@hexabot-ai/api 3.2.2-beta.2 → 3.2.3

package/src/channel/services/source.service.ts

@@ -15,6 +15,7 @@ import { FindManyOptions, FindOneOptions, In, Not } from 'typeorm';
 import { DeleteResult } from 'typeorm/driver/mongodb/typings';
 import z from 'zod';
 
+import { CONSOLE_CHANNEL_NAME } from '@/extensions/channels/console/settings.schema';
 import { UpdateOneOptions } from '@/utils/generics/base-orm.repository';
 import { BaseOrmService } from '@/utils/generics/base-orm.service';
 import { WorkflowService } from '@/workflow/services/workflow.service';
@@ -113,9 +114,17 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
     return keys.length === 1 && keys[0] === 'state' && payload.state === false;
   }
 
+  private ensureSourceCanBeDisabled(channel: string, state?: boolean): void {
+    if (channel === CONSOLE_CHANNEL_NAME && state === false) {
+      throw new BadRequestException('Console source cannot be disabled');
+    }
+  }
+
   private async buildCreatePayload(
     payload: SourceCreateDto,
   ): Promise<SourceCreateDto> {
+    this.ensureSourceCanBeDisabled(payload.channel, payload.state);
+
     const normalizedSettings = this.normalizeSettings(
       payload.channel,
       payload.settings,
@@ -147,6 +156,9 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
       throw new NotFoundException('Source not found');
     }
 
+    const channel = payload.channel ?? existing.channel;
+    this.ensureSourceCanBeDisabled(channel, payload.state);
+
     if (!this.channelRegistry.findChannel(existing.channel)) {
       if (this.isStateOnlyDisablePayload(payload)) {
         return await super.updateOne(idOrOptions, { state: false }, options);
@@ -157,13 +169,16 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
       );
     }
 
-    const channel = payload.channel ?? existing.channel;
     const shouldResetSettings =
       payload.channel !== undefined && payload.settings === undefined;
-    const settingsInput = shouldResetSettings
-      ? {}
-      : (payload.settings ?? existing.settings);
-    const normalizedSettings = this.normalizeSettings(channel, settingsInput);
+    const shouldNormalizeSettings =
+      payload.settings !== undefined || shouldResetSettings;
+    const normalizedSettings = shouldNormalizeSettings
+      ? this.normalizeSettings(
+          channel,
+          shouldResetSettings ? {} : payload.settings,
+        )
+      : undefined;
     const normalizedDefaultWorkflow =
       payload.defaultWorkflow !== undefined
         ? await this.normalizeDefaultWorkflow(payload.defaultWorkflow)
@@ -174,7 +189,9 @@ export class SourceService extends BaseOrmService<SourceOrmEntity> {
       {
         ...payload,
         channel,
-        settings: normalizedSettings,
+        ...(normalizedSettings !== undefined
+          ? { settings: normalizedSettings }
+          : {}),
         ...(normalizedDefaultWorkflow !== undefined
           ? { defaultWorkflow: normalizedDefaultWorkflow }
           : {}),

package/src/config/index.ts

@@ -6,6 +6,13 @@
 
 import { join } from 'path';
 
+import {
+  parseAuditHeaders,
+  parseCsv,
+  parseIntWithFallback,
+  parseOptionalInt,
+} from '@/utils/helpers/parse';
+
 import { Config } from './types';
 
 const isProduction = (process.env.NODE_ENV || 'development')
@@ -16,59 +23,6 @@ const shouldAutoMigrate =
   (autoMigrateToggle === 'true' &&
     (process.env.API_IS_PRIMARY_NODE || 'true') === 'true') ||
   !isProduction;
-const parseIntWithFallback = (
-  value: string | undefined,
-  fallback: number,
-): number => {
-  if (!value) {
-    return fallback;
-  }
-  const parsed = Number.parseInt(value, 10);
-
-  return Number.isNaN(parsed) ? fallback : parsed;
-};
-const parseOptionalInt = (value: string | undefined): number | undefined => {
-  if (value === undefined) {
-    return undefined;
-  }
-  const parsed = Number.parseInt(value, 10);
-
-  return Number.isNaN(parsed) ? undefined : parsed;
-};
-const parseCsv = (value: string | undefined, fallback: string[]): string[] => {
-  if (!value) {
-    return fallback;
-  }
-
-  return value
-    .split(',')
-    .map((entry) => entry.trim())
-    .filter((entry) => entry.length > 0);
-};
-const parseAuditHeaders = (
-  value: string | undefined,
-): Record<string, string> => {
-  if (!value) {
-    return {};
-  }
-
-  try {
-    const parsed = JSON.parse(value) as unknown;
-
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-      return {};
-    }
-
-    return Object.fromEntries(
-      Object.entries(parsed).map(([key, headerValue]) => [
-        key,
-        String(headerValue),
-      ]),
-    );
-  } catch {
-    return {};
-  }
-};
 const sessionMaxAge = parseIntWithFallback(
   process.env.SESSION_MAX_AGE,
   24 * 60 * 60 * 1000,
@@ -114,9 +68,7 @@ export const config: Config = {
       headers:
         'content-type,x-xsrf-token,x-csrf-token,authorization,mcp-session-id,last-event-id',
       methods: ['GET', 'PATCH', 'POST', 'DELETE', 'OPTIONS', 'HEAD'],
-      allowOrigins: process.env.FRONTEND_ORIGIN
-        ? process.env.FRONTEND_ORIGIN.split(',').map((origin) => origin.trim())
-        : ['*'],
+      allowOrigins: parseCsv(process.env.FRONTEND_ORIGIN, ['*']),
       allowCredentials: true,
     },
     csrf: true,
@@ -174,9 +126,9 @@ export const config: Config = {
     // that sets a cookie (this is used by the sails.io.js socket client
     // to get access to a 3rd party cookie and to enable sessions).
     grant3rdPartyCookie: true,
-    onlyAllowOrigins: process.env.FRONTEND_ORIGIN
-      ? process.env.FRONTEND_ORIGIN.split(',').map((origin) => origin.trim())
-      : [], // ['http://example.com', 'https://example.com'],
+    // Admin/frontend origins for Socket.IO connections without a web source.
+    // Web widget origins are controlled by each web source's allowed_domains.
+    onlyAllowOrigins: parseCsv(process.env.FRONTEND_ORIGIN, []), // ['http://example.com', 'https://example.com'],
   },
   session: {
     secret: process.env.SESSION_SECRET || 'changeme',

package/src/extensions/actions/ai/ai-base.action.ts

@@ -5,13 +5,14 @@
  */
 
 import { createOpenAI } from '@ai-sdk/openai';
+import { createOpenAICompatible } from '@ai-sdk/openai-compatible';
 import { ProviderV2, ProviderV3 } from '@ai-sdk/provider';
 import {
   IncomingMessageType,
   Message,
-  Thread,
   StdIncomingMessage,
   StdOutgoingMessage,
+  Thread,
 } from '@hexabot-ai/types';
 import {
   LanguageModel,
@@ -123,7 +124,11 @@ export abstract class AiBaseAction<
     // Most hosted providers need an API key; skip strict enforcement for custom/local providers.
     const providerId = this.getProviderId(provider);
 
-    return providerId === 'openai' || providerId === 'gateway';
+    return (
+      providerId === 'openai' ||
+      providerId === 'gateway' ||
+      providerId === 'litellm'
+    );
   }
 
   protected async loadProvider(
@@ -143,6 +148,14 @@ export abstract class AiBaseAction<
       return createGatewayProvider(options);
     }
 
+    if (providerId === 'litellm') {
+      return createOpenAICompatible({
+        ...options,
+        name: 'litellm',
+        baseURL: options.baseURL || '',
+      });
+    }
+
     const moduleCandidates = new Set<string>([
       provider,
       normalized,

package/src/extensions/actions/ai/model.binding.ts

@@ -36,6 +36,7 @@ export const vercelAiSdkProviders = [
   'huggingface',
   'hume',
   'klingai',
+  'litellm',
   'lmnt',
   'luma',
   'mistral',
@@ -85,7 +86,7 @@ export const aiModelBindingSchema = z.strictObject({
       'ui:options': {
         showWhen: {
           field: 'provider',
-          equals: 'gateway',
+          in: ['gateway', 'litellm'],
         },
       },
     }),

package/src/extensions/channels/console/i18n/en.translations.json

@@ -3,14 +3,10 @@
     "Admin Chat Console": "Admin Chat Console",
     "Allowed domains": "Allowed domains",
     "Comma-separated list of allowed CORS origins.": "Comma-separated list of allowed CORS origins.",
-    "Show start button": "Show start button",
-    "Display the start button before chat begins.": "Display the start button before chat begins.",
     "Disable input": "Disable input",
     "Disable the user input field in the chat widget.": "Disable the user input field in the chat widget.",
     "Persistent menu": "Persistent menu",
     "Keep the menu visible in the chat interface.": "Keep the menu visible in the chat interface.",
-    "Greeting message": "Greeting message",
-    "Greeting shown to users when the conversation starts.": "Greeting shown to users when the conversation starts.",
     "Show emoji": "Show emoji",
     "Enable emoji picker in the chat interface.": "Enable emoji picker in the chat interface.",
     "Show file upload": "Show file upload",
@@ -18,7 +14,6 @@
     "Show location": "Show location",
     "Enable location sharing action in the chat interface.": "Enable location sharing action in the chat interface.",
     "Allowed upload types": "Allowed upload types",
-    "Comma-separated MIME types accepted by the upload input.": "Comma-separated MIME types accepted by the upload input.",
-    "Welcome! Ready to start chatting with our chatbot?": "Welcome! Ready to start chatting with our chatbot?"
+    "Comma-separated MIME types accepted by the upload input.": "Comma-separated MIME types accepted by the upload input."
   }
 }

package/src/extensions/channels/console/i18n/fr.translations.json

@@ -3,14 +3,10 @@
     "Admin Chat Console": "Testeur Live Chat",
     "Allowed domains": "Domaines autorisés",
     "Comma-separated list of allowed CORS origins.": "Liste séparée par des virgules des origines CORS autorisées.",
-    "Show start button": "Afficher le bouton de démarrage",
-    "Display the start button before chat begins.": "Afficher le bouton de démarrage avant le début de la discussion.",
     "Disable input": "Désactiver la saisie",
     "Disable the user input field in the chat widget.": "Désactiver le champ de saisie utilisateur dans le widget de chat.",
     "Persistent menu": "Menu persistant",
     "Keep the menu visible in the chat interface.": "Garder le menu visible dans l'interface de chat.",
-    "Greeting message": "Message de bienvenue",
-    "Greeting shown to users when the conversation starts.": "Message affiché aux utilisateurs au début de la conversation.",
     "Show emoji": "Afficher les emojis",
     "Enable emoji picker in the chat interface.": "Activer le sélecteur d'emojis dans l'interface de chat.",
     "Show file upload": "Afficher l'envoi de fichier",
@@ -18,7 +14,6 @@
     "Show location": "Afficher la localisation",
     "Enable location sharing action in the chat interface.": "Activer le partage de localisation dans l'interface de chat.",
     "Allowed upload types": "Types de téléversement autorisés",
-    "Comma-separated MIME types accepted by the upload input.": "Types MIME acceptés par le champ d'envoi, séparés par des virgules.",
-    "Welcome! Ready to start chatting with our chatbot?": "Bienvenue ! Prêt à commencer à discuter avec notre chatbot ?"
+    "Comma-separated MIME types accepted by the upload input.": "Types MIME acceptés par le champ d'envoi, séparés par des virgules."
   }
 }

package/src/extensions/channels/console/index.channel.ts

@@ -18,6 +18,10 @@ export default class ConsoleChannelHandler extends BaseWebChannelHandler<
   typeof CONSOLE_CHANNEL_NAME
 > {
   constructor() {
-    super(CONSOLE_CHANNEL_NAME, CONSOLE_CHANNEL_SOURCE_SETTINGS_SCHEMA);
+    super(
+      CONSOLE_CHANNEL_NAME,
+      CONSOLE_CHANNEL_SOURCE_SETTINGS_SCHEMA,
+      'system',
+    );
   }
 }

package/src/extensions/channels/console/settings.schema.ts

@@ -22,10 +22,6 @@ export const CONSOLE_CHANNEL_SOURCE_SETTINGS_SCHEMA = z
         title: 'Allowed domains',
         description: 'Comma-separated list of allowed CORS origins.',
       }),
-    start_button: z.boolean().default(true).meta({
-      title: 'Show start button',
-      description: 'Display the start button before chat begins.',
-    }),
     input_disabled: z.boolean().default(false).meta({
       title: 'Disable input',
       description: 'Disable the user input field in the chat widget.',
@@ -34,14 +30,6 @@ export const CONSOLE_CHANNEL_SOURCE_SETTINGS_SCHEMA = z
       title: 'Persistent menu',
       description: 'Keep the menu visible in the chat interface.',
     }),
-    greeting_message: z
-      .string()
-      .default('Welcome! Ready to start chatting with our chatbot?')
-      .meta({
-        title: 'Greeting message',
-        description: 'Greeting shown to users when the conversation starts.',
-        'ui:widget': 'textarea',
-      }),
     show_emoji: z.boolean().default(true).meta({
       title: 'Show emoji',
       description: 'Enable emoji picker in the chat interface.',

package/src/extensions/channels/web/base-web-channel.ts

@@ -8,6 +8,7 @@ import { randomUUID } from 'crypto';
 
 import type {
   Attachment,
+  ChannelVisibility,
   Source,
   StdOutgoingMessageEnvelope,
   Subscriber,
@@ -50,6 +51,7 @@ import { MessageService } from '@/chat/services/message.service';
 import type { SubscriberChannelData } from '@/chat/types/channel';
 import { MenuService } from '@/cms/services/menu.service';
 import { config } from '@/config';
+import { getAllowedDomains } from '@/utils/helpers/origin';
 import { SocketRequest } from '@/websocket/utils/socket-request';
 import { SocketResponse } from '@/websocket/utils/socket-response';
 
@@ -116,8 +118,12 @@ export default abstract class BaseWebChannelHandler<N extends ChannelName>
   @ExtensionInject(WebHistoryService)
   private historyService!: WebHistoryService;
 
-  constructor(name: N, sourceSettingsSchema?: z.ZodTypeAny) {
-    super(name, sourceSettingsSchema);
+  constructor(
+    name: N,
+    sourceSettingsSchema?: z.ZodTypeAny,
+    visibility?: ChannelVisibility,
+  ) {
+    super(name, sourceSettingsSchema, visibility);
   }
 
   async onModuleInit() {
@@ -303,12 +309,11 @@ export default abstract class BaseWebChannelHandler<N extends ChannelName>
     res: Response | SocketResponse,
     source: Source,
   ): Promise<void> {
-    const allowedDomains =
-      typeof source.settings.allowed_domains === 'string'
-        ? source.settings.allowed_domains
-        : '*';
-
-    await this.sessionService.validateCors(req, res, allowedDomains);
+    await this.sessionService.validateCors(
+      req,
+      res,
+      getAllowedDomains(source.settings),
+    );
   }
 
   protected async getOrCreateSession(

package/src/extensions/channels/web/services/web-session.service.ts

@@ -12,6 +12,7 @@ import { SubscriberCreateDto } from '@/chat/dto/subscriber.dto';
 import { SubscriberService } from '@/chat/services/subscriber.service';
 import { ThreadService } from '@/chat/services/thread.service';
 import { LoggerService } from '@/logger/logger.service';
+import { isAllowedOrigin, normalizeOrigin } from '@/utils/helpers/origin';
 import { SocketRequest } from '@/websocket/utils/socket-request';
 import { SocketResponse } from '@/websocket/utils/socket-response';
 
@@ -62,38 +63,26 @@ export class WebSessionService {
     res: Response | SocketResponse,
     allowedDomains: string,
   ): Promise<void> {
-    if (!req.headers?.origin) {
+    const origin = req.headers?.origin;
+
+    if (!origin) {
       this.logger.debug('No origin ', req.headers);
       throw new Error('CORS - No origin provided!');
     }
 
-    const originUrl = new URL(req.headers.origin);
-    if (!['http:', 'https:'].includes(originUrl.protocol)) {
+    const normalizedOrigin = normalizeOrigin(origin);
+
+    if (!normalizedOrigin) {
       throw new Error('CORS - Invalid origin!');
     }
 
-    const origins = allowedDomains.split(',');
-    const foundOrigin = origins
-      .filter((o) => o.trim() !== '*')
-      .map((o) => {
-        try {
-          return new URL(o.trim()).origin;
-        } catch {
-          this.logger.error(`Invalid URL in allowed domains: ${o}`);
-
-          return null;
-        }
-      })
-      .filter((o): o is string => o !== null)
-      .some((o) => o === originUrl.origin);
-
-    if (!foundOrigin && !origins.includes('*')) {
+    if (!isAllowedOrigin(normalizedOrigin, allowedDomains)) {
       res.set('Access-Control-Allow-Origin', '');
-      this.logger.debug('No origin found ', req.headers.origin);
+      this.logger.debug('No origin found ', origin);
       throw new Error('CORS - Domain not allowed!');
     }
 
-    res.set('Access-Control-Allow-Origin', originUrl.origin);
+    res.set('Access-Control-Allow-Origin', normalizedOrigin);
     res.set('Access-Control-Allow-Credentials', 'true');
     res.set('Access-Control-Expose-Headers', '');
     if (req.method === 'OPTIONS') {

package/src/extensions/channels/web/settings.schema.ts

@@ -12,6 +12,8 @@ export const WEB_CHANNEL_NAME = 'web' as const;
 
 const WEB_ALLOWED_UPLOAD_TYPES =
   'audio/mpeg,audio/x-ms-wma,audio/vnd.rn-realaudio,audio/x-wav,image/gif,image/jpeg,image/png,image/tiff,image/vnd.microsoft.icon,image/vnd.djvu,image/svg+xml,text/css,text/csv,text/html,text/plain,text/xml,video/mpeg,video/mp4,video/quicktime,video/x-ms-wmv,video/x-msvideo,video/x-flv,video/web,application/msword,application/vnd.ms-powerpoint,application/pdf,application/vnd.ms-excel,application/vnd.oasis.opendocument.presentation,application/vnd.oasis.opendocument.tex,application/vnd.oasis.opendocument.spreadsheet,application/vnd.oasis.opendocument.graphics,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.openxmlformats-officedocument.presentationml.presentation,application/vnd.openxmlformats-officedocument.wordprocessingml.document';
+const emptyStringToUndefined = (value: unknown) =>
+  typeof value === 'string' && value.trim() === '' ? undefined : value;
 
 export const WEB_CHANNEL_SOURCE_SETTINGS_SCHEMA = z
   .strictObject({
@@ -46,10 +48,14 @@ export const WEB_CHANNEL_SOURCE_SETTINGS_SCHEMA = z
       title: 'Window title',
       description: 'Title displayed in the web widget header.',
     }),
-    avatar_url: z.url().default('').optional().meta({
-      title: 'Avatar URL',
-      description: 'URL of the chatbot avatar image.',
-    }),
+    avatar_url: z
+      .preprocess(emptyStringToUndefined, z.url().optional())
+      .default('')
+      .optional()
+      .meta({
+        title: 'Avatar URL',
+        description: 'URL of the chatbot avatar image.',
+      }),
     show_emoji: z.boolean().default(true).meta({
       title: 'Show emoji',
       description: 'Enable emoji picker in the chat interface.',

package/src/setting/services/setting.service.ts

@@ -28,6 +28,7 @@ import {
 import { Cacheable } from '@/utils/decorators/cacheable.decorator';
 import { UpdateOneOptions } from '@/utils/generics/base-orm.repository';
 import { BaseOrmService } from '@/utils/generics/base-orm.service';
+import { splitAllowedOrigins } from '@/utils/helpers/origin';
 import { UpdateEntityEvent } from '@/utils/types/entity-event.types';
 
 import { SettingCreateDto, SettingUpdateDto } from '../dto/setting.dto';
@@ -272,9 +273,9 @@ export class SettingService extends BaseOrmService<SettingOrmEntity> {
       where: { label: 'allowed_domains' },
     })) as Setting[];
     const allowedDomains = settings.flatMap((setting) =>
-      (typeof setting.value === 'string' ? setting.value : '')
-        .split(',')
-        .filter((origin) => origin),
+      typeof setting.value === 'string'
+        ? splitAllowedOrigins(setting.value)
+        : [],
     );
     const uniqueOrigins = new Set([
       ...config.security.cors.allowOrigins,

package/src/utils/helpers/origin.ts

@@ -0,0 +1,50 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import { parseCsv } from './parse';
+
+export const normalizeOrigin = (value: string | undefined): string | null => {
+  if (!value) {
+    return null;
+  }
+
+  try {
+    const url = new URL(value.trim());
+
+    return ['http:', 'https:'].includes(url.protocol) ? url.origin : null;
+  } catch {
+    return null;
+  }
+};
+
+export const splitAllowedOrigins = (
+  allowedOrigins: string | string[],
+): string[] => parseCsv(allowedOrigins, []);
+
+export const getAllowedDomains = (settings: Record<string, unknown>): string =>
+  typeof settings.allowed_domains === 'string' ? settings.allowed_domains : '*';
+
+export const isAllowedOrigin = (
+  origin: string | undefined,
+  allowedOrigins: string | string[],
+): boolean => {
+  const normalizedOrigin = normalizeOrigin(origin);
+  const allowedOriginValues = splitAllowedOrigins(allowedOrigins);
+
+  if (!normalizedOrigin) {
+    return false;
+  }
+
+  if (allowedOriginValues.includes('*')) {
+    return true;
+  }
+
+  const normalizedAllowedOrigins = allowedOriginValues
+    .map(normalizeOrigin)
+    .filter((allowedOrigin): allowedOrigin is string => allowedOrigin !== null);
+
+  return normalizedAllowedOrigins.includes(normalizedOrigin);
+};

package/src/utils/helpers/parse.ts

@@ -0,0 +1,68 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+export const parseIntWithFallback = (
+  value: string | undefined,
+  fallback: number,
+): number => {
+  if (!value) {
+    return fallback;
+  }
+  const parsed = Number.parseInt(value, 10);
+
+  return Number.isNaN(parsed) ? fallback : parsed;
+};
+
+export const parseOptionalInt = (
+  value: string | undefined,
+): number | undefined => {
+  if (value === undefined) {
+    return undefined;
+  }
+  const parsed = Number.parseInt(value, 10);
+
+  return Number.isNaN(parsed) ? undefined : parsed;
+};
+
+export const parseCsv = (
+  value: string | string[] | undefined,
+  fallback: string[],
+): string[] => {
+  if (!value) {
+    return fallback;
+  }
+
+  const values = Array.isArray(value) ? value : value.split(',');
+
+  return values
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+};
+
+export const parseAuditHeaders = (
+  value: string | undefined,
+): Record<string, string> => {
+  if (!value) {
+    return {};
+  }
+
+  try {
+    const parsed = JSON.parse(value) as unknown;
+
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return {};
+    }
+
+    return Object.fromEntries(
+      Object.entries(parsed).map(([key, headerValue]) => [
+        key,
+        String(headerValue),
+      ]),
+    );
+  } catch {
+    return {};
+  }
+};

package/src/utils/index.ts

@@ -46,6 +46,8 @@ export * from './helpers/misc';
 
 export * from './helpers/object';
 
+export * from './helpers/parse';
+
 export * from './helpers/safeRandom';
 
 export * from './helpers/svg';

package/src/websocket/tokens.ts

@@ -0,0 +1,7 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+export const WEBSOCKET_GATEWAY = Symbol('WEBSOCKET_GATEWAY');