iris-chatbot 5.3.0 → 5.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iris-chatbot",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "private": false,
   "description": "One-command installer for the Iris project template.",
   "bin": {

package/template/next-env.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
+import "./.next/dev/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/template/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "iris",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "iris",
-      "version": "5.3.0",
+      "version": "5.4.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.72.1",
         "clsx": "^2.1.1",

package/template/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iris",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "private": true,
   "description": "One-command installer for the Iris project template.",
   "engines": {

package/template/src/app/api/chat/route.ts

@@ -1,6 +1,8 @@
 import OpenAI from "openai";
 import Anthropic from "@anthropic-ai/sdk";
+import type { BetaContentBlockParam, BetaMessageParam } from "@anthropic-ai/sdk/resources/beta";
 import type {
+  ChatAttachment,
   ChatConnectionPayload,
   ChatMessageInput,
   MemoryContextPayload,
@@ -11,6 +13,10 @@ import type {
 } from "../../../lib/types";
 import { DEFAULT_LOCAL_TOOLS_SETTINGS } from "../../../lib/types";
 import { GEMINI_OPENAI_BASE_URL, supportsToolsByDefault } from "../../../lib/connections";
+import {
+  getAttachmentProviderForConnection,
+  normalizeChatAttachments,
+} from "../../../lib/attachments";
 import { createApprovalRequest } from "../../../lib/tooling/approvals";
 import {
   createToolRegistry,
@@ -514,17 +520,59 @@ function sanitizeChatMessages(messages: ChatMessageInput[]): ChatMessageInput[]
       continue;
     }
     const normalizedContent = message.content.replace(/\r\n/g, "\n");
-    if (!normalizedContent.trim()) {
+    const normalizedAttachments =
+      role === "user" ? normalizeChatAttachments(message.attachments) : [];
+    if (!normalizedContent.trim() && normalizedAttachments.length === 0) {
       continue;
     }
     sanitized.push({
       role,
       content: normalizedContent,
+      ...(normalizedAttachments.length > 0
+        ? { attachments: normalizedAttachments }
+        : {}),
     });
   }
   return sanitized;
 }
 
+function messageHasAttachments(message: ChatMessageInput): boolean {
+  return Array.isArray(message.attachments) && message.attachments.length > 0;
+}
+
+function messagesContainAttachments(messages: ChatMessageInput[]): boolean {
+  return messages.some((message) => messageHasAttachments(message));
+}
+
+function validateAttachmentProviderCompatibility(params: {
+  connection: RuntimeConnection;
+  messages: ChatMessageInput[];
+}): string | null {
+  const providerFromConnection = getAttachmentProviderForConnection(params.connection);
+  const providers = new Set<ChatAttachment["provider"]>();
+  for (const message of params.messages) {
+    for (const attachment of message.attachments ?? []) {
+      providers.add(attachment.provider);
+    }
+  }
+
+  if (providers.size === 0) {
+    return null;
+  }
+  if (providers.size > 1) {
+    return "Attachments from multiple providers cannot be mixed in one request.";
+  }
+  if (!providerFromConnection) {
+    return "This connection does not support attachments.";
+  }
+
+  const providerFromAttachment = [...providers][0];
+  if (providerFromAttachment !== providerFromConnection) {
+    return `Attachments were uploaded for ${providerFromAttachment}, but the active connection is ${providerFromConnection}.`;
+  }
+  return null;
+}
+
 function sanitizeMemoryContext(
   memory: ChatRequest["memory"],
 ): MemoryContextPayload | null {
@@ -638,10 +686,103 @@ function normalizeWebSourcesEnabled(value: boolean | undefined): boolean {
   return value !== false;
 }
 
+type WebSearchMode = "off" | "auto" | "required";
+
 function supportsWebSourcesViaOpenAI(connection: RuntimeConnection): boolean {
   return connection.kind === "builtin" && connection.provider === "openai";
 }
 
+function getLastUserMessageText(messages: ChatMessageInput[]): string {
+  return [...messages].reverse().find((message) => message.role === "user")?.content?.trim() ?? "";
+}
+
+function decideWebSearchMode(params: {
+  enabled: boolean;
+  connection: RuntimeConnection;
+  messages: ChatMessageInput[];
+}): WebSearchMode {
+  if (!params.enabled || !supportsWebSourcesViaOpenAI(params.connection)) {
+    return "off";
+  }
+
+  const text = getLastUserMessageText(params.messages).replace(/\s+/g, " ").trim().toLowerCase();
+  if (!text) {
+    return "auto";
+  }
+
+  const disableSearchRequested =
+    /\b(?:no|without|skip)\s+(?:web\s+)?(?:search|browsing|browse|lookup|look up)\b/.test(text) ||
+    /\b(?:don't|do not)\s+(?:web\s+)?(?:search|browse|look up|lookup)\b/.test(text) ||
+    /\boffline only\b/.test(text);
+  if (disableSearchRequested) {
+    return "off";
+  }
+
+  const explicitSearchRequested =
+    /\bsearch(?:\s+the)?\s+web\b/.test(text) ||
+    /\blook(?:\s+it)?\s+up\b/.test(text) ||
+    /\bcheck(?:\s+it)?\s+online\b/.test(text) ||
+    /\bverify(?:\s+it)?\s+online\b/.test(text) ||
+    /\bbrowse(?:\s+the)?\s+web\b/.test(text) ||
+    /\bgoogle\s+(?:it|this)\b/.test(text);
+  if (explicitSearchRequested) {
+    return "required";
+  }
+
+  const asksForSources =
+    /\b(?:source|sources|cite|citation|citations|reference|references|link|links)\b/.test(text);
+  const freshnessSignals =
+    /\b(?:latest|current|currently|today|right now|as of|recent|recently|up[- ]to[- ]date|breaking)\b/.test(
+      text,
+    );
+  const volatileDomainSignals =
+    /\b(?:price|pricing|cost|fee|subscription|per token|rate limit|stock|share price|market cap|forecast|weather|score|standings|odds|election|poll)\b/.test(
+      text,
+    );
+  const leadershipSignals =
+    /\b(?:who is|current)\s+(?:the\s+)?(?:ceo|president|prime minister|governor|mayor)\b/.test(text);
+  const metricSignals =
+    /\b(?:average|median|how many|number of|count|rate|percentage|percent|statistics?|stats?)\b/.test(
+      text,
+    );
+  const metricEntitySignals =
+    /\b(?:users?|people|prompts?|requests?|queries?|api|model|gpt|traffic|revenue|downloads?|adoption|daily|weekly|monthly|yearly|per day|per week|per month)\b/.test(
+      text,
+    );
+
+  if (
+    asksForSources ||
+    freshnessSignals ||
+    volatileDomainSignals ||
+    leadershipSignals ||
+    (metricSignals && metricEntitySignals)
+  ) {
+    return "required";
+  }
+
+  const likelyFactualQuestion =
+    text.includes("?") || /^(?:what|who|when|where|which|how)\b/.test(text);
+  const uncertaintySignals =
+    /\b(?:not sure|unsure|uncertain|verify|double-check|confirm|accurate|accuracy)\b/.test(text);
+  if (likelyFactualQuestion && uncertaintySignals) {
+    return "auto";
+  }
+
+  return "off";
+}
+
+function withWebSearchGuidance(system: string | undefined, mode: WebSearchMode): string | undefined {
+  const trimmed = system?.trim() || "";
+  if (mode === "off") {
+    return trimmed || undefined;
+  }
+  const guidance =
+    mode === "required"
+      ? "Web search is required for this turn. Use web_search before answering and cite the sources you relied on."
+      : "Use web_search when the request depends on current or uncertain facts (pricing, statistics, recency). For stable/general knowledge, answer directly without web_search.";
+  return trimmed ? `${trimmed}\n\n${guidance}` : guidance;
+}
+
 function mergeCitationSources(
   target: Map<string, ProviderCitationSource>,
   sources: ProviderCitationSource[] | undefined,
@@ -2481,12 +2622,97 @@ async function tryDirectAutomationFastPath(params: {
   return true;
 }
 
+function toOpenAIMessageContent(
+  message: ChatMessageInput,
+): string | OpenAI.Responses.ResponseInputMessageContentList {
+  if (message.role !== "user" || !messageHasAttachments(message)) {
+    return message.content;
+  }
+
+  const content: OpenAI.Responses.ResponseInputMessageContentList = [];
+  if (message.content.trim()) {
+    content.push({
+      type: "input_text",
+      text: message.content,
+    });
+  }
+
+  for (const attachment of message.attachments ?? []) {
+    if (attachment.kind === "image") {
+      content.push({
+        type: "input_image",
+        detail: "auto",
+        file_id: attachment.providerFileId,
+      });
+      continue;
+    }
+    content.push({
+      type: "input_file",
+      file_id: attachment.providerFileId,
+      filename: attachment.name,
+    });
+  }
+
+  if (content.length === 0) {
+    content.push({
+      type: "input_text",
+      text: "",
+    });
+  }
+  return content;
+}
+
+function toAnthropicUserContent(message: ChatMessageInput): string | BetaContentBlockParam[] {
+  if (!messageHasAttachments(message)) {
+    return message.content;
+  }
+
+  const content: BetaContentBlockParam[] = [];
+  if (message.content.trim()) {
+    content.push({
+      type: "text",
+      text: message.content,
+    });
+  }
+
+  for (const attachment of message.attachments ?? []) {
+    if (attachment.kind === "image") {
+      content.push({
+        type: "image",
+        source: {
+          type: "file",
+          file_id: attachment.providerFileId,
+        },
+      });
+      continue;
+    }
+    content.push({
+      type: "document",
+      title: attachment.name,
+      citations: { enabled: true },
+      source: {
+        type: "file",
+        file_id: attachment.providerFileId,
+      },
+    });
+  }
+
+  if (content.length === 0) {
+    content.push({
+      type: "text",
+      text: "",
+    });
+  }
+  return content;
+}
+
 async function streamPlainChat(params: {
   connection: RuntimeConnection;
   model: string;
   system?: string;
   messages: ChatMessageInput[];
   enableWebSources: boolean;
+  webSearchMode?: WebSearchMode;
   send: (chunk: ChatStreamChunk) => void;
   signal?: AbortSignal;
 }) {
@@ -2506,19 +2732,65 @@ async function streamPlainChat(params: {
       throw new Error("Missing Anthropic API key for this connection.");
     }
     const client = new Anthropic({ apiKey: params.connection.apiKey });
-    const response = await client.messages.stream({
-      model: params.model,
-      max_tokens: 1024,
-      system: params.system,
-      messages: params.messages.map((message) => ({
-        role: message.role === "assistant" ? "assistant" : "user",
-        content: message.content,
-      })),
-    });
+    if (messagesContainAttachments(params.messages)) {
+      const systemBlocks = [
+        params.system?.trim() || "",
+        ...params.messages
+          .filter((message) => message.role === "system")
+          .map((message) => message.content.trim())
+          .filter(Boolean),
+      ].filter(Boolean);
+      const anthropicMessages: BetaMessageParam[] = params.messages
+        .filter((message) => message.role !== "system")
+        .map((message) => ({
+          role: message.role === "assistant" ? "assistant" : "user",
+          content:
+            message.role === "assistant"
+              ? message.content
+              : toAnthropicUserContent(message),
+        }));
+
+      const response = await client.beta.messages.create({
+        model: params.model,
+        max_tokens: 1024,
+        system: systemBlocks.length > 0 ? systemBlocks.join("\n\n") : undefined,
+        messages: anthropicMessages,
+        stream: true,
+        betas: ["files-api-2025-04-14", "pdfs-2024-09-25"],
+      });
+
+      for await (const event of response) {
+        const eventAny = event as {
+          type?: string;
+          delta?: { type?: string; text?: string };
+          error?: { message?: string };
+        };
+        if (eventAny.type === "content_block_delta" && eventAny.delta?.type === "text_delta") {
+          emitTokenText(params.send, eventAny.delta.text ?? "");
+          continue;
+        }
+        if (eventAny.type === "error") {
+          params.send({
+            type: "error",
+            error: eventAny.error?.message || "Anthropic response error",
+          });
+        }
+      }
+    } else {
+      const response = await client.messages.stream({
+        model: params.model,
+        max_tokens: 1024,
+        system: params.system,
+        messages: params.messages.map((message) => ({
+          role: message.role === "assistant" ? "assistant" : "user",
+          content: message.content,
+        })),
+      });
 
-    for await (const event of response) {
-      if (event.type === "content_block_delta" && event.delta?.type === "text_delta") {
-        emitTokenText(params.send, event.delta.text);
+      for await (const event of response) {
+        if (event.type === "content_block_delta" && event.delta?.type === "text_delta") {
+          emitTokenText(params.send, event.delta.text);
+        }
       }
     }
     return;
@@ -2536,20 +2808,30 @@ async function streamPlainChat(params: {
     baseURL: openAIBaseURL,
     defaultHeaders: openAIHeaders,
   });
-  const useWebSources =
-    params.enableWebSources && supportsWebSourcesViaOpenAI(params.connection);
+  const useWebSources = params.enableWebSources && supportsWebSourcesViaOpenAI(params.connection);
+  const webSearchMode: WebSearchMode = useWebSources
+    ? params.webSearchMode === "required"
+      ? "required"
+      : "auto"
+    : "off";
+  const instructions = withWebSearchGuidance(params.system, webSearchMode);
   const response = await client.responses.create(
     {
       model: params.model,
-      instructions: params.system,
+      instructions,
       input: params.messages.map((message) => ({
         type: "message",
         role: message.role,
-        content: message.content,
+        content: toOpenAIMessageContent(message),
       })),
-      tools: useWebSources ? [{ type: "web_search" }] : undefined,
-      tool_choice: useWebSources ? "auto" : undefined,
-      include: useWebSources ? ["web_search_call.action.sources"] : undefined,
+      tools: webSearchMode !== "off" ? [{ type: "web_search" }] : undefined,
+      tool_choice:
+        webSearchMode === "required"
+          ? "required"
+          : webSearchMode === "auto"
+            ? "auto"
+            : undefined,
+      include: webSearchMode !== "off" ? ["web_search_call.action.sources"] : undefined,
       stream: true,
     },
     { signal: params.signal },
@@ -3001,10 +3283,25 @@ export async function POST(request: Request) {
       headers: { "Content-Type": "application/json" },
     });
   }
+  const hasAttachmentsInMessages = messagesContainAttachments(sanitizedMessages);
+  const attachmentCompatibilityError = validateAttachmentProviderCompatibility({
+    connection,
+    messages: sanitizedMessages,
+  });
+  if (attachmentCompatibilityError) {
+    return new Response(JSON.stringify({ error: attachmentCompatibilityError }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
 
   const webSourcesEnabled = normalizeWebSourcesEnabled(body.enableWebSources);
-  const enableWebSourcesForConnection =
-    webSourcesEnabled && supportsWebSourcesViaOpenAI(connection);
+  const webSearchMode = decideWebSearchMode({
+    enabled: webSourcesEnabled,
+    connection,
+    messages: sanitizedMessages,
+  });
+  const enableWebSourcesForConnection = webSearchMode !== "off";
   const localToolsRequested = normalizeLocalTools(body.localTools);
   const memoryContext = sanitizeMemoryContext(body.memory);
   const requestMeta = sanitizeChatRequestMeta(body.meta);
@@ -3046,7 +3343,7 @@ export async function POST(request: Request) {
           });
         }
 
-        if (localTools.enabled) {
+        if (localTools.enabled && !hasAttachmentsInMessages) {
           const lastUserText =
             [...sanitizedMessages].reverse().find((message) => message.role === "user")?.content ?? "";
           const communicationIntentType = classifyDraftCommunicationIntent(lastUserText);
@@ -3111,6 +3408,7 @@ export async function POST(request: Request) {
           system,
           messages: sanitizedMessages,
           enableWebSources: enableWebSourcesForConnection,
+          webSearchMode,
           send,
           signal: request.signal,
         });

package/template/src/app/api/chat/uploads/route.ts

@@ -0,0 +1,220 @@
+import OpenAI from "openai";
+import Anthropic from "@anthropic-ai/sdk";
+import type { ChatAttachment, ChatConnectionPayload } from "../../../../lib/types";
+import {
+  getAttachmentProviderForConnection,
+  MAX_ATTACHMENTS_PER_MESSAGE,
+  validateAttachmentCandidate,
+} from "../../../../lib/attachments";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type RuntimeConnection = {
+  kind: "builtin" | "openai_compatible" | "ollama";
+  provider?: "openai" | "anthropic" | "google";
+  baseUrl?: string;
+  apiKey?: string;
+  headers: Array<{ key: string; value: string }>;
+};
+
+function headersArrayToRecord(
+  headers: RuntimeConnection["headers"],
+): Record<string, string> | undefined {
+  if (!headers.length) {
+    return undefined;
+  }
+  const out: Record<string, string> = {};
+  for (const header of headers) {
+    const key = header.key.trim();
+    if (!key) {
+      continue;
+    }
+    out[key] = header.value;
+  }
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+function normalizeConnection(rawConnection: unknown): RuntimeConnection | null {
+  if (!rawConnection || typeof rawConnection !== "object") {
+    return null;
+  }
+  const connection = rawConnection as Partial<ChatConnectionPayload>;
+  const kind =
+    connection.kind === "builtin" ||
+    connection.kind === "openai_compatible" ||
+    connection.kind === "ollama"
+      ? connection.kind
+      : null;
+  if (!kind) {
+    return null;
+  }
+  const provider =
+    kind === "builtin" &&
+    (connection.provider === "openai" ||
+      connection.provider === "anthropic" ||
+      connection.provider === "google")
+      ? connection.provider
+      : undefined;
+  const baseUrl =
+    typeof connection.baseUrl === "string" && connection.baseUrl.trim().length > 0
+      ? connection.baseUrl.trim()
+      : undefined;
+  const apiKey =
+    typeof connection.apiKey === "string" && connection.apiKey.trim().length > 0
+      ? connection.apiKey.trim()
+      : undefined;
+  const headers = Array.isArray(connection.headers)
+    ? connection.headers
+        .filter(
+          (header): header is { key: string; value: string } =>
+            Boolean(header) &&
+            typeof header.key === "string" &&
+            typeof header.value === "string",
+        )
+        .map((header) => ({
+          key: header.key,
+          value: header.value,
+        }))
+    : [];
+
+  return {
+    kind,
+    provider,
+    baseUrl,
+    apiKey,
+    headers,
+  };
+}
+
+function badRequest(message: string) {
+  return new Response(JSON.stringify({ error: message }), {
+    status: 400,
+    headers: {
+      "Content-Type": "application/json",
+    },
+  });
+}
+
+export async function POST(request: Request) {
+  let formData: FormData;
+  try {
+    formData = await request.formData();
+  } catch {
+    return badRequest("Invalid multipart form payload.");
+  }
+
+  const rawConnection = formData.get("connection");
+  if (typeof rawConnection !== "string" || !rawConnection.trim()) {
+    return badRequest("Missing connection payload.");
+  }
+
+  let parsedConnectionValue: unknown;
+  try {
+    parsedConnectionValue = JSON.parse(rawConnection);
+  } catch {
+    return badRequest("Invalid connection payload.");
+  }
+
+  const connection = normalizeConnection(parsedConnectionValue);
+  if (!connection) {
+    return badRequest("Invalid connection payload.");
+  }
+
+  const providerFamily = getAttachmentProviderForConnection(connection);
+  if (!providerFamily) {
+    return badRequest("This connection does not support chat attachments.");
+  }
+
+  const files = formData.getAll("files").filter((entry): entry is File => entry instanceof File);
+  if (files.length === 0) {
+    return badRequest("No files were uploaded.");
+  }
+  if (files.length > MAX_ATTACHMENTS_PER_MESSAGE) {
+    return badRequest(`You can upload up to ${MAX_ATTACHMENTS_PER_MESSAGE} files per message.`);
+  }
+
+  const attachments: ChatAttachment[] = [];
+
+  if (providerFamily === "anthropic") {
+    if (!connection.apiKey) {
+      return badRequest("Missing Anthropic API key.");
+    }
+    const client = new Anthropic({
+      apiKey: connection.apiKey,
+    });
+
+    for (const file of files) {
+      const validation = validateAttachmentCandidate({
+        name: file.name,
+        mimeType: file.type,
+        sizeBytes: file.size,
+      });
+      if (!validation.ok) {
+        return badRequest(validation.error);
+      }
+
+      const uploadable = new File([await file.arrayBuffer()], validation.name, {
+        type: validation.mimeType,
+      });
+      const uploaded = await client.beta.files.upload({
+        file: uploadable,
+        betas: ["files-api-2025-04-14"],
+      });
+
+      attachments.push({
+        provider: "anthropic",
+        providerFileId: uploaded.id,
+        kind: validation.kind,
+        name: validation.name,
+        mimeType: validation.mimeType,
+        sizeBytes: validation.sizeBytes,
+      });
+    }
+  } else {
+    if (connection.kind === "openai_compatible" && !connection.baseUrl) {
+      return badRequest("OpenAI-compatible connection is missing base URL.");
+    }
+    if (connection.kind === "builtin" && connection.provider === "openai" && !connection.apiKey) {
+      return badRequest("Missing OpenAI API key.");
+    }
+
+    const client = new OpenAI({
+      apiKey: connection.apiKey ?? "no-key-required",
+      baseURL: connection.kind === "openai_compatible" ? connection.baseUrl : undefined,
+      defaultHeaders: headersArrayToRecord(connection.headers),
+    });
+
+    for (const file of files) {
+      const validation = validateAttachmentCandidate({
+        name: file.name,
+        mimeType: file.type,
+        sizeBytes: file.size,
+      });
+      if (!validation.ok) {
+        return badRequest(validation.error);
+      }
+
+      const uploadable = await OpenAI.toFile(
+        await file.arrayBuffer(),
+        validation.name,
+        { type: validation.mimeType },
+      );
+      const uploaded = await client.files.create({
+        file: uploadable,
+        purpose: "user_data",
+      });
+
+      attachments.push({
+        provider: "openai",
+        providerFileId: uploaded.id,
+        kind: validation.kind,
+        name: validation.name,
+        mimeType: validation.mimeType,
+        sizeBytes: validation.sizeBytes,
+      });
+    }
+  }
+
+  return Response.json({ attachments });
+}