ruflo 3.5.2 → 3.5.3

package/src/ruvocal/src/routes/api/mcp/health/+server.ts

@@ -0,0 +1,292 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import type { KeyValuePair } from "$lib/types/Tool";
+import { config } from "$lib/server/config";
+import { logger } from "$lib/server/logger";
+import type { RequestHandler } from "./$types";
+import { isValidUrl } from "$lib/server/urlSafety";
+import { isStrictHfMcpLogin, hasNonEmptyToken, isExaMcpServer } from "$lib/server/mcp/hf";
+
+interface HealthCheckRequest {
+	url: string;
+	headers?: KeyValuePair[];
+}
+
+interface HealthCheckResponse {
+	ready: boolean;
+	tools?: Array<{
+		name: string;
+		description?: string;
+		inputSchema?: unknown;
+	}>;
+	error?: string;
+	authRequired?: boolean;
+}
+
+export const POST: RequestHandler = async ({ request, locals }) => {
+	let client: Client | undefined;
+
+	try {
+		const body: HealthCheckRequest = await request.json();
+		const { url, headers } = body;
+
+		if (!url) {
+			return new Response(JSON.stringify({ ready: false, error: "URL is required" }), {
+				status: 400,
+				headers: { "Content-Type": "application/json" },
+			});
+		}
+
+		// URL validation handled above
+
+		if (!isValidUrl(url)) {
+			return new Response(
+				JSON.stringify({
+					ready: false,
+					error: "Invalid or unsafe URL (only HTTPS is supported)",
+				} as HealthCheckResponse),
+				{ status: 400, headers: { "Content-Type": "application/json" } }
+			);
+		}
+
+		// Inject Exa API key for mcp.exa.ai servers via URL param
+		let finalUrl = url;
+		try {
+			const exaApiKey = config.EXA_API_KEY;
+			if (isExaMcpServer(url) && hasNonEmptyToken(exaApiKey)) {
+				const urlObj = new URL(url);
+				if (!urlObj.searchParams.has("exaApiKey")) {
+					urlObj.searchParams.set("exaApiKey", exaApiKey);
+					finalUrl = urlObj.toString();
+					logger.debug({}, "[MCP Health] injected Exa API key");
+				}
+			}
+		} catch {
+			// best-effort injection
+		}
+
+		const baseUrl = new URL(finalUrl);
+
+		// Minimal header handling
+		const headersRecord: Record<string, string> = headers?.length
+			? Object.fromEntries(headers.map((h) => [h.key, h.value]))
+			: {};
+		if (!headersRecord["Accept"]) {
+			headersRecord["Accept"] = "application/json, text/event-stream";
+		}
+
+		// If enabled, attach the logged-in user's HF token only for the official HF MCP endpoint
+		try {
+			const shouldForward = config.MCP_FORWARD_HF_USER_TOKEN === "true";
+			const userToken =
+				(locals as unknown as { hfAccessToken?: string } | undefined)?.hfAccessToken ??
+				(locals as unknown as { token?: string } | undefined)?.token;
+			const hasAuth = typeof headersRecord["Authorization"] === "string";
+			const isHfMcpTarget = isStrictHfMcpLogin(url);
+			if (shouldForward && !hasAuth && isHfMcpTarget && hasNonEmptyToken(userToken)) {
+				headersRecord["Authorization"] = `Bearer ${userToken}`;
+			}
+		} catch {
+			// best-effort overlay
+		}
+
+		// Add an abort timeout to outbound requests (align with fetch-url: 30s)
+		const controller = new AbortController();
+		const timeoutId = setTimeout(() => controller.abort(), 30000);
+		const signal = controller.signal;
+		const requestInit: RequestInit = {
+			headers: headersRecord,
+			signal,
+		};
+
+		let httpError: Error | undefined;
+		let lastError: Error | undefined;
+
+		// Try Streamable HTTP transport first
+		try {
+			logger.info({}, `[MCP Health] Trying HTTP transport for ${url}`);
+			client = new Client({
+				name: "chat-ui-health-check",
+				version: "1.0.0",
+			});
+
+			const transport = new StreamableHTTPClientTransport(baseUrl, { requestInit });
+			logger.info({}, `[MCP Health] Connecting to ${url}...`);
+			await client.connect(transport);
+			logger.info({}, `[MCP Health] Connected successfully via HTTP`);
+
+			// Connection successful, get tools
+			const toolsResponse = await client.listTools();
+
+			// Disconnect after getting tools
+			await client.close();
+
+			if (toolsResponse && toolsResponse.tools) {
+				const response: HealthCheckResponse = {
+					ready: true,
+					tools: toolsResponse.tools.map((tool) => ({
+						name: tool.name,
+						description: tool.description,
+						inputSchema: tool.inputSchema,
+					})),
+					authRequired: false,
+				};
+
+				const res = new Response(JSON.stringify(response), {
+					status: 200,
+					headers: { "Content-Type": "application/json" },
+				});
+				clearTimeout(timeoutId);
+				return res;
+			} else {
+				const res = new Response(
+					JSON.stringify({
+						ready: false,
+						error: "Connected but no tools available",
+						authRequired: false,
+					} as HealthCheckResponse),
+					{
+						status: 503,
+						headers: { "Content-Type": "application/json" },
+					}
+				);
+				clearTimeout(timeoutId);
+				return res;
+			}
+		} catch (error) {
+			httpError = error instanceof Error ? error : new Error(String(error));
+			lastError = httpError;
+			logger.warn(lastError.message, "Streamable HTTP failed, trying SSE transport...");
+
+			// Close failed client
+			try {
+				await client?.close();
+			} catch {
+				// Ignore
+			}
+
+			// Try SSE transport
+			try {
+				logger.info({}, `[MCP Health] Trying SSE transport for ${url}`);
+				client = new Client({
+					name: "chat-ui-health-check",
+					version: "1.0.0",
+				});
+
+				const sseTransport = new SSEClientTransport(baseUrl, { requestInit });
+				logger.info({}, `[MCP Health] Connecting via SSE...`);
+				await client.connect(sseTransport);
+				logger.info({}, `[MCP Health] Connected successfully via SSE`);
+
+				// Connection successful, get tools
+				const toolsResponse = await client.listTools();
+
+				// Disconnect after getting tools
+				await client.close();
+
+				if (toolsResponse && toolsResponse.tools) {
+					const response: HealthCheckResponse = {
+						ready: true,
+						tools: toolsResponse.tools.map((tool) => ({
+							name: tool.name,
+							description: tool.description,
+							inputSchema: tool.inputSchema,
+						})),
+						authRequired: false,
+					};
+
+					const res = new Response(JSON.stringify(response), {
+						status: 200,
+						headers: { "Content-Type": "application/json" },
+					});
+					clearTimeout(timeoutId);
+					return res;
+				} else {
+					const res = new Response(
+						JSON.stringify({
+							ready: false,
+							error: "Connected but no tools available",
+							authRequired: false,
+						} as HealthCheckResponse),
+						{
+							status: 503,
+							headers: { "Content-Type": "application/json" },
+						}
+					);
+					clearTimeout(timeoutId);
+					return res;
+				}
+			} catch (sseError) {
+				lastError = sseError instanceof Error ? sseError : new Error(String(sseError));
+				// Prefer the HTTP error when both failed so UI shows the primary failure (e.g., HTTP 500) instead
+				// of the fallback SSE message.
+				if (httpError) {
+					lastError = new Error(
+						`HTTP transport failed: ${httpError.message}; SSE fallback failed: ${lastError.message}`,
+						{ cause: sseError instanceof Error ? sseError : undefined }
+					);
+				}
+				logger.error(lastError, "Both transports failed.");
+			}
+		}
+
+		// Both transports failed
+		let errorMessage = lastError?.message || "Failed to connect to MCP server";
+
+		// Detect unauthorized to signal auth requirement
+		const lower = (errorMessage || "").toLowerCase();
+		const authRequired =
+			lower.includes("unauthorized") ||
+			lower.includes("forbidden") ||
+			lower.includes("401") ||
+			lower.includes("403");
+
+		// Provide more helpful error messages
+		if (authRequired) {
+			errorMessage =
+				"Authentication required. Provide appropriate Authorization headers in the server configuration.";
+		} else if (errorMessage.includes("not valid JSON")) {
+			errorMessage =
+				"Server returned invalid response. This might not be a valid MCP endpoint. MCP servers should respond to POST requests at /mcp with JSON-RPC messages.";
+		} else if (errorMessage.includes("fetch failed") || errorMessage.includes("ECONNREFUSED")) {
+			errorMessage = `Cannot connect to ${url}. Please verify the server is running and accessible.`;
+		} else if (errorMessage.includes("CORS")) {
+			errorMessage = `CORS error. The MCP server needs to allow requests from this origin.`;
+		}
+
+		const res = new Response(
+			JSON.stringify({
+				ready: false,
+				error: errorMessage,
+				authRequired,
+			} as HealthCheckResponse),
+			{
+				status: 503,
+				headers: { "Content-Type": "application/json" },
+			}
+		);
+		clearTimeout(timeoutId);
+		return res;
+	} catch (error) {
+		logger.error(error, "MCP health check failed");
+
+		// Clean up client if it exists
+		try {
+			await client?.close();
+		} catch {
+			// Ignore
+		}
+
+		const response: HealthCheckResponse = {
+			ready: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+		};
+
+		const res = new Response(JSON.stringify(response), {
+			status: 503,
+			headers: { "Content-Type": "application/json" },
+		});
+		return res;
+	}
+};

package/src/ruvocal/src/routes/api/mcp/servers/+server.ts

@@ -0,0 +1,32 @@
+import type { MCPServer } from "$lib/types/Tool";
+import { config } from "$lib/server/config";
+
+export async function GET() {
+	// Parse MCP_SERVERS environment variable
+	const mcpServersEnv = config.MCP_SERVERS || "[]";
+
+	let servers: Array<{ name: string; url: string; headers?: Record<string, string> }> = [];
+
+	try {
+		servers = JSON.parse(mcpServersEnv);
+		if (!Array.isArray(servers)) {
+			servers = [];
+		}
+	} catch (error) {
+		console.error("Failed to parse MCP_SERVERS env variable:", error);
+		servers = [];
+	}
+
+	// Convert internal server config to client MCPServer format
+	const mcpServers: MCPServer[] = servers.map((server) => ({
+		id: `base-${server.name}`, // Stable ID based on name
+		name: server.name,
+		url: server.url,
+		type: "base" as const,
+		// headers intentionally omitted
+		isLocked: false, // Base servers can be toggled by users
+		status: undefined, // Status determined client-side via health check
+	}));
+
+	return Response.json(mcpServers);
+}

package/src/ruvocal/src/routes/api/models/+server.ts

@@ -0,0 +1,25 @@
+import { models } from "$lib/server/models";
+
+export async function GET() {
+	const res = models
+		.filter((m) => m.unlisted == false)
+		.map((model) => ({
+			id: model.id,
+			name: model.name,
+			websiteUrl: model.websiteUrl ?? "https://huggingface.co",
+			modelUrl: model.modelUrl ?? "https://huggingface.co",
+			// tokenizer removed in this build
+			datasetName: model.datasetName,
+			datasetUrl: model.datasetUrl,
+			displayName: model.displayName,
+			description: model.description ?? "",
+			logoUrl: model.logoUrl,
+			promptExamples: model.promptExamples ?? [],
+			preprompt: model.preprompt ?? "",
+			multimodal: model.multimodal ?? false,
+			supportsTools: (model as unknown as { supportsTools?: boolean }).supportsTools ?? false,
+			unlisted: model.unlisted ?? false,
+			hasInferenceAPI: model.hasInferenceAPI ?? false,
+		}));
+	return Response.json(res);
+}

package/src/ruvocal/src/routes/api/transcribe/+server.ts

@@ -0,0 +1,104 @@
+import { error, json } from "@sveltejs/kit";
+import { config } from "$lib/server/config";
+import { getApiToken } from "$lib/server/apiToken";
+import { logger } from "$lib/server/logger";
+
+const MAX_AUDIO_SIZE = 25 * 1024 * 1024; // 25MB
+const TRANSCRIPTION_TIMEOUT = 60000; // 60 seconds
+
+const ALLOWED_CONTENT_TYPES = [
+	"audio/webm",
+	"audio/ogg",
+	"audio/wav",
+	"audio/flac",
+	"audio/mpeg",
+	"audio/mp4",
+	"audio/x-wav",
+];
+
+export async function POST({ request, locals }) {
+	const transcriptionModel = config.get("TRANSCRIPTION_MODEL");
+
+	if (!transcriptionModel) {
+		throw error(503, "Transcription is not configured");
+	}
+
+	const token = getApiToken(locals);
+
+	if (!token) {
+		throw error(401, "Authentication required");
+	}
+
+	const rawContentType = request.headers.get("content-type") || "";
+	// Normalize content-type: Safari sends "audio/webm; codecs=opus" (with space)
+	// but HF API expects "audio/webm;codecs=opus" (no space)
+	const contentType = rawContentType.replace(/;\s+/g, ";");
+	const isAllowed = ALLOWED_CONTENT_TYPES.some((type) => contentType.includes(type));
+
+	if (!isAllowed) {
+		logger.warn({ contentType }, "Unsupported audio format for transcription");
+		throw error(400, `Unsupported audio format: ${contentType}`);
+	}
+
+	const contentLength = parseInt(request.headers.get("content-length") || "0");
+	if (contentLength > MAX_AUDIO_SIZE) {
+		throw error(413, "Audio file too large (max 25MB)");
+	}
+
+	try {
+		const audioBuffer = await request.arrayBuffer();
+
+		if (audioBuffer.byteLength > MAX_AUDIO_SIZE) {
+			throw error(413, "Audio file too large (max 25MB)");
+		}
+
+		const baseUrl =
+			config.get("TRANSCRIPTION_BASE_URL") || "https://router.huggingface.co/hf-inference/models";
+		const apiUrl = `${baseUrl}/${transcriptionModel}`;
+
+		const controller = new AbortController();
+		const timeoutId = setTimeout(() => controller.abort(), TRANSCRIPTION_TIMEOUT);
+
+		const response = await fetch(apiUrl, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${token}`,
+				"Content-Type": contentType,
+				// Bill to organization if configured
+				...(locals?.billingOrganization ? { "X-HF-Bill-To": locals.billingOrganization } : {}),
+			},
+			body: audioBuffer,
+			signal: controller.signal,
+		}).finally(() => clearTimeout(timeoutId));
+
+		if (!response.ok) {
+			const errorText = await response.text();
+			logger.error(
+				{ status: response.status, error: errorText, model: transcriptionModel },
+				"Whisper API error"
+			);
+			throw error(response.status, `Transcription failed: ${errorText}`);
+		}
+
+		const result = await response.json();
+
+		// Whisper API returns { text: "transcribed text" }
+		// Filter out responses that only contain dots (e.g. "..." returned for silence/unclear audio)
+		const text = (result.text || "").trim();
+		const isOnlyDots = /^\.+$/.test(text);
+		return json({ text: isOnlyDots ? "" : text });
+	} catch (err) {
+		if (err instanceof Error && err.name === "AbortError") {
+			logger.error({ model: transcriptionModel }, "Transcription timeout");
+			throw error(504, "Transcription took too long. Please try a shorter recording.");
+		}
+
+		// Re-throw SvelteKit errors
+		if (err && typeof err === "object" && "status" in err) {
+			throw err;
+		}
+
+		logger.error(err, "Transcription error");
+		throw error(500, "Failed to transcribe audio");
+	}
+}

package/src/ruvocal/src/routes/api/user/+server.ts

@@ -0,0 +1,15 @@
+export async function GET({ locals }) {
+	if (locals.user) {
+		const res = {
+			id: locals.user._id,
+			username: locals.user.username,
+			name: locals.user.name,
+			email: locals.user.email,
+			avatarUrl: locals.user.avatarUrl,
+			hfUserId: locals.user.hfUserId,
+		};
+
+		return Response.json(res);
+	}
+	return Response.json({ message: "Must be signed in" }, { status: 401 });
+}

package/src/ruvocal/src/routes/api/user/validate-token/+server.ts

@@ -0,0 +1,20 @@
+import { adminTokenManager } from "$lib/server/adminToken";
+import { z } from "zod";
+
+const validateTokenSchema = z.object({
+	token: z.string(),
+});
+
+export const POST = async ({ request, locals }) => {
+	const { success, data } = validateTokenSchema.safeParse(await request.json());
+
+	if (!success) {
+		return new Response(JSON.stringify({ error: "Invalid token" }), { status: 400 });
+	}
+
+	if (adminTokenManager.checkToken(data.token, locals.sessionId)) {
+		return new Response(JSON.stringify({ valid: true }));
+	}
+
+	return new Response(JSON.stringify({ valid: false }));
+};

package/src/ruvocal/src/routes/api/v2/conversations/+server.ts

@@ -0,0 +1,48 @@
+import type { RequestHandler } from "@sveltejs/kit";
+import { superjsonResponse } from "$lib/server/api/utils/superjsonResponse";
+import { requireAuth } from "$lib/server/api/utils/requireAuth";
+import { collections } from "$lib/server/database";
+import { authCondition } from "$lib/server/auth";
+import type { Conversation } from "$lib/types/Conversation";
+import { CONV_NUM_PER_PAGE } from "$lib/constants/pagination";
+
+export const GET: RequestHandler = async ({ locals, url }) => {
+	requireAuth(locals);
+
+	const pageSize = CONV_NUM_PER_PAGE;
+	const p = parseInt(url.searchParams.get("p") ?? "0") || 0;
+
+	const convs = await collections.conversations
+		.find(authCondition(locals))
+		.project<Pick<Conversation, "_id" | "title" | "updatedAt" | "model">>({
+			title: 1,
+			updatedAt: 1,
+			model: 1,
+		})
+		.sort({ updatedAt: -1 })
+		.skip(p * pageSize)
+		.limit(pageSize + 1)
+		.toArray();
+
+	const hasMore = convs.length > pageSize;
+	const res = (hasMore ? convs.slice(0, pageSize) : convs).map((conv) => ({
+		_id: conv._id,
+		id: conv._id, // legacy param iOS
+		title: conv.title,
+		updatedAt: conv.updatedAt,
+		model: conv.model,
+		modelId: conv.model, // legacy param iOS
+	}));
+
+	return superjsonResponse({ conversations: res, hasMore });
+};
+
+export const DELETE: RequestHandler = async ({ locals }) => {
+	requireAuth(locals);
+
+	const res = await collections.conversations.deleteMany({
+		...authCondition(locals),
+	});
+
+	return superjsonResponse(res.deletedCount);
+};

package/src/ruvocal/src/routes/api/v2/conversations/[id]/+server.ts

@@ -0,0 +1,94 @@
+import { error, type RequestHandler } from "@sveltejs/kit";
+import { superjsonResponse } from "$lib/server/api/utils/superjsonResponse";
+import { requireAuth } from "$lib/server/api/utils/requireAuth";
+import { resolveConversation } from "$lib/server/api/utils/resolveConversation";
+import { collections } from "$lib/server/database";
+import { authCondition } from "$lib/server/auth";
+import { ObjectId } from "mongodb";
+import { validModelIdSchema } from "$lib/server/models";
+
+export const GET: RequestHandler = async ({ locals, params, url }) => {
+	requireAuth(locals);
+
+	const conversation = await resolveConversation(
+		params.id ?? "",
+		locals,
+		url.searchParams.get("fromShare")
+	);
+
+	return superjsonResponse({
+		messages: conversation.messages,
+		title: conversation.title,
+		model: conversation.model,
+		preprompt: conversation.preprompt,
+		rootMessageId: conversation.rootMessageId,
+		id: conversation._id.toString(),
+		updatedAt: conversation.updatedAt,
+		modelId: conversation.model,
+		shared: conversation.shared,
+	});
+};
+
+export const DELETE: RequestHandler = async ({ locals, params }) => {
+	requireAuth(locals);
+
+	const id = params.id ?? "";
+	if (!ObjectId.isValid(id)) {
+		error(400, "Invalid conversation ID");
+	}
+	const res = await collections.conversations.deleteOne({
+		_id: new ObjectId(id),
+		...authCondition(locals),
+	});
+
+	if (res.deletedCount === 0) {
+		error(404, "Conversation not found");
+	}
+
+	return superjsonResponse({ success: true });
+};
+
+export const PATCH: RequestHandler = async ({ locals, params, request }) => {
+	requireAuth(locals);
+
+	const body = await request.json();
+	const title = body?.title as string | undefined;
+	const model = body?.model as string | undefined;
+
+	if (title !== undefined) {
+		if (typeof title !== "string" || title.length === 0 || title.length > 100) {
+			error(400, "Title must be a string between 1 and 100 characters");
+		}
+	}
+
+	if (model !== undefined) {
+		if (!validModelIdSchema.safeParse(model).success) {
+			error(400, "Invalid model ID");
+		}
+	}
+
+	const updateValues = {
+		...(title !== undefined && {
+			title: title.replace(/<\/?think>/gi, "").trim(),
+		}),
+		...(model !== undefined && { model }),
+	};
+
+	const id = params.id ?? "";
+	if (!ObjectId.isValid(id)) {
+		error(400, "Invalid conversation ID");
+	}
+	const res = await collections.conversations.updateOne(
+		{
+			_id: new ObjectId(id),
+			...authCondition(locals),
+		},
+		{ $set: updateValues }
+	);
+
+	if (typeof res.matchedCount === "number" ? res.matchedCount === 0 : res.modifiedCount === 0) {
+		error(404, "Conversation not found");
+	}
+
+	return superjsonResponse({ success: true });
+};

package/src/ruvocal/src/routes/api/v2/conversations/[id]/message/[messageId]/+server.ts

@@ -0,0 +1,43 @@
+import { error, type RequestHandler } from "@sveltejs/kit";
+import { superjsonResponse } from "$lib/server/api/utils/superjsonResponse";
+import { requireAuth } from "$lib/server/api/utils/requireAuth";
+import { resolveConversation } from "$lib/server/api/utils/resolveConversation";
+import { collections } from "$lib/server/database";
+import { authCondition } from "$lib/server/auth";
+import { ObjectId } from "mongodb";
+
+export const DELETE: RequestHandler = async ({ locals, params }) => {
+	requireAuth(locals);
+
+	const id = params.id ?? "";
+	const messageId = params.messageId ?? "";
+
+	const conversation = await resolveConversation(id, locals);
+
+	if (!conversation.messages.map((m) => m.id).includes(messageId)) {
+		error(404, "Message not found");
+	}
+
+	const filteredMessages = conversation.messages
+		.filter(
+			(message) =>
+				!(message.id === messageId) && message.ancestors && !message.ancestors.includes(messageId)
+		)
+		.map((message) => {
+			if (message.children && message.children.includes(messageId)) {
+				message.children = message.children.filter((child) => child !== messageId);
+			}
+			return message;
+		});
+
+	const res = await collections.conversations.updateOne(
+		{ _id: new ObjectId(conversation._id), ...authCondition(locals) },
+		{ $set: { messages: filteredMessages } }
+	);
+
+	if (res.modifiedCount === 0) {
+		error(500, "Deleting message failed");
+	}
+
+	return superjsonResponse({ success: true });
+};