@pheem49/mint 1.15.0 → 1.17.0

package/crates/mint-core/src/api_server/routes/library.rs

@@ -0,0 +1,97 @@
+use super::{
+    super::{percent_decode, query_param, send_json_response},
+    RequestCtx,
+};
+use crate::library::{LibraryQuery, LibraryStore};
+use tokio::{io::AsyncWriteExt, net::TcpStream};
+
+pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, mut socket: TcpStream) {
+    let method = ctx.method.to_owned();
+    let route = ctx.route.to_owned();
+    let query = LibraryQuery {
+        kind: query_param(ctx.query, "kind"),
+        search: query_param(ctx.query, "search"),
+        chat_id: query_param(ctx.query, "chatId"),
+        trashed: query_param(ctx.query, "trashed").is_some_and(|s| s == "true"),
+        cursor: query_param(ctx.query, "cursor"),
+    };
+    // SQLite, migration, and disk IO never block the async API executor.
+    enum Reply {
+        Json(String),
+        Bytes(String, Vec<u8>),
+    }
+    let result = tokio::task::spawn_blocking(move || -> Result<Reply, String> {
+        let store = LibraryStore::open_default().map_err(|e| e.to_string())?;
+        let tail = route
+            .strip_prefix("/api/library")
+            .unwrap_or("")
+            .trim_start_matches('/');
+        if method == "GET" && tail.is_empty() {
+            return serde_json::to_string(&store.list(&query).map_err(|e| e.to_string())?)
+                .map(Reply::Json)
+                .map_err(|e| e.to_string());
+        }
+        let (id, action) = tail.split_once('/').unwrap_or((tail, ""));
+        let id = percent_decode(id);
+        match (method.as_str(), action) {
+            ("GET", "") => serde_json::to_string(&store.get(&id).map_err(|e| e.to_string())?)
+                .map(Reply::Json)
+                .map_err(|e| e.to_string()),
+            ("GET", "content" | "thumbnail") => {
+                let thumb = action == "thumbnail";
+                let (item, bytes) = store.read(&id, thumb).map_err(|e| e.to_string())?;
+                let mime = if thumb {
+                    "image/png".to_owned()
+                } else {
+                    item.mime_type
+                };
+                Ok(Reply::Bytes(mime, bytes))
+            }
+            ("DELETE", "") => {
+                store.remove(&id).map_err(|e| e.to_string())?;
+                Ok(Reply::Json("{}".into()))
+            }
+            ("POST", "trash" | "restore") => {
+                store
+                    .set_trashed(&id, action == "trash")
+                    .map_err(|e| e.to_string())?;
+                Ok(Reply::Json("{}".into()))
+            }
+            _ => Err("Unknown Library operation".into()),
+        }
+    })
+    .await;
+    match result {
+        Ok(Ok(Reply::Json(json))) => send_json_response(socket, "200 OK", &json).await,
+        Ok(Ok(Reply::Bytes(mime, bytes))) => {
+            // Content is downloaded through authenticated fetch; never execute uploaded HTML on this origin.
+            let mime = if mime
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || b"/.-+;= ".contains(&b))
+            {
+                mime
+            } else {
+                "application/octet-stream".into()
+            };
+            let headers = format!(
+                "HTTP/1.1 200 OK\r\nContent-Type: {mime}\r\nContent-Length: {}\r\nContent-Disposition: attachment\r\nX-Content-Type-Options: nosniff\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nConnection: close\r\n\r\n",
+                bytes.len()
+            );
+            let _ = socket.write_all(headers.as_bytes()).await;
+            let _ = socket.write_all(&bytes).await;
+        }
+        other => {
+            let message = match other {
+                Ok(Err(error)) => error,
+                Err(error) => error.to_string(),
+                _ => unreachable!(),
+            };
+            send_json_response(
+                socket,
+                "400 Bad Request",
+                &serde_json::json!({"message":message}).to_string(),
+            )
+            .await;
+        }
+    }
+}

package/crates/mint-core/src/api_server/routes/media_gen.rs

@@ -16,74 +16,27 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
     } = ctx;
     match (method, route) {
         ("POST", "/api/image-generate") => {
-            #[derive(serde::Deserialize)]
-            #[serde(rename_all = "camelCase")]
-            struct ImageGenApiRequest {
-                prompt: String,
-                #[serde(default)]
-                negative_prompt: Option<String>,
-                #[serde(default)]
-                aspect_ratio: Option<String>,
-                #[serde(default)]
-                num_images: Option<u8>,
-                #[serde(default)]
-                model: Option<String>,
-                /// Which image provider to use (overrides config.image_gen_provider).
-                #[serde(default)]
-                provider: Option<String>,
-                #[serde(default)]
-                image_data_uri: Option<String>,
-                #[serde(default)]
-                mask_data_uri: Option<String>,
-                #[serde(default)]
-                mode: Option<String>,
-            }
-
-            if let Ok(req) = serde_json::from_str::<ImageGenApiRequest>(body) {
+            if let Ok(request) = serde_json::from_str::<ImageGenRequest>(body) {
                 let config = load_config().unwrap_or_default();
-                let gen_request = ImageGenRequest {
-                    prompt: req.prompt.clone(),
-                    negative_prompt: req.negative_prompt,
-                    aspect_ratio: req.aspect_ratio,
-                    num_images: req.num_images,
-                    model: req.model,
-                    provider: req.provider,
-                    image_data_uri: req.image_data_uri,
-                    mask_data_uri: req.mask_data_uri,
-                    mode: req.mode,
-                };
-                match generate_images(&config, &gen_request).await {
-                    Ok(result) => {
+                match crate::image_workflow::generate_and_save_images(&config, &request).await {
+                    Ok(mut result) => {
                         log_api_req(
                             "POST",
                             "/api/image-generate",
                             "200 OK",
                             Some(&format!("Provider: {} | {}", result.provider, auth_label)),
                         );
-                        let data_uris: Vec<String> = result
-                            .images
-                            .iter()
-                            .map(|img| img.data_uri.clone())
-                            .collect();
-                        let mut saved = save_chat_images(
-                            data_uris,
-                            Some(result.provider.clone()),
-                            Some(req.prompt.clone()),
-                        )
-                        .unwrap_or_default();
-                        for picture in &mut saved {
+                        for picture in &mut result.images {
                             picture.url = Some(format!("/api/pictures/{}", picture.filename));
                             picture.thumbnail_url =
                                 Some(format!("/api/pictures/{}", picture.filename));
                         }
-                        let response = json!({
-                            "images": saved,
-                            "model": result.model,
-                            "provider": result.provider,
-                            "prompt": result.prompt,
-                            "description": result.description
-                        });
-                        send_json_response(socket, "200 OK", &response.to_string()).await;
+                        send_json_response(
+                            socket,
+                            "200 OK",
+                            &serde_json::to_string(&result).unwrap_or_default(),
+                        )
+                        .await;
                     }
                     Err(e) => {
                         log_api_err("API /api/image-generate error", &e);

package/crates/mint-core/src/api_server/routes/misc.rs

@@ -3,6 +3,20 @@ use tokio::net::TcpStream;
 
 use super::super::*;
 
+struct MediaModelQuery {
+    provider: String,
+    api_key: String,
+}
+
+impl MediaModelQuery {
+    fn parse(query: &str) -> Self {
+        Self {
+            provider: query_param(query, "provider").unwrap_or_default(),
+            api_key: query_param(query, "apiKey").unwrap_or_default(),
+        }
+    }
+}
+
 pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStream) {
     let RequestCtx {
         method,
@@ -15,6 +29,71 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
         auth_label: _auth_label,
     } = ctx;
     match (method, route) {
+        ("GET", "/api/workspace-history") => {
+            let root = query_param(query, "root")
+                .map(|value| percent_decode(&value))
+                .unwrap_or_default();
+            let result = (|| -> Result<_, String> {
+                if root.trim().is_empty() {
+                    return Err("Workspace root is required".into());
+                }
+                let config = load_config().map_err(|e| e.to_string())?;
+                let root = crate::assert_path_capability(
+                    std::path::Path::new(&root),
+                    crate::Capability::Read,
+                    &config,
+                )
+                .map_err(|e| e.to_string())?;
+                crate::system::workspace_history::list(&root)
+            })();
+            match result {
+                Ok(entries) => {
+                    send_json_response(socket, "200 OK", &json!(entries).to_string()).await
+                }
+                Err(message) => {
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({ "message": message }).to_string(),
+                    )
+                    .await
+                }
+            }
+        }
+        ("POST", "/api/workspace-history/undo") => {
+            #[derive(Deserialize)]
+            #[serde(rename_all = "camelCase")]
+            struct UndoWorkspaceRequest {
+                root: String,
+                revision: u64,
+                expected_id: Option<String>,
+            }
+            let result = (|| -> Result<_, String> {
+                let request: UndoWorkspaceRequest =
+                    serde_json::from_str(body).map_err(|e| e.to_string())?;
+                let config = load_config().map_err(|e| e.to_string())?;
+                let root = crate::assert_path_capability(
+                    std::path::Path::new(&request.root),
+                    crate::Capability::Write,
+                    &config,
+                )
+                .map_err(|e| e.to_string())?;
+                crate::workspace::undo_last(&root, request.revision, request.expected_id.as_deref())
+            })();
+            match result {
+                Ok(snapshot) => {
+                    send_json_response(socket, "200 OK", &json!(snapshot).to_string()).await
+                }
+                Err(message) => {
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({ "message": message }).to_string(),
+                    )
+                    .await
+                }
+            }
+        }
         ("POST", "/api/active-model") => {
             #[derive(Deserialize)]
             struct ActiveModelReq {
@@ -102,6 +181,42 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             }
         }
 
+        ("GET", route) if route == "/api/proxy-image" || route.starts_with("/api/proxy-image") => {
+            let target_url = query_param(query, "url").unwrap_or_default();
+            if target_url.trim().is_empty() {
+                send_json_response(
+                    socket,
+                    "400 Bad Request",
+                    "{\"error\":\"missing url query parameter\"}",
+                )
+                .await;
+                return;
+            }
+
+            let cache_dir = crate::media::image_proxy::default_cache_dir();
+            match crate::media::image_proxy::fetch_and_cache_image(&cache_dir, &target_url).await {
+                Ok((mime_type, bytes)) => {
+                    send_binary_response(socket, "200 OK", &mime_type, &bytes).await;
+                }
+                Err(err) => {
+                    let status = match &err {
+                        crate::media::image_proxy::ImageProxyError::InvalidUrl(_)
+                        | crate::media::image_proxy::ImageProxyError::SsrfBlocked(_) => {
+                            "400 Bad Request"
+                        }
+                        crate::media::image_proxy::ImageProxyError::BadStatus(code)
+                            if *code == 404 =>
+                        {
+                            "404 Not Found"
+                        }
+                        _ => "502 Bad Gateway",
+                    };
+                    let err_msg = serde_json::json!({ "error": err.to_string() }).to_string();
+                    send_json_response(socket, status, &err_msg).await;
+                }
+            }
+        }
+
         ("GET", "/api/media") => {
             let path_param = query_param(query, "path")
                 .map(|p| percent_decode(&p))
@@ -365,6 +480,86 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
             }
         }
 
+        ("GET", "/api/file/media") => {
+            let path = query_param(query, "path").unwrap_or_default();
+            let root = query_param(query, "workspace").unwrap_or_default();
+            let prepared = tokio::task::spawn_blocking(move || {
+                if root.trim().is_empty() {
+                    return Err("Select a source workspace".to_string());
+                }
+                crate::workspace::prepare_media(
+                    std::path::Path::new(&root),
+                    &path,
+                    &load_config().map_err(|error| error.to_string())?,
+                )
+            })
+            .await
+            .map_err(|error| error.to_string())
+            .and_then(|value| value);
+            match prepared {
+                Ok(media) => match tokio::fs::File::open(&media.path).await {
+                    Ok(mut file) => {
+                        let headers = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: {}\r\nContent-Length: {}\r\nX-Content-Type-Options: nosniff\r\nCache-Control: no-store\r\nAccess-Control-Allow-Origin: *\r\nConnection: close\r\n\r\n",
+                            media.mime_type, media.byte_length
+                        );
+                        let mut socket = socket;
+                        if socket.write_all(headers.as_bytes()).await.is_ok() {
+                            let _ = tokio::io::copy(&mut file, &mut socket).await;
+                        }
+                    }
+                    Err(error) => {
+                        send_json_response(
+                            socket,
+                            "404 Not Found",
+                            &json!({"error": error.to_string()}).to_string(),
+                        )
+                        .await
+                    }
+                },
+                Err(error) => {
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({"error": error}).to_string(),
+                    )
+                    .await
+                }
+            }
+        }
+
+        ("GET", "/api/file/image") => {
+            let path = query_param(query, "path").unwrap_or_default();
+            let root = query_param(query, "workspace").unwrap_or_default();
+            let result = tokio::task::spawn_blocking(move || {
+                if root.trim().is_empty() {
+                    return Err("Select a source workspace".to_string());
+                }
+                let config = load_config().map_err(|error| error.to_string())?;
+                crate::workspace::read_image(std::path::Path::new(&root), &path, &config)
+            })
+            .await;
+            match result {
+                Ok(Ok(data_url)) => {
+                    send_json_response(socket, "200 OK", &json!({"dataUrl": data_url}).to_string())
+                        .await
+                }
+                other => {
+                    let error = match other {
+                        Ok(Err(error)) => error,
+                        Err(error) => error.to_string(),
+                        _ => unreachable!(),
+                    };
+                    send_json_response(
+                        socket,
+                        "400 Bad Request",
+                        &json!({"error": error}).to_string(),
+                    )
+                    .await;
+                }
+            }
+        }
+
         ("GET", "/api/file/read") => {
             let file_path = query_param(query, "path").unwrap_or_default();
             if file_path.is_empty() {
@@ -435,26 +630,9 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
         }
 
         ("GET", "/api/live-models") => {
-            // Query param: apiKey=<gemini_key>
-            // Returns models that support Gemini Live (BidiGenerateContent / native-audio).
-            // Falls back to the static GEMINI_LIVE_MODELS preset list so the UI is never empty.
-            let api_key = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("apiKey="))
-                .map(|v| percent_decode(v))
-                .unwrap_or_default();
-
-            let dynamic = crate::slash::model_fetcher::fetch_gemini_live_models(&api_key).await;
-
-            let models = if !dynamic.is_empty() {
-                dynamic
-            } else {
-                // Static preset fallback — always two well-known live models.
-                vec![
-                    "gemini-2.5-flash-native-audio-preview-12-2025".to_string(),
-                    "gemini-3.1-flash-live-preview".to_string(),
-                ]
-            };
+            let MediaModelQuery { api_key, .. } = MediaModelQuery::parse(query);
+            let config = load_config().unwrap_or_default();
+            let models = crate::model_catalog::live_models(&config, &api_key).await;
 
             send_json_response(
                 socket,
@@ -465,52 +643,9 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
         }
 
         ("GET", "/api/image-models") => {
-            // Query params: provider=<id>&apiKey=<key>
-            let provider = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("provider="))
-                .map(|v| percent_decode(v))
-                .unwrap_or_default();
-            let mut api_key = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("apiKey="))
-                .map(|v| percent_decode(v))
-                .unwrap_or_default();
-
-            let cfg_opt = load_config().ok();
-            if api_key.trim().is_empty() {
-                if let Some(ref cfg) = cfg_opt {
-                    api_key = match provider.to_lowercase().as_str() {
-                        "nanobanana" | "gemini" | "google" => cfg.api_key.clone(),
-                        "dalle" | "openai" => cfg.openai_api_key.clone(),
-                        "stability" => cfg.stability_api_key.clone(),
-                        "ideogram" => cfg.ideogram_api_key.clone(),
-                        "replicate" => cfg.replicate_api_key.clone(),
-                        "bfl" | "flux" => cfg.bfl_api_key.clone(),
-                        _ => String::new(),
-                    };
-                }
-            }
-
-            let dynamic =
-                crate::media::image_model_fetcher::fetch_image_provider_models(&provider, &api_key)
-                    .await;
-
-            let models = if !dynamic.is_empty() {
-                dynamic
-            } else {
-                match cfg_opt {
-                    Some(ref cfg) => {
-                        crate::media::image_models::image_model_options_for_provider(cfg, &provider)
-                    }
-                    None => match load_config() {
-                        Ok(cfg) => crate::media::image_models::image_model_options_for_provider(
-                            &cfg, &provider,
-                        ),
-                        Err(_) => Vec::new(),
-                    },
-                }
-            };
+            let MediaModelQuery { provider, api_key } = MediaModelQuery::parse(query);
+            let config = load_config().unwrap_or_default();
+            let models = crate::model_catalog::image_models(&config, &provider, &api_key).await;
 
             send_json_response(
                 socket,
@@ -521,47 +656,9 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
         }
 
         ("GET", "/api/video-models") => {
-            // Query params: provider=<id>&apiKey=<key>
-            let provider = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("provider="))
-                .map(|v| percent_decode(v))
-                .unwrap_or_default();
-            let mut api_key = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("apiKey="))
-                .map(|v| percent_decode(v))
-                .unwrap_or_default();
-
-            let cfg_opt = load_config().ok();
-            if api_key.trim().is_empty() {
-                if let Some(ref cfg) = cfg_opt {
-                    api_key = match provider.to_lowercase().as_str() {
-                        "veo" | "gemini" | "google" => cfg.api_key.clone(),
-                        _ => String::new(),
-                    };
-                }
-            }
-
-            let dynamic =
-                crate::media::video_model_fetcher::fetch_video_provider_models(&provider, &api_key)
-                    .await;
-
-            let models = if !dynamic.is_empty() {
-                dynamic
-            } else {
-                match cfg_opt {
-                    Some(ref cfg) => {
-                        crate::media::video_models::video_model_options_for_provider(cfg, &provider)
-                    }
-                    None => match load_config() {
-                        Ok(cfg) => crate::media::video_models::video_model_options_for_provider(
-                            &cfg, &provider,
-                        ),
-                        Err(_) => Vec::new(),
-                    },
-                }
-            };
+            let MediaModelQuery { provider, api_key } = MediaModelQuery::parse(query);
+            let config = load_config().unwrap_or_default();
+            let models = crate::model_catalog::video_models(&config, &provider, &api_key).await;
 
             send_json_response(
                 socket,
@@ -576,3 +673,19 @@ pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStrea
         ),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn review_model_query_preserves_literal_plus_percent_and_utf8() {
+        let mut url = reqwest::Url::parse("http://localhost/api/image-models").unwrap();
+        url.query_pairs_mut()
+            .append_pair("provider", "OpEnAi")
+            .append_pair("apiKey", "key+part%2Fก");
+        let options = MediaModelQuery::parse(url.query().unwrap());
+        assert_eq!(options.provider, "OpEnAi");
+        assert_eq!(options.api_key, "key+part%2Fก");
+    }
+}

package/crates/mint-core/src/api_server/routes/mod.rs

@@ -1,7 +1,10 @@
 pub(super) mod auth;
+pub(super) mod background_jobs;
 pub(super) mod chat;
 pub(super) mod cron_mcp;
 pub(super) mod gemini_live;
+pub(super) mod html_preview;
+pub(super) mod library;
 pub(super) mod linked_folders;
 pub(super) mod media_gen;
 pub(super) mod misc;
@@ -9,6 +12,7 @@ pub(super) mod profile_oauth;
 pub(super) mod sessions;
 pub(super) mod skills_subagents;
 pub(super) mod slash;
+pub(super) mod sources;
 pub(super) mod status_health;
 
 /// Parsed pieces of a request, shared across every route handler — grouped
@@ -25,3 +29,5 @@ pub(super) struct RequestCtx<'a> {
     pub(super) header_end: usize,
     pub(super) auth_label: String,
 }
+
+pub(super) mod mods;

package/crates/mint-core/src/api_server/routes/mods.rs

@@ -0,0 +1,31 @@
+use super::RequestCtx;
+use crate::api_server::send_json_response;
+use serde_json::json;
+use tokio::net::TcpStream;
+
+pub(in crate::api_server) async fn execute(ctx: RequestCtx<'_>, socket: TcpStream) {
+    let op = match serde_json::from_str::<crate::mods::Operation>(ctx.body) {
+        Ok(op) => op,
+        Err(e) => {
+            send_json_response(
+                socket,
+                "400 Bad Request",
+                &json!({"error":e.to_string()}).to_string(),
+            )
+            .await;
+            return;
+        }
+    };
+    let result = crate::mods::operate_async(op).await;
+    match result {
+        Ok(value) => send_json_response(socket, "200 OK", &value.to_string()).await,
+        Err(error) => {
+            send_json_response(
+                socket,
+                "400 Bad Request",
+                &json!({"error":error}).to_string(),
+            )
+            .await
+        }
+    }
+}