@hexabot-ai/api 3.2.2-alpha.1 → 3.2.2-alpha.10

package/src/attachment/utilities/index.ts

@@ -4,13 +4,13 @@
  * Full terms: see LICENSE.md.
  */
 
+import { randomUUID } from 'crypto';
 import { createReadStream, existsSync } from 'fs';
 import { extname } from 'path';
 import { Readable } from 'stream';
 
 import { Logger, StreamableFile } from '@nestjs/common';
 import { StreamableFileOptions } from '@nestjs/common/file-stream/interfaces/streamable-options.interface';
-import { v4 as uuidv4 } from 'uuid';
 
 import { config } from '@/config';
 
@@ -80,7 +80,7 @@ export const generateUniqueFilename = (originalname: string) => {
   const extension = extname(originalname);
   const name = originalname.slice(0, -extension.length);
 
-  return `${name}-${uuidv4()}${extension}`;
+  return `${name}-${randomUUID()}${extension}`;
 };
 
 /**

package/src/bootstrap.ts

@@ -4,7 +4,7 @@
  * Full terms: see LICENSE.md.
  */
 
-import { Type, ValidationPipe } from '@nestjs/common';
+import { ConsoleLogger, Logger, Type, ValidationPipe } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
 import type { NestExpressApplication } from '@nestjs/platform-express';
 import bodyParser from 'body-parser';
@@ -25,6 +25,12 @@ moduleAlias.addAliases({
   '@': __dirname,
 });
 
+class HexabotBootstrapLogger extends ConsoleLogger {
+  override log(message: unknown, context?: string) {
+    super.log(message, context === 'NestApplication' ? 'Hexabot' : context);
+  }
+}
+
 const rawBodyBuffer = (req, res, buf, encoding) => {
   if (buf?.length) {
     req.rawBody = buf.toString(encoding || 'utf8');
@@ -37,6 +43,9 @@ const isProductionEnv = (forced?: boolean): boolean => {
 
   return config.env.toLowerCase().includes('prod');
 };
+const normalizeLocalhostUrl = (url: string): string => {
+  return url.replace('://127.0.0.1', '://localhost');
+};
 
 export interface HexabotBootstrapOptions {
   listen?: {
@@ -54,6 +63,7 @@ export async function createHexabotApplication<
   await resolveDynamicProviders();
   const app = await NestFactory.create<TApp>(moduleRef, {
     bodyParser: false,
+    logger: new HexabotBootstrapLogger(),
   });
 
   app.set('query parser', 'extended');
@@ -134,6 +144,8 @@ export async function bootstrapHexabotApp(
   const host = options.listen?.host ?? '0.0.0.0';
 
   await app.listen(port, host);
+  const appUrl = normalizeLocalhostUrl(await app.getUrl());
+  Logger.log(`Hexabot is running at ${appUrl}`, 'Hexabot');
 
   return app;
 }

package/src/channel/channel.service.ts

@@ -42,9 +42,12 @@ export class ChannelService implements OnApplicationBootstrap {
   ) {}
 
   async onApplicationBootstrap(): Promise<void> {
-    await this.sourceService.ensureDefaultSources(
-      this.getAll().map((handler) => handler.getName()),
+    const registeredChannelNames = this.getAll().map((handler) =>
+      handler.getName(),
     );
+
+    await this.sourceService.ensureDefaultSources(registeredChannelNames);
+    await this.sourceService.disableUnregisteredSources(registeredChannelNames);
   }
 
   public setChannel<T extends ChannelName, C extends ChannelHandler<T>>(

package/src/channel/lib/Handler.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { randomUUID } from 'crypto';
+
 import type {
   ActionOptions,
   Attachment,
@@ -16,7 +18,6 @@ import { Inject, Injectable, OnModuleInit, Type } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
 import { Request, Response } from 'express';
 import mime from 'mime';
-import { v4 as uuidv4 } from 'uuid';
 import z from 'zod';
 
 import { AttachmentService } from '@/attachment/services/attachment.service';
@@ -232,7 +233,7 @@ export default abstract class ChannelHandler<
     const attachments = await Promise.all(
       metadatas.map(({ file, name, type, size }) => {
         return this.attachmentService.store(file, {
-          name: `${name ? `${name}-` : ''}${uuidv4()}.${mime.extension(type)}`,
+          name: `${name ? `${name}-` : ''}${randomUUID()}.${mime.extension(type)}`,
           type,
           size,
           resourceRef: AttachmentResourceRef.MessageAttachment,

package/src/channel/lib/__test__/label.mock.ts

@@ -12,12 +12,6 @@ const baseLabel: Label = {
   ...modelInstance,
   title: '',
   name: '',
-  label_id: {
-    messenger: '',
-    web: '',
-    dimelo: '',
-    twitter: '',
-  },
   description: '',
   builtin: false,
   group: null,
@@ -27,12 +21,6 @@ export const labelMock: Label = {
   ...baseLabel,
   title: 'Label',
   name: 'label',
-  label_id: {
-    messenger: 'none',
-    web: 'none',
-    dimelo: 'none',
-    twitter: 'none',
-  },
 };
 
 export const customerLabelsMock: Label[] = [
@@ -40,22 +28,10 @@ export const customerLabelsMock: Label[] = [
     ...baseLabel,
     title: 'Client',
     name: 'client',
-    label_id: {
-      messenger: 'none',
-      web: 'none',
-      dimelo: 'none',
-      twitter: 'none',
-    },
   },
   {
     ...baseLabel,
     title: 'Professional',
     name: 'profressional',
-    label_id: {
-      messenger: 'none',
-      web: 'none',
-      dimelo: 'none',
-      twitter: 'none',
-    },
   },
 ];

package/src/channel/services/source.service.ts

@@ -11,7 +11,7 @@ import {
   MethodNotAllowedException,
   NotFoundException,
 } from '@nestjs/common';
-import { FindManyOptions, FindOneOptions } from 'typeorm';
+import { FindManyOptions, FindOneOptions, In, Not } from 'typeorm';
 import { DeleteResult } from 'typeorm/driver/mongodb/typings';
 import z from 'zod';
 
@@ -107,6 +107,12 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
     return defaultWorkflow;
   }
 
+  private isStateOnlyDisablePayload(payload: SourceUpdateDto): boolean {
+    const keys = Object.keys(payload);
+
+    return keys.length === 1 && keys[0] === 'state' && payload.state === false;
+  }
+
   private async buildCreatePayload(
     payload: SourceCreateDto,
   ): Promise<SourceCreateDto> {
@@ -141,6 +147,16 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
       throw new NotFoundException('Source not found');
     }
 
+    if (!this.channelRegistry.findChannel(existing.channel)) {
+      if (this.isStateOnlyDisablePayload(payload)) {
+        return await super.updateOne(idOrOptions, { state: false }, options);
+      }
+
+      throw new BadRequestException(
+        `Channel "${existing.channel}" is not registered`,
+      );
+    }
+
     const channel = payload.channel ?? existing.channel;
     const shouldResetSettings =
       payload.channel !== undefined && payload.settings === undefined;
@@ -167,6 +183,27 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
     );
   }
 
+  async disableUnregisteredSources(
+    registeredChannelNames: string[],
+  ): Promise<Source[]> {
+    const uniqueRegisteredChannelNames = Array.from(
+      new Set(registeredChannelNames),
+    );
+
+    return await super.updateMany(
+      {
+        where:
+          uniqueRegisteredChannelNames.length > 0
+            ? {
+                state: true,
+                channel: Not(In(uniqueRegisteredChannelNames)),
+              }
+            : { state: true },
+      },
+      { state: false },
+    );
+  }
+
   async findActiveByRef(sourceRef: string): Promise<Source> {
     const normalizedSourceRef = sourceRef.trim();
     const source = await this.findOne(normalizedSourceRef);

package/src/chat/chat.module.ts

@@ -45,7 +45,7 @@ import { ThreadService } from './services/thread.service';
       SubscriberOrmEntity,
       ThreadOrmEntity,
     ]),
-    CmsModule,
+    forwardRef(() => CmsModule),
     AttachmentModule,
     UserModule,
 

package/src/chat/dto/label.dto.ts

@@ -6,13 +6,7 @@
 
 import { labelFullSchema, labelSchema } from '@hexabot-ai/types';
 import { ApiProperty, ApiPropertyOptional, PartialType } from '@nestjs/swagger';
-import {
-  IsNotEmpty,
-  IsObject,
-  IsOptional,
-  IsString,
-  Matches,
-} from 'class-validator';
+import { IsNotEmpty, IsOptional, IsString, Matches } from 'class-validator';
 
 import { IsUUIDv4 } from '@/utils/decorators/is-uuid.decorator';
 import { TDto } from '@/utils/types/dto.types';
@@ -43,11 +37,6 @@ export class LabelCreateDto {
   @IsOptional()
   @IsString()
   description?: string;
-
-  @ApiPropertyOptional({ description: 'Label id', type: Object })
-  @IsOptional()
-  @IsObject()
-  label_id?: Record<string, any>;
 }
 
 export class LabelUpdateDto extends PartialType(LabelCreateDto) {}

package/src/chat/entities/label.entity.ts

@@ -16,7 +16,6 @@ import {
 } from 'typeorm';
 
 import { AuditLabel } from '@/audit/decorators/audit-label.decorator';
-import { JsonColumn } from '@/database/decorators/json-column.decorator';
 import { BaseOrmEntity } from '@/database/entities/base.entity';
 import { AsRelation } from '@/utils/decorators/relation-ref.decorator';
 
@@ -51,9 +50,6 @@ export class LabelOrmEntity extends BaseOrmEntity<LabelDto> {
   @RelationId((label: LabelOrmEntity) => label.group)
   private readonly groupId?: string | null;
 
-  @JsonColumn({ nullable: true })
-  label_id?: Record<string, any> | null;
-
   @Column({ type: 'text', nullable: true })
   description?: string | null;
 

package/src/chat/entities/subscriber.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { subscriberSchema, subscriberFullSchema } from '@hexabot-ai/types';
 import {
   Check,
@@ -30,6 +32,8 @@ import { SubscriberDto } from '../dto/subscriber.dto';
 
 import { LabelOrmEntity } from './label.entity';
 
+const requireEntity = createRequire(__filename);
+
 export class SubscriberChannel {
   @Column()
   name: string;
@@ -65,13 +69,16 @@ export class SubscriberOrmEntity<
   @Column({ type: 'varchar', length: 64 })
   foreignId: string;
 
-  @ManyToOne('SourceOrmEntity', {
-    // STI (`users` table) stores both subscribers and operators.
-    // Keep the column nullable at the DB level, and enforce non-null for
-    // Subscriber rows via `CHK_SUBSCRIBER_SOURCE_REQUIRED`.
-    nullable: true,
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('../../channel/entities/source.entity').SourceOrmEntity,
+    {
+      // STI (`users` table) stores both subscribers and operators.
+      // Keep the column nullable at the DB level, and enforce non-null for
+      // Subscriber rows via `CHK_SUBSCRIBER_SOURCE_REQUIRED`.
+      nullable: true,
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'source_id' })
   @AsRelation()
   source: SourceOrmEntity;

package/src/chat/services/subscriber.service.ts

@@ -4,12 +4,13 @@
  * Full terms: see LICENSE.md.
  */
 
+import { randomUUID } from 'crypto';
+
 import { Subscriber } from '@hexabot-ai/types';
 import { Inject, Injectable, Optional, forwardRef } from '@nestjs/common';
 import { OnEvent } from '@nestjs/event-emitter';
 import mime from 'mime';
 import { In, IsNull, Not } from 'typeorm';
-import { v4 as uuidv4 } from 'uuid';
 
 import { AttachmentService } from '@/attachment/services/attachment.service';
 import {
@@ -159,7 +160,7 @@ export class SubscriberService extends BaseOrmService<SubscriberOrmEntity> {
     const { file, type, size } = avatar;
     const extension = mime.extension(type);
     const attachment = await this.attachmentService.store(file, {
-      name: `avatar-${uuidv4()}.${extension}`,
+      name: `avatar-${randomUUID()}.${extension}`,
       size,
       type,
       resourceRef: AttachmentResourceRef.SubscriberAvatar,

package/src/cms/entities/content-type.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { contentTypeSchema, contentTypeFullSchema } from '@hexabot-ai/types';
 import { JSONSchema7 as JsonSchema } from 'json-schema';
 import { Column, Entity, Index, OneToMany } from 'typeorm';
@@ -14,7 +16,9 @@ import { BaseOrmEntity } from '@/database/entities/base.entity';
 
 import { ContentTypeDto } from '../dto/contentType.dto';
 
-import { ContentOrmEntity } from './content.entity';
+import type { ContentOrmEntity } from './content.entity';
+
+const requireEntity = createRequire(__filename);
 
 @Entity({ name: 'content_types' })
 @Index(['name'], { unique: true })
@@ -31,8 +35,12 @@ export class ContentTypeOrmEntity extends BaseOrmEntity<ContentTypeDto> {
   @JsonColumn({ nullable: true })
   schema!: JsonSchema;
 
-  @OneToMany(() => ContentOrmEntity, (content) => content.contentType, {
-    cascade: ['remove'],
-  })
+  @OneToMany(
+    () => requireEntity('./content.entity').ContentOrmEntity,
+    (content: ContentOrmEntity) => content.contentType,
+    {
+      cascade: ['remove'],
+    },
+  )
   contents?: ContentOrmEntity[];
 }

package/src/cms/entities/content.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import {
   contentSchema,
   contentFullSchema,
@@ -31,7 +33,9 @@ import { AsRelation } from '@/utils/decorators/relation-ref.decorator';
 
 import { ContentDto } from '../dto/content.dto';
 
-import { ContentTypeOrmEntity } from './content-type.entity';
+import type { ContentTypeOrmEntity } from './content-type.entity';
+
+const requireEntity = createRequire(__filename);
 
 @Entity({ name: 'contents' })
 @Index(['title'])
@@ -44,10 +48,14 @@ export class ContentOrmEntity extends BaseOrmEntity<ContentDto> {
   /**
    * The content type of this content.
    */
-  @ManyToOne(() => ContentTypeOrmEntity, (entity) => entity.contents, {
-    nullable: false,
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('./content-type.entity').ContentTypeOrmEntity,
+    (entity: ContentTypeOrmEntity) => entity.contents,
+    {
+      nullable: false,
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'content_type_id' })
   @AsRelation()
   contentType!: ContentTypeOrmEntity;

package/src/cms/services/content-type.service.ts

@@ -8,8 +8,8 @@ import { ContentType } from '@hexabot-ai/types';
 import { Injectable } from '@nestjs/common';
 import { JSONSchema7 } from 'json-schema';
 
-import { InferCreateDto } from '@/utils';
 import { BaseOrmService } from '@/utils/generics/base-orm.service';
+import type { InferCreateDto } from '@/utils/types/dto.types';
 
 import { ContentTypeOrmEntity } from '../entities/content-type.entity';
 import { ContentTypeRepository } from '../repositories/content-type.repository';

package/src/cms/services/rag.service.ts

@@ -9,7 +9,7 @@ import { OnEvent } from '@nestjs/event-emitter';
 
 import { LoggerService } from '@/logger/logger.service';
 import { SettingService } from '@/setting/services/setting.service';
-import { UserOrmEntity } from '@/user';
+import type { UserOrmEntity } from '@/user/entities/user.entity';
 import {
   DeleteEntityEvent,
   InsertEntityEvent,

package/src/config/index.ts

@@ -82,23 +82,37 @@ const sessionLimitSubquery =
     ? true
     : process.env.SESSION_LIMIT_SUBQUERY === 'true';
 const sessionTtlSeconds = parseOptionalInt(process.env.SESSION_TTL_SECONDS);
+const apiBaseUrl = process.env.API_ORIGIN || 'http://localhost:3000/api';
 
 export const config: Config = {
   i18n: {
     translationFilename: process.env.I18N_TRANSLATION_FILENAME || 'messages',
   },
   appPath: process.cwd(),
-  apiBaseUrl: process.env.API_ORIGIN || 'http://localhost:3000/api',
+  apiBaseUrl,
   uiBaseUrl: process.env.FRONTEND_BASE_URL
     ? process.env.FRONTEND_BASE_URL
     : 'http://localhost:3000', // default to local dev
   ssoEnabled: process.env.SSO_ENABLED === 'true',
+  mcp: {
+    enabled: process.env.MCP_ENABLED === 'true',
+    serverName: process.env.MCP_SERVER_NAME || 'hexabot-api',
+    serverTitle: process.env.MCP_SERVER_TITLE || 'Hexabot API MCP Server',
+    serverVersion: process.env.MCP_SERVER_VERSION || '1.0.0',
+    serverDescription:
+      process.env.MCP_SERVER_DESCRIPTION ||
+      'Manage Hexabot workflows, runs, memory, credentials, actions, and CMS content.',
+    serverInstructions:
+      process.env.MCP_SERVER_INSTRUCTIONS ||
+      'Use these tools to inspect and manage Hexabot API resources. Credential values are never exposed.',
+  },
   security: {
     httpsEnabled: process.env.HTTPS_ENABLED === 'true',
     trustProxy: process.env.HTTPS_ENABLED === 'true', // Nginx in use ?
     cors: {
       allRoutes: true,
-      headers: 'content-type,x-xsrf-token,x-csrf-token',
+      headers:
+        'content-type,x-xsrf-token,x-csrf-token,authorization,mcp-session-id,last-event-id',
       methods: ['GET', 'PATCH', 'POST', 'DELETE', 'OPTIONS', 'HEAD'],
       allowOrigins: process.env.FRONTEND_ORIGIN
         ? process.env.FRONTEND_ORIGIN.split(',').map((origin) => origin.trim())
@@ -109,6 +123,7 @@ export const config: Config = {
     csrfExclude: [
       /^\/auth\/local$/, // login
       /^\/auth\/logout$/, // logout
+      /^\/mcp$/, // MCP Streamable HTTP endpoint
       /^\/webhook\//, // Any webhook channel
       /^\/reset(\/[^\/]+)?$/, // Reset request / Change password
     ],

package/src/config/types.ts

@@ -43,6 +43,14 @@ type TDatabaseConfig = {
   schema?: string;
   autoMigrate: boolean;
 };
+type TMcpConfig = {
+  enabled: boolean;
+  serverName: string;
+  serverTitle: string;
+  serverVersion: string;
+  serverDescription: string;
+  serverInstructions: string;
+};
 type SocketCookie =
   | {
       maxAge?: number | undefined;
@@ -59,6 +67,7 @@ export type Config = {
   apiBaseUrl: string;
   uiBaseUrl: string;
   ssoEnabled: boolean;
+  mcp: TMcpConfig;
   security: {
     httpsEnabled: boolean;
     trustProxy: boolean;

package/src/database/decorators/json-column.decorator.ts

@@ -12,6 +12,7 @@ type JsonColumnOptions = Omit<ColumnOptions, 'type'>;
 
 const dbTypeToJsonColumn: Record<string, ColumnType> = {
   sqlite: 'simple-json',
+  'better-sqlite3': 'simple-json',
   postgres: 'json',
   mysql: 'json',
   mariadb: 'json',

package/src/database/typeorm-config.service.ts

@@ -51,7 +51,7 @@ export class TypeormConfigService implements TypeOrmOptionsFactory {
         // @ts-expect-error type mismatch)
         return {
           ...base,
-          type: 'sqlite',
+          type: 'better-sqlite3',
           database: db.sqlitePath ?? 'hexabot.sqlite',
         };
     }

package/src/extensions/actions/ai/mcp.binding.ts

@@ -30,12 +30,13 @@ export const aiMcpToolBindingSchema = z.strictObject({
         'Optional allow-list of MCP tool names. Leave empty to expose all server tools.',
       'ui:widget': 'AutoCompleteWidget',
       'ui:options': {
-        entity: 'McpServerTool',
-        valueKey: 'name',
+        apiPath: '/mcpserver/:id/tools',
         labelKey: 'name',
+        idKey: 'name',
+        valueKey: 'name',
         idFormPath: 'server_id',
-        routeParamKey: 'id',
         disableSearch: true,
+        multiple: true,
       },
     }),
 });

package/src/extensions/actions/web/http-request.action.ts

@@ -110,6 +110,26 @@ function isJsonContentType(contentType?: string) {
   );
 }
 
+function normalizeHeaderValue(value: unknown): string | undefined {
+  if (value === undefined || value === null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    return value.map(String).join(', ');
+  }
+
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return String(value);
+  }
+
+  return undefined;
+}
+
 function resolveFinalUrl(response: {
   request?: { res?: { responseUrl?: string }; responseUrl?: string };
 }) {
@@ -175,10 +195,9 @@ export const HttpRequestAction = createAction<
         validateStatus: () => true,
         ...(requestData !== undefined ? { data: requestData } : {}),
       });
-      const contentTypeHeader = response.headers?.['content-type'];
-      const contentType = Array.isArray(contentTypeHeader)
-        ? contentTypeHeader.join(', ')
-        : contentTypeHeader;
+      const contentType = normalizeHeaderValue(
+        response.headers?.['content-type'],
+      );
       const responseData = response.data;
       let body: HttpRequestOutput['body'] = '';