* Preserve original content-type in fetch-url API
The API now returns the content-type from the fetched response instead of always using text/plain. This allows clients to receive the correct content type for the requested resource.
* Improve MIME type handling for URL file fetches
Adds a utility for safer MIME type inference and selection, using file extensions and forwarded headers. Updates file fetch logic in UrlFetchModal and loadAttachmentsFromUrls to use the new helper, improving filename extraction and MIME type accuracy. The API endpoint now always returns 'text/plain' for safety, exposing the original content type in a custom header.
* Update src/lib/components/chat/UrlFetchModal.svelte
Co-authored-by: Eliott C. <coyotte508@gmail.com>
* Update src/lib/utils/loadAttachmentsFromUrls.ts
Co-authored-by: Eliott C. <coyotte508@gmail.com>
---------
Co-authored-by: Eliott C. <coyotte508@gmail.com>
Add strict security headers to fetch-url endpoint (#1993)
Introduces comprehensive security headers and forces 'text/plain' content type for all responses from the fetch-url API endpoint. This prevents execution of active content and mitigates risks if the endpoint is accessed directly.
* Update ServerCard.svelte
feat(mcp): add Model Context Protocol integration with tool support
Improve MCP tools caching and server selection logic
Replaces single-entry MCP tools cache with a multi-keyed cache based on server configuration, improving cache accuracy for different server sets. Refactors server selection logic in runMcpFlow to better handle custom server lists and selected server names. Removes MCP flow from generate.ts, streamlining text generation logic.
* Add OAuth authentication for MCP servers
Introduces browser-based OAuth flow for MCP servers, including new auth helpers, localStorage management, and UI actions for authentication and sign-out. Server cards now support authentication, and enabled servers include persisted auth headers for API requests. Adds callback handler and route for OAuth completion.
* Add server authentication status and UI indicators
Introduces an 'authRequired' property to MCPServer and health check responses to indicate when authenti…
* Add custom scrollbar class to Modal component
Applied the 'scrollbar-custom' class to the Modal's main container to enable custom scrollbar styling. This improves the appearance and consistency of scrollbars within modals.
* Add support for loading attachments from URLs
Implements the ability to load file attachments via URL parameters using a new utility (loadAttachmentsFromUrls) and a server-side proxy endpoint (/api/fetch-url) to securely fetch remote files. Updates chat and model pages to handle 'attachments' query parameters, injects file content into user messages, and improves multimodal message preparation. Also includes minor UI adjustments for file display and refactors Plausible analytics script initialization.
* Block redirects in fetch-url API endpoint
* Add custom scrollbar class to Modal component
Applied the 'scrollbar-custom' class to the Modal's main container to enable custom scrollbar styling. This improves the appearance and consistency of scrollbars within modals.
* Add support for loading attachments from URLs
Implements the ability to load file attachments via URL parameters using a new utility (loadAttachmentsFromUrls) and a server-side proxy endpoint (/api/fetch-url) to securely fetch remote files. Updates chat and model pages to handle 'attachments' query parameters, injects file content into user messages, and improves multimodal message preparation. Also includes minor UI adjustments for file display and refactors Plausible analytics script initialization.
