@pheem49/mint 1.16.0 → 1.18.0

package/crates/mint-core/src/api_server.rs

@@ -62,9 +62,9 @@ use crate::{
     orchestrate_agent_loop,
     orchestrate_chat_stream_with_fallback,
     orchestrate_chat_with_fallback,
-    profile_pictures_dir,
     register_user,
     render_timeline,
+    resolve_avatar_file_path,
     save_avatar_file,
     save_chat_images,
     save_config,
@@ -115,6 +115,44 @@ pub(crate) fn log_api_err(context: &str, error: &dyn std::fmt::Display) {
     );
 }
 
+pub(crate) fn should_log_api_route(route: &str) -> bool {
+    let route = route.split('?').next().unwrap_or(route);
+    if !route.starts_with("/api/") {
+        return false;
+    }
+
+    if route.starts_with("/api/pictures/")
+        || route.starts_with("/api/thumbnails/")
+        || route.starts_with("/api/proxy-image")
+        || route.starts_with("/api/background-jobs")
+        || route == "/api/media"
+        || route == "/api/chat"
+        || route == "/api/chat-stream"
+        || route == "/api/image-generate"
+        || route == "/api/video-generate"
+        || route == "/api/action"
+        || route == "/api/config"
+        || route == "/api/gemini-live"
+        || route == "/api/interactions"
+        || route == "/api/conversation-snapshot"
+        || route == "/api/conversation-changes"
+        || route == "/api/conversation-sources"
+        || route == "/api/status"
+        || route == "/api/chat-sessions"
+        || route == "/api/mods"
+        || route.starts_with("/api/mods/")
+        || route == "/api/models"
+        || route.starts_with("/api/models/")
+        || (route.starts_with("/api/library/")
+            && (route.ends_with("/thumbnail") || route.ends_with("/content")))
+        || route.starts_with("/api/mcp-artifacts/")
+    {
+        return false;
+    }
+
+    true
+}
+
 /// Binds the local HTTP API on `port` and blocks forever serving requests.
 /// Also starts the messaging bridges and cron scheduler as a side effect —
 /// callers (`mint api`, `mint gateway start --api-port`, ...) must not call
@@ -143,6 +181,31 @@ pub async fn shutdown_on_signal(on_shutdown: impl FnOnce()) {
     on_shutdown();
 }
 
+fn parse_http_request_framing(buf: &[u8]) -> Option<(usize, usize)> {
+    let header_end = buf.windows(4).position(|window| window == b"\r\n\r\n")?;
+    let headers_str = String::from_utf8_lossy(&buf[..header_end]);
+    let content_len = headers_str
+        .lines()
+        .find_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            if name.trim().eq_ignore_ascii_case("content-length") {
+                value.trim().parse::<usize>().ok()
+            } else {
+                None
+            }
+        })
+        .unwrap_or(0);
+    Some((header_end, header_end + 4 + content_len))
+}
+
+fn parse_request_line(headers: &str) -> Option<(&str, &str)> {
+    let first_line = headers.split("\r\n").next().unwrap_or(headers);
+    let mut parts = first_line.split_whitespace();
+    let method = parts.next()?;
+    let path = parts.next()?;
+    Some((method, path))
+}
+
 pub async fn start_api_server(port: u16) -> Result<(), std::io::Error> {
     start_api_server_on(SocketAddr::from(([0, 0, 0, 0], port))).await
 }
@@ -180,6 +243,7 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
             Ok(val) => val,
             Err(_) => continue,
         };
+        let _ = socket.set_nodelay(true);
         // Some routes (the native folder picker) only make sense for, and are
         // only safe for, a browser on this same machine — capture that now
         // while we still have the peer address.
@@ -199,7 +263,7 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
             let outcome = std::panic::AssertUnwindSafe(async move {
             let mut request_bytes = Vec::with_capacity(8192);
             let mut chunk = [0_u8; 8192];
-            let mut expected_len: Option<usize> = None;
+            let mut framing: Option<(usize, usize)> = None;
 
             loop {
                 let n = match socket.read(&mut chunk).await {
@@ -217,31 +281,28 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                     return;
                 }
 
-                let headers_str = String::from_utf8_lossy(&request_bytes);
-                if expected_len.is_none() && headers_str.contains("\r\n\r\n") {
-                    expected_len = headers_str
-                        .to_lowercase()
-                        .find("content-length:")
-                        .and_then(|content_length_pos| {
-                            let sub = &headers_str[content_length_pos..];
-                            let line_end = sub.find("\r\n")?;
-                            sub["content-length:".len()..line_end]
-                                .trim()
-                                .parse::<usize>()
-                                .ok()
-                        })
-                        .and_then(|content_len| {
-                            let header_len = headers_str.find("\r\n\r\n")? + 4;
-                            Some(header_len + content_len)
-                        });
-                }
-
-                if let Some(total_len) = expected_len {
+                if framing.is_none() {
+                    if let Some((header_end, total_len)) = parse_http_request_framing(&request_bytes) {
+                        if total_len > MAX_API_REQUEST_BYTES {
+                            send_json_response(
+                                socket,
+                                "413 Payload Too Large",
+                                "{\"provider\":\"error\",\"model\":\"error\",\"text\":\"Request is too large. Try a smaller image or fewer images.\"}",
+                            )
+                            .await;
+                            return;
+                        }
+                        if total_len > request_bytes.capacity() {
+                            request_bytes.reserve(total_len - request_bytes.len());
+                        }
+                        framing = Some((header_end, total_len));
+                    }
+                }
+
+                if let Some((_, total_len)) = framing {
                     if request_bytes.len() >= total_len {
                         break;
                     }
-                } else if headers_str.contains("\r\n\r\n") {
-                    break;
                 }
             }
 
@@ -249,25 +310,21 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                 return;
             }
 
-            let request_str = String::from_utf8_lossy(&request_bytes);
-            let lines: Vec<&str> = request_str.split("\r\n").collect();
-            if lines.is_empty() {
+            let Some((header_end, total_len)) = framing.or_else(|| parse_http_request_framing(&request_bytes)) else {
                 return;
+            };
+            if request_bytes.len() > total_len {
+                request_bytes.truncate(total_len);
             }
 
-            let req_line: Vec<&str> = lines[0].split_whitespace().collect();
-            if req_line.len() < 2 {
+            let request_str = String::from_utf8_lossy(&request_bytes);
+            let Some(str_header_end) = request_str.find("\r\n\r\n") else {
+                return;
+            };
+            let Some((method, path)) = parse_request_line(&request_str[..str_header_end]) else {
                 return;
-            }
-
-            let method = req_line[0];
-            let path = req_line[1];
-
-            let header_end = match request_str.find("\r\n\r\n") {
-                Some(idx) => idx,
-                None => return,
             };
-            let body = &request_str[header_end + 4..];
+            let body = &request_str[str_header_end + 4..];
 
             if method == "OPTIONS" {
                 let response = "HTTP/1.1 200 OK\r\n\
@@ -290,7 +347,7 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
             {
                 let request = crate::webhooks::Request {
                     method: method.into(), path: path.into(),
-                    headers: request_str[..header_end].into(),
+                    headers: request_str[..str_header_end].into(),
                     body: request_bytes[header_end + 4..].to_vec(),
                 };
                 crate::webhooks::handle(socket, service, config, request).await;
@@ -337,26 +394,21 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                 return;
             }
 
-            if route.starts_with("/api/")
-                && !route.starts_with("/api/pictures/")
-                && !route.starts_with("/api/thumbnails/")
-                && route != "/api/media"
-                && route != "/api/chat"
-                && route != "/api/chat-stream"
-                && route != "/api/image-generate"
-                && route != "/api/video-generate"
-                && route != "/api/action"
-                && route != "/api/config"
-                && route != "/api/gemini-live"
-                && route != "/api/interactions"
-                && route != "/api/conversation-snapshot"
-                && route != "/api/conversation-changes"
-                && route != "/api/status"
-                && route != "/api/chat-sessions"
-            {
+            if should_log_api_route(route) {
                 log_api_req(method, route, "200 OK", Some(&auth_label));
             }
 
+            if method == "POST" && route == "/api/speech" {
+                let result = match serde_json::from_str::<crate::tts::playback::SpeechRequest>(body) {
+                    Ok(request) => crate::tts::playback::request(request).await,
+                    Err(error) => Err(error.to_string()),
+                };
+                match result {
+                    Ok(reply) => send_json_response(socket, "200 OK", &serde_json::to_string(&reply).unwrap()).await,
+                    Err(error) => send_json_response(socket, "400 Bad Request", &json!({"error":error}).to_string()).await,
+                }
+                return;
+            }
             match (method, route) {
                 ("GET" | "POST" | "DELETE", route) if route == "/api/library" || route.starts_with("/api/library/") => {
                     routes::library::execute(routes::RequestCtx { method, route, query, body, request_str: &request_str, request_bytes: &request_bytes, header_end, auth_label: auth_label.clone() }, socket).await;
@@ -366,7 +418,12 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                 }
                 ("GET", route) if route.starts_with("/api/mcp-artifacts/") => {
                     let id = route.trim_start_matches("/api/mcp-artifacts/").to_owned();
-                    let artifact = tokio::task::spawn_blocking(move || crate::integrations::mcp_result::read_artifact(&id)).await;
+                    let chat=reqwest::Url::parse(&format!("http://localhost/?{query}")).ok().and_then(|url|url.query_pairs().find(|(key,_)|key=="chatId").map(|(_,value)|value.into_owned()));
+                    let artifact = tokio::task::spawn_blocking(move || {
+                        let (entry,bytes)=crate::integrations::mcp_result::read_artifact(&id)?;
+                        if chat.as_deref()!=Some(entry.chat_id.as_str()) {return Err(String::from("Artifact unavailable"));}
+                        Ok((entry,bytes))
+                    }).await;
                     match artifact {
                         Ok(Ok((entry, bytes))) => {
                             let mime = if entry.kind == "image" { entry.mime_type.as_str() } else { "application/octet-stream" };
@@ -1119,6 +1176,25 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                         socket,
                     )
                     .await;
+                }
+                                ("GET", route)
+                                    if route == "/api/proxy-image"
+                                        || route.starts_with("/api/proxy-image") =>
+                                {
+                    routes::misc::execute(
+                        routes::RequestCtx {
+                            method,
+                            route,
+                            query,
+                            body,
+                            request_str: &request_str,
+                            request_bytes: &request_bytes,
+                            header_end,
+                            auth_label: auth_label.clone(),
+                        },
+                        socket,
+                    )
+                    .await;
                 }
                                 ("GET", "/api/config") => {
                     routes::misc::execute(
@@ -1225,7 +1301,9 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
                 | ("POST", "/api/checkpoints/undo")
                 | ("GET", "/api/workspace-history")
                 | ("POST", "/api/workspace-history/undo")
-                | ("GET", "/api/file/read") => {
+                | ("GET", "/api/file/read")
+                | ("GET", "/api/file/image")
+                | ("GET", "/api/file/media") => {
                     routes::misc::execute(
                         routes::RequestCtx {
                             method,
@@ -1368,22 +1446,32 @@ pub async fn start_api_server_on(addr: SocketAddr) -> Result<(), std::io::Error>
     }
 }
 
+pub(crate) fn resolve_agent_root(workspace_path: Option<&str>) -> std::path::PathBuf {
+    if let Some(path_str) = workspace_path.map(str::trim).filter(|s| !s.is_empty()) {
+        let path = std::path::PathBuf::from(path_str);
+        if let Ok(canonical) = path.canonicalize() {
+            if canonical.is_dir() {
+                return canonical;
+            }
+        } else if path.is_dir() {
+            return path;
+        }
+    }
+    let current = std::env::current_dir().unwrap_or_default();
+    current.canonicalize().unwrap_or(current)
+}
+
 async fn run_web_agent_loop(
     config: &MintConfig,
     request: &ChatRequest,
 ) -> Result<ChatResponse, String> {
-    let root = std::env::current_dir().map_err(|error| error.to_string())?;
+    let root = resolve_agent_root(request.workspace_path.as_deref());
     let fast_mode = config
         .extra
         .get("enableFastMode")
         .and_then(Value::as_bool)
         .unwrap_or(false);
-    // Same pre-scoping as `/api/chat-stream`'s agent-mode branch in
-    // routes/chat.rs and for the same reason: `root` above deliberately
-    // stays this server process's own cwd (not the client's workspace), so
-    // `orchestrate_agent_loop`'s self-derivation from `root` alone can't
-    // distinguish workspaces here — scope from the client's `workspace_path`
-    // explicitly instead. Idempotent/safe either way (see `scoped_chat_id`).
+    // Resolve client's workspace path for parity with desktop. Idempotent on scoped_chat_id.
     let scoped_chat_id = crate::agent::memory::scoped_chat_id(
         request
             .chat_id
@@ -1975,4 +2063,62 @@ mod tests {
         assert!(ts >= before);
         assert!(ts < before + 5);
     }
+
+    #[test]
+    fn test_should_log_api_route_exclusions() {
+        // Routine noisy/polling routes should be suppressed from terminal log spam
+        assert!(!should_log_api_route("/api/background-jobs"));
+        assert!(!should_log_api_route("/api/background-jobs/abc"));
+        assert!(!should_log_api_route("/api/mods"));
+        assert!(!should_log_api_route("/api/models"));
+        assert!(!should_log_api_route("/api/status"));
+        assert!(!should_log_api_route("/api/conversation-sources"));
+        assert!(!should_log_api_route("/api/interactions"));
+        assert!(!should_log_api_route("/api/pictures/foo.png"));
+        assert!(!should_log_api_route("/api/thumbnails/bar.jpg"));
+        assert!(!should_log_api_route("/api/proxy-image"));
+        assert!(!should_log_api_route(
+            "/api/proxy-image?url=https://example.com/pic.jpg"
+        ));
+        assert!(!should_log_api_route("/not-api/test"));
+        assert!(!should_log_api_route(
+            "/api/library/c2db083a-728b-49fb-8e96-ef1c6c4553a0/thumbnail"
+        ));
+        assert!(!should_log_api_route(
+            "/api/library/mint-20261011-130823-512a5fb5/thumbnail"
+        ));
+        assert!(!should_log_api_route(
+            "/api/library/c2db083a-728b-49fb-8e96-ef1c6c4553a0/content"
+        ));
+        assert!(!should_log_api_route("/api/mcp-artifacts/artifact-123"));
+
+        // Standard operational API calls should still be logged
+        assert!(should_log_api_route("/api/library"));
+        assert!(should_log_api_route("/api/library?kind=file"));
+        assert!(should_log_api_route(
+            "/api/library/c2db083a-728b-49fb-8e96-ef1c6c4553a0"
+        ));
+        assert!(should_log_api_route(
+            "/api/library/c2db083a-728b-49fb-8e96-ef1c6c4553a0/trash"
+        ));
+        assert!(should_log_api_route("/api/system-info"));
+        assert!(should_log_api_route("/api/select-folder"));
+    }
+
+    #[test]
+    fn http_request_framing_parses_headers_once_without_utf8_scanning_binary_or_large_body() {
+        let mut raw = b"POST /api/chat-stream HTTP/1.1\r\nHost: localhost:3000\r\nContent-Length: 10\r\n\r\n1234".to_vec();
+        // Even if the body contains invalid UTF-8 bytes, header framing only inspects the header slice.
+        raw.extend_from_slice(&[0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa]);
+        let (header_end, total_len) = parse_http_request_framing(&raw).expect("headers complete");
+        assert_eq!(&raw[header_end..header_end + 4], b"\r\n\r\n");
+        assert_eq!(total_len, header_end + 4 + 10);
+        assert_eq!(raw.len(), total_len);
+
+        let header_str = std::str::from_utf8(&raw[..header_end]).unwrap();
+        assert_eq!(
+            parse_request_line(header_str),
+            Some(("POST", "/api/chat-stream"))
+        );
+    }
 }

package/crates/mint-core/src/avatar_bridge.rs

@@ -358,28 +358,6 @@ fn resolve_tool_signal(action: &str, had_error: bool, is_start: bool) -> Option<
             return None; // silent on success — avatar_signal from the model is the source of truth
         }),
 
-        "browser_open"
-        | "browser_click"
-        | "browser_type"
-        | "browser_read"
-        | "browser_mouse_move"
-        | "browser_mouse_click"
-        | "browser_key_press"
-        | "browser_screenshot" => Some(if is_start {
-            AvatarSignal {
-                action: Some("searching"),
-                prop: Some("magnifying_glass"),
-                ..AvatarSignal::emotions(&[("interest", "high")])
-            }
-        } else if had_error {
-            AvatarSignal {
-                action: Some("dismissive"),
-                ..AvatarSignal::emotions(&[("fear", "medium"), ("surprise", "low")])
-            }
-        } else {
-            return None;
-        }),
-
         "generate_image"
         | "image_studio.generate"
         | "generate_video"
@@ -402,7 +380,7 @@ fn resolve_tool_signal(action: &str, had_error: bool, is_start: bool) -> Option<
             }
         }),
 
-        "dispatch_subagent" => Some(if is_start {
+        "dispatch_agents" | "dispatch_subagent" => Some(if is_start {
             AvatarSignal {
                 action: Some("typing"),
                 prop: Some("keyboard"),
@@ -563,10 +541,13 @@ impl AvatarBridge {
             AgentProgress::ContextCompaction { .. } => {}
             AgentProgress::PlanUpdated { .. } => {}
             AgentProgress::RunCompleted { .. }
+            | AgentProgress::SubagentStarted { .. }
+            | AgentProgress::SubagentFinished { .. }
             | AgentProgress::ToolProgress { .. }
             | AgentProgress::ToolArtifacts { .. }
             | AgentProgress::ToolDiscovery { .. }
-            | AgentProgress::DeviceState { .. } => {}
+            | AgentProgress::DeviceState { .. }
+            | AgentProgress::ExecutionUpdate { .. } => {}
         }
     }
 

package/crates/mint-core/src/browser/cdp.rs

@@ -1,13 +1,49 @@
-//! Transport layer: a hand-rolled Chrome DevTools Protocol client over a raw
-//! WebSocket. Every call here opens a fresh connection, sends one JSON-RPC
-//! request, and reads until the matching `id` comes back — there is no
-//! connection pooling or session reuse, so every higher-level action pays a
-//! full websocket handshake + page-list lookup.
+//! Target-pinned CDP transport. Agent/workflow sessions retain sockets so
+//! session-scoped Chrome settings survive across actions. A disconnected input
+//! is never resent automatically.
 
 use crate::MintConfig;
 use futures_util::{SinkExt, StreamExt};
 use serde_json::{Value, json};
-use tokio_tungstenite::{connect_async, tungstenite::Message};
+use std::{collections::BTreeMap, future::Future, sync::Arc};
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async, tungstenite::Message};
+type Socket = WebSocketStream<MaybeTlsStream<tokio::net::TcpStream>>;
+type Pool = Arc<tokio::sync::Mutex<BTreeMap<String, Socket>>>;
+tokio::task_local! {static SOCKETS: Pool;}
+pub(super) async fn run_transport<F: Future>(future: F) -> F::Output {
+    SOCKETS
+        .scope(Arc::new(tokio::sync::Mutex::new(BTreeMap::new())), future)
+        .await
+}
+
+async fn exchange(
+    socket: &mut Socket,
+    id: u64,
+    method: &str,
+    params: Value,
+) -> Result<Value, String> {
+    socket
+        .send(Message::Text(
+            json!({"id":id,"method":method,"params":params})
+                .to_string()
+                .into(),
+        ))
+        .await
+        .map_err(|e| format!("browser_disconnected: {e}; input completion may be unconfirmed"))?;
+    while let Some(message) = socket.next().await {
+        let Message::Text(raw) = message.map_err(|e| e.to_string())? else {
+            continue;
+        };
+        let value: Value = serde_json::from_str(&raw).map_err(|e| e.to_string())?;
+        if value["id"] == id {
+            return Ok(value);
+        }
+    }
+    Err(
+        "browser_disconnected: socket closed before response; observe before repeating input"
+            .into(),
+    )
+}
 
 use super::overlay::build_overlay_script;
 
@@ -58,28 +94,48 @@ pub(super) async fn cdp_call_raw(
         let socket_url = page["webSocketDebuggerUrl"]
             .as_str()
             .ok_or("Missing browser websocket URL")?;
-        let (mut socket, _) = connect_async(socket_url)
-            .await
-            .map_err(|e| format!("browser_disconnected: {e}"))?;
-        socket
-            .send(Message::Text(
-                json!({ "id": 1, "method": method, "params": params })
-                    .to_string()
-                    .into(),
-            ))
-            .await
-            .map_err(|e| e.to_string())?;
-        while let Some(message) = socket.next().await {
-            let Message::Text(raw) = message.map_err(|e| e.to_string())? else {
-                continue;
-            };
-            let value: Value = serde_json::from_str(&raw).map_err(|e| e.to_string())?;
-            if value["id"] == 1 {
-                validate_response(&value)?;
-                return Ok(value);
+        let pool = SOCKETS.try_with(Arc::clone).ok();
+        let mut reused = if let Some(pool) = &pool {
+            pool.lock().await.remove(socket_url)
+        } else {
+            None
+        };
+        let mut socket = if let Some(socket) = reused.take() {
+            socket
+        } else {
+            let (mut socket, _) = connect_async(socket_url)
+                .await
+                .map_err(|e| format!("browser_disconnected: {e}"))?;
+            if config.extra.get("__managedBrowser") == Some(&json!(true)) {
+                let width = config
+                    .extra
+                    .get("browserViewportWidth")
+                    .and_then(Value::as_u64)
+                    .unwrap_or(1440)
+                    .clamp(320, 7680);
+                let height = config
+                    .extra
+                    .get("browserViewportHeight")
+                    .and_then(Value::as_u64)
+                    .unwrap_or(900)
+                    .clamp(240, 4320);
+                let reply = exchange(
+                    &mut socket,
+                    0,
+                    "Emulation.setDeviceMetricsOverride",
+                    json!({"width":width,"height":height,"deviceScaleFactor":1,"mobile":false}),
+                )
+                .await?;
+                validate_response(&reply)?;
             }
+            socket
+        };
+        let value = exchange(&mut socket, 1, method, params).await?;
+        if let Some(pool) = pool {
+            pool.lock().await.insert(socket_url.to_owned(), socket);
         }
-        Err("browser_disconnected: websocket closed before response".into())
+        validate_response(&value)?;
+        Ok(value)
     })
     .await
     .map_err(|_| {
@@ -103,13 +159,19 @@ pub(super) fn validate_response(value: &Value) -> Result<(), String> {
     Ok(())
 }
 
-pub(super) async fn fetch_pages(config: &MintConfig) -> Result<Vec<Value>, String> {
-    let endpoint = config
+/// Debug endpoint of the managed headless browser for this run. Mint never
+/// borrows a browser on a well-known port: without a managed run the fallback
+/// is an unreachable address so calls fail instead of hijacking another browser.
+pub(super) fn debug_endpoint(config: &MintConfig) -> &str {
+    config
         .extra
         .get("browserDebugUrl")
         .and_then(Value::as_str)
-        .unwrap_or("http://127.0.0.1:9222/json/list");
-    fetch_pages_endpoint(endpoint).await
+        .unwrap_or("http://127.0.0.1:0/json/list")
+}
+
+pub(super) async fn fetch_pages(config: &MintConfig) -> Result<Vec<Value>, String> {
+    fetch_pages_endpoint(debug_endpoint(config)).await
 }
 
 pub(super) async fn fetch_pages_endpoint(endpoint: &str) -> Result<Vec<Value>, String> {