@k2b/cloud 0.26.0 → 0.27.0

package/src/services/outgoing-mail/test-send.ts

@@ -0,0 +1,40 @@
+import { audit } from "../audit";
+import { get } from "../settings";
+import { type MailAuditContext, OutgoingMailError, resolveMailCredentials } from "./store";
+import { buildMailTransport } from "./transport";
+
+export const smtpFailureMessage = (error: unknown, secrets: readonly (string | null)[]): string => {
+  let message = error instanceof Error ? error.message : "SMTP delivery failed.";
+  for (const secret of secrets.filter((s): s is string => !!s)) {
+    for (const representation of [secret, Buffer.from(secret).toString("base64")])
+      message = message.split(representation).join("[REDACTED]");
+  }
+  return message;
+};
+export const outgoingMailTest = {
+  async send(key: string, recipient: string, context: MailAuditContext): Promise<void> {
+    const profile = await resolveMailCredentials(key);
+    const event = { ...context, action: "outgoing_mail.profile.test", target: { type: "outgoing_mail_profile", id: key } };
+    // Fail before the external effect if audit storage is unavailable.
+    await audit.record({ ...event, outcome: "allowed" });
+    const transport = buildMailTransport(profile);
+    try {
+      await transport.sendMail({
+        from: { address: profile.fromAddress, name: profile.fromName ?? (await get<string>("app.name")) },
+        to: recipient,
+        subject: "Cloud test email",
+        text: "This is a test email from Cloud. SMTP delivery is configured correctly if you received it.",
+      });
+    } catch (error) {
+      const message = smtpFailureMessage(error, [
+        profile.smtpPassword,
+        profile.smtpUser,
+        profile.smtpUser ? `\0${profile.smtpUser}\0${profile.smtpPassword ?? ""}` : null,
+      ]);
+      await audit.recordResultAfterSideEffect({ ...event, result: { ok: false, error: { code: "smtp_failed", message, status: 500 } } });
+      throw new OutgoingMailError("smtp_failed", message, 502);
+    } finally {
+      transport.close();
+    }
+  },
+};

package/src/services/outgoing-mail/transport.ts

@@ -0,0 +1,13 @@
+import { createTransport } from "nodemailer";
+import type { resolveMailCredentials } from "./store";
+
+export const buildMailTransport = (profile: Awaited<ReturnType<typeof resolveMailCredentials>>) =>
+  createTransport({
+    host: profile.smtpHost,
+    port: profile.smtpPort,
+    secure: profile.smtpSecure,
+    ...(profile.smtpUser ? { auth: { user: profile.smtpUser, pass: profile.smtpPassword ?? "" } } : {}),
+    connectionTimeout: 10000,
+    greetingTimeout: 10000,
+    socketTimeout: 60000,
+  });

package/src/services/settings/core-settings.ts

@@ -292,7 +292,7 @@ export const CORE_SETTINGS = {
     default: 30,
     min: 0,
     description:
-      "Maximum running time per AI turn. Zero or an empty field disables this limit. Existing turns keep their original budget; request and tool timeouts still apply.",
+      "Maximum running time per AI turn. In the last tenth, the Assistant stops using tools and answers. Zero or an empty field disables this limit. Existing turns keep their original budget; request and tool timeouts still apply.",
   },
   "ai.max_tool_result_chars": {
     kind: "number",
@@ -672,43 +672,6 @@ export const CORE_SETTINGS = {
     description: "Account request denial email template (HTML). Subject: Account Request Update",
     templateVars: ["FIRST_NAME", "REASON", "CONTACT_EMAIL", "APP_NAME"] as readonly string[],
   },
-  "mail.noreply.smtp_host": {
-    kind: "string",
-    label: "SMTP Host",
-    default: "",
-    description: "SMTP server hostname",
-    placeholder: "e.g. smtp.example.org",
-  },
-  "mail.noreply.smtp_port": {
-    kind: "number",
-    label: "SMTP Port",
-    default: 587,
-    min: 1,
-    max: 65535,
-    description: "SMTP server port (587 for STARTTLS, 465 for SSL)",
-  },
-  "mail.noreply.from": {
-    kind: "email",
-    label: "From Address",
-    default: "",
-    description: "From email address",
-    placeholder: "e.g. noreply@example.org",
-  },
-  "mail.noreply.user": {
-    kind: "string",
-    label: "SMTP User",
-    default: "",
-    description: "SMTP username",
-    placeholder: "e.g. noreply@example.org",
-  },
-  "mail.noreply.password": {
-    kind: "secret",
-    label: "SMTP Password",
-    default: "",
-    description: "SMTP password",
-    placeholder: "SMTP password",
-  },
-
   // ── Security ────────────────────────────────────────────────────────────
   "security.rate_limit_per_second": {
     kind: "number",

package/src/services/settings/store.ts

@@ -136,7 +136,11 @@ export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unk
  */
 export const allKnownKeys = (): string[] => SETTINGS.map((d) => d.key);
 
-const knownKeysWith = (extraKnownKeys: readonly string[]) => Array.from(new Set([...allKnownKeys(), ...extraKnownKeys]));
+// Retain the prior SMTP configuration for one release so operators can roll back.
+const retainedLegacyKeys = ["smtp_host", "smtp_port", "from", "user", "password"].map((key) => `mail.noreply.${key}`);
+
+const knownKeysWith = (extraKnownKeys: readonly string[]) =>
+  Array.from(new Set([...allKnownKeys(), ...retainedLegacyKeys, ...extraKnownKeys]));
 
 export const listLegacyKeys = async (extraKnownKeys: readonly string[] = []): Promise<LegacySettingRow[]> => {
   const knownKeys = knownKeysWith(extraKnownKeys);

package/src/shared/ai-model-request-settings.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { AiExtraBodySchema, AiReasoningEffortSchema, AiRequestHeadersSchema } from "./ai-request-options";
+
+export const AiModelRequestSettingsUpdateSchema = z
+  .object({
+    expected: z.string().min(1),
+    reasoningEffort: AiReasoningEffortSchema.nullable(),
+    extraBody: AiExtraBodySchema.nullable().optional(),
+    requestHeaders: AiRequestHeadersSchema.optional(),
+    clearRequestHeaders: z.boolean().optional(),
+  })
+  .strict();
+export type AiModelRequestSettingsUpdate = z.infer<typeof AiModelRequestSettingsUpdateSchema>;
+export const AiModelRequestSettingsSchema = z.object({
+  id: z.string(),
+  reasoningEffort: z.string().nullable(),
+  extraBody: z.record(z.string(), z.unknown()).nullable(),
+  requestHeaderNames: z.array(z.string()),
+  revision: z.string(),
+});
+export type AiModelRequestSettings = z.infer<typeof AiModelRequestSettingsSchema>;

package/src/shared/ai-platform-prompt.ts

@@ -58,7 +58,7 @@ Use search_tools only when the needed operation is unknown. If a loaded Skill or
 {%- if appToolsEnabled %}
 
 # Cloud app tools
-Installed apps publish live Queries and Actions through tool discovery. Calls run with the current user's permissions and the owning app authorizes every call; catalog visibility is not access. Search with a known appId when possible, load only needed names, and treat Query or Action as read/write metadata rather than a search filter. Reuse returned typed resource refs unchanged. Missing tools may be temporary. Claim success only after the call succeeds.
+Installed apps publish live Queries and Actions through tool discovery. Calls run with the current user's permissions and the owning app authorizes every call; catalog visibility is not access. Search with a known appId when possible, load only needed names, and treat Query or Action as read/write metadata rather than a search filter. Reuse returned typed resource refs unchanged. If load_tools reports a tool as unavailable, follow its reason: look up an unknown name once with search_tools; otherwise do not search or retry for it again in this turn, and continue with what is available or tell the user what is missing. Claim success only after the call succeeds.
 {%- endif %}
 {%- if hasFiles %}
 

package/src/shared/ai-request-options.ts

@@ -0,0 +1,185 @@
+import { z } from "zod";
+
+// nessi 0.15 deep-merges extraBody last. Reserve identity/content, tool/loop
+// control, structured output, and profile-owned generation settings across all
+// adapters so an escape hatch cannot replace Cloud's request or quota budget.
+export const AI_RESERVED_EXTRA_BODY_KEYS = [
+  "model",
+  "models",
+  "route",
+  "messages",
+  "system",
+  "contents",
+  "systemInstruction",
+  "tools",
+  "tool_choice",
+  "toolConfig",
+  "parallel_tool_calls",
+  "stream",
+  "stream_options",
+  "response_format",
+  "structured_outputs",
+  "format",
+  "temperature",
+  "n",
+  "max_tokens",
+  "max_completion_tokens",
+  "reasoning_effort",
+  "reasoning",
+] as const;
+const keyName = (key: string) => key.replace(/_/g, "").toLowerCase();
+const reserved = new Set(AI_RESERVED_EXTRA_BODY_KEYS.map(keyName));
+const unsafeKeys = new Set(["__proto__", "constructor", "prototype"]);
+const nestedReserved = new Map<string, ReadonlySet<string>>([
+  [
+    keyName("generationConfig"),
+    new Set(["responseSchema", "responseJsonSchema", "responseMimeType", "temperature", "maxOutputTokens", "candidateCount"].map(keyName)),
+  ],
+  [keyName("output_config"), new Set(["format"].map(keyName))],
+  [keyName("options"), new Set(["temperature", "num_predict"].map(keyName))],
+]);
+const plainObject = (value: unknown): value is Record<string, unknown> =>
+  value !== null &&
+  typeof value === "object" &&
+  (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+
+export const AiReasoningEffortSchema = z.preprocess(
+  (value) => (typeof value === "string" && !value.trim() ? undefined : value),
+  z
+    .string()
+    .trim()
+    .min(1)
+    .max(32)
+    .regex(/^[a-z0-9_-]+$/)
+    .optional(),
+);
+
+export const AiExtraBodySchema = z
+  .custom<Record<string, unknown>>(plainObject, "Extra parameters must be a plain JSON object.")
+  .superRefine((body, ctx) => {
+    if (!plainObject(body)) return;
+    try {
+      if (new TextEncoder().encode(JSON.stringify(body)).byteLength > 8192) {
+        ctx.addIssue({ code: "custom", message: "Extra parameters exceed 8 KiB of UTF-8 JSON." });
+        return;
+      }
+    } catch {
+      ctx.addIssue({ code: "custom", message: "Extra parameters must contain serializable JSON values." });
+      return;
+    }
+    let invalidJson = false;
+    const seen = new Set<object>();
+    const pending: { value: unknown; path: (string | number)[] }[] = [{ value: body, path: [] }];
+    while (pending.length) {
+      const entry = pending.pop()!;
+      const { value, path } = entry;
+      if (
+        value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value))
+      )
+        continue;
+      if (!Array.isArray(value) && !plainObject(value)) {
+        invalidJson = true;
+        continue;
+      }
+      if (seen.has(value)) continue;
+      seen.add(value);
+      for (const [key, child] of Object.entries(value)) {
+        if (unsafeKeys.has(key))
+          ctx.addIssue({ code: "custom", path: [...path, key], message: "Prototype keys are not allowed in extra parameters." });
+        pending.push({ value: child, path: [...path, key] });
+      }
+    }
+    if (invalidJson) {
+      ctx.addIssue({ code: "custom", message: "Extra parameters must contain only JSON values." });
+      return;
+    }
+    for (const key of Object.keys(body)) {
+      const normalizedKey = keyName(key);
+      if (reserved.has(normalizedKey))
+        ctx.addIssue({
+          code: "custom",
+          path: [key],
+          message:
+            normalizedKey === "reasoning" || normalizedKey === "reasoningeffort"
+              ? "Use the thinking-level field (reasoningEffort) instead."
+              : "This parameter is owned by Cloud; use the model profile fields instead.",
+        });
+      const nested = body[key];
+      const reservedChildren = nestedReserved.get(normalizedKey);
+      if (reservedChildren && !plainObject(nested))
+        ctx.addIssue({
+          code: "custom",
+          path: [key],
+          message: "This parameter must be a plain JSON object so Cloud can preserve its owned settings.",
+        });
+      if (plainObject(nested))
+        for (const child of Object.keys(nested)) {
+          if (reservedChildren?.has(keyName(child)))
+            ctx.addIssue({
+              code: "custom",
+              path: [key, child],
+              message: "This parameter is owned by Cloud's generation or structured-output settings.",
+            });
+        }
+    }
+  })
+  .meta({
+    type: "object",
+    additionalProperties: true,
+    description: "Extra provider parameters (at most 8192 bytes of UTF-8 JSON); Cloud-owned request keys are reserved.",
+  });
+
+const reservedHeaders = new Set(["content-type", "content-length", "host", "connection", "transfer-encoding"]);
+// Validate with metadata-only messages: never include a submitted header value.
+export const AiRequestHeadersSchema = z
+  .custom<Record<string, string | null>>(plainObject, "Extra headers must be a JSON object of names to strings or null.")
+  .superRefine((headers, ctx) => {
+    if (!plainObject(headers)) return;
+    if (Object.keys(headers).length > 32) ctx.addIssue({ code: "custom", message: "At most 32 extra headers are allowed." });
+    const names = new Set<string>();
+    for (const [name, value] of Object.entries(headers)) {
+      const lower = name.toLowerCase();
+      if (name.length > 128 || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name))
+        ctx.addIssue({ code: "custom", path: [name], message: "Header names must be HTTP tokens of at most 128 characters." });
+      if (names.has(lower)) ctx.addIssue({ code: "custom", path: [name], message: "Duplicate header names are case-insensitive." });
+      names.add(lower);
+      if (reservedHeaders.has(lower)) ctx.addIssue({ code: "custom", path: [name], message: "This HTTP header is reserved." });
+      if (value !== null && (typeof value !== "string" || value.length > 4096 || /[^\t\x20-\x7E]/.test(value)))
+        ctx.addIssue({
+          code: "custom",
+          path: [name],
+          message: "Header values must be strings of at most 4096 printable ASCII characters, spaces or tabs, or null to remove.",
+        });
+    }
+  })
+  .meta({
+    type: "object",
+    maxProperties: 32,
+    propertyNames: { type: "string", maxLength: 128, pattern: "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$" },
+    additionalProperties: { anyOf: [{ type: "string", maxLength: 4096, pattern: "^[\\t\\x20-\\x7E]*$" }, { type: "null" }] },
+    writeOnly: true,
+  });
+
+export const AI_REQUEST_HEADERS_PROVIDER_ERROR = "Extra headers are only supported for vLLM and OpenAI-compatible endpoints.";
+export const providerSupportsRequestHeaders = (provider: string): boolean => provider === "vllm" || provider === "openai-compatible";
+
+/** Case-insensitive PATCH. Canonical Authorization avoids duplicate casing in nessi's Bearer overwrite. */
+export const patchAiRequestHeaders = (current: Record<string, string>, patch: Record<string, string | null>): Record<string, string> => {
+  AiRequestHeadersSchema.parse(patch);
+  const result: Record<string, string> = Object.fromEntries(Object.entries(current));
+  for (const [name, value] of Object.entries(patch)) {
+    for (const stored of Object.keys(result)) if (stored.toLowerCase() === name.toLowerCase()) delete result[stored];
+    if (value !== null)
+      Object.defineProperty(result, name.toLowerCase() === "authorization" ? "Authorization" : name, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+      });
+  }
+  AiRequestHeadersSchema.parse(result);
+  return result;
+};

package/src/ssr/admin-navigation.ts

@@ -14,7 +14,7 @@ export const buildAdminGroups = (apps: readonly RuntimeContext["apps"][number][]
   const t = platformMessages.resolve([locale]).t;
   const settingsLinks: AdminLink[] = [
     { href: "/admin/settings?tab=general", icon: "ti-app-window", label: t.general },
-    { href: "/admin/settings?tab=mail", icon: "ti-mail", label: "Mail" },
+    { href: "/admin/outgoing-mail", icon: "ti-mail", label: t.outgoingMail },
     { href: "/admin/settings?tab=pdf-rendering", icon: "ti-file-type-pdf", label: t.pdfRendering },
     { href: "/admin/settings?tab=email-templates", icon: "ti-template", label: t.emailTemplates },
     { href: "/admin/settings?tab=security", icon: "ti-shield-lock", label: t.security },

package/src/ssr/platform-messages.ts

@@ -22,6 +22,7 @@ export const platformMessages = i18n.define({
       linuxAccess: "Linux identities",
       pdfRendering: "PDF rendering",
       emailTemplates: "Email templates",
+      outgoingMail: "Outgoing mail",
       security: "Security",
       legal: "Legal",
       providers: "Providers",
@@ -90,6 +91,7 @@ export const platformMessages = i18n.define({
       linuxAccess: "Linux-Identitäten",
       pdfRendering: "PDF-Erstellung",
       emailTemplates: "E-Mail-Vorlagen",
+      outgoingMail: "Ausgehende Mail",
       security: "Sicherheit",
       legal: "Rechtliches",
       providers: "Anbieter",

package/src/ssr/workspace-navigation.ts

@@ -35,7 +35,11 @@ function validItems(value: unknown): value is NavigationItem[] {
       if (!entry || typeof entry !== "object" || typeof entry.id !== "string" || typeof entry.label !== "string") return false;
       if (entry.href !== undefined && typeof entry.href !== "string") return false;
       if (entry.action !== undefined && typeof entry.action !== "string") return false;
-      return (entry.children === undefined || validItems(entry.children)) && (entry.actions === undefined || validItems(entry.actions));
+      return (
+        (entry.children === undefined || validItems(entry.children)) &&
+        (entry.actions === undefined || validItems(entry.actions)) &&
+        (entry.inlineActions === undefined || validItems(entry.inlineActions))
+      );
     })
   );
 }
@@ -59,6 +63,8 @@ export function readWorkspaceNavigation(): WorkspaceNavigationState | undefined
         ...(item.expanded !== undefined ? { expanded: undefined, defaultExpanded: item.expanded } : {}),
         ...(item.children ? { children: links(item.children) } : {}),
         ...(item.actions ? { actions: links(item.actions) } : {}),
+        // Inline actions only run actions, so each waits for the owner.
+        ...(item.inlineActions ? { inlineActions: item.inlineActions.map((action) => ({ ...action, disabled: true })) } : {}),
       }));
     const items = links(value.items);
     return {