tinywebui 0.1.4 → 0.1.5

package/src/store/users.js

@@ -1,102 +1,177 @@
 import { randomUUID } from 'node:crypto';
-
 // Users, their preferences, and login sessions.
 // One area of the Store; see index.js.
-
 export class UserStore {
-  constructor(db, deps = {}) {
-    this.db = db;
-    Object.assign(this, deps);
-  }
-
-  getPrefs(userId) {
-    const out = {};
-    for (const r of this.db.prepare('SELECT key, value FROM user_prefs WHERE user_id = ?').all(userId)) out[r.key] = r.value;
-    return out;
-  }
-
-  setPref(userId, key, value) {
-    if (value == null) this.db.prepare('DELETE FROM user_prefs WHERE user_id = ? AND key = ?').run(userId, key);
-    else this.db.prepare(`INSERT INTO user_prefs (user_id, key, value) VALUES (?, ?, ?)
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    getPrefs(userId) {
+        const out = {};
+        for (const r of this.db.prepare('SELECT key, value FROM user_prefs WHERE user_id = ?').all(userId))
+            out[r.key] = r.value;
+        return out;
+    }
+    setPref(userId, key, value) {
+        if (value == null)
+            this.db.prepare('DELETE FROM user_prefs WHERE user_id = ? AND key = ?').run(userId, key);
+        else
+            this.db.prepare(`INSERT INTO user_prefs (user_id, key, value) VALUES (?, ?, ?)
       ON CONFLICT(user_id, key) DO UPDATE SET value = excluded.value`).run(userId, key, String(value));
-  }
-
-  get(id) {
-    return this.db.prepare('SELECT * FROM users WHERE id = ?').get(id) || null;
-  }
-
-  list() {
-    return this.db.prepare(`
+    }
+    get(id) {
+        return this.db.prepare('SELECT * FROM users WHERE id = ?').get(id) || null;
+    }
+    count() {
+        return this.db.prepare('SELECT COUNT(*) AS n FROM users').get().n;
+    }
+    localCount() {
+        return this.db.prepare('SELECT COUNT(*) AS n FROM users WHERE password_hash IS NOT NULL').get().n;
+    }
+    byEmail(email) {
+        return this.db.prepare('SELECT * FROM users WHERE email = ?').get(email) || null;
+    }
+    list() {
+        return this.db.prepare(`
       SELECT u.id, u.email, u.name, u.role, u.status, u.external_id, u.created_at, u.last_login_at,
              (SELECT COUNT(*) FROM chats c WHERE c.user_id = u.id) AS chat_count
       FROM users u ORDER BY u.created_at ASC
     `).all();
-  }
-
-  /** Admin-side changes only: role in (admin,user), status in (pending,approved,disabled). */
-  update(id, { role, status } = {}) {
-    const sets = []; const vals = [];
-    if (role !== undefined) { sets.push('role = ?'); vals.push(role); }
-    if (status !== undefined) {
-      sets.push('status = ?'); vals.push(status);
-      if (status === 'approved') { sets.push('approved_at = COALESCE(approved_at, ?)'); vals.push(Date.now()); }
-    }
-    if (sets.length) this.db.prepare(`UPDATE users SET ${sets.join(', ')} WHERE id = ?`).run(...vals, id);
-    return this.get(id);
-  }
-
-  byExternalId(externalId) {
-    return this.db.prepare('SELECT * FROM users WHERE external_id = ?').get(externalId) || null;
-  }
-
-  /** Whether another account already holds this email (emails are unique). */
-  emailTaken(email, exceptId) {
-    return Boolean(this.db.prepare('SELECT 1 FROM users WHERE email = ? AND id != ?').get(email, exceptId));
-  }
-
-  /**
-   * Creates the user a gateway vouched for, unless one with that external id
-   * exists. The unique index makes this atomic: concurrent first requests race
-   * to insert, exactly one wins. Returns { user, created }.
-   */
-  provision({ externalId, role, status, now = Date.now() }) {
-    const created = this.db.prepare(`
+    }
+    /** Admin-side changes only: role in (admin,user), status in (pending,approved,disabled). */
+    update(id, { role, status } = {}) {
+        const sets = [];
+        const vals = [];
+        if (role !== undefined) {
+            sets.push('role = ?');
+            vals.push(role);
+        }
+        if (status !== undefined) {
+            sets.push('status = ?');
+            vals.push(status);
+            if (status === 'approved') {
+                sets.push('approved_at = COALESCE(approved_at, ?)');
+                vals.push(Date.now());
+            }
+        }
+        if (sets.length)
+            this.db.prepare(`UPDATE users SET ${sets.join(', ')} WHERE id = ?`).run(...vals, id);
+        return this.get(id);
+    }
+    byExternalId(externalId) {
+        return this.db.prepare('SELECT * FROM users WHERE external_id = ?').get(externalId) || null;
+    }
+    /** Whether another account already holds this email (emails are unique). */
+    emailTaken(email, exceptId) {
+        return Boolean(this.db.prepare('SELECT 1 FROM users WHERE email = ? AND id != ?').get(email, exceptId));
+    }
+    /**
+     * Creates the user a gateway vouched for, unless one with that external id
+     * exists. The unique index makes this atomic: concurrent first requests race
+     * to insert, exactly one wins. Returns { user, created }.
+     */
+    provision({ externalId, role, status, now = Date.now() }) {
+        const created = this.db.prepare(`
       INSERT INTO users (id, external_id, role, status, created_at, approved_at, last_login_at)
       VALUES (?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(external_id) DO NOTHING
     `).run(randomUUID(), externalId, role, status, now, status === 'approved' ? now : null, now).changes > 0;
-    return { user: this.byExternalId(externalId), created };
-  }
-
-  /** Gateway-side sync of identity metadata; only these columns can be set. */
-  sync(id, fields) {
-    const allowed = ['email', 'name', 'role', 'status', 'last_login_at'];
-    const keys = Object.keys(fields).filter((k) => allowed.includes(k));
-    if (keys.length) this.db.prepare(`UPDATE users SET ${keys.map((k) => `${k} = ?`).join(', ')} WHERE id = ?`).run(...keys.map((k) => fields[k]), id);
-    return this.get(id);
-  }
-
-  /** The single approved admin account behind a 'single' password. */
-  ensureOwner(id) {
-    const now = Date.now();
-    this.db.prepare(`INSERT INTO users (id, role, status, created_at, approved_at)
+        return { user: this.byExternalId(externalId), created };
+    }
+    /** Gateway-side sync of identity metadata; only these columns can be set. */
+    sync(id, fields) {
+        const allowed = ['email', 'name', 'role', 'status', 'last_login_at'];
+        const keys = Object.keys(fields).filter((k) => allowed.includes(k));
+        if (keys.length)
+            this.db.prepare(`UPDATE users SET ${keys.map((k) => `${k} = ?`).join(', ')} WHERE id = ?`).run(...keys.map((k) => fields[k]), id);
+        return this.get(id);
+    }
+    /** The single approved admin account behind a 'single' password. */
+    ensureOwner(id) {
+        const now = Date.now();
+        this.db.prepare(`INSERT INTO users (id, role, status, created_at, approved_at)
       VALUES (?, 'admin', 'approved', ?, ?) ON CONFLICT(id) DO NOTHING`).run(id, now, now);
-  }
-
-  addSession(tokenHash, userId, expiresAt) {
-    this.db.prepare('INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
-      .run(tokenHash, userId, Date.now(), expiresAt);
-  }
-
-  getSession(tokenHash) {
-    return this.db.prepare('SELECT * FROM sessions WHERE token_hash = ?').get(tokenHash) || null;
-  }
-
-  deleteSession(tokenHash) {
-    this.db.prepare('DELETE FROM sessions WHERE token_hash = ?').run(tokenHash);
-  }
-
-  deleteUserSessions(userId) {
-    this.db.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
-  }
+    }
+    removePasswordless(id) {
+        this.db.prepare('DELETE FROM users WHERE id = ? AND password_hash IS NULL AND external_id IS NULL').run(id);
+    }
+    /** Atomically claims a fresh local installation. Exactly one caller wins. */
+    createFirstLocal({ email, passwordHash, now = Date.now() }) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            if (this.localCount() !== 0) {
+                this.db.exec('ROLLBACK');
+                return null;
+            }
+            const id = randomUUID();
+            this.db.prepare(`INSERT INTO users
+        (id, email, password_hash, role, status, created_at, approved_at, last_login_at)
+        VALUES (?, ?, ?, 'admin', 'approved', ?, ?, ?)`)
+                .run(id, email, passwordHash, now, now, now);
+            this.db.exec('COMMIT');
+            return this.get(id);
+        }
+        catch (err) {
+            this.db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    createInvite({ id, tokenHash, email, createdBy, createdAt = Date.now(), expiresAt }) {
+        this.db.prepare(`INSERT INTO invitations
+      (id, token_hash, email, created_by, created_at, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?)`)
+            .run(id, tokenHash, email, createdBy, createdAt, expiresAt);
+        return this.db.prepare('SELECT id, email, created_by, created_at, expires_at FROM invitations WHERE id = ?').get(id);
+    }
+    listInvites(now = Date.now()) {
+        return this.db.prepare(`SELECT id, email, created_by, created_at, expires_at
+      FROM invitations WHERE used_at IS NULL AND expires_at > ? ORDER BY created_at DESC`).all(now);
+    }
+    revokeInvite(id) {
+        return this.db.prepare('DELETE FROM invitations WHERE id = ? AND used_at IS NULL').run(id).changes > 0;
+    }
+    /** Claims a valid invitation and creates its approved local user in one transaction. */
+    acceptInvite({ tokenHash, email, passwordHash, now = Date.now() }) {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const invite = this.db.prepare('SELECT * FROM invitations WHERE token_hash = ?').get(tokenHash);
+            if (!invite || invite.used_at !== null || invite.expires_at <= now) {
+                this.db.exec('ROLLBACK');
+                return { error: 'invalid_or_expired' };
+            }
+            if (invite.email && invite.email !== email) {
+                this.db.exec('ROLLBACK');
+                return { error: 'email_mismatch' };
+            }
+            if (this.byEmail(email)) {
+                this.db.exec('ROLLBACK');
+                return { error: 'email_taken' };
+            }
+            const id = randomUUID();
+            this.db.prepare(`INSERT INTO users
+        (id, email, password_hash, role, status, created_at, approved_at, last_login_at)
+        VALUES (?, ?, ?, 'user', 'approved', ?, ?, ?)`)
+                .run(id, email, passwordHash, now, now, now);
+            this.db.prepare('UPDATE invitations SET used_at = ?, used_by = ? WHERE id = ?').run(now, id, invite.id);
+            this.db.exec('COMMIT');
+            return { user: this.get(id) };
+        }
+        catch (err) {
+            this.db.exec('ROLLBACK');
+            throw err;
+        }
+    }
+    addSession(tokenHash, userId, expiresAt) {
+        this.db.prepare('INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)')
+            .run(tokenHash, userId, Date.now(), expiresAt);
+    }
+    getSession(tokenHash) {
+        return this.db.prepare('SELECT * FROM sessions WHERE token_hash = ?').get(tokenHash) || null;
+    }
+    deleteSession(tokenHash) {
+        this.db.prepare('DELETE FROM sessions WHERE token_hash = ?').run(tokenHash);
+    }
+    deleteUserSessions(userId) {
+        this.db.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+    }
 }

package/src/store/wire.js

@@ -1,55 +1,64 @@
 /* Row <-> message shapes: what the model is sent (toWire) and what the UI shows (toView). */
-
 function base(row) {
-  const msg = { role: row.role };
-  if (row.tool_call_id) msg.tool_call_id = row.tool_call_id;
-  if (row.tool_calls_json) msg.tool_calls = JSON.parse(row.tool_calls_json);
-  if (row.reasoning_details_json) msg.reasoning_details = JSON.parse(row.reasoning_details_json);
-  if (row.images_json) msg.images = JSON.parse(row.images_json);
-  return msg;
+    // content is set by each caller, after these, so the key order stays as it was.
+    const msg = { role: row.role };
+    if (row.tool_call_id)
+        msg.tool_call_id = row.tool_call_id;
+    if (row.tool_calls_json)
+        msg.tool_calls = JSON.parse(row.tool_calls_json);
+    if (row.reasoning_details_json)
+        msg.reasoning_details = JSON.parse(row.reasoning_details_json);
+    if (row.images_json)
+        msg.images = JSON.parse(row.images_json);
+    return msg;
 }
-
 /**
  * What the model sees. A demoted tool message sends its stub; everything else
  * sends its content verbatim. Reasoning text rides along; `buildMessages` in
  * harness/provider.js decides whether the provider gets it back.
  */
 export function toWire(row) {
-  const msg = base(row);
-  if (row.reasoning) msg.reasoning = row.reasoning;
-  msg.content = row.role === 'tool' ? (row.stub_text ?? row.content) : (row.content ?? null);
-  // An epoch took these images off the wire. The note is a pure function of
-  // the row, so every rebuild sends the same bytes.
-  if (row.images_dropped && msg.images?.length) {
-    const n = msg.images.length;
-    msg.content = `${msg.content ?? ''}\n\n[${n} image${n === 1 ? '' : 's'} attached here ${n === 1 ? 'was' : 'were'} removed from context to save space. Ask the user to re-attach if you need to look again.]`;
-    delete msg.images;
-  }
-  // A model that was sent images needs the OpenAI multimodal shape -- an array
-  // of parts rather than a plain string. Built only when there are images, so
-  // every text-only turn keeps sending the plain string it always has, which
-  // is what most of the caching machinery in harness/provider.js assumes.
-  if (msg.images?.length) {
-    const parts = [];
-    if (msg.content) parts.push({ type: 'text', text: msg.content });
-    for (const img of msg.images) {
-      parts.push({ type: 'image_url', image_url: { url: `data:${img.mime};base64,${img.data}` } });
+    const msg = base(row);
+    if (row.reasoning)
+        msg.reasoning = row.reasoning;
+    msg.content = row.role === 'tool' ? (row.stub_text ?? row.content) : (row.content ?? null);
+    // An epoch took these images off the wire. The note is a pure function of
+    // the row, so every rebuild sends the same bytes.
+    if (row.images_dropped && msg.images?.length) {
+        const n = msg.images.length;
+        msg.content = `${msg.content ?? ''}\n\n[${n} image${n === 1 ? '' : 's'} attached here ${n === 1 ? 'was' : 'were'} removed from context to save space. Ask the user to re-attach if you need to look again.]`;
+        delete msg.images;
+    }
+    // A model that was sent images needs the OpenAI multimodal shape -- an array
+    // of parts rather than a plain string. Built only when there are images, so
+    // every text-only turn keeps sending the plain string it always has, which
+    // is what most of the caching machinery in harness/provider.js assumes.
+    if (msg.images?.length) {
+        const parts = [];
+        // Still the row's own text here: parts are only built below.
+        if (msg.content)
+            parts.push({ type: 'text', text: msg.content });
+        for (const img of msg.images) {
+            parts.push({ type: 'image_url', image_url: { url: `data:${img.mime};base64,${img.data}` } });
+        }
+        msg.content = parts;
     }
-    msg.content = parts;
-  }
-  delete msg.images;
-  return msg;
+    delete msg.images;
+    return msg;
 }
-
 /** What the transcript shows: always the full text, stub or not. */
 export function toView(row) {
-  const msg = base(row);
-  // The client needs a handle on each message to be able to rewind to one.
-  msg.seq = row.seq;
-  msg.content = row.content ?? null;
-  if (row.reasoning) msg.reasoning = row.reasoning;
-  if (row.usage_json) msg.usage = JSON.parse(row.usage_json);
-  if (row.stub_text) msg.compacted = true;
-  if (row.origin_json) msg.origin = JSON.parse(row.origin_json);
-  return msg;
+    const msg = base(row);
+    // The client needs a handle on each message to be able to rewind to one.
+    msg.seq = row.seq;
+    msg.content = row.content ?? null;
+    if (row.reasoning)
+        msg.reasoning = row.reasoning;
+    if (row.usage_json)
+        msg.usage = JSON.parse(row.usage_json);
+    if (row.stub_text)
+        msg.compacted = true;
+    if (row.origin_json)
+        msg.origin = JSON.parse(row.origin_json);
+    return msg;
 }

package/src/tools/ask_tool.js

@@ -7,87 +7,87 @@
  * only validates the call and turns the outcome into the tool result. A run
  * with nobody to ask (an automation) never waits; it gets the fallback at once.
  */
-
 export const ASK_USER = 'ask_user';
-
 const MAX_QUESTION = 2000;
 const MAX_CHOICES = 10;
 const MAX_CHOICE = 200;
-
 export function askToolDef() {
-  return {
-    type: 'function',
-    function: {
-      name: ASK_USER,
-      description: [
-        'Ask the user one question and wait for the answer, then continue this same task',
-        'with it. The run pauses until they answer; if they do not answer in time, you are',
-        'told so and continue on your own assumptions.',
-        '',
-        'Use it only for information that materially changes the result and that you cannot',
-        'infer or safely assume: choosing between materially different files, accounts or',
-        'environments; a missing value; a decision with real downstream effects; a manual',
-        'step the user must do first.',
-        '',
-        'Do not use it to ask "should I continue?", for preferences with a sensible default,',
-        'to confirm ordinary reversible actions, or because the request is only mildly',
-        'ambiguous -- make a reasonable assumption and state it instead. One question per',
-        'call; offer `choices` when there are a few valid answers.'
-      ].join('\n'),
-      parameters: {
-        type: 'object',
-        properties: {
-          question: { type: 'string', description: 'The question, written for the user to read.' },
-          choices: {
-            type: 'array',
-            items: { type: 'string' },
-            description: `Optional answers to pick from (up to ${MAX_CHOICES}).`
-          },
-          allow_free_text: {
-            type: 'boolean',
-            description: 'Whether the user may type their own answer instead of picking a choice. Default true.'
-          }
-        },
-        required: ['question']
-      }
-    }
-  };
+    return {
+        type: 'function',
+        function: {
+            name: ASK_USER,
+            description: [
+                'Ask the user one question and wait for the answer, then continue this same task',
+                'with it. The run pauses until they answer; if they do not answer in time, you are',
+                'told so and continue on your own assumptions.',
+                '',
+                'Use it only for information that materially changes the result and that you cannot',
+                'infer or safely assume: choosing between materially different files, accounts or',
+                'environments; a missing value; a decision with real downstream effects; a manual',
+                'step the user must do first.',
+                '',
+                'Do not use it to ask "should I continue?", for preferences with a sensible default,',
+                'to confirm ordinary reversible actions, or because the request is only mildly',
+                'ambiguous -- make a reasonable assumption and state it instead. One question per',
+                'call; offer `choices` when there are a few valid answers.'
+            ].join('\n'),
+            parameters: {
+                type: 'object',
+                properties: {
+                    question: { type: 'string', description: 'The question, written for the user to read.' },
+                    choices: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        description: `Optional answers to pick from (up to ${MAX_CHOICES}).`
+                    },
+                    allow_free_text: {
+                        type: 'boolean',
+                        description: 'Whether the user may type their own answer instead of picking a choice. Default true.'
+                    }
+                },
+                required: ['question']
+            }
+        }
+    };
 }
-
 /** The result text for each way a question can end. JSON, so it parses and reads. */
 export function askResult(outcome) {
-  if (outcome.answered) return JSON.stringify({ answered: true, answer: outcome.answer });
-  const message = {
-    timeout: 'The user did not respond within the configured timeout.',
-    skipped: 'The user chose to let you continue without answering.',
-    unattended: 'No interactive user is available for this run.'
-  }[outcome.reason] || 'The question could not be put to the user.';
-  return JSON.stringify({
-    answered: false,
-    reason: outcome.reason,
-    message: `${message} Continue the task using your own reasonable assumptions, and state any`
-      + ' important assumptions in your final answer when they materially affect the result.'
-  });
+    if (outcome.answered)
+        return JSON.stringify({ answered: true, answer: outcome.answer });
+    const message = {
+        timeout: 'The user did not respond within the configured timeout.',
+        skipped: 'The user chose to let you continue without answering.',
+        unattended: 'No interactive user is available for this run.'
+    }[outcome.reason] || 'The question could not be put to the user.';
+    return JSON.stringify({
+        answered: false,
+        reason: outcome.reason,
+        message: `${message} Continue the task using your own reasonable assumptions, and state any`
+            + ' important assumptions in your final answer when they materially affect the result.'
+    });
 }
-
 /**
  * The tool handler. `ctx.askUser({ question, choices, allowFreeText })`
  * resolves to `{ answered: true, answer }` or `{ answered: false, reason }`;
  * without one (an unattended run) the fallback comes back at once.
  */
 export async function callAskUser(args, ctx) {
-  const question = typeof args.question === 'string' ? args.question.trim() : '';
-  if (!question) return 'Error: "question" is required and must be a non-empty string.';
-  if (question.length > MAX_QUESTION) return `Error: "question" is over ${MAX_QUESTION} characters; ask something shorter.`;
-  if (args.choices !== undefined && !(Array.isArray(args.choices) && args.choices.every((c) => typeof c === 'string'))) {
-    return 'Error: "choices" must be a list of strings.';
-  }
-  const choices = [...new Set((args.choices || []).map((c) => c.trim()).filter(Boolean))];
-  if (choices.length > MAX_CHOICES) return `Error: at most ${MAX_CHOICES} choices.`;
-  if (choices.some((c) => c.length > MAX_CHOICE)) return `Error: each choice must be under ${MAX_CHOICE} characters.`;
-  // Nothing to pick and nothing to type would be a question nobody can answer.
-  const allowFreeText = args.allow_free_text !== false || choices.length === 0;
-
-  if (ctx.unattended || !ctx.askUser) return askResult({ answered: false, reason: 'unattended' });
-  return askResult(await ctx.askUser({ question, choices, allowFreeText }));
+    const question = typeof args.question === 'string' ? args.question.trim() : '';
+    if (!question)
+        return 'Error: "question" is required and must be a non-empty string.';
+    if (question.length > MAX_QUESTION)
+        return `Error: "question" is over ${MAX_QUESTION} characters; ask something shorter.`;
+    if (args.choices !== undefined && !(Array.isArray(args.choices) && args.choices.every((c) => typeof c === 'string'))) {
+        return 'Error: "choices" must be a list of strings.';
+    }
+    const choices = [...new Set((args.choices || []).map((c) => c.trim()).filter(Boolean))];
+    if (choices.length > MAX_CHOICES)
+        return `Error: at most ${MAX_CHOICES} choices.`;
+    if (choices.some((c) => c.length > MAX_CHOICE))
+        return `Error: each choice must be under ${MAX_CHOICE} characters.`;
+    // Nothing to pick and nothing to type would be a question nobody can answer.
+    const allowFreeText = args.allow_free_text !== false || choices.length === 0;
+    if (ctx.unattended || !ctx.askUser)
+        return askResult({ answered: false, reason: 'unattended' });
+    return askResult(await ctx.askUser({ question, choices, allowFreeText }));
 }