@hed-hog/core 0.0.364 → 0.0.366

package/src/mcp-chat/mcp-chat.service.ts

@@ -11,6 +11,8 @@ import {
     NotFoundException,
 } from '@nestjs/common';
 import axios from 'axios';
+import { AiExecutionService } from '../ai-instruction/ai-execution.service';
+import { AiPromptBuilderService } from '../ai-instruction/ai-prompt-builder.service';
 import { buildAiConfigFromIntegration } from '../integration-profile/integration-profile.utils';
 import { McpRegistryService, McpToolEntry } from '../mcp/mcp-registry.service';
 import { McpContext } from '../mcp/types/mcp-context.type';
@@ -81,13 +83,18 @@ type ConversationHistoryItem = {
 const MAX_OPENAI_TOOLS = 128;
 const TARGET_SELECTED_TOOLS = 112;
 const MAX_ITERATIONS = 20;
+// Maximum number of history messages to send per turn.
+// Older messages beyond this window are dropped to limit prompt tokens.
+const HISTORY_MESSAGE_LIMIT = 40;
 const FORCE_FINISH_THRESHOLD = 2;
 const MIN_DOMAIN_CONFIDENCE = 2;
 const AMBIGUOUS_DOMAIN_DELTA = 1;
 
-const SYSTEM_PROMPT =
+// SYSTEM_PROMPT is now managed via AiInstructionService (slug: system.global).
+// This fallback is used only if the DB is unreachable during startup.
+const SYSTEM_PROMPT_FALLBACK =
   'You are a helpful assistant with access to tools from the HedHog system. ' +
-  'Use the available tools to answer the user\'s questions accurately. ' +
+  "Use the available tools to answer the user's questions accurately. " +
   'Always respond in the same language the user writes in.';
 
 const sanitize = (n: string) => n.replace(/\./g, '__');
@@ -242,6 +249,10 @@ export class McpChatService {
     private readonly setting: SettingService,
     @Inject(forwardRef(() => McpRegistryService))
     private readonly registry: McpRegistryService,
+    @Inject(forwardRef(() => AiPromptBuilderService))
+    private readonly promptBuilder: AiPromptBuilderService,
+    @Inject(forwardRef(() => AiExecutionService))
+    private readonly aiExecution: AiExecutionService,
   ) {}
 
   async listConversations(userId: number) {
@@ -311,10 +322,33 @@ export class McpChatService {
       });
     }
 
-    if (provider === 'gemini') {
-      return this.runGeminiLoop(conversationId, userId, locale, message, apiKey);
+    const executionId = await this.aiExecution.start({
+      userId,
+      conversationId,
+      trigger: 'manual',
+      contextSlug: 'mcp-chat',
+    });
+
+    try {
+      if (provider === 'gemini') {
+        return await this.runGeminiLoop(conversationId, userId, locale, message, apiKey, executionId);
+      }
+      return await this.runOpenAiLoop(conversationId, userId, locale, message, apiKey, executionId);
+    } catch (err) {
+      await this.aiExecution.finish(executionId, 'failed', String(err));
+      throw err;
+    }
+  }
+
+  private async getSystemPrompt(locale?: string): Promise<string> {
+    try {
+      const built = await this.promptBuilder.build({
+        locale,
+      });
+      return built.systemPrompt || SYSTEM_PROMPT_FALLBACK;
+    } catch {
+      return SYSTEM_PROMPT_FALLBACK;
     }
-    return this.runOpenAiLoop(conversationId, userId, locale, message, apiKey);
   }
 
   // ── OpenAI loop ──────────────────────────────────────────────────────────
@@ -325,14 +359,22 @@ export class McpChatService {
     locale: string,
     message: string,
     apiKey: string,
+    executionId: number,
   ) {
-    const history = await this.prisma.mcp_conversation_message.findMany({
+    const systemPrompt = await this.getSystemPrompt(locale);
+
+    const allHistory = await this.prisma.mcp_conversation_message.findMany({
       where: { conversation_id: conversationId },
       orderBy: { created_at: 'asc' },
     });
+    // Limit to the most recent messages to avoid token explosion on long conversations.
+    // We take the tail rather than summarize to ensure tool_call/tool_result pairs stay intact.
+    const history = allHistory.length > HISTORY_MESSAGE_LIMIT
+      ? allHistory.slice(allHistory.length - HISTORY_MESSAGE_LIMIT)
+      : allHistory;
 
     const openAiMessages: OpenAiMessage[] = [
-      { role: 'system', content: SYSTEM_PROMPT },
+      { role: 'system', content: systemPrompt },
       ...this.toOpenAiMessages(history),
     ];
 
@@ -351,10 +393,12 @@ export class McpChatService {
     const tools = toolSelection.tools;
 
     const callSignatures = new Set<string>();
+    let stepOrder = 0;
     let maxIterations = MAX_ITERATIONS;
     while (maxIterations-- > 0) {
       const forceFinish = maxIterations < FORCE_FINISH_THRESHOLD;
       let response: any;
+      const stepStart = Date.now();
       try {
         response = await axios.post(
           'https://api.openai.com/v1/chat/completions',
@@ -389,6 +433,20 @@ export class McpChatService {
         );
       }
 
+      const usage = response.data?.usage;
+      await this.aiExecution.recordStep({
+        executionId,
+        stepOrder: stepOrder++,
+        type: 'prompt',
+        provider: 'openai',
+        model: 'gpt-4o-mini',
+        durationMs: Date.now() - stepStart,
+        usage: usage
+          ? { input: usage.prompt_tokens ?? 0, output: usage.completion_tokens ?? 0, total: usage.total_tokens ?? 0 }
+          : undefined,
+        inputSummary: openAiMessages[openAiMessages.length - 1]?.content?.toString()?.slice(0, 200),
+      });
+
       const choice = response.data?.choices?.[0];
       const assistantMsg = choice?.message;
 
@@ -492,12 +550,15 @@ export class McpChatService {
         },
       });
 
+      await this.aiExecution.finish(executionId, 'completed');
+
       return this.prisma.mcp_conversation_message.findMany({
         where: { conversation_id: conversationId },
         orderBy: { created_at: 'asc' },
       });
     }
 
+    await this.aiExecution.finish(executionId, 'failed', 'Maximum tool call iterations exceeded.');
     throw new BadRequestException('Maximum tool call iterations exceeded.');
   }
 
@@ -509,11 +570,17 @@ export class McpChatService {
     locale: string,
     message: string,
     apiKey: string,
+    executionId: number,
   ) {
-    const history = await this.prisma.mcp_conversation_message.findMany({
+    const systemPrompt = await this.getSystemPrompt(locale);
+
+    const allHistory = await this.prisma.mcp_conversation_message.findMany({
       where: { conversation_id: conversationId },
       orderBy: { created_at: 'asc' },
     });
+    const history = allHistory.length > HISTORY_MESSAGE_LIMIT
+      ? allHistory.slice(allHistory.length - HISTORY_MESSAGE_LIMIT)
+      : allHistory;
 
     const geminiContents: GeminiContent[] = this.toGeminiContents(history);
     const toolSelection = await this.buildGeminiTools(
@@ -523,6 +590,7 @@ export class McpChatService {
       history,
     );
     if (toolSelection.clarification) {
+      await this.aiExecution.finish(executionId, 'completed');
       return this.recordAssistantAndReturnHistory(
         conversationId,
         toolSelection.clarification,
@@ -530,17 +598,19 @@ export class McpChatService {
     }
     const functionDeclarations = toolSelection.tools;
 
+    let stepOrder = 0;
     let maxIterations = MAX_ITERATIONS;
     let callIndex = 0;
 
     while (maxIterations-- > 0) {
       const forceFinish = maxIterations < FORCE_FINISH_THRESHOLD;
       let response: any;
+      const stepStart = Date.now();
       try {
         response = await axios.post(
           `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${apiKey}`,
           {
-            systemInstruction: { parts: [{ text: SYSTEM_PROMPT }] },
+            systemInstruction: { parts: [{ text: systemPrompt }] },
             contents: geminiContents,
             tools:
               !forceFinish && functionDeclarations.length > 0
@@ -572,6 +642,19 @@ export class McpChatService {
         );
       }
 
+      const geminiUsage = response.data?.usageMetadata;
+      await this.aiExecution.recordStep({
+        executionId,
+        stepOrder: stepOrder++,
+        type: 'prompt',
+        provider: 'gemini',
+        model: 'gemini-2.0-flash',
+        durationMs: Date.now() - stepStart,
+        usage: geminiUsage
+          ? { input: geminiUsage.promptTokenCount ?? 0, output: geminiUsage.candidatesTokenCount ?? 0, total: geminiUsage.totalTokenCount ?? 0 }
+          : undefined,
+      });
+
       const candidate = response.data?.candidates?.[0];
       const parts: GeminiPart[] = candidate?.content?.parts ?? [];
 
@@ -649,12 +732,15 @@ export class McpChatService {
         },
       });
 
+      await this.aiExecution.finish(executionId, 'completed');
+
       return this.prisma.mcp_conversation_message.findMany({
         where: { conversation_id: conversationId },
         orderBy: { created_at: 'asc' },
       });
     }
 
+    await this.aiExecution.finish(executionId, 'failed', 'Maximum tool call iterations exceeded.');
     throw new BadRequestException('Maximum tool call iterations exceeded.');
   }
 

package/src/notification/notification.service.ts

@@ -52,7 +52,7 @@ export class NotificationService implements OnModuleInit, OnModuleDestroy {
   }
 
   async onModuleInit() {
-    const databaseUrl = String(process.env.DATABASE_URL || '');
+    const databaseUrl = String(process.env.DIRECT_DATABASE_URL || process.env.DATABASE_URL || '');
     if (!databaseUrl.startsWith('postgresql://')) {
       this.logger.warn(
         'Cluster notification stream disabled because DATABASE_URL is not PostgreSQL',
@@ -94,6 +94,7 @@ export class NotificationService implements OnModuleInit, OnModuleDestroy {
   }
 
   async list(userId: number, paginationParams: any) {
+    await this.cleanupStaleProgressNotifications(userId);
     return this.pagination.paginate(
       this.prisma.notification,
       paginationParams,
@@ -104,6 +105,36 @@ export class NotificationService implements OnModuleInit, OnModuleDestroy {
     );
   }
 
+  private async cleanupStaleProgressNotifications(userId: number) {
+    const stale = await this.prisma.$queryRaw<{ id: number }[]>`
+      SELECT n.id
+      FROM notification n
+      WHERE n.user_id = ${userId}
+        AND n.progress IS NOT NULL
+        AND n.progress < 100
+        AND n.finished_at IS NULL
+        AND (n.action_data->>'queueJobId') IS NOT NULL
+        AND NOT EXISTS (
+          SELECT 1 FROM queue_job qj
+          WHERE qj.id = (n.action_data->>'queueJobId')::int
+        )
+    `;
+
+    if (!stale.length) return;
+
+    await this.prisma.notification.updateMany({
+      where: { id: { in: stale.map((n) => n.id) } },
+      data: {
+        progress: 100,
+        type: 'error' as any,
+        body: 'O processamento foi interrompido (job não encontrado).',
+        finished_at: new Date(),
+      },
+    });
+
+    await this.broadcastNotificationEvent(userId, { type: 'notification.updated' });
+  }
+
   async unreadCount(userId: number) {
     const count = await this.prisma.notification.count({
       where: { user_id: userId, status: 'unread' },

package/src/oauth/oauth.service.ts

@@ -94,7 +94,8 @@ export class OAuthService {
       throw new BadRequestException('Invalid mobile redirect URI.');
     }
 
-    const authUrl = await this.getAuthUrl(provider, sanitizedRedirectUri);
+    const callbackPath = `/callback/${String(provider)}/login`;
+    const authUrl = await this.getAuthUrl(provider, callbackPath);
     const flow = 'login';
     const { token, signature } = await this.issueMobileState(
       provider,
@@ -153,6 +154,46 @@ export class OAuthService {
         );
       }
 
+      // Mobile browser flow: Microsoft redirected to backend callback with hhmob state.
+      // Complete auth here and redirect the browser to the mobile app URI with tokens.
+      if (state?.startsWith('hhmob.') && !redirectUri) {
+        const mobileRedirectUri = await this.lookupMobileRedirectUri(state, provider);
+        if (!mobileRedirectUri) {
+          throw new BadRequestException(
+            getLocaleText(
+              'oauth.callback.invalidState',
+              locale,
+              'OAuth callback state is invalid or expired. Start the sign-in flow again.',
+            ),
+          );
+        }
+
+        const callbackKey = this.buildCallbackKey(provider, type, code);
+        const tokens = (await this.callbackCoordinator.execute(callbackKey, async () => {
+          const profile = await this.getProvider(provider).getProfile(code, type);
+          return this.finalizeCallback({
+            res,
+            locale,
+            ipAddress,
+            userAgent,
+            provider,
+            type,
+            profile,
+            userId,
+            includeRefreshTokenInBody: true,
+          });
+        })) as { accessToken: string; refreshToken?: string };
+
+        const params = new URLSearchParams({ accessToken: tokens.accessToken });
+        if (tokens.refreshToken) params.set('refreshToken', tokens.refreshToken);
+
+        this.logger.log(
+          `OAuth mobile browser callback completed: provider=${provider} type=${type}`,
+        );
+        (res as any).redirect(`${mobileRedirectUri}?${params.toString()}`);
+        return;
+      }
+
       const callbackKey = this.buildCallbackKey(provider, type, code);
 
       return await this.callbackCoordinator.execute(callbackKey, async () => {
@@ -321,6 +362,38 @@ export class OAuthService {
     return Number(consumedRows) > 0;
   }
 
+  private async lookupMobileRedirectUri(
+    encodedState: string,
+    provider: user_account_provider_52222e2ecb_enum,
+  ): Promise<string | null> {
+    if (!encodedState?.startsWith('hhmob.')) return null;
+
+    const parts = encodedState.split('.');
+    const stateToken = parts[1];
+    const signature = parts[2];
+
+    if (!stateToken || !signature) return null;
+
+    const hasValidSignature = this.security.verifyHmacSha256(
+      `oauth-mobile-state:${stateToken}`,
+      signature,
+    );
+    if (!hasValidSignature) return null;
+
+    const tokenHash = this.security.hashSha256(stateToken);
+    const record = await this.prisma.oauth_mobile_state_token.findFirst({
+      where: {
+        token_hash: tokenHash,
+        provider: String(provider).toLowerCase(),
+        expires_at: { gt: new Date() },
+        consumed_at: null,
+      },
+      select: { redirect_uri: true },
+    });
+
+    return record?.redirect_uri ?? null;
+  }
+
   private async finalizeCallback({
     res,
     locale,

package/src/profile/events/profile-avatar-updated.event.ts

@@ -0,0 +1,8 @@
+export const PROFILE_AVATAR_UPDATED = 'profile.avatar_updated';
+
+export class ProfileAvatarUpdatedEvent {
+  constructor(
+    public readonly userId: number,
+    public readonly fileId: number | null,
+  ) {}
+}

package/src/profile/events/profile-email-changed.event.ts

@@ -0,0 +1,8 @@
+export const PROFILE_EMAIL_CHANGED = 'profile.email_changed';
+
+export class ProfileEmailChangedEvent {
+  constructor(
+    public readonly userId: number,
+    public readonly email: string,
+  ) {}
+}

package/src/profile/events/profile-updated.event.ts

@@ -0,0 +1,8 @@
+export const PROFILE_UPDATED = 'profile.updated';
+
+export class ProfileUpdatedEvent {
+  constructor(
+    public readonly userId: number,
+    public readonly name: string,
+  ) {}
+}

package/src/profile/profile.service.ts

@@ -2,6 +2,7 @@ import { getLocaleText } from '@hed-hog/api-locale';
 import { PrismaService, user } from '@hed-hog/api-prisma';
 import { User } from '@hed-hog/api-types';
 import { BadRequestException, forwardRef, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import { EventEmitter2 } from '@nestjs/event-emitter';
 import { JwtService } from '@nestjs/jwt';
 import type {
     VerifiedAuthenticationResponse,
@@ -27,6 +28,9 @@ import { EmailVerificationDto } from './dto/email-verification-confirm.dto';
 import { SendEmailVerificationDto } from './dto/send-email-verification.dto';
 import { SetPreferencesDto } from './dto/set-preferences.dto';
 import { UpdateDto } from './dto/update.dto';
+import { PROFILE_AVATAR_UPDATED, ProfileAvatarUpdatedEvent } from './events/profile-avatar-updated.event';
+import { PROFILE_EMAIL_CHANGED, ProfileEmailChangedEvent } from './events/profile-email-changed.event';
+import { PROFILE_UPDATED, ProfileUpdatedEvent } from './events/profile-updated.event';
 
 @Injectable()
 export class ProfileService {
@@ -44,6 +48,7 @@ export class ProfileService {
     private readonly token: TokenService,
     @Inject(forwardRef(() => MailService))
     private readonly mail: MailService,
+    private readonly eventEmitter: EventEmitter2,
   ) {}
 
   async changeEmail(locale: string, userId: number, { email, password, pin }: ChangeEmailDto) {
@@ -237,6 +242,7 @@ export class ProfileService {
     }
 
     const verifiedAt = new Date();
+    let userIdentifierId = challenge.user_identifier_id;
 
     await this.prisma.$transaction(async (tx) => {
 
@@ -244,8 +250,6 @@ export class ProfileService {
         where: { id: challengeId },
       })
 
-      let userIdentifierId = challenge.user_identifier_id;
-
       if (!userIdentifierId) {
         const userIdentifier = await tx.user_identifier.findFirst({
           where: { user_id: userId, type: 'email', verified_at: null },
@@ -277,18 +281,19 @@ export class ProfileService {
         }
       });
 
-      // Delete ALL other email identifiers (both verified and unverified) to maintain single email principle
-      // This ensures user has only one verified primary email
-      await tx.user_identifier.deleteMany({
-        where: {
-          user_id: userId,
-          type: 'email',
-          id: { not: userIdentifierId }
-        }
-      });
+      // Keep previous emails intact so the user can still authenticate with the old address.
+      // The verified identifier above becomes the new active email, but older verified emails remain valid aliases.
 
     });
 
+    const confirmedIdentifier = await this.prisma.user_identifier.findUnique({
+      where: { id: userIdentifierId },
+      select: { value: true },
+    });
+    if (confirmedIdentifier?.value) {
+      this.eventEmitter.emit(PROFILE_EMAIL_CHANGED, new ProfileEmailChangedEvent(userId, confirmedIdentifier.value));
+    }
+
     return { success: true };
   }
 
@@ -338,16 +343,20 @@ export class ProfileService {
   }
 
   async update(userid: number, { name }: UpdateDto) {
-    return this.prisma.user.update({
+    const result = await this.prisma.user.update({
       where: { id: userid },
-      data: {
-        name,
-      },
+      data: { name },
     });
+    if (name) {
+      this.eventEmitter.emit(PROFILE_UPDATED, new ProfileUpdatedEvent(userid, name));
+    }
+    return result;
   }
 
   async updateAvatar(locale: string, userId: number, file: MulterFile) {
-    return this.user.changeAvatar(locale, userId, file);   
+    const result = await this.user.changeAvatar(locale, userId, file);
+    this.eventEmitter.emit(PROFILE_AVATAR_UPDATED, new ProfileAvatarUpdatedEvent(userId, result?.id ?? null));
+    return result;
   }
 
   async changePassword(locale:string, userId: number, {currentPassword, newPassword}: ChangePasswordDto, ipAddress?: string, userAgent?: string) {