tinywebui 0.1.4 → 0.1.5

package/src/server.js

@@ -1,18 +1,16 @@
 import { createServer } from 'node:http';
-import { randomBytes } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { watch, existsSync } from 'node:fs';
 import { dirname } from 'node:path';
-
-import { createConfigSource, LockedError, configProblems, redactSecrets } from './config/config.js';
+import { createConfigSource, LockedError, ConfigError, configProblems, redactSecrets } from './config/config.js';
 import { McpHub, missingCommand } from './mcp.js';
-import { isClosed, findEntry } from './config/models.js';
+import { isClosed, findEntry, effectiveConfig } from './config/models.js';
 import { Store, SCHEMA_VERSION } from './store/index.js';
 import { fingerprint, featuresFor, modelsFor, resolveAccess } from './access/policy.js';
-import { hashPassword, applyAccessPolicy } from './access/auth.js';
+import { applyAccessPolicy } from './access/auth.js';
 import { audit } from './audit.js';
 import { logger } from './log.js';
-import { resolveAuth, OWNER_ID } from './access/auth_gate.js';
+import { resolveAuth, isSignedIn } from './access/auth_gate.js';
 import { json, HttpError, SECURITY_HEADERS, crossSite, badHost, serveStatic } from './http.js';
 import { expandToolDef, callExpand } from './tools/context_tool.js';
 import { documentToolDef, callReadDocument } from './tools/document_tool.js';
@@ -36,11 +34,8 @@ import { chatRoutes } from './routes/chats.js';
 import { adminRoutes } from './routes/admin.js';
 import { EVENT } from '../public/shared/events.js';
 import { FEATURE } from '../public/shared/features.js';
-
 const log = logger('server');
-
 const VERSION = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')).version;
-
 /**
  * Every API route, with the feature it needs (null: any signed-in caller, or
  * anyone for the pre-auth routes the auth gate lets through). Dispatch and
@@ -48,436 +43,452 @@ const VERSION = JSON.parse(await readFile(new URL('../package.json', import.meta
  * about who may use it. First match wins.
  */
 function routeTable(app) {
-  // What route groups may ask for. Each group's signature names the part it
-  // uses; config, hub and passwordHash change at runtime, so they are read
-  // through accessors rather than captured.
-  const deps = {
-    store: app.store, runs: app.runs, scheduler: app.scheduler, retrieval: app.retrieval,
-    source: app.source, version: app.version,
-    config: () => app.cfg, hub: () => app.hub, passwordHash: () => app.passwordHash, launchToken: () => app.launchToken,
-    saveConfig: (patch, by) => app.saveConfig(patch, by), refreshConfig: () => app.refreshConfig(),
-    auditMcp: (by, before) => app.auditMcp(by, before), swapHub: (servers) => app.swapHub(servers),
-    multiUser: () => app.multiUser(), modelFor: (userId, role) => app.modelFor(userId, role),
-    instructionsFor: (userId) => app.instructionsFor(userId),
-    toolsFor: (features) => app.toolsFor(features), toolsView: () => app.toolsView(), configFor: (auth) => app.configFor(auth)
-  };
-  return [
-    ...authRoutes(deps), ...settingsRoutes(deps), ...mcpRoutes(deps), ...libraryRoutes(deps),
-    ...automationRoutes(deps), ...documentRoutes(deps), ...chatRoutes(deps), ...adminRoutes(deps)
-  ];
+    // What route groups may ask for. Each group's signature names the part it
+    // uses; config and hub change at runtime, so they are read through
+    // accessors rather than captured.
+    const deps = {
+        store: app.store, runs: app.runs, scheduler: app.scheduler, retrieval: app.retrieval,
+        source: app.source, version: app.version,
+        config: () => app.cfg, hub: () => app.hub,
+        saveConfig: (patch, by) => app.saveConfig(patch, by), refreshConfig: () => app.refreshConfig(),
+        auditMcp: (by, before) => app.auditMcp(by, before), swapHub: (servers) => app.swapHub(servers),
+        multiUser: () => app.multiUser(), modelFor: (userId, role) => app.modelFor(userId, role),
+        instructionsFor: (userId) => app.instructionsFor(userId),
+        toolsFor: (features) => app.toolsFor(features), toolsView: () => app.toolsView(), configFor: (auth) => app.configFor(auth)
+    };
+    return [
+        ...authRoutes(deps), ...settingsRoutes(deps), ...mcpRoutes(deps), ...libraryRoutes(deps),
+        ...automationRoutes(deps), ...documentRoutes(deps), ...chatRoutes(deps), ...adminRoutes(deps)
+    ];
 }
-
 // Handlers only read their dependencies when called, so a stub lists the table.
 export const API_ROUTES = routeTable({}).map((r) => [r.method, r.path, r.feature]);
-
 // Fields a non-admin never sees: credentials, and where the deployment's
 // trust boundary sits.
 const ADMIN_ONLY_FIELDS = /^(apiKey|keyHint|connectors|authPassword|sessionSecret|google|baseUrl|trusted|adminEmails|models$)/;
-
 const LOOPBACK_BINDS = ['127.0.0.1', '::1', 'localhost'];
-
-// 'single': the stored hash, or one made in memory from $TINYWEBUI_PASSWORD
-// (handy for containers); null means sign-in is by launch link only.
-const ownerHash = (cfg) => cfg.authPassword || (process.env.TINYWEBUI_PASSWORD ? hashPassword(process.env.TINYWEBUI_PASSWORD) : null);
-
 /**
  * Starts an instance. Everything but port/host is optional and passed to
  * createConfigSource: `config` (keys set here win and are locked in the UI),
  * `configFile` (a path, or false for none), `mcpServers`, `mcpFile`, `dbPath`.
  */
 export async function start({ port = 7777, host = '127.0.0.1', ...sourceOpts } = {}) {
-  const source = createConfigSource(sourceOpts);
-  const initial = source.load();
-  const problems = configProblems(initial);
-  if (problems.length) throw new Error(problems.join('\n'));
-  const loopback = LOOPBACK_BINDS.includes(host);
-  if (initial.authMode === 'none' && !loopback) {
-    throw new Error("authMode 'none' is limited to loopback; use password login or a trusted-header gateway for network access");
-  }
-  if (initial.authMode === 'single' && !ownerHash(initial) && !loopback) {
-    throw new Error("authMode 'single' needs a password on a network bind: run `tinywebui set-password` or set $TINYWEBUI_PASSWORD");
-  }
-
-  const store = new Store(source.dbPath(initial), { migrate: initial.autoMigrate !== false });
-  // Runs live in this process, so nothing from before it can still be waiting.
-  store.chats.expireQuestions();
-  if (store.migratedFrom !== null && store.migratedFrom < SCHEMA_VERSION) {
-    log.info(`migrated database from schema ${store.migratedFrom} to ${SCHEMA_VERSION}`);
-  }
-  if (initial.authMode === 'trusted-header') applyAccessPolicy(store, initial);
-
-  // The embedding bundle loads now, so a problem with it stops startup with a
-  // clear message instead of surfacing on the first search -- except under
-  // 'auto', where a model that simply isn't installed means lexical.
-  let resolved;
-  try {
-    const load = sourceOpts.embedder ? async () => sourceOpts.embedder : loadEmbedder;
-    resolved = await resolveRetrieval(initial.retrieval, defaultModelsDir(source.path()), load);
-  } catch (err) { store.close(); throw err; }
-  const { embedder } = resolved;
-  if (resolved.fallback) log.warn(`retrieval: lexical only -- ${resolved.fallback}`);
-  else if (embedder) log.info(`retrieval: ${resolved.mode} with ${embedder.spec?.repoId || initial.retrieval.model} (${embedder.dim} dims)`);
-
-  if (initial.authMode === 'single') store.users.ensureOwner(OWNER_ID);
-
-  /**
-   * What every part of the server shares. `cfg` and `hub` are replaced, not
-   * mutated, when settings are saved or files reload, so read them from here
-   * at use time rather than holding on to them.
-   */
-  const app = {
-    version: VERSION,
-    source,
-    store,
-    retrieval: new Retrieval(store, { ...initial.retrieval, mode: resolved.mode }, embedder),
-    cfg: initial,
-    hub: null,
-    passwordHash: initial.authMode === 'single' ? ownerHash(initial) : null,
-    // A passwordless loopback install signs in with this instead: printed as a
-    // link at startup, so only someone who can read this terminal gets in.
-    // Made whenever it could be needed, so a reload that drops the password
-    // still leaves a way in.
-    launchToken: initial.authMode === 'single' && loopback ? randomBytes(32).toString('hex') : null,
-
-    // Every UI/API change lands in config.json (source.save) and is audited:
-    // who, which keys, the new values (none of these keys are secrets), and the
-    // config fingerprint before and after, to line up with a git diff.
-    saveConfig(patch, by) {
-      const before = fingerprint(app.cfg, source.loadMcpServers());
-      app.cfg = source.save(patch);
-      audit('config.changed', { by: by ?? 'local', keys: Object.keys(patch), values: redactSecrets(patch), before, after: fingerprint(app.cfg, source.loadMcpServers()) });
-      return app.cfg;
-    },
-    /** Re-reads the config after something other than saveConfig wrote the file. */
-    refreshConfig() {
-      app.cfg = source.load();
-    },
-    // `change` (action and server name, never a value) says what the assistant did.
-    auditMcp: (by, before, change) => audit('mcp.changed', { by: by ?? 'local', ...(change ? { change } : {}), before, after: fingerprint(app.cfg, source.loadMcpServers()) }),
-
-    /** What manage_mcp may do. It works on the file, not the live hub, so it sees what the next connect will. */
-    mcpEdit: {
-      locked: () => source.mcpLocked,
-      servers() {
-        let parsed;
-        try { parsed = JSON.parse(source.readMcpFile()); }
-        catch (err) { throw new Error(`mcp.json is not valid JSON (${err.message}); ask the user to fix it before anything is changed`); }
-        return structuredClone(parsed.mcpServers || parsed);
-      },
-      save(servers, { by, change }) {
-        const before = fingerprint(app.cfg, source.loadMcpServers());
-        source.saveMcpFile(JSON.stringify({ mcpServers: servers }, null, 2));
-        app.auditMcp(by, before, change);
-        // Noted now so the file watcher takes this write for our own. The
-        // reconnect waits for the reply to finish (onRunIdle): swapping now
-        // would close the servers the running turn is still calling.
-        mcpText = source.readMcpFile();
-        mcpDirty = true;
-      },
-      status: () => Object.fromEntries(app.hub.inventory(app.cfg.disabledTools).servers
-        .map((s) => [s.name, { status: s.status, error: s.error, tools: s.tools.length }])),
-      check: (spec) => missingCommand(spec)?.message ?? null
-    },
-
-    multiUser: () => app.cfg.authMode === 'trusted-header',
-
+    const source = createConfigSource(sourceOpts);
+    const initial = source.load();
+    const problems = configProblems(initial);
+    if (problems.length)
+        throw new Error(problems.join('\n'));
+    if (initial.authMode === 'local' && !LOOPBACK_BINDS.includes(host)) {
+        throw new Error("authMode 'local' is limited to loopback; use multiuser or a trusted-header gateway for network access");
+    }
+    const store = new Store(source.dbPath(initial), { migrate: initial.autoMigrate !== false });
+    // Runs live in this process, so nothing from before it can still be waiting.
+    store.chats.expireQuestions();
+    if (store.migratedFrom !== null && store.migratedFrom < SCHEMA_VERSION) {
+        log.info(`migrated database from schema ${store.migratedFrom} to ${SCHEMA_VERSION}`);
+    }
+    if (initial.authMode === 'trusted-header')
+        applyAccessPolicy(store, initial);
+    // The embedding bundle loads now, so a problem with it stops startup with a
+    // clear message instead of surfacing on the first search -- except under
+    // 'auto', where a model that simply isn't installed means lexical.
+    let resolved;
+    try {
+        const load = sourceOpts.embedder ? async () => sourceOpts.embedder : loadEmbedder;
+        resolved = await resolveRetrieval(initial.retrieval, defaultModelsDir(source.path()), load);
+    }
+    catch (err) {
+        store.close();
+        throw err;
+    }
+    const { embedder } = resolved;
+    if (resolved.fallback)
+        log.warn(`retrieval: lexical only -- ${resolved.fallback}`);
+    else if (embedder)
+        log.info(`retrieval: ${resolved.mode} with ${embedder.spec?.repoId || initial.retrieval.model} (${embedder.dim} dims)`);
     /**
-     * The model a person's turns use. Tiers 1-2: the configured model. Tier 3:
-     * their own pick if their role still allows it, else the configured model
-     * if allowed, else the first model their role allows.
+     * What every part of the server shares. `cfg` and `hub` are replaced, not
+     * mutated, when settings are saved or files reload, so read them from here
+     * at use time rather than holding on to them.
      */
-    modelFor(userId, role) {
-      const { cfg } = app;
-      // With a catalog, everything is an entry id; a provider id (as the
-      // default `model` may be) is resolved to its entry.
-      const known = (m) => (isClosed(cfg) ? findEntry(cfg, m)?.id : m);
-      const fallback = known(cfg.model) || cfg.model;
-      if (cfg.authMode !== 'trusted-header' || !userId) return fallback;
-      const allowed = modelsFor(cfg, role);
-      const ok = (m) => m && (allowed === '*' || allowed.includes(m));
-      const pref = known(store.users.getPrefs(userId).model);
-      if (ok(pref)) return pref;
-      if (ok(fallback)) return fallback;
-      // First of the role's models still enabled (a parked one never runs).
-      return allowed.map(known).find(Boolean) || fallback;
-    },
-
-    /** A person's own instructions, added after the system prompt, when an admin lets users set them. */
-    instructionsFor(userId) {
-      if (!userId || app.cfg.authMode !== 'trusted-header') return null;
-      if (!resolveAccess(app.cfg).customize.includes('instructions')) return null;
-      return store.users.getPrefs(userId).instructions || null;
-    },
-
-    /** The tools a turn gets: what is switched on, minus manage_automation for
-     * anyone whose role has no automations. */
-    toolsFor: (features) => app.hub.activeTools(app.cfg.disabledTools)
-      .filter((t) => features.has(FEATURE.AUTOMATIONS) || t.function.name !== 'manage_automation')
-      .filter((t) => features.has(FEATURE.MCP) || t.function.name !== MANAGE_MCP),
-
-    /** A stored owner's features: null (tiers 1-2) is the one person. */
-    ownerFeatures: (userId) => featuresFor(app.cfg, userId ? store.users.get(userId)?.role : null),
-
-    /** The tools panel payload: inventory plus each tool's approval state. */
-    toolsView() {
-      const { cfg, hub } = app;
-      const inv = hub.inventory(cfg.disabledTools);
-      const mark = (t) => ({ ...t, approval: overrideFor(cfg, t.name) });
-      return {
-        // Built-ins never ask, so they carry no approval state to show.
-        internal: inv.internal,
-        servers: inv.servers.map((s) => ({ ...s, tools: s.tools.map(mark) })),
-        disabledTools: cfg.disabledTools || [],
-        toolApproval: cfg.toolApproval
-      };
-    },
-
-    configFor(auth) {
-      const pub = source.public(app.cfg);
-      if (auth.features.has(FEATURE.SETTINGS) && auth.isAdmin) return pub;
-      if (auth.features.has(FEATURE.SETTINGS)) {
-        // Allowed to edit settings, but not to see where the deployment's keys point.
-        const out = {};
-        for (const [k, v] of Object.entries(pub)) if (!ADMIN_ONLY_FIELDS.test(k)) out[k] = v;
-        return out;
-      }
-      const out = {};
-      for (const [k, v] of Object.entries(pub)) if (!ADMIN_ONLY_FIELDS.test(k)) out[k] = v;
-      return { ...out, readOnly: true };
-    },
-
-    /** Replaces the hub wholesale: the old one's child processes are shut
-     * down after the new one is up, so a rename cannot leave an orphan. */
-    swapHub(servers) {
-      // Recorded now, not once connected: the file watcher fires 300 ms after
-      // our own save, and a slow connect would make that echo look like an
-      // outside edit and start a second swap.
-      mcpText = source.readMcpFile();
-      // One swap at a time: two in flight would both close the same old hub
-      // and leave the first new one, and its child processes, running.
-      const run = swapping.then(async () => {
-        if (stopping) return;
-        const old = app.hub;
-        app.hub = await connectHub(servers);
-        await old.close();
-      });
-      swapping = run.catch(() => {});
-      return run;
-    },
-
-    onRunIdle: (chatId) => {
-      app.scheduler.drain(chatId);
-      // manage_mcp saved mcp.json during that run. Re-read the file rather than
-      // reuse what it saved: someone may have edited it since.
-      if (mcpDirty) {
-        mcpDirty = false;
-        app.swapHub(source.loadMcpServers()).catch((err) => log.error(`mcp reconnect failed: ${err.message}`));
-      }
-    }
-  };
-  app.runs = createRuns(app);
-  app.scheduler = createScheduler(app);
-  const { retrieval, runs, scheduler } = app;
-
-  // The built-in tools are ours, not an MCP server's, but the model should not
-  // be able to tell: they are registered onto the same hub and called the same way.
-  const connectHub = async (servers) =>
-    (await new McpHub(servers).connect())
-      .registerLocal(expandToolDef(), (args, ctx) => callExpand(args, { ...ctx, store }), { readOnly: true })
-      .registerLocal(documentToolDef(), (args, ctx) => callReadDocument(args, { ...ctx, store, retrieval }), { readOnly: true })
-      .registerLocal(chatSearchToolDef(), (args, ctx) => callSearchChats(args, { ...ctx, store, retrieval }), { readOnly: true })
-      // Changes nothing, so it never waits for approval; never alongside
-      // other calls, so a question cannot race a write it is asking about.
-      .registerLocal(askToolDef(), callAskUser, { readOnly: true, idempotent: false, executionMode: 'sequential' })
-      .registerLocal(taskToolDef(), (args, ctx) => callManageTasks(args, {
+    const app = {
+        version: VERSION,
+        source,
+        store,
+        retrieval: new Retrieval(store, { ...initial.retrieval, mode: resolved.mode }, embedder),
+        cfg: initial,
+        // Set by connectHub below, before the server listens.
+        hub: null,
+        // Every UI/API change lands in config.json (source.save) and is audited:
+        // who, which keys, the new values (none of these keys are secrets), and the
+        // config fingerprint before and after, to line up with a git diff.
+        saveConfig(patch, by) {
+            const before = fingerprint(app.cfg, source.loadMcpServers());
+            app.cfg = source.save(patch);
+            audit('config.changed', { by: by ?? 'local', keys: Object.keys(patch), values: redactSecrets(patch), before, after: fingerprint(app.cfg, source.loadMcpServers()) });
+            return app.cfg;
+        },
+        /** Re-reads the config after something other than saveConfig wrote the file. */
+        refreshConfig() {
+            app.cfg = source.load();
+        },
+        // `change` (action and server name, never a value) says what the assistant did.
+        auditMcp: (by, before, change) => audit('mcp.changed', { by: by ?? 'local', ...(change ? { change } : {}), before, after: fingerprint(app.cfg, source.loadMcpServers()) }),
+        /** What manage_mcp may do. It works on the file, not the live hub, so it sees what the next connect will. */
+        mcpEdit: {
+            locked: () => source.mcpLocked,
+            servers() {
+                let parsed;
+                try {
+                    parsed = JSON.parse(source.readMcpFile());
+                }
+                catch (err) {
+                    throw new Error(`mcp.json is not valid JSON (${err.message}); ask the user to fix it before anything is changed`);
+                }
+                return structuredClone(parsed.mcpServers || parsed);
+            },
+            save(servers, { by, change }) {
+                const before = fingerprint(app.cfg, source.loadMcpServers());
+                source.saveMcpFile(JSON.stringify({ mcpServers: servers }, null, 2));
+                app.auditMcp(by, before, change);
+                // Noted now so the file watcher takes this write for our own. The
+                // reconnect waits for the reply to finish (onRunIdle): swapping now
+                // would close the servers the running turn is still calling.
+                mcpText = source.readMcpFile();
+                mcpDirty = true;
+            },
+            status: () => Object.fromEntries(app.hub.inventory(app.cfg.disabledTools).servers
+                .map((s) => [s.name, { status: s.status, error: s.error, tools: s.tools.length }])),
+            check: (spec) => missingCommand(spec)?.message ?? null
+        },
+        multiUser: () => ['multiuser', 'trusted-header'].includes(app.cfg.authMode),
+        /**
+         * The model a person's turns use. Tiers 1-2: the configured model. Tier 3:
+         * their own pick if their role still allows it, else the configured model
+         * if allowed, else the first model their role allows.
+         */
+        modelFor(userId, role) {
+            const { cfg } = app;
+            // With a catalog, everything is an entry id; a provider id (as the
+            // default `model` may be) is resolved to its entry.
+            const known = (m) => (isClosed(cfg) ? findEntry(cfg, m)?.id : m);
+            const fallback = known(cfg.model) || cfg.model;
+            if (!app.multiUser() || !userId)
+                return fallback;
+            const allowed = modelsFor(cfg, role);
+            const ok = (m) => Boolean(m && (allowed === '*' || allowed.includes(m)));
+            const pref = known(store.users.getPrefs(userId).model);
+            if (ok(pref))
+                return pref;
+            if (ok(fallback))
+                return fallback;
+            // Every model allowed and none set up yet: there is nothing to pick.
+            if (allowed === '*')
+                return fallback;
+            // First of the role's models still enabled (a parked one never runs).
+            return allowed.map(known).find(Boolean) || fallback;
+        },
+        /** A person's own instructions, added after the system prompt, when an admin lets users set them. */
+        instructionsFor(userId) {
+            if (!userId || !app.multiUser())
+                return null;
+            if (!resolveAccess(app.cfg).customize.includes('instructions'))
+                return null;
+            return store.users.getPrefs(userId).instructions || null;
+        },
+        /** The tools a turn gets: what is switched on, minus manage_automation for
+         * anyone whose role has no automations. */
+        toolsFor: (features) => app.hub.activeTools(app.cfg.disabledTools)
+            .filter((t) => features.has(FEATURE.AUTOMATIONS) || t.function.name !== 'manage_automation')
+            .filter((t) => features.has(FEATURE.MCP) || t.function.name !== MANAGE_MCP),
+        /** A stored owner's features: null (tiers 1-2) is the one person. */
+        ownerFeatures: (userId) => featuresFor(app.cfg, userId ? store.users.get(userId)?.role : null),
+        /** The tools panel payload: inventory plus each tool's approval state. */
+        toolsView() {
+            const { cfg, hub } = app;
+            const inv = hub.inventory(cfg.disabledTools);
+            const mark = (t) => ({ ...t, approval: overrideFor(cfg, t.name) });
+            return {
+                // Built-ins never ask, so they carry no approval state to show.
+                internal: inv.internal,
+                servers: inv.servers.map((s) => ({ ...s, tools: s.tools.map(mark) })),
+                disabledTools: cfg.disabledTools || [],
+                toolApproval: cfg.toolApproval
+            };
+        },
+        configFor(auth) {
+            const pub = source.public(app.cfg);
+            if (auth.features.has(FEATURE.SETTINGS) && auth.isAdmin)
+                return pub;
+            if (auth.features.has(FEATURE.SETTINGS)) {
+                // Allowed to edit settings, but not to see where the deployment's keys point.
+                const out = {};
+                for (const [k, v] of Object.entries(pub))
+                    if (!ADMIN_ONLY_FIELDS.test(k))
+                        out[k] = v;
+                return out;
+            }
+            const out = {};
+            for (const [k, v] of Object.entries(pub))
+                if (!ADMIN_ONLY_FIELDS.test(k))
+                    out[k] = v;
+            return { ...out, readOnly: true };
+        },
+        /** Replaces the hub wholesale: the old one's child processes are shut
+         * down after the new one is up, so a rename cannot leave an orphan. */
+        swapHub(servers) {
+            // Recorded now, not once connected: the file watcher fires 300 ms after
+            // our own save, and a slow connect would make that echo look like an
+            // outside edit and start a second swap.
+            mcpText = source.readMcpFile();
+            // One swap at a time: two in flight would both close the same old hub
+            // and leave the first new one, and its child processes, running.
+            const run = swapping.then(async () => {
+                if (stopping)
+                    return;
+                const old = app.hub;
+                app.hub = await connectHub(servers);
+                await old.close();
+            });
+            swapping = run.catch(() => { });
+            return run;
+        },
+        onRunIdle: (chatId) => {
+            app.scheduler.drain(chatId);
+            // manage_mcp saved mcp.json during that run. Re-read the file rather than
+            // reuse what it saved: someone may have edited it since.
+            if (mcpDirty) {
+                mcpDirty = false;
+                app.swapHub(source.loadMcpServers()).catch((err) => log.error(`mcp reconnect failed: ${err.message}`));
+            }
+        }
+    };
+    app.runs = createRuns(app);
+    app.scheduler = createScheduler(app);
+    const { retrieval, runs, scheduler } = app;
+    // The built-in tools are ours, not an MCP server's, but the model should not
+    // be able to tell: they are registered onto the same hub and called the same way.
+    const connectHub = async (servers) => (await new McpHub(servers).connect())
+        .registerLocal(expandToolDef(), (args, ctx) => callExpand(args, { ...ctx, store }), { readOnly: true })
+        .registerLocal(documentToolDef(), (args, ctx) => callReadDocument(args, { ...ctx, store, retrieval }), { readOnly: true })
+        .registerLocal(chatSearchToolDef(), (args, ctx) => callSearchChats(args, { ...ctx, store, retrieval }), { readOnly: true })
+        // Changes nothing, so it never waits for approval; never alongside
+        // other calls, so a question cannot race a write it is asking about.
+        .registerLocal(askToolDef(), callAskUser, { readOnly: true, idempotent: false, executionMode: 'sequential' })
+        .registerLocal(taskToolDef(), (args, ctx) => callManageTasks(args, {
         ...ctx, store, onChange: () => runs.get(ctx.chatId)?.emit({ type: EVENT.TASKS, tasks: store.chats.visibleTasks(ctx.chatId) })
-      }), { executionMode: 'sequential' })
-      .registerLocal(automationToolDef(), (args, ctx) => {
+    }), { executionMode: 'sequential' })
+        .registerLocal(automationToolDef(), (args, ctx) => {
         const out = manageAutomation(args, { ...ctx, store, triggerAutomation: scheduler.trigger });
         scheduler.arm();
         return out;
-      })
-      // Unlike the tools above it asks before anything but "list": a local
-      // server is a command run on this machine, and mcp.json holds credentials.
-      .registerLocal(mcpToolDef(), (args, ctx) => callManageMcp(args, { ...ctx, mcp: app.mcpEdit }), {
+    })
+        // Unlike the tools above it asks before anything but "list": a local
+        // server is a command run on this machine, and mcp.json holds credentials.
+        .registerLocal(mcpToolDef(), (args, ctx) => callManageMcp(args, { ...ctx, mcp: app.mcpEdit }), {
         readOnly: (args) => args?.action === 'list',
         gated: (args) => args?.action !== 'list',
         executionMode: 'sequential'
-      });
-
-  app.hub = await connectHub(source.loadMcpServers());
-  // What mcp.json said when the hub was last (re)built, so a reload can tell
-  // a real edit from the echo of the UI's own save.
-  let mcpText = source.readMcpFile();
-  // Set when manage_mcp has saved mcp.json and the hub still has to follow.
-  let mcpDirty = false;
-  // The hub swap in progress, if any, and whether shutdown has begun.
-  let swapping = Promise.resolve();
-  let stopping = false;
-  const serversOf = (text) => { try { const p = JSON.parse(text); return p.mcpServers || p; } catch { return {}; } };
-
-  log.info(`config: ${source.path() || '(in code, no file)'}`);
-  log.info(`mcp:    ${source.mcpPath() || '(in code)'}`);
-  log.info(`db:     ${source.dbPath(app.cfg)}`);
-  log.info(`model:  ${app.cfg.model} via ${app.cfg.baseUrl}`);
-  log.info(`tools:  ${app.hub.tools.length} from ${app.hub.clients.size} MCP server(s)`);
-  // Repeated after the banner, grouped, so it is the last thing a first run shows.
-  const offFor = Map.groupBy(app.hub.install, ([, need]) => need.url);
-  for (const [url, entries] of offFor) {
-    log.warn(`${entries.map(([name]) => name).join(', ')} off until ${entries[0][1].name} is installed: ${url}`);
-  }
-  log.info(`policy: ${fingerprint(app.cfg, source.loadMcpServers())} (fingerprint)`);
-
-  const routes = routeTable(app);
-
-  const server = createServer(async (req, res) => {
-    try {
-      for (const [k, v] of Object.entries(SECURITY_HEADERS)) res.setHeader(k, v);
-      const url = new URL(req.url || '/', 'http://x');
-      const { pathname } = url;
-      if (badHost(req, app.cfg)) {
-        audit('request.bad_host_rejected', { host: String(req.headers.host).slice(0, 100), path: pathname });
-        return json(res, 403, { error: 'unknown host' });
-      }
-      if (crossSite(req, app.cfg)) {
-        audit('request.cross_site_rejected', { method: req.method, path: pathname });
-        return json(res, 403, { error: 'cross-site request refused' });
-      }
-      // Probes for orchestrators: no auth, nothing sensitive. /healthz says
-      // the process answers; /readyz that it can serve (database reachable),
-      // and which build and config it serves.
-      if (req.method === 'GET' && pathname === '/healthz') return json(res, 200, { ok: true });
-      if (req.method === 'GET' && pathname === '/readyz') {
-        let dbOk = false;
-        try { dbOk = store.ping(); } catch { /* not ready */ }
-        return json(res, dbOk ? 200 : 503, { ready: dbOk, version: VERSION, fingerprint: fingerprint(app.cfg, source.loadMcpServers()) });
-      }
-      const auth = resolveAuth(req, pathname, app.cfg, store);
-      if (auth.notFound) return json(res, 404, { error: 'not found' });
-      if (auth.unauthorized) return json(res, 401, { error: 'unauthorized' });
-      if (auth.disabled) return json(res, 403, { error: 'disabled' });
-      if (auth.pending) return json(res, 403, { error: 'pending_approval' });
-
-      if (!pathname.startsWith('/api/')) return serveStatic(req, res);
-      for (const route of routes) {
-        if (route.method !== req.method) continue;
-        const match = route.path.exec(pathname);
-        if (!match) continue;
-        if (route.feature && !auth.features.has(route.feature)) return json(res, 403, { error: 'feature_disabled', feature: route.feature });
-        return await route.handle({ req, res, auth, url, params: match.slice(1) });
-      }
-      return json(res, 404, { error: 'not found' });
-    } catch (err) {
-      if (err instanceof HttpError && err.status === 413) req.resume?.();
-      if (!res.headersSent) json(res, err instanceof HttpError ? err.status : err instanceof LockedError ? 409 : 500, { error: err.message });
-      else res.end();
+    });
+    app.hub = await connectHub(source.loadMcpServers());
+    // What mcp.json said when the hub was last (re)built, so a reload can tell
+    // a real edit from the echo of the UI's own save.
+    let mcpText = source.readMcpFile();
+    // Set when manage_mcp has saved mcp.json and the hub still has to follow.
+    let mcpDirty = false;
+    // The hub swap in progress, if any, and whether shutdown has begun.
+    let swapping = Promise.resolve();
+    let stopping = false;
+    const serversOf = (text) => { try {
+        const p = JSON.parse(text);
+        return p.mcpServers || p;
     }
-  });
-
-  await new Promise((resolve) => server.listen(port, host, resolve));
-  scheduler.arm();
-  const origin = `http://${host.includes(':') ? `[${host}]` : host}:${server.address().port}`;
-  // In the fragment, so it never reaches a server log or a Referer header.
-  app.launchUrl = app.launchToken ? `${origin}/#token=${app.launchToken}` : origin;
-  log.info(app.launchToken && !app.passwordHash ? `sign in: ${app.launchUrl}` : origin);
-  // Anything stored before dense retrieval was on (or under another model)
-  // is embedded in the background; document queries fill in on demand too.
-  retrieval.backfill((msg) => log.info(`retrieval: ${msg}`))
-    .catch((err) => log.error(`retrieval backfill failed: ${err.message}`));
-
-  /**
-   * Re-reads config.json and mcp.json after a hand or agent edit. All or
-   * nothing: a file that fails to parse or validate is reported and the
-   * running config stays exactly as it was. tinywebui.config.js is code and
-   * is only read at startup, as is authMode (switching it live would strand
-   * sessions and half the auth state).
-   */
-  async function reloadFromFiles(reason) {
-    let next, servers, text;
-    try {
-      next = source.load();
-      text = source.readMcpFile();
-      const parsed = JSON.parse(text);
-      servers = parsed.mcpServers || parsed;
-      for (const [name, spec] of Object.entries(servers)) {
-        if (!spec || (!spec.command && !spec.url)) throw new Error(`mcp server "${name}" needs either "command" or "url"`);
-      }
-    } catch (err) {
-      log.warn(`reload rejected (${reason}): ${err.message}`);
-      audit('config.reload_rejected', { reason, problems: [err.message] });
-      return false;
-    }
-    const problems = configProblems(next);
-    if (next.authMode !== app.cfg.authMode) problems.push('authMode changes need a restart');
-    if (JSON.stringify(next.retrieval) !== JSON.stringify(app.cfg.retrieval)) problems.push('retrieval changes need a restart');
-    if (problems.length) {
-      log.warn(`reload rejected (${reason}):\n  ${problems.join('\n  ')}`);
-      audit('config.reload_rejected', { reason, problems });
-      return false;
+    catch {
+        return {};
+    } };
+    log.info(`config: ${source.path() || '(in code, no file)'}`);
+    log.info(`keys:   ${source.secretsPath() || '(in memory)'}`);
+    log.info(`mcp:    ${source.mcpPath() || '(in code)'}`);
+    log.info(`db:     ${source.dbPath(app.cfg)}`);
+    const via = effectiveConfig(app.cfg).baseUrl;
+    log.info(`model:  ${app.cfg.model ? `${app.cfg.model} via ${via || '(no endpoint)'}` : 'none yet: add a connector and its models in Settings'}`);
+    log.info(`tools:  ${app.hub.tools.length} from ${app.hub.clients.size} MCP server(s)`);
+    // Repeated after the banner, grouped, so it is the last thing a first run shows.
+    const offFor = Map.groupBy(app.hub.install, ([, need]) => need.url);
+    for (const [url, entries] of offFor) {
+        log.warn(`${entries.map(([name]) => name).join(', ')} off until ${entries[0][1].name} is installed: ${url}`);
     }
-    const before = fingerprint(app.cfg, serversOf(mcpText));
-    const after = fingerprint(next, servers);
-    const mcpChanged = text !== mcpText;
-    if (before === after && !mcpChanged) return true; // our own write, or a no-op save
-    app.cfg = next;
-    if (next.authMode === 'single') {
-      app.passwordHash = ownerHash(next);
-      if (!app.passwordHash) log.info(`sign in: ${app.launchUrl}`);
-    }
-    if (next.authMode === 'trusted-header') applyAccessPolicy(store, next);
-    if (mcpChanged) await app.swapHub(servers);
+    log.info(`policy: ${fingerprint(app.cfg, source.loadMcpServers())} (fingerprint)`);
+    const routes = routeTable(app);
+    const server = createServer(async (req, res) => {
+        try {
+            for (const [k, v] of Object.entries(SECURITY_HEADERS))
+                res.setHeader(k, v);
+            const url = new URL(req.url || '/', 'http://x');
+            const { pathname } = url;
+            if (badHost(req, app.cfg)) {
+                audit('request.bad_host_rejected', { host: String(req.headers.host).slice(0, 100), path: pathname });
+                return json(res, 403, { error: 'unknown host' });
+            }
+            if (crossSite(req, app.cfg)) {
+                audit('request.cross_site_rejected', { method: req.method, path: pathname });
+                return json(res, 403, { error: 'cross-site request refused' });
+            }
+            // Probes for orchestrators: no auth, nothing sensitive. /healthz says
+            // the process answers; /readyz that it can serve (database reachable),
+            // and which build and config it serves.
+            if (req.method === 'GET' && pathname === '/healthz')
+                return json(res, 200, { ok: true });
+            if (req.method === 'GET' && pathname === '/readyz') {
+                let dbOk = false;
+                try {
+                    dbOk = store.ping();
+                }
+                catch { /* not ready */ }
+                return json(res, dbOk ? 200 : 503, { ready: dbOk, version: VERSION, fingerprint: fingerprint(app.cfg, source.loadMcpServers()) });
+            }
+            const auth = resolveAuth(req, pathname, app.cfg, store);
+            if (auth.notFound)
+                return json(res, 404, { error: 'not found' });
+            if (auth.unauthorized)
+                return json(res, 401, { error: 'unauthorized' });
+            if (auth.disabled)
+                return json(res, 403, { error: 'disabled' });
+            if (auth.pending)
+                return json(res, 403, { error: 'pending_approval' });
+            if (!pathname.startsWith('/api/'))
+                return serveStatic(req, res);
+            for (const route of routes) {
+                if (route.method !== req.method)
+                    continue;
+                const match = route.path.exec(pathname);
+                if (!match)
+                    continue;
+                const ctx = { req, res, url, params: match.slice(1) };
+                if (!route.feature)
+                    return await route.handle({ ...ctx, auth });
+                if (!auth.features.has(route.feature) || !isSignedIn(auth))
+                    return json(res, 403, { error: 'feature_disabled', feature: route.feature });
+                return await route.handle({ ...ctx, auth });
+            }
+            return json(res, 404, { error: 'not found' });
+        }
+        catch (err) {
+            if (err instanceof HttpError && err.status === 413)
+                req.resume?.();
+            const status = err instanceof HttpError ? err.status : err instanceof LockedError ? 409 : err instanceof ConfigError ? 400 : 500;
+            if (!res.headersSent)
+                json(res, status, { error: err.message });
+            else
+                res.end();
+        }
+    });
+    await new Promise((resolve) => server.listen(port, host, resolve));
     scheduler.arm();
-    log.info(`reloaded (${reason}): policy ${after}`);
-    audit('config.reloaded', { reason, before, after, mcpChanged });
-    return true;
-  }
-
-  // Editors often replace a file rather than write into it, which a watch on
-  // the file itself would lose; watching the folder catches both.
-  const watchers = [];
-  let reloadTimer = null;
-  const scheduleReload = (reason) => {
-    clearTimeout(reloadTimer);
-    reloadTimer = setTimeout(() => { reloadFromFiles(reason).catch((err) => log.error(`reload failed: ${err.message}`)); }, 300);
-    reloadTimer.unref?.();
-  };
-  if (sourceOpts.watch !== false) {
-    const targets = [source.path(), source.mcpPath()].filter(Boolean);
-    for (const folder of new Set(targets.map((t) => dirname(t)))) {
-      if (!existsSync(folder)) continue;
-      const names = new Set(targets.filter((t) => dirname(t) === folder).map((t) => t.slice(folder.length + 1)));
-      try {
-        const w = watch(folder, (_, name) => { if (name && names.has(String(name))) scheduleReload('file changed'); });
-        w.unref?.();
-        watchers.push(w);
-      } catch (err) { log.error(`cannot watch ${folder}: ${err.message}`); }
+    const origin = `http://${host.includes(':') ? `[${host}]` : host}:${server.address().port}`;
+    log.info(origin);
+    // Anything stored before dense retrieval was on (or under another model)
+    // is embedded in the background; document queries fill in on demand too.
+    retrieval.backfill((msg) => log.info(`retrieval: ${msg}`))
+        .catch((err) => log.error(`retrieval backfill failed: ${err.message}`));
+    /**
+     * Re-reads config.json and mcp.json after a hand or agent edit. All or
+     * nothing: a file that fails to parse or validate is reported and the
+     * running config stays exactly as it was. tinywebui.config.js is code and
+     * is only read at startup, as is authMode (switching it live would strand
+     * sessions and half the auth state).
+     */
+    async function reloadFromFiles(reason) {
+        let next, servers, text;
+        try {
+            next = source.load();
+            text = source.readMcpFile();
+            const parsed = JSON.parse(text);
+            servers = parsed.mcpServers || parsed;
+            for (const [name, spec] of Object.entries(servers)) {
+                if (!spec || (!spec.command && !spec.url))
+                    throw new Error(`mcp server "${name}" needs either "command" or "url"`);
+            }
+        }
+        catch (err) {
+            log.warn(`reload rejected (${reason}): ${err.message}`);
+            audit('config.reload_rejected', { reason, problems: [err.message] });
+            return false;
+        }
+        const problems = configProblems(next);
+        if (next.authMode !== app.cfg.authMode)
+            problems.push('authMode changes need a restart');
+        if (JSON.stringify(next.retrieval) !== JSON.stringify(app.cfg.retrieval))
+            problems.push('retrieval changes need a restart');
+        if (problems.length) {
+            log.warn(`reload rejected (${reason}):\n  ${problems.join('\n  ')}`);
+            audit('config.reload_rejected', { reason, problems });
+            return false;
+        }
+        const before = fingerprint(app.cfg, serversOf(mcpText));
+        const after = fingerprint(next, servers);
+        const mcpChanged = text !== mcpText;
+        if (before === after && !mcpChanged)
+            return true; // our own write, or a no-op save
+        app.cfg = next;
+        if (next.authMode === 'trusted-header')
+            applyAccessPolicy(store, next);
+        if (mcpChanged)
+            await app.swapHub(servers);
+        scheduler.arm();
+        log.info(`reloaded (${reason}): policy ${after}`);
+        audit('config.reloaded', { reason, before, after, mcpChanged });
+        return true;
+    }
+    // Editors often replace a file rather than write into it, which a watch on
+    // the file itself would lose; watching the folder catches both.
+    const watchers = [];
+    let reloadTimer;
+    const scheduleReload = (reason) => {
+        clearTimeout(reloadTimer);
+        reloadTimer = setTimeout(() => { reloadFromFiles(reason).catch((err) => log.error(`reload failed: ${err.message}`)); }, 300);
+        reloadTimer.unref?.();
+    };
+    if (sourceOpts.watch !== false) {
+        const targets = [source.path(), source.mcpPath()].filter((t) => Boolean(t));
+        for (const folder of new Set(targets.map((t) => dirname(t)))) {
+            if (!existsSync(folder))
+                continue;
+            const names = new Set(targets.filter((t) => dirname(t) === folder).map((t) => t.slice(folder.length + 1)));
+            try {
+                const w = watch(folder, (_, name) => { if (name && names.has(String(name)))
+                    scheduleReload('file changed'); });
+                w.unref?.();
+                watchers.push(w);
+            }
+            catch (err) {
+                log.error(`cannot watch ${folder}: ${err.message}`);
+            }
+        }
     }
-  }
-  const onHup = () => scheduleReload('SIGHUP');
-  process.on('SIGHUP', onHup);
-  server.reload = reloadFromFiles;
-  server.launchUrl = app.launchUrl;
-
-  // Real teardown, reused two ways: on SIGINT/SIGTERM it exits the process, and
-  // as `server.shutdown()` it does not -- which is what a test harness needs.
-  const shutdown = async () => {
-    scheduler.stop();
-    clearTimeout(reloadTimer);
-    for (const w of watchers) w.close();
-    process.off('SIGHUP', onHup);
-    // A swap still connecting would otherwise finish after this and leave
-    // its servers running.
-    stopping = true;
-    await swapping;
-    await app.hub.close();
-    await Promise.allSettled([...retrieval.pending.values()]);
-    embedder?.close?.();
-    store.close();
-    await new Promise((resolve) => server.close(resolve));
-  };
-  process.on('SIGINT', () => shutdown().then(() => process.exit(0)));
-  process.on('SIGTERM', () => shutdown().then(() => process.exit(0)));
-
-  server.shutdown = shutdown;
-  return server;
+    const onHup = () => scheduleReload('SIGHUP');
+    process.on('SIGHUP', onHup);
+    server.reload = reloadFromFiles;
+    // Real teardown, reused two ways: on SIGINT/SIGTERM it exits the process, and
+    // as `server.shutdown()` it does not -- which is what a test harness needs.
+    const shutdown = async () => {
+        scheduler.stop();
+        clearTimeout(reloadTimer);
+        for (const w of watchers)
+            w.close();
+        process.off('SIGHUP', onHup);
+        // A swap still connecting would otherwise finish after this and leave
+        // its servers running.
+        stopping = true;
+        await swapping;
+        await app.hub.close();
+        await Promise.allSettled([...retrieval.pending.values()]);
+        embedder?.close?.();
+        store.close();
+        await new Promise((resolve) => server.close(resolve));
+    };
+    process.on('SIGINT', () => shutdown().then(() => process.exit(0)));
+    process.on('SIGTERM', () => shutdown().then(() => process.exit(0)));
+    server.shutdown = shutdown;
+    return server;
 }