Commit History
-
fix: add ngrok domains to frame-ancestors CSP Running
cb9873f -
feat: default to zai-org/GLM-4.7 as the default model
9883efb -
feat: add DEFAULT_MODEL environment variable support
Allows setting a specific model as the default via DEFAULT_MODEL env var, similar to how TASK_MODEL works. If not set, falls back to models[0].34f0b6d -
fix: allow localhost in frame-ancestors for testing
b868ae9 -
fix: add hf.space to allowed frame-ancestors
HuggingFace Spaces uses *.hf.space domain for serving apps, so we need to allow that in addition to huggingface.coefbd4d0 -
fix: use port 7860 (HuggingFace Spaces default)
f1a4933 -
fix: use environment variables for HOST/PORT instead of CLI args
SvelteKit's Node adapter reads HOST and PORT from environment variables, not command line arguments. This was causing the server to not bind to the correct port, failing the HuggingFace Spaces healthcheck.9ff732c -
chore: enable embedded MongoDB by default for HF Spaces
af0a419 -
chore: update README.md with metadata for Chat UI
183db9b -
chore: configure Git LFS for binary files
f09ff48
-
fix: allow localhost frame-ancestors in development mode
Adds http://localhost:* and http://127.0.0.1:* to allowed frame-ancestors when running in development mode, enabling local testing of iframe embedding.b4ad3ab -
feat: restrict iframe embedding to huggingface.co
When ALLOW_IFRAME=true, instead of allowing all origins, now specifically allows embedding only from https://huggingface.co and 'self'. This enables embedding the chat UI on pages like huggingface.co/papers while maintaining security by blocking embedding from other origins.4b0f9fa
-
Bump @modelcontextprotocol/sdk from 1.25.1 to 1.25.2 (#2035)
dependabot[bot] +1: dependabot[bot]Unverified signatureBumps [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) from 1.25.1 to 1.25.2. - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/1.25.1...v1.25.2) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.25.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>18a5518 -
Bump undici from 7.16.0 to 7.18.2 (#2047)
dependabot[bot] +1: dependabot[bot]Unverified signatureBumps [undici](https://github.com/nodejs/undici) from 7.16.0 to 7.18.2. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v7.16.0...v7.18.2) --- updated-dependencies: - dependency-name: undici dependency-version: 7.18.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>4c450dd -
refactor: remove isPro from database schema (#2050)
Unverified signature* refactor: remove isPro from database schema - Remove isPro field from User type - Remove isPro parsing from OAuth login - Remove isPro from user API response - isPro is now fetched purely client-side from HuggingFace public API * fix: keep isPro as null on fetch error to avoid showing wrong badge6e4c99f -
feat: add PRO badge and credits modal for HuggingChat (#2048)
Unverified signature* feat: add PRO badge and credits modal for HuggingChat - Add isPro field to User type and persist from OAuth login - Fetch fresh isPro status from HuggingFace public API on page load - Display "Get PRO" button for non-PRO users in sidebar - Display "PRO" badge for PRO users in sidebar - Update SubscribeModal to show "Purchase Credits" for PRO users - Add IconPro component for gradient sparkle icon * feat: improve SubscribeModal UI for PRO users - Use IconDazzled with yellow-orange-red gradient for "Out of Credits" - Use IconPro with pink-green-yellow gradient for "Upgrade Required" - Update credits message to mention HF services and Inference Providersb9a2152
-
Adding tool-tip and updating color for sidebar toggle button. (#2044)
Unverified signatureadding tooltip and updating colora2297a7
-
fix(markdown): use htmlparser2 instead of DOMPurify for Web Worker compatibility (#2039)
Unverified signature- Replace isomorphic-dompurify with htmlparser2 (works in Web Workers) - Add sanitizeHtmlForMultimedia() for video/audio/source tag allowlisting - Update tests to expect escaped (not stripped) disallowed tags97bf9da -
feat(markdown): allow video and audio tags (#2037)
Unverified signature* feat(markdown): allow video and audio tags in markdown - Add custom image renderer to convert video/audio URLs to media tags - Use DOMPurify to sanitize raw HTML, allowing only video/audio/source - Add comprehensive tests for media rendering and XSS prevention * feat(mcp): increase tool timeout from 30s to 60s * feat(mcp): update tool prompt to mention video/audio support * test: update markdown test for DOMPurify behavior7b56bb5 -
fix(mcp): communicate tool errors to LLM to prevent hallucinated success (#2036)
Unverified signatureWhen MCP tool calls fail (e.g., timeout), the error was shown in the UI but not sent to the LLM. This caused the LLM to hallucinate success because it never received feedback about the failure. Now error messages are included in toolMessages so the LLM can acknowledge failures and respond appropriately.02a3822
-
MCP Tool Progress Notifications and MCP SDK bump. (#2030)
shaun smithUnverified signature* bump SDK version * MCP Tool Progress Notifications * lintcc316dd -
[Fix]: Hovering bug of close button in dark theme. (#2034)
Unverified signaturefixing hovering bug of close button in dark theme.0464cba
-
fix(mcp): reduce Exa API context size sent to LLM (#2026)
Unverified signatureUse highlights instead of full page text to minimize context size. The previous implementation requested `text: true` which returned entire page contents (5-20K+ chars per result), overwhelming LLM context. Now uses: - highlights: 3 sentences, 2 per URL (concise, query-relevant) - text fallback: max 500 chars (only if highlights empty) This matches what the MCP server at mcp.exa.ai likely returns.2d994c9
-
Fix DEV login (#2023)
Unverified signature--------- Co-authored-by: Eliott C. <coyotte508@gmail.com>d4e1a40 -
fix redirect url in CIMD doc
80ad6b8
-
feat(mcp): add direct Exa API integration to bypass slow mcp.exa.ai (#2021)
Unverified signature* feat(mcp): add direct Exa API integration to bypass slow mcp.exa.ai Intercepts calls to mcp.exa.ai and routes them directly to api.exa.ai, eliminating the slow hosted MCP server (~3-12s latency) while keeping the same user configuration. - Add exaDirect.ts module with direct API client - Intercept tool listing in tools.ts to return hardcoded definitions - Intercept tool calls in httpClient.ts to use direct API - Add EXA_API_KEY config for authentication No user config changes needed - existing MCP_SERVERS with mcp.exa.ai continue to work transparently. * Add scroll to metadata output in ToolUpdate Wrapped the metadata <pre> block with custom scrollbar, max height, and vertical overflow for better readability when displaying large metadata content. * fix(mcp): bypass mcp.exa.ai in health check, security/leak fixes - Add Exa bypass to /api/mcp/health endpoint for instant response - Support x-api-key header for API key (preferred over URL param) - Fix event listener leak by addin…1d3e986
-
fix(log): log warn in case of payment required
Unverified signature30b54ae -
fix(log): rename context field
Unverified signature6137a33 -
fix(log): add statusCode in log context
Unverified signature06d5cfe -
fix(logger): contextual logs (#2019)
Unverified signatureb70b749 -
fix: improve logs (#2018)
Unverified signaturec178e57
-
Require authentication before processing query params (#2017)
Unverified signatureAdded checks in +page.svelte and models/[...model]/+page.svelte to require authentication if 'q', 'prompt', or 'attachments' query parameters are present. This prevents unauthenticated users from processing these parameters and ensures proper redirection to login when needed. Also improved error handling for non-JSON error responses.c6c2e23 -
fix(logger): rename message field in logs (#2015)
Unverified signature86afb5e -
fix(log): use logger (#2016)
Unverified signature55137e7 -
Refactor tool block update logic in ChatMessage
Replaces the use of the last block for tool updates with a search for an existing tool block by UUID. This ensures that updates are correctly grouped with their corresponding tool blocks, improving message block handling.788aa2d -
Handle closed connection errors in MCP HTTP client
99156e4 -
fix(mcp): use logger (#2014)
Unverified signatured6b4c4f
-
Escape HTML in href attribute
242870e
-
Add black background to welcome modal image
76c6bc7
-
Update welcome modal image source path
de92afb -
Replace welcome modal video with GIF for mobile compatibility (#2011)
Unverified signatureReplace welcome modal video with optimized GIF for mobile compatibility Videos with autoplay don't work reliably on mobile browsers. This change replaces the external CDN video with a locally hosted animated GIF that works consistently across all devices. - Created 2x retina resolution GIF (840x384, renders at 420x192) - Optimized to 1.08MB with 24-color palette - 20 frames at 10fps for smooth 2-second loop - Updated WelcomeModal to use img tag instead of video - Removes dependency on external CDN Co-authored-by: Claude <noreply@anthropic.com>fc0da1b -
Add max_tokens parameter to GLM-4.6V model config
Set the max_tokens parameter to 8192 for the zai-org/GLM-4.6V model in both dev and prod environment YAML files to control output length.bba8f4d -
Add new LLM models to dev and prod configs
Added DictaLM-3.0-24B-Thinking, EssentialAI/rnj-1-instruct, ServiceNow-AI/Apriel-1.6-15b-Thinker, and three GLM-4.6V variants to the MODELS list in both dev.yaml and prod.yaml to expand supported reasoning, coding, and multimodal capabilities.e6a5c03 -
formatting
b25ac89 -
Add documentation
Introduced a new documentation structure under docs/source, covering configuration, installation (local, Docker, Helm), architecture, and common issues. Updated .env and README.md to clarify model discovery and LLM router configuration. This improves onboarding, setup, and operational guidance for developers and users.700a224
-
transcription returning ellipsis dots (#2009)
Unverified signatureFix transcription returning dots for silence/unclear audio Whisper model returns "..." (or similar dot patterns) when audio is too short, silent, or unclear. Filter out responses that only contain dots server-side to prevent them from being inserted into the draft message or triggering auto-send on mobile. Co-authored-by: Claude <noreply@anthropic.com>d2ae872 -
Update README with simplified MongoDB setup instructions
Streamlines the setup steps by clarifying that MongoDB configuration is optional for local development, as Chat UI now falls back to an embedded MongoDB if MONGODB_URL is not set. Updates Docker instructions and removes redundant details about MongoDB setup, making the guide easier to follow for new users.96fb92b -
Update README for improved setup instructions
Clarifies local setup instructions, corrects Docker port mapping, and updates LLM router description to reflect server-side smart routing. These changes improve accuracy and usability of the documentation.008e1e3 -
Enhance meta tags and add robots.txt
Updated meta tags in +layout.svelte for improved SEO and social sharing, including more detailed Twitter and Open Graph tags. Added robots.txt to control crawler access and reference sitemap.92b5726 -
Use base path in redirect for conversation page
Updated the redirect in the conversation page loader to use the `base` path from `$app/paths` instead of a hardcoded root path. This ensures correct redirection when the app is deployed under a subpath.96e9f3b