kiku-agent 1.3.2 → 1.3.3

package/server/web-chat/routes/providerRoute.js

@@ -5,8 +5,12 @@ import {
   setActiveProvider,
   savePersistedProviderBaseUrl,
   getProvider,
+  getPersistedInferenceSettings,
+  savePersistedInferenceSettings,
+  withSettingsWriteQueue,
 } from '../../agent/config.js';
 import { currentAgent, setCurrentAgent } from '../core/connection.js';
+import { validateInferenceBaseUrl, isTrustedRequest, sanitizeInferenceError } from '../core/urlGuard.js';
 import { LLMClient } from '../../agent/llmClient.js';
 
 export async function handleProviderGetRoute(req, res) {
@@ -14,6 +18,7 @@ export async function handleProviderGetRoute(req, res) {
     const catalog = getUnifiedProviderCatalog();
     sendJson(res, 200, {
       status: 'ok',
+      inference: getPersistedInferenceSettings(),
       activeProvider: catalog.activeProvider,
       activeBaseUrl: catalog.activeBaseUrl,
       activeModel: catalog.activeModel,
@@ -21,11 +26,12 @@ export async function handleProviderGetRoute(req, res) {
       providers: catalog.providers,
     });
   } catch (err) {
-    sendError(res, 500, err.message);
+    sendError(res, 500, sanitizeInferenceError(err, isTrustedRequest(req)));
   }
 }
 
 export async function handleProviderUpdateRoute(req, res) {
+  if (!isTrustedRequest(req)) return sendError(res, 403, 'Changing server provider settings requires local or admin access');
   let body;
   try {
     body = await parseJsonBody(req);
@@ -33,40 +39,65 @@ export async function handleProviderUpdateRoute(req, res) {
     return sendError(res, 400, `Invalid JSON body: ${err.message}`);
   }
   try {
-    const provider = String(body.provider || body.activeProvider || '').toLowerCase().trim() || null;
-    const model = typeof body.model === 'string' && body.model.trim() ? body.model.trim() : null;
+    if (body.inference !== undefined && (!body.inference || typeof body.inference !== 'object' || Array.isArray(body.inference))) return sendError(res, 400, 'Invalid inference settings');
+    let provider = String(body.provider || body.activeProvider || '').toLowerCase().trim() || null;
+    // 'auto' means CLI/Server sync mode: no explicit provider switch, just return catalog.
+    if (provider === 'auto') provider = null;
+    let model = typeof body.model === 'string' && body.model.trim() ? body.model.trim() : null;
+    if (model && model.toLowerCase() === 'auto') model = null;
+    if (model && !/^[A-Za-z0-9._\-/: ]{1,200}$/.test(model)) {
+      return sendError(res, 400, `Invalid model id "${model.slice(0, 50)}"`);
+    }
     const baseUrl = typeof body.baseUrl === 'string' && body.baseUrl.trim() ? body.baseUrl.trim().replace(/\/+$/, '') : null;
 
-    if (baseUrl && !provider) {
-      return sendError(res, 400, 'Provider is required when setting a baseUrl');
+    if (!provider) {
+      // Auto (CLI/Server sync) mode: text-field leftovers (baseUrl/model) are
+      // display-only — ignore them and just report the active catalog.
+      if (body.inference) await withSettingsWriteQueue(() => savePersistedInferenceSettings(body.inference));
+      const catalog = getUnifiedProviderCatalog();
+      return sendJson(res, 200, {
+        status: 'ok',
+      inference: getPersistedInferenceSettings(),
+        activeProvider: catalog.activeProvider,
+        activeBaseUrl: catalog.activeBaseUrl,
+        activeModel: catalog.activeModel,
+        localEndpoints: catalog.localEndpoints,
+        providers: catalog.providers,
+      });
     }
 
     if (baseUrl && provider) {
       const pDef = getProvider(provider);
       if (!pDef) return sendError(res, 400, `Unknown provider "${provider}"`);
-      try {
-        new URL(baseUrl);
-      } catch {
-        return sendError(res, 400, `Invalid baseUrl "${baseUrl}"`);
-      }
-      savePersistedProviderBaseUrl(provider, baseUrl);
+      const guard = await validateInferenceBaseUrl(baseUrl, { callerIsTrusted: isTrustedRequest(req) });
+      if (!guard.ok) return sendError(res, 400, guard.reason);
+      await withSettingsWriteQueue(() => savePersistedProviderBaseUrl(provider, guard.normalized));
     }
 
     let catalog;
+    let switchError = null;
     if (provider) {
       const pDef = getProvider(provider);
       if (!pDef) return sendError(res, 400, `Unknown provider "${provider}"`);
-      setActiveProvider(provider, { model, baseUrl });
+      await withSettingsWriteQueue(() => {
+        setActiveProvider(provider, { model, baseUrl });
+        if (body.inference) savePersistedInferenceSettings(body.inference);
+      });
       if (currentAgent?.client) {
         try {
-          currentAgent.client.switchProvider(provider, { model: model || undefined, baseUrl: baseUrl || undefined });
+          await currentAgent.client.switchProvider(provider, { model: model || undefined, baseUrl: baseUrl || undefined });
           setCurrentAgent(currentAgent);
-        } catch {}
+        } catch (err) {
+          // Persisted, but the live agent could not hot-swap — surface instead of swallowing.
+          switchError = err?.message || 'Failed to hot-swap the active agent client';
+        }
       } else if (baseUrl || model) {
         try {
           const client = new LLMClient({ provider, model: model || undefined, baseUrl: baseUrl || getProviderBaseUrl(provider) });
           void client;
-        } catch {}
+        } catch (err) {
+          switchError = err?.message || 'Failed to construct a client for the requested provider';
+        }
       }
       catalog = getUnifiedProviderCatalog();
     } else {
@@ -75,6 +106,8 @@ export async function handleProviderUpdateRoute(req, res) {
 
     sendJson(res, 200, {
       status: 'ok',
+      inference: getPersistedInferenceSettings(),
+      switchError: switchError ? sanitizeInferenceError(switchError, isTrustedRequest(req)) : null,
       activeProvider: catalog.activeProvider,
       activeBaseUrl: catalog.activeBaseUrl,
       activeModel: catalog.activeModel,
@@ -82,6 +115,6 @@ export async function handleProviderUpdateRoute(req, res) {
       providers: catalog.providers,
     });
   } catch (err) {
-    sendError(res, 500, err.message);
+    sendError(res, 500, sanitizeInferenceError(err, isTrustedRequest(req)));
   }
 }

package/server/web-chat/routes/staticRoute.js

@@ -1,7 +1,11 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import zlib from 'node:zlib';
+import crypto from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { getWebChatHtml } from '../ui/htmlBuilder.js';
+import { getSettingsHtml } from '../ui/settingsBuilder.js';
+import { getDocsHtml } from '../ui/docsBuilder.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -25,6 +29,161 @@ const MIME_TYPES = {
   '.txt': 'text/plain; charset=utf-8'
 };
 
+const COMPRESSIBLE_EXTS = new Set(['.css', '.js', '.mjs', '.json', '.txt', '.svg']);
+
+
+let webChatCache = null;
+let webChatCacheTimestamp = 0;
+let settingsCache = null;
+let settingsCacheTimestamp = 0;
+let docsCache = null;
+let docsCacheTimestamp = 0;
+const staticCompressCache = new Map();
+
+function getCachedWebChatBundle(port) {
+  const now = Date.now();
+  const ttl = process.env.NODE_ENV === 'production' ? Infinity : 2000;
+  if (webChatCache && webChatCache.port === port && (now - webChatCacheTimestamp) < ttl) {
+    return webChatCache;
+  }
+  const html = getWebChatHtml(port);
+  const raw = Buffer.from(html, 'utf8');
+  const hash = crypto.createHash('md5').update(raw).digest('hex');
+  const etag = `W/"${hash}"`;
+  webChatCache = {
+    port,
+    raw,
+    etag,
+    br: null,
+    gzip: null,
+    deflate: null
+  };
+  webChatCacheTimestamp = now;
+  return webChatCache;
+}
+
+function getCachedSettingsBundle() {
+  const now = Date.now();
+  const ttl = process.env.NODE_ENV === 'production' ? Infinity : 2000;
+  if (settingsCache && (now - settingsCacheTimestamp) < ttl) {
+    return settingsCache;
+  }
+  const html = getSettingsHtml();
+  const raw = Buffer.from(html, 'utf8');
+  const hash = crypto.createHash('md5').update(raw).digest('hex');
+  const etag = `W/"${hash}"`;
+  settingsCache = {
+    raw,
+    etag,
+    br: null,
+    gzip: null,
+    deflate: null
+  };
+  settingsCacheTimestamp = now;
+  return settingsCache;
+}
+
+function getCachedDocsBundle() {
+  const now = Date.now();
+  const ttl = process.env.NODE_ENV === 'production' ? Infinity : 2000;
+  if (docsCache && (now - docsCacheTimestamp) < ttl) {
+    return docsCache;
+  }
+  const html = getDocsHtml();
+  const raw = Buffer.from(html, 'utf8');
+  const hash = crypto.createHash('md5').update(raw).digest('hex');
+  const etag = `W/"${hash}"`;
+  docsCache = {
+    raw,
+    etag,
+    br: null,
+    gzip: null,
+    deflate: null
+  };
+  docsCacheTimestamp = now;
+  return docsCache;
+}
+
+function sendCompressedResponse(req, res, statusCode, baseHeaders, rawBuffer, etag, cacheEntry = null) {
+  const reqHeaders = req?.headers || {};
+  const acceptEncoding = typeof reqHeaders['accept-encoding'] === 'string'
+    ? reqHeaders['accept-encoding'].toLowerCase()
+    : '';
+
+ 
+  const ifNoneMatch = reqHeaders['if-none-match'];
+  if (etag && ifNoneMatch) {
+    const cleanEtag = etag.replace(/^W\//, '');
+    const cleanClient = ifNoneMatch.replace(/^W\//, '');
+    if (ifNoneMatch === etag || cleanClient === cleanEtag || ifNoneMatch.includes(cleanEtag)) {
+      const respHeaders = {
+        'ETag': etag,
+        'Cache-Control': baseHeaders['Cache-Control'] || 'no-cache',
+        'Vary': 'Accept-Encoding'
+      };
+      res.writeHead(304, respHeaders);
+      res.end();
+      return;
+    }
+  }
+
+  const respHeaders = { ...baseHeaders, 'Vary': 'Accept-Encoding' };
+  if (etag) {
+    respHeaders['ETag'] = etag;
+  }
+
+ 
+  if (rawBuffer.length >= 1024) {
+    if (acceptEncoding.includes('br')) {
+      let brBuf = cacheEntry?.br;
+      if (!brBuf) {
+        brBuf = zlib.brotliCompressSync(rawBuffer, {
+          params: {
+            [zlib.constants.BROTLI_PARAM_QUALITY]: 5
+          }
+        });
+        if (cacheEntry) cacheEntry.br = brBuf;
+      }
+      respHeaders['Content-Encoding'] = 'br';
+      respHeaders['Content-Length'] = brBuf.length;
+      res.writeHead(statusCode, respHeaders);
+      res.end(brBuf);
+      return;
+    }
+
+    if (acceptEncoding.includes('gzip')) {
+      let gzBuf = cacheEntry?.gzip;
+      if (!gzBuf) {
+        gzBuf = zlib.gzipSync(rawBuffer, { level: 6 });
+        if (cacheEntry) cacheEntry.gzip = gzBuf;
+      }
+      respHeaders['Content-Encoding'] = 'gzip';
+      respHeaders['Content-Length'] = gzBuf.length;
+      res.writeHead(statusCode, respHeaders);
+      res.end(gzBuf);
+      return;
+    }
+
+    if (acceptEncoding.includes('deflate')) {
+      let defBuf = cacheEntry?.deflate;
+      if (!defBuf) {
+        defBuf = zlib.deflateSync(rawBuffer);
+        if (cacheEntry) cacheEntry.deflate = defBuf;
+      }
+      respHeaders['Content-Encoding'] = 'deflate';
+      respHeaders['Content-Length'] = defBuf.length;
+      res.writeHead(statusCode, respHeaders);
+      res.end(defBuf);
+      return;
+    }
+  }
+
+ 
+  respHeaders['Content-Length'] = rawBuffer.length;
+  res.writeHead(statusCode, respHeaders);
+  res.end(rawBuffer);
+}
+
 export function handleStaticRoute(req, res, pathname, port) {
   const rawUrl = req?.url || '';
   let currentPath = pathname;
@@ -52,6 +211,8 @@ export function handleStaticRoute(req, res, pathname, port) {
     return true;
   }
 
+  const reqHeaders = req?.headers || {};
+
   if (currentPath === '/favicon.ico') {
     let icoPath = path.join(PUBLIC_DIR, 'favicon.ico');
     if (!fs.existsSync(icoPath)) {
@@ -59,8 +220,20 @@ export function handleStaticRoute(req, res, pathname, port) {
       if (fs.existsSync(cwdPath)) icoPath = cwdPath;
     }
     if (fs.existsSync(icoPath)) {
+      const stat = fs.statSync(icoPath);
+      const etag = `W/"${stat.size.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
+      if (reqHeaders['if-none-match'] === etag) {
+        res.writeHead(304, {
+          'ETag': etag,
+          'Cache-Control': 'public, max-age=86400, immutable'
+        });
+        res.end();
+        return true;
+      }
       res.writeHead(200, {
         'Content-Type': 'image/x-icon',
+        'Content-Length': stat.size,
+        'ETag': etag,
         'Cache-Control': 'public, max-age=86400, immutable'
       });
       res.end(fs.readFileSync(icoPath));
@@ -74,15 +247,28 @@ export function handleStaticRoute(req, res, pathname, port) {
       const cwdPath = path.join(process.cwd(), 'public', 'sw.js');
       if (fs.existsSync(cwdPath)) swPath = cwdPath;
     }
-    res.writeHead(200, {
-      'Content-Type': 'application/javascript; charset=utf-8',
-      'Service-Worker-Allowed': '/',
-      'Cache-Control': 'no-cache, no-store, must-revalidate'
-    });
     if (fs.existsSync(swPath)) {
-      fs.createReadStream(swPath).pipe(res);
+      const stat = fs.statSync(swPath);
+      const etag = `W/"${stat.size.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
+      if (reqHeaders['if-none-match'] === etag) {
+        res.writeHead(304, {
+          'ETag': etag,
+          'Service-Worker-Allowed': '/',
+          'Cache-Control': 'no-cache, must-revalidate',
+          'Vary': 'Accept-Encoding'
+        });
+        res.end();
+        return true;
+      }
+      const raw = fs.readFileSync(swPath);
+      sendCompressedResponse(req, res, 200, {
+        'Content-Type': 'application/javascript; charset=utf-8',
+        'Service-Worker-Allowed': '/',
+        'Cache-Control': 'no-cache, must-revalidate'
+      }, raw, etag);
+      return true;
     } else {
-      res.end(`const CACHE_NAME = 'kiku-v1';
+      const defaultSw = `const CACHE_NAME = 'kiku-v1';
 const ASSETS = ['/', '/manifest.json'];
 self.addEventListener('install', (event) => {
   event.waitUntil(caches.open(CACHE_NAME).then((cache) => cache.addAll(ASSETS)).then(() => self.skipWaiting()));
@@ -91,6 +277,13 @@ self.addEventListener('activate', (event) => {
   event.waitUntil(caches.keys().then((keys) => Promise.all(keys.filter((k) => k !== CACHE_NAME).map((k) => caches.delete(k)))).then(() => self.clients.claim()));
 });
 self.addEventListener('fetch', (event) => {
+  let url;
+  try {
+    url = new URL(event.request.url);
+  } catch {
+    return;
+  }
+  if (url.origin !== self.location.origin) return;
   if (event.request.url.includes('/api/')) return;
   event.respondWith(caches.match(event.request).then((cached) => cached || fetch(event.request).then((response) => {
     if (response.ok && event.request.method === 'GET') {
@@ -98,18 +291,26 @@ self.addEventListener('fetch', (event) => {
       caches.open(CACHE_NAME).then((cache) => cache.put(event.request, clone));
     }
     return response;
-  }).catch(() => cached)));
-});`);
+  }).catch(() => cached || new Response('', { status: 504, statusText: 'Gateway Timeout' }))));
+});`;
+      const raw = Buffer.from(defaultSw, 'utf8');
+      const hash = crypto.createHash('md5').update(raw).digest('hex');
+      sendCompressedResponse(req, res, 200, {
+        'Content-Type': 'application/javascript; charset=utf-8',
+        'Service-Worker-Allowed': '/',
+        'Cache-Control': 'no-cache, must-revalidate'
+      }, raw, `W/"${hash}"`);
+      return true;
     }
-    return true;
   }
 
-  if (currentPath.startsWith('/fonts/') || currentPath.startsWith('/images/') || currentPath === '/manifest.json' || currentPath === '/robots.txt') {
+  const lookupPath = decodedPath || currentPath;
+  if (lookupPath.startsWith('/fonts/') || lookupPath.startsWith('/images/') || lookupPath === '/manifest.json' || lookupPath === '/robots.txt') {
     const targetDir = fs.existsSync(PUBLIC_DIR) ? PUBLIC_DIR : path.join(process.cwd(), 'public');
     const targetDirCanonical = path.resolve(targetDir);
     const targetDirPrefix = targetDirCanonical + path.sep;
 
-    const relativePath = currentPath.replace(/^\/+/, '');
+    const relativePath = lookupPath.replace(/^\/+/, '');
     const resolvedPath = path.resolve(targetDirCanonical, relativePath);
 
     if (!resolvedPath.startsWith(targetDirPrefix) && resolvedPath !== targetDirCanonical) {
@@ -127,10 +328,80 @@ self.addEventListener('fetch', (event) => {
       }
     }
 
+    if (!fs.existsSync(filePath)) {
+      const altRel = relativePath.startsWith('images/general/')
+        ? 'images/' + relativePath.slice('images/general/'.length)
+        : relativePath.startsWith('images/')
+        ? 'images/general/' + relativePath.slice('images/'.length)
+        : null;
+      if (altRel) {
+        const altResolved = path.resolve(targetDirCanonical, altRel);
+        if (altResolved.startsWith(targetDirPrefix) && fs.existsSync(altResolved)) {
+          filePath = altResolved;
+        } else {
+          const cwdPublic = path.resolve(process.cwd(), 'public');
+          const altCwd = path.resolve(cwdPublic, altRel);
+          if (altCwd.startsWith(cwdPublic + path.sep) && fs.existsSync(altCwd)) {
+            filePath = altCwd;
+          }
+        }
+      }
+    }
+
     if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) {
+      const stat = fs.statSync(filePath);
       const ext = path.extname(filePath).toLowerCase();
+      const mime = MIME_TYPES[ext] || 'application/octet-stream';
+      const etag = `W/"${stat.size.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
+
+    
+      if (reqHeaders['if-none-match'] === etag) {
+        res.writeHead(304, {
+          'ETag': etag,
+          'Cache-Control': ext === '.json' || ext === '.txt' ? 'no-cache' : 'public, max-age=31536000, immutable',
+          'Vary': 'Accept-Encoding'
+        });
+        res.end();
+        return true;
+      }
+      if (reqHeaders['if-modified-since']) {
+        const clientTime = new Date(reqHeaders['if-modified-since']).getTime();
+        if (!isNaN(clientTime) && Math.floor(stat.mtimeMs / 1000) <= Math.floor(clientTime / 1000)) {
+          res.writeHead(304, {
+            'ETag': etag,
+            'Cache-Control': ext === '.json' || ext === '.txt' ? 'no-cache' : 'public, max-age=31536000, immutable',
+            'Vary': 'Accept-Encoding'
+          });
+          res.end();
+          return true;
+        }
+      }
+
+    
+      if (COMPRESSIBLE_EXTS.has(ext) && stat.size >= 1024) {
+        let entry = staticCompressCache.get(filePath);
+        if (!entry || entry.mtimeMs !== stat.mtimeMs) {
+          const raw = fs.readFileSync(filePath);
+          entry = { mtimeMs: stat.mtimeMs, raw, etag, br: null, gzip: null, deflate: null };
+          if (staticCompressCache.size > 80) {
+            const oldest = staticCompressCache.keys().next().value;
+            staticCompressCache.delete(oldest);
+          }
+          staticCompressCache.set(filePath, entry);
+        }
+        sendCompressedResponse(req, res, 200, {
+          'Content-Type': mime,
+          'Cache-Control': ext === '.json' || ext === '.txt' ? 'no-cache' : 'public, max-age=31536000, immutable'
+        }, entry.raw, etag, entry);
+        return true;
+      }
+
+    
       res.writeHead(200, {
-        'Content-Type': MIME_TYPES[ext] || 'application/octet-stream',
+        'Content-Type': mime,
+        'Content-Length': stat.size,
+        'ETag': etag,
+        'Last-Modified': stat.mtime.toUTCString(),
         'Cache-Control': ext === '.json' || ext === '.txt' ? 'no-cache' : 'public, max-age=31536000, immutable'
       });
       fs.createReadStream(filePath).pipe(res);
@@ -138,12 +409,30 @@ self.addEventListener('fetch', (event) => {
     }
   }
 
+  if (currentPath === '/docs' || currentPath.startsWith('/docs/') || currentPath.startsWith('/docs?') || currentPath === '/settings/docs' || currentPath.startsWith('/settings/docs')) {
+    const bundle = getCachedDocsBundle();
+    sendCompressedResponse(req, res, 200, {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-cache, must-revalidate'
+    }, bundle.raw, bundle.etag, bundle);
+    return true;
+  }
+
+  if (currentPath === '/settings' || currentPath.startsWith('/settings/') || currentPath.startsWith('/settings?')) {
+    const bundle = getCachedSettingsBundle();
+    sendCompressedResponse(req, res, 200, {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Cache-Control': 'no-cache, must-revalidate'
+    }, bundle.raw, bundle.etag, bundle);
+    return true;
+  }
+
   if (currentPath === '/' || currentPath === '/chat' || currentPath.startsWith('/chat/') || currentPath === '/index.html') {
-    res.writeHead(200, {
+    const bundle = getCachedWebChatBundle(port);
+    sendCompressedResponse(req, res, 200, {
       'Content-Type': 'text/html; charset=utf-8',
-      'Cache-Control': 'no-cache, no-store, must-revalidate'
-    });
-    res.end(getWebChatHtml(port));
+      'Cache-Control': 'no-cache, must-revalidate'
+    }, bundle.raw, bundle.etag, bundle);
     return true;
   }