotState>({ ...defaultState });
+
+let autopilotWorker: Worker | null = null;
+let detailWorker: Worker | null = null;
+const detailCallbacks = new Map<string, (content: string | null, error?: string) => void>();
+
+async function ensureWorkers() {
+	if (typeof window === "undefined") return;
+
+	if (!autopilotWorker) {
+		const mod = await import("$lib/workers/autopilotWorker?worker");
+		autopilotWorker = new mod.default();
+		autopilotWorker.onmessage = handleWorkerMessage;
+	}
+
+	if (!detailWorker) {
+		const mod = await import("$lib/workers/detailFetchWorker?worker");
+		detailWorker = new mod.default();
+		detailWorker.onmessage = handleDetailMessage;
+	}
+}
+
+function handleWorkerMessage(e: MessageEvent) {
+	const msg = e.data;
+
+	switch (msg.type) {
+		case "batch_update":
+			state.groups = msg.groups;
+			for (const update of msg.updates as AutopilotUIUpdate[]) {
+				applyUpdate(update);
+			}
+			break;
+
+		case "text":
+			state.textContent += msg.content;
+			break;
+
+		case "done":
+			state.active = false;
+			state.groups = msg.groups;
+			break;
+
+		case "error":
+			state.active = false;
+			state.error = msg.error;
+			break;
+
+		case "stopped":
+			state.active = false;
+			state.groups = msg.groups;
+			break;
+	}
+}
+
+function applyUpdate(update: AutopilotUIUpdate) {
+	switch (update.type) {
+		case "start":
+			state.maxSteps = update.maxSteps;
+			break;
+		case "end":
+			state.totalSteps = update.totalSteps;
+			state.totalTasks = update.totalTasks;
+			state.duration = update.duration;
+			break;
+		case "text":
+			state.textContent += update.content;
+			break;
+		case "paused":
+			state.paused = true;
+			state.pauseReason = update.reason;
+			break;
+		case "error_event":
+			state.error = update.error;
+			break;
+	}
+}
+
+function handleDetailMessage(e: MessageEvent<DetailWorkerOutgoing>) {
+	const msg = e.data;
+	if (msg.type === "detail") {
+		const cb = detailCallbacks.get(msg.detailToken);
+		if (cb) {
+			cb(msg.content);
+			detailCallbacks.delete(msg.detailToken);
+		}
+	} else if (msg.type === "detail_error") {
+		const cb = detailCallbacks.get(msg.detailToken);
+		if (cb) {
+			cb(null, msg.error);
+			detailCallbacks.delete(msg.detailToken);
+		}
+	}
+}
+
+export function useAutopilot() {
+	return {
+		get state() {
+			return state;
+		},
+
+		async start(url: string, headers: Record<string, string>, body: unknown) {
+			await ensureWorkers();
+			Object.assign(state, { ...defaultState, active: true });
+			autopilotWorker?.postMessage({ type: "start", url, headers, body });
+		},
+
+		stop() {
+			autopilotWorker?.postMessage({ type: "stop" });
+		},
+
+		async fetchDetail(detailToken: string, bridgeUrl: string): Promise<string> {
+			await ensureWorkers();
+			return new Promise((resolve, reject) => {
+				detailCallbacks.set(detailToken, (content, error) => {
+					if (error) reject(new Error(error));
+					else resolve(content!);
+				});
+				detailWorker?.postMessage({ type: "fetch", detailToken, bridgeUrl });
+			});
+		},
+
+		prefetchDetail(detailToken: string, bridgeUrl: string) {
+			detailWorker?.postMessage({ type: "prefetch", detailToken, bridgeUrl });
+		},
+
+		evictDetail(detailToken: string) {
+			detailWorker?.postMessage({ type: "evict", detailToken });
+		},
+
+		destroy() {
+			autopilotWorker?.terminate();
+			detailWorker?.terminate();
+			autopilotWorker = null;
+			detailWorker = null;
+		},
+	};
+}

package/src/ruvocal/src/lib/stores/backgroundGenerations.svelte.ts

@@ -0,0 +1,32 @@
+export type BackgroundGeneration = {
+	id: string;
+	startedAt: number;
+};
+
+export const backgroundGenerationEntries = $state<BackgroundGeneration[]>([]);
+
+export function addBackgroundGeneration(entry: BackgroundGeneration) {
+	const index = backgroundGenerationEntries.findIndex(({ id }) => id === entry.id);
+
+	if (index === -1) {
+		backgroundGenerationEntries.push(entry);
+		return;
+	}
+
+	backgroundGenerationEntries[index] = entry;
+}
+
+export function removeBackgroundGeneration(id: string) {
+	const index = backgroundGenerationEntries.findIndex((entry) => entry.id === id);
+	if (index === -1) return;
+
+	backgroundGenerationEntries.splice(index, 1);
+}
+
+export function clearBackgroundGenerations() {
+	backgroundGenerationEntries.length = 0;
+}
+
+export function hasBackgroundGeneration(id: string) {
+	return backgroundGenerationEntries.some((entry) => entry.id === id);
+}

package/src/ruvocal/src/lib/stores/backgroundGenerations.ts

@@ -0,0 +1 @@
+export * from "./backgroundGenerations.svelte";

package/src/ruvocal/src/lib/stores/errors.ts

@@ -0,0 +1,9 @@
+import { writable } from "svelte/store";
+
+export const ERROR_MESSAGES = {
+	default: "Oops, something went wrong.",
+	authOnly: "You have to be logged in.",
+	rateLimited: "You are sending too many messages. Try again later.",
+};
+
+export const error = writable<string | undefined>(undefined);

package/src/ruvocal/src/lib/stores/isAborted.ts

@@ -0,0 +1,3 @@
+import { writable } from "svelte/store";
+
+export const isAborted = writable<boolean>(false);

package/src/ruvocal/src/lib/stores/isPro.ts

@@ -0,0 +1,4 @@
+import { writable } from "svelte/store";
+
+// null = unknown/loading, true = PRO, false = not PRO
+export const isPro = writable<boolean | null>(null);

package/src/ruvocal/src/lib/stores/loading.ts

@@ -0,0 +1,3 @@
+import { writable } from "svelte/store";
+
+export const loading = writable(false);