tinywebui 0.1.3 → 0.1.5

package/src/routes/documents.js

@@ -4,130 +4,140 @@ import { normalizeImage } from '../files/images.js';
 import { logger } from '../log.js';
 import { FEATURE } from '../../public/shared/features.js';
 import { CORPUS } from '../store/index.js';
-
 const log = logger('retrieval');
-
 const MAX_FILE_BYTES = 5 * 1024 * 1024;
-
 /** Decodes and normalizes one uploaded image; null on anything unusable. */
 export async function normalizeUpload(mimeRaw, dataBase64) {
-  const mime = String(mimeRaw || '');
-  if (!mime.startsWith('image/') && mime !== '') return null;
-  let buf;
-  try { buf = Buffer.from(String(dataBase64 || ''), 'base64'); } catch { return null; }
-  if (!buf.length || buf.length > MAX_FILE_BYTES) return null;
-  try {
-    const normalized = await normalizeImage(buf, mime);
-    return normalized && { mime: normalized.mime, data: normalized.data.toString('base64') };
-  } catch {
-    return null;
-  }
+    const mime = String(mimeRaw || '');
+    if (!mime.startsWith('image/') && mime !== '')
+        return null;
+    let buf;
+    try {
+        buf = Buffer.from(String(dataBase64 || ''), 'base64');
+    }
+    catch {
+        return null;
+    }
+    if (!buf.length || buf.length > MAX_FILE_BYTES)
+        return null;
+    try {
+        const normalized = await normalizeImage(buf, mime);
+        return normalized && { mime: normalized.mime, data: normalized.data.toString('base64') };
+    }
+    catch {
+        return null;
+    }
 }
-
 export function documentRoutes({ retrieval, store }) {
-  // Uploads and attaches land before the first message exists, so the chat is
-  // created lazily, the same way /api/chat does for a brand-new conversation.
-  // Null when the id is someone else's: "no such chat", never a key clash.
-  const chatFor = (chatId, auth, title) => {
-    const own = store.chats.get(chatId, auth.userId);
-    if (own) return own;
-    if (store.chats.byId(chatId)) return null;
-    return store.chats.create({ id: chatId, title: String(title).slice(0, 60) }, auth.userId);
-  };
-  // Embedded once, in the background; a question that arrives first waits for it.
-  const ingest = (doc) => retrieval.ingest(CORPUS.DOCUMENTS, doc.id)
-    .catch((err) => log.error(`embedding ${doc.id} failed: ${err.message}`));
-
-  return [
-    // Uploads, including the paste-as-file path.
-    { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/documents$/, feature: FEATURE.ATTACHMENTS, handle: async ({ req, res, auth, params: [chatId] }) => {
-      const { filename, mime, dataBase64 } = await readJson(req, UPLOAD_LIMIT);
-      if (!filename || typeof dataBase64 !== 'string') {
-        return json(res, 400, { error: 'filename and dataBase64 are required' });
-      }
-      let buf;
-      try {
-        buf = Buffer.from(dataBase64, 'base64');
-      } catch {
-        return json(res, 400, { error: 'dataBase64 is not valid base64' });
-      }
-      if (buf.length > MAX_FILE_BYTES) {
-        return json(res, 400, { error: `file exceeds ${MAX_FILE_BYTES.toLocaleString('en-US')} byte limit` });
-      }
-
-      let text;
-      try {
-        text = await extractText(buf, String(filename));
-      } catch (err) {
-        return json(res, 400, { error: err.message });
-      }
-      if (!text.trim()) return json(res, 400, { error: 'no extractable text in that file' });
-
-      const chat = chatFor(chatId, auth, filename);
-      if (!chat) return json(res, 404, { error: 'no such chat' });
-      // The same file dropped in twice is one document in the chat.
-      const already = store.documents.findInChat(chat.id, buf);
-      if (already) return json(res, 200, { chatId: chat.id, document: already });
-      const doc = store.documents.add(chat.id, { filename: String(filename), mime: mime || null, content: text, original: buf }, retrieval.passageSettings());
-      ingest(doc);
-      return json(res, 200, { chatId: chat.id, document: doc });
-    } },
-
-    // What the user has attached in earlier chats, one line per distinct file,
-    // for the "attach from earlier chats" picker.
-    { method: 'GET', path: /^\/api\/documents$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth }) => {
-      return json(res, 200, { documents: store.documents.library(auth.userId) });
-    } },
-
-    // Attaches a file the user already uploaded elsewhere, without uploading
-    // it again: the chat gets its own copy of the text (same stored file).
-    { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/documents\/attach$/, feature: FEATURE.ATTACHMENTS, handle: async ({ req, res, auth, params: [chatId] }) => {
-      const { documentId } = await readJson(req);
-      if (typeof documentId !== 'string' || !documentId) return json(res, 400, { error: 'documentId is required' });
-      // Checked before the chat is created, so a bad id leaves no empty chat behind.
-      const source = store.documents.get(documentId, auth.userId);
-      if (!source) return json(res, 404, { error: 'no such document' });
-      const chat = chatFor(chatId, auth, source.filename);
-      if (!chat) return json(res, 404, { error: 'no such chat' });
-      const doc = store.documents.copyToChat(documentId, chat.id, auth.userId, retrieval.passageSettings());
-      if (!doc.existing) ingest(doc);
-      return json(res, 200, { chatId: chat.id, document: doc });
-    } },
-
-    // Lets the "files" rail open a document's full extracted text -- the
-    // same content the model reads via read_document, in a plain new tab.
-    // Documents have no delete route of their own: the only way one goes
-    // away is editing the message that attached it (see /edit in chats.js).
-    { method: 'GET', path: /^\/api\/documents\/([\w.-]+)$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth, params: [id] }) => {
-      const doc = store.documents.get(id, auth.userId);
-      if (!doc) return json(res, 404, { error: 'no such document' });
-      return json(res, 200, { filename: doc.filename, mime: doc.mime, content: doc.content });
-    } },
-
-    // What the "artifacts" rail opens: the file as uploaded. Documents stored
-    // before originals were kept fall back to their extracted text.
-    { method: 'GET', path: /^\/api\/documents\/([\w.-]+)\/original$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth, params: [id] }) => {
-      const doc = store.documents.get(id, auth.userId);
-      if (!doc) return json(res, 404, { error: 'no such document' });
-      const original = store.documents.original(id, auth.userId);
-      const { type, inline } = original ? servingFor(doc.filename) : servingFor('.txt');
-      const body = original || Buffer.from(doc.content, 'utf8');
-      // The name is percent-encoded (RFC 5987) so it cannot break out of the header.
-      const disposition = `${inline ? 'inline' : 'attachment'}; filename*=UTF-8''${encodeURIComponent(doc.filename)}`;
-      res.writeHead(200, { 'content-type': type, 'content-length': body.length, 'content-disposition': disposition });
-      res.end(body);
-    } },
-
-    // Converts one staged image to a wire-safe format before it's ever sent,
-    // so the composer's own preview and the optimistic thumbnail in the
-    // transcript show the same bytes the model (and the store) end up with,
-    // instead of a HEIC/AVIF the browser can't decode until the turn ends
-    // and the chat reloads with what the server stored.
-    { method: 'POST', path: /^\/api\/images\/normalize$/, feature: FEATURE.IMAGES, handle: async ({ req, res }) => {
-      const { mime, dataBase64 } = await readJson(req, UPLOAD_LIMIT);
-      const normalized = await normalizeUpload(mime, dataBase64);
-      if (!normalized) return json(res, 400, { error: 'unrecognized or oversized image' });
-      return json(res, 200, normalized);
-    } }
-  ];
+    // Uploads and attaches land before the first message exists, so the chat is
+    // created lazily, the same way /api/chat does for a brand-new conversation.
+    // Null when the id is someone else's: "no such chat", never a key clash.
+    const chatFor = (chatId, auth, title) => {
+        const own = store.chats.get(chatId, auth.userId);
+        if (own)
+            return own;
+        if (store.chats.byId(chatId))
+            return null;
+        return store.chats.create({ id: chatId, title: String(title).slice(0, 60) }, auth.userId);
+    };
+    // Embedded once, in the background; a question that arrives first waits for it.
+    const ingest = (doc) => retrieval.ingest(CORPUS.DOCUMENTS, doc.id)
+        .catch((err) => log.error(`embedding ${doc.id} failed: ${err.message}`));
+    return [
+        // Uploads, including the paste-as-file path.
+        { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/documents$/, feature: FEATURE.ATTACHMENTS, handle: async ({ req, res, auth, params: [chatId] }) => {
+                const { filename, mime, dataBase64 } = await readJson(req, UPLOAD_LIMIT);
+                if (!filename || typeof dataBase64 !== 'string') {
+                    return json(res, 400, { error: 'filename and dataBase64 are required' });
+                }
+                let buf;
+                try {
+                    buf = Buffer.from(dataBase64, 'base64');
+                }
+                catch {
+                    return json(res, 400, { error: 'dataBase64 is not valid base64' });
+                }
+                if (buf.length > MAX_FILE_BYTES) {
+                    return json(res, 400, { error: `file exceeds ${MAX_FILE_BYTES.toLocaleString('en-US')} byte limit` });
+                }
+                let text;
+                try {
+                    text = await extractText(buf, String(filename));
+                }
+                catch (err) {
+                    return json(res, 400, { error: err.message });
+                }
+                if (!text.trim())
+                    return json(res, 400, { error: 'no extractable text in that file' });
+                const chat = chatFor(chatId, auth, filename);
+                if (!chat)
+                    return json(res, 404, { error: 'no such chat' });
+                // The same file dropped in twice is one document in the chat.
+                const already = store.documents.findInChat(chat.id, buf);
+                if (already)
+                    return json(res, 200, { chatId: chat.id, document: already });
+                const doc = store.documents.add(chat.id, { filename: String(filename), mime: typeof mime === 'string' && mime ? mime : null, content: text, original: buf }, retrieval.passageSettings());
+                ingest(doc);
+                return json(res, 200, { chatId: chat.id, document: doc });
+            } },
+        // What the user has attached in earlier chats, one line per distinct file,
+        // for the "attach from earlier chats" picker.
+        { method: 'GET', path: /^\/api\/documents$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth }) => {
+                return json(res, 200, { documents: store.documents.library(auth.userId) });
+            } },
+        // Attaches a file the user already uploaded elsewhere, without uploading
+        // it again: the chat gets its own copy of the text (same stored file).
+        { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/documents\/attach$/, feature: FEATURE.ATTACHMENTS, handle: async ({ req, res, auth, params: [chatId] }) => {
+                const { documentId } = await readJson(req);
+                if (typeof documentId !== 'string' || !documentId)
+                    return json(res, 400, { error: 'documentId is required' });
+                // Checked before the chat is created, so a bad id leaves no empty chat behind.
+                const source = store.documents.get(documentId, auth.userId);
+                if (!source)
+                    return json(res, 404, { error: 'no such document' });
+                const chat = chatFor(chatId, auth, source.filename);
+                if (!chat)
+                    return json(res, 404, { error: 'no such chat' });
+                const doc = store.documents.copyToChat(documentId, chat.id, auth.userId, retrieval.passageSettings());
+                if (!doc.existing)
+                    ingest(doc);
+                return json(res, 200, { chatId: chat.id, document: doc });
+            } },
+        // Lets the "files" rail open a document's full extracted text -- the
+        // same content the model reads via read_document, in a plain new tab.
+        // Documents have no delete route of their own: the only way one goes
+        // away is editing the message that attached it (see /edit in chats.js).
+        { method: 'GET', path: /^\/api\/documents\/([\w.-]+)$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth, params: [id] }) => {
+                const doc = store.documents.get(id, auth.userId);
+                if (!doc)
+                    return json(res, 404, { error: 'no such document' });
+                return json(res, 200, { filename: doc.filename, mime: doc.mime, content: doc.content });
+            } },
+        // What the "artifacts" rail opens: the file as uploaded. Documents stored
+        // before originals were kept fall back to their extracted text.
+        { method: 'GET', path: /^\/api\/documents\/([\w.-]+)\/original$/, feature: FEATURE.ATTACHMENTS, handle: ({ res, auth, params: [id] }) => {
+                const doc = store.documents.get(id, auth.userId);
+                if (!doc)
+                    return json(res, 404, { error: 'no such document' });
+                const original = store.documents.original(id, auth.userId);
+                const { type, inline } = original ? servingFor(doc.filename) : servingFor('.txt');
+                const body = original || Buffer.from(doc.content, 'utf8');
+                // The name is percent-encoded (RFC 5987) so it cannot break out of the header.
+                const disposition = `${inline ? 'inline' : 'attachment'}; filename*=UTF-8''${encodeURIComponent(doc.filename)}`;
+                res.writeHead(200, { 'content-type': type, 'content-length': body.length, 'content-disposition': disposition });
+                res.end(body);
+            } },
+        // Converts one staged image to a wire-safe format before it's ever sent,
+        // so the composer's own preview and the optimistic thumbnail in the
+        // transcript show the same bytes the model (and the store) end up with,
+        // instead of a HEIC/AVIF the browser can't decode until the turn ends
+        // and the chat reloads with what the server stored.
+        { method: 'POST', path: /^\/api\/images\/normalize$/, feature: FEATURE.IMAGES, handle: async ({ req, res }) => {
+                const { mime, dataBase64 } = await readJson(req, UPLOAD_LIMIT);
+                const normalized = await normalizeUpload(mime, dataBase64);
+                if (!normalized)
+                    return json(res, 400, { error: 'unrecognized or oversized image' });
+                return json(res, 200, normalized);
+            } }
+    ];
 }

package/src/routes/library.js

@@ -1,51 +1,48 @@
 import { json, readJson } from '../http.js';
 import { FEATURE } from '../../public/shared/features.js';
-
 /** The sidebar's search, usage statistics, and folders. */
 export function libraryRoutes({ runs, store }) {
-  return [
-    // Full-text search across every stored message, for the sidebar's search
-    // box. GET with a query string, so it is bookmarkable and cacheable like
-    // any other read.
-    { method: 'GET', path: /^\/api\/search$/, feature: FEATURE.SEARCH, handle: ({ res, auth, url }) => {
-      const q = url.searchParams.get('q') || '';
-      const limit = 30;
-      // A chat mid-turn is still being written -- store.search would be
-      // matching against text that has not settled, and openChat/rejoin is
-      // not built to land a click in the middle of a live stream. Overfetch
-      // and filter rather than ask the store to know about runs, which is a
-      // server-only concept it has no business importing.
-      const results = store.search.chats(q, limit * 2, auth.userId)
-        .filter((r) => !runs.isRunning(r.chatId))
-        .slice(0, limit);
-      return json(res, 200, { results });
-    } },
-
-    // ?model= narrows every figure to one model; adding &provider= to one
-    // upstream serving it.
-    { method: 'GET', path: /^\/api\/usage$/, feature: FEATURE.STATISTICS, handle: ({ res, auth, url }) => {
-      const q = url.searchParams;
-      const filter = { model: q.get('model') || undefined, provider: q.has('provider') ? q.get('provider') : undefined };
-      return json(res, 200, { days: store.usage.rollup(auth.userId, filter), statistics: store.usage.statistics(auth.userId, filter) });
-    } },
-
-    { method: 'GET', path: /^\/api\/folders$/, feature: FEATURE.FOLDERS, handle: ({ res, auth }) =>
-      json(res, 200, { folders: store.chats.listFolders(auth.userId) }) },
-
-    { method: 'POST', path: /^\/api\/folders$/, feature: FEATURE.FOLDERS, handle: async ({ req, res, auth }) => {
-      const { name } = await readJson(req);
-      const created = store.chats.createFolder(name, auth.userId);
-      if (!created) return json(res, 400, { error: 'folder name required' });
-      return json(res, 200, { folder: created });
-    } },
-
-    { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/organize$/, feature: FEATURE.FOLDERS, handle: async ({ req, res, auth, params: [chatId] }) => {
-      const { folder, tags } = await readJson(req);
-      const found = store.chats.get(chatId, auth.userId);
-      if (!found) return json(res, 404, { error: 'no such chat' });
-      if (folder) store.chats.createFolder(folder, auth.userId);
-      const updated = store.chats.organize(chatId, { folder, tags }, auth.userId);
-      return json(res, 200, { folder: updated.folder });
-    } }
-  ];
+    return [
+        // Full-text search across every stored message, for the sidebar's search
+        // box. GET with a query string, so it is bookmarkable and cacheable like
+        // any other read.
+        { method: 'GET', path: /^\/api\/search$/, feature: FEATURE.SEARCH, handle: ({ res, auth, url }) => {
+                const q = url.searchParams.get('q') || '';
+                const limit = 30;
+                // A chat mid-turn is still being written -- store.search would be
+                // matching against text that has not settled, and openChat/rejoin is
+                // not built to land a click in the middle of a live stream. Overfetch
+                // and filter rather than ask the store to know about runs, which is a
+                // server-only concept it has no business importing.
+                const results = store.search.chats(q, limit * 2, auth.userId)
+                    .filter((r) => !runs.isRunning(r.chatId))
+                    .slice(0, limit);
+                return json(res, 200, { results });
+            } },
+        // ?model= narrows every figure to one model; adding &provider= to one
+        // upstream serving it.
+        { method: 'GET', path: /^\/api\/usage$/, feature: FEATURE.STATISTICS, handle: ({ res, auth, url }) => {
+                const q = url.searchParams;
+                const filter = { model: q.get('model') || undefined, provider: q.has('provider') ? q.get('provider') : undefined };
+                return json(res, 200, { days: store.usage.rollup(auth.userId, filter), statistics: store.usage.statistics(auth.userId, filter) });
+            } },
+        { method: 'GET', path: /^\/api\/folders$/, feature: FEATURE.FOLDERS, handle: ({ res, auth }) => json(res, 200, { folders: store.chats.listFolders(auth.userId) }) },
+        { method: 'POST', path: /^\/api\/folders$/, feature: FEATURE.FOLDERS, handle: async ({ req, res, auth }) => {
+                const { name } = await readJson(req);
+                const created = store.chats.createFolder(name, auth.userId);
+                if (!created)
+                    return json(res, 400, { error: 'folder name required' });
+                return json(res, 200, { folder: created });
+            } },
+        { method: 'POST', path: /^\/api\/chats\/([\w.-]+)\/organize$/, feature: FEATURE.FOLDERS, handle: async ({ req, res, auth, params: [chatId] }) => {
+                const { folder, tags } = await readJson(req);
+                const found = store.chats.get(chatId, auth.userId);
+                if (!found)
+                    return json(res, 404, { error: 'no such chat' });
+                if (folder)
+                    store.chats.createFolder(folder, auth.userId);
+                const updated = store.chats.organize(chatId, { folder, tags }, auth.userId);
+                return json(res, 200, { folder: updated.folder });
+            } }
+    ];
 }

package/src/routes/mcp.js

@@ -5,55 +5,55 @@ import { actor } from '../access/auth_gate.js';
 import { toolList } from './settings.js';
 import { logger } from '../log.js';
 import { FEATURE } from '../../public/shared/features.js';
-
 const log = logger('mcp');
-
 export function mcpRoutes({ auditMcp, config, hub, source, swapHub }) {
-
-  /** Writes mcp.json (audited), then reconnects. A locked or invalid file is the caller's error. */
-  const saveAndReconnect = async (res, text, auth) => {
-    let servers;
-    try {
-      const before = fingerprint(config(), source.loadMcpServers());
-      servers = source.saveMcpFile(text);
-      auditMcp(actor(auth), before);
-    } catch (err) {
-      json(res, err instanceof LockedError ? 409 : 400, { error: err.message });
-      return false;
-    }
-    await swapHub(servers);
-    log.info(`reloaded: ${hub().tools.length} tool(s)`);
-    return true;
-  };
-
-  return [
-    // mcp.json can hold server credentials (env, headers): admins only.
-    { method: 'GET', path: /^\/api\/mcp$/, feature: FEATURE.MCP, handle: ({ res }) =>
-      json(res, 200, { path: source.mcpPath(), text: source.readMcpFile(), locked: source.mcpLocked }) },
-
-    { method: 'POST', path: /^\/api\/mcp$/, feature: FEATURE.MCP, handle: async ({ req, res, auth }) => {
-      const { text } = await readJson(req, UPLOAD_LIMIT);
-      if (!await saveAndReconnect(res, text, auth)) return undefined;
-      return json(res, 200, { tools: toolList(hub()), mcpErrors: hub().errors });
-    } },
-
-    // Disabling a server tears its connection down rather than filtering its
-    // tools out client-side: an unwanted server is one fewer child process or
-    // open connection, not just one the model happens not to be offered.
-    { method: 'POST', path: /^\/api\/mcp\/servers\/([^/]+)\/toggle$/, feature: FEATURE.MCP, handle: async ({ req, res, auth, params: [rawName] }) => {
-      const name = decodeURIComponent(rawName);
-      const { disabled } = await readJson(req);
-      let servers;
-      try {
-        const parsed = JSON.parse(source.readMcpFile());
-        servers = parsed.mcpServers || parsed;
-      } catch (err) {
-        return json(res, 500, { error: `mcp.json is not valid JSON: ${err.message}` });
-      }
-      if (!servers[name]) return json(res, 404, { error: `no such server "${name}"` });
-      servers[name] = { ...servers[name], disabled: Boolean(disabled) };
-      if (!await saveAndReconnect(res, JSON.stringify({ mcpServers: servers }, null, 2), auth)) return undefined;
-      return json(res, 200, { ...hub().inventory(config().disabledTools), disabledTools: config().disabledTools || [] });
-    } }
-  ];
+    /** Writes mcp.json (audited), then reconnects. A locked or invalid file is the caller's error. */
+    const saveAndReconnect = async (res, text, auth) => {
+        let servers;
+        try {
+            const before = fingerprint(config(), source.loadMcpServers());
+            servers = source.saveMcpFile(text);
+            auditMcp(actor(auth), before);
+        }
+        catch (err) {
+            json(res, err instanceof LockedError ? 409 : 400, { error: err.message });
+            return false;
+        }
+        await swapHub(servers);
+        log.info(`reloaded: ${hub().tools.length} tool(s)`);
+        return true;
+    };
+    return [
+        // mcp.json can hold server credentials (env, headers): admins only.
+        { method: 'GET', path: /^\/api\/mcp$/, feature: FEATURE.MCP, handle: ({ res }) => json(res, 200, { path: source.mcpPath(), text: source.readMcpFile(), locked: source.mcpLocked }) },
+        { method: 'POST', path: /^\/api\/mcp$/, feature: FEATURE.MCP, handle: async ({ req, res, auth }) => {
+                const { text } = await readJson(req, UPLOAD_LIMIT);
+                if (typeof text !== 'string')
+                    return json(res, 400, { error: 'text must be the contents of mcp.json' });
+                if (!await saveAndReconnect(res, text, auth))
+                    return undefined;
+                return json(res, 200, { tools: toolList(hub()), mcpErrors: hub().errors });
+            } },
+        // Disabling a server tears its connection down rather than filtering its
+        // tools out client-side: an unwanted server is one fewer child process or
+        // open connection, not just one the model happens not to be offered.
+        { method: 'POST', path: /^\/api\/mcp\/servers\/([^/]+)\/toggle$/, feature: FEATURE.MCP, handle: async ({ req, res, auth, params: [rawName] }) => {
+                const name = decodeURIComponent(rawName);
+                const { disabled } = await readJson(req);
+                let servers;
+                try {
+                    const parsed = JSON.parse(source.readMcpFile());
+                    servers = parsed.mcpServers || parsed;
+                }
+                catch (err) {
+                    return json(res, 500, { error: `mcp.json is not valid JSON: ${err.message}` });
+                }
+                if (!servers[name])
+                    return json(res, 404, { error: `no such server "${name}"` });
+                servers[name] = { ...servers[name], disabled: Boolean(disabled) };
+                if (!await saveAndReconnect(res, JSON.stringify({ mcpServers: servers }, null, 2), auth))
+                    return undefined;
+                return json(res, 200, { ...hub().inventory(config().disabledTools), disabledTools: config().disabledTools || [] });
+            } }
+    ];
 }