feat: add the community-funded Homarr assistant provider (#6563)

* Add Homarr provider proxy foundation * Complete Homarr provider integration * Harden Homarr provider integration * Address Homarr provider review feedback * Address CodeRabbit provider feedback * Localize provider errors * Handle provider activity load failures * docs: improve workshop and homepage * Harden Homarr provider limits * fix: harden the Homarr provider * fix: address provider review feedback * fix: clarify provider request accounting * feat: complete the Homarr provider endpoint * fix: terminate invalid provider streams
2026-08-14 11:32:11 +02:00
1 parent b8f360c04e
commit 45d8bc9443
@@ -26,6 +26,7 @@ import {
 } from "@mantine/core";
 import {
  IconAlertTriangle,
+  IconBrandGithub,
  IconCheck,
  IconCircleCheck,
  IconDatabaseSearch,
@@ -51,14 +52,14 @@ import type { AssistantProvider, AssistantProviderCategory } from "@homarr/defin
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
 import { useScopedI18n } from "@homarr/translation/client";

+import { getWorkshopAssistantProviderUrl } from "~/components/workshop/workshop-client";
+
 import classes from "./assistant-configuration.module.css";
 import { formatAssistantContextWindow, getAssistantConnectionState } from "./assistant-configuration-state";

 type HeaderEntry = { id: number; name: string; value: string };
 type CredentialFlow = "idle" | "remove";
-type AssistantProviderOption = AssistantProvider | "homarr";
-
-const ProviderIcon = ({ providerId, size = 20 }: { providerId: AssistantProviderOption; size?: number }) => {
+const ProviderIcon = ({ providerId, size = 20 }: { providerId: AssistantProvider; size?: number }) => {
  if (providerId === "homarr") {
    return <Image src="/logo/logo.png" alt="" aria-hidden w={size} h={size} fit="contain" />;
  }
@@ -154,8 +155,13 @@ export const AssistantConfiguration = () => {
  const [webSearchEnabled, setWebSearchEnabled] = useState(false);

  useEffect(() => {
-    setProvider(configuration?.provider ?? "openrouter");
-    setBaseUrl(configuration?.baseUrl ?? assistantProviderPresets.openrouter.baseUrl);
+    const configuredProvider = configuration?.provider ?? "openrouter";
+    setProvider(configuredProvider);
+    setBaseUrl(
+      configuredProvider === "homarr"
+        ? getWorkshopAssistantProviderUrl()
+        : (configuration?.baseUrl ?? assistantProviderPresets.openrouter.baseUrl),
+    );
    setModelDiscoveryPath(configuration?.modelDiscoveryPath ?? "");
    setModelId(configuration?.modelId ?? "");
    setEnabled(configuration?.enabled ?? false);
@@ -203,20 +209,7 @@ export const AssistantConfiguration = () => {
            label: t(`provider.options.${providerId}.label`),
          }));

-        return {
-          group: t(`provider.groups.${category}`),
-          items:
-            category === "hosted"
-              ? [
-                  {
-                    value: "homarr",
-                    label: t("provider.options.homarr.label"),
-                    disabled: true,
-                  },
-                  ...items,
-                ]
-              : items,
-        };
+        return { group: t(`provider.groups.${category}`), items };
      }),
    [t],
  );
@@ -232,6 +225,7 @@ export const AssistantConfiguration = () => {
  }, [modelId, models]);

  const preset = assistantProviderPresets[provider];
+  const isHomarrProvider = provider === "homarr";
  const headerValuesValid = headers.every((header) => header.name.trim().length > 0 && header.value.length > 0);
  const { hasStoredApiKey, connectionPending, connectionReady } = getAssistantConnectionState({
    connectionConfigured: configuration?.connectionConfigured === true,
@@ -304,7 +298,7 @@ export const AssistantConfiguration = () => {
    const nextPreset = assistantProviderPresets[nextProvider];
    clearDraftConnectionState();
    setProvider(nextProvider);
-    setBaseUrl(nextPreset.baseUrl);
+    setBaseUrl(nextProvider === "homarr" ? getWorkshopAssistantProviderUrl() : nextPreset.baseUrl);
    setModelDiscoveryPath(nextPreset.modelDiscoveryPath ?? "");
  };

@@ -334,16 +328,19 @@ export const AssistantConfiguration = () => {
  };

  const saveConnection = (clearApiKey = false) => {
-    const customHeaders =
-      headers.length > 0 ? Object.fromEntries(headers.map((header) => [header.name.trim(), header.value])) : undefined;
+    const customHeaders = isHomarrProvider
+      ? undefined
+      : headers.length > 0
+        ? Object.fromEntries(headers.map((header) => [header.name.trim(), header.value]))
+        : undefined;
    updateConnection.mutate({
      provider,
      baseUrl,
      modelDiscoveryPath: modelDiscoveryPath.trim() || null,
-      apiKey: clearApiKey ? undefined : apiKey.trim() || undefined,
-      clearApiKey,
+      apiKey: clearApiKey || isHomarrProvider ? undefined : apiKey.trim() || undefined,
+      clearApiKey: clearApiKey || isHomarrProvider,
      customHeaders,
-      clearCustomHeaders: clearHeaders,
+      clearCustomHeaders: clearHeaders || isHomarrProvider,
    });
  };

@@ -434,17 +431,12 @@ export const AssistantConfiguration = () => {
              leftSection={<ProviderIcon providerId={provider} />}
              renderOption={({ option }) => (
                <Group gap="sm" wrap="nowrap" align="center" w="100%">
-                  <ProviderIcon providerId={option.value as AssistantProviderOption} />
+                  <ProviderIcon providerId={option.value as AssistantProvider} />
                  <Box flex={1} miw={0}>
                    <Group gap="xs" wrap="nowrap" justify="space-between">
                      <Text size="sm" truncate>
                        {option.label}
                      </Text>
-                      {option.value === "homarr" && (
-                        <Badge size="xs" variant="light" color="gray" flex="0 0 auto">
-                          {t("provider.comingSoon")}
-                        </Badge>
-                      )}
                    </Group>
                  </Box>
                </Group>
@@ -455,6 +447,7 @@ export const AssistantConfiguration = () => {
              description={t("baseUrl.description")}
              leftSection={<IconWorld size={16} />}
              value={baseUrl}
+              disabled={isHomarrProvider}
              onChange={(event) => changeBaseUrl(event.currentTarget.value)}
              placeholder="https://provider.example/v1"
            />
@@ -462,6 +455,7 @@ export const AssistantConfiguration = () => {
              label={t("model.discoveryPath")}
              description={t("model.discoveryPathDescription")}
              value={modelDiscoveryPath}
+              disabled={isHomarrProvider}
              onChange={(event) => changeModelDiscoveryPath(event.currentTarget.value)}
              placeholder="/models"
            />
@@ -473,7 +467,11 @@ export const AssistantConfiguration = () => {
          title={t("credentials.title")}
          description={t("credentials.description")}
          status={
-            hasStoredApiKey ? undefined : (
+            isHomarrProvider ? (
+              <Badge variant="light" color="blue">
+                {t("credentials.workshop")}
+              </Badge>
+            ) : hasStoredApiKey ? undefined : (
              <Badge variant="light" color={preset.requiresApiKey ? "yellow" : "gray"}>
                {preset.requiresApiKey ? t("credentials.required") : t("credentials.optional")}
              </Badge>
@@ -494,7 +492,11 @@ export const AssistantConfiguration = () => {
            </Group>
          }
        >
-          {hasStoredApiKey && credentialFlow === "idle" ? (
+          {isHomarrProvider ? (
+            <Alert color="blue" icon={<IconBrandGithub size={18} />} title={t("provider.homarrAuth.title")}>
+              {t("provider.homarrAuth.description")}
+            </Alert>
+          ) : hasStoredApiKey && credentialFlow === "idle" ? (
            <Group className={classes.credentialSummary} justify="space-between" align="center">
              <Group className={classes.credentialSummaryContent} gap="sm" wrap="nowrap">
                <ThemeIcon color="teal" variant="light" radius="xl">
@@ -545,80 +547,87 @@ export const AssistantConfiguration = () => {
            />
          )}

-          <Accordion variant="contained" radius="md">
-            <Accordion.Item value="headers">
-              <Accordion.Control className={classes.advancedControl} icon={<IconShieldLock size={18} />}>
-                <Group justify="space-between" wrap="nowrap">
-                  <Box>
-                    <Text size="sm" fw={600}>
-                      {t("headers.title")}
-                    </Text>
-                    <Text size="xs" c="dimmed">
-                      {t("headers.description")}
-                    </Text>
-                  </Box>
-                  {configuration?.customHeadersConfigured && (
-                    <Badge variant="light" color={clearHeaders ? "yellow" : "green"}>
-                      {clearHeaders ? t("headers.pendingRemoval") : t("headers.savedBadge")}
-                    </Badge>
-                  )}
-                </Group>
-              </Accordion.Control>
-              <Accordion.Panel>
-                <Stack gap="sm">
-                  <Group justify="space-between" align="center">
-                    <Text size="sm" c="dimmed">
-                      {configuration?.customHeadersConfigured ? t("headers.configured") : t("headers.empty")}
-                    </Text>
-                    <Button variant="light" size="compact-sm" leftSection={<IconPlus size={14} />} onClick={addHeader}>
-                      {t("headers.add")}
-                    </Button>
+          {!isHomarrProvider && (
+            <Accordion variant="contained" radius="md">
+              <Accordion.Item value="headers">
+                <Accordion.Control className={classes.advancedControl} icon={<IconShieldLock size={18} />}>
+                  <Group justify="space-between" wrap="nowrap">
+                    <Box>
+                      <Text size="sm" fw={600}>
+                        {t("headers.title")}
+                      </Text>
+                      <Text size="xs" c="dimmed">
+                        {t("headers.description")}
+                      </Text>
+                    </Box>
+                    {configuration?.customHeadersConfigured && (
+                      <Badge variant="light" color={clearHeaders ? "yellow" : "green"}>
+                        {clearHeaders ? t("headers.pendingRemoval") : t("headers.savedBadge")}
+                      </Badge>
+                    )}
                  </Group>
-                  {headers.map((header) => (
-                    <Group key={header.id} align="flex-end" wrap="wrap">
-                      <TextInput
-                        flex={1}
-                        miw="12rem"
-                        label={t("headers.name")}
-                        value={header.name}
-                        onChange={(event) => updateHeader(header.id, "name", event.currentTarget.value)}
-                        placeholder="X-Provider-Header"
-                      />
-                      <PasswordInput
-                        flex={2}
-                        miw="12rem"
-                        label={t("headers.value")}
-                        value={header.value}
-                        onChange={(event) => updateHeader(header.id, "value", event.currentTarget.value)}
-                        placeholder={t("headers.valuePlaceholder")}
-                        autoComplete="off"
-                      />
-                      <Tooltip label={t("headers.remove")}>
-                        <ActionIcon
-                          size="lg"
-                          variant="subtle"
-                          color="red"
-                          aria-label={t("headers.remove")}
-                          onClick={() => setHeaders((current) => current.filter((item) => item.id !== header.id))}
-                        >
-                          <IconTrash size={17} />
-                        </ActionIcon>
-                      </Tooltip>
+                </Accordion.Control>
+                <Accordion.Panel>
+                  <Stack gap="sm">
+                    <Group justify="space-between" align="center">
+                      <Text size="sm" c="dimmed">
+                        {configuration?.customHeadersConfigured ? t("headers.configured") : t("headers.empty")}
+                      </Text>
+                      <Button
+                        variant="light"
+                        size="compact-sm"
+                        leftSection={<IconPlus size={14} />}
+                        onClick={addHeader}
+                      >
+                        {t("headers.add")}
+                      </Button>
                    </Group>
-                  ))}
-                  {configuration?.customHeadersConfigured && headers.length === 0 && (
-                    <Button
-                      variant="light"
-                      color={clearHeaders ? "gray" : "red"}
-                      onClick={() => setClearHeaders(!clearHeaders)}
-                    >
-                      {clearHeaders ? t("headers.keep") : t("headers.clear")}
-                    </Button>
-                  )}
-                </Stack>
-              </Accordion.Panel>
-            </Accordion.Item>
-          </Accordion>
+                    {headers.map((header) => (
+                      <Group key={header.id} align="flex-end" wrap="wrap">
+                        <TextInput
+                          flex={1}
+                          miw="12rem"
+                          label={t("headers.name")}
+                          value={header.name}
+                          onChange={(event) => updateHeader(header.id, "name", event.currentTarget.value)}
+                          placeholder="X-Provider-Header"
+                        />
+                        <PasswordInput
+                          flex={2}
+                          miw="12rem"
+                          label={t("headers.value")}
+                          value={header.value}
+                          onChange={(event) => updateHeader(header.id, "value", event.currentTarget.value)}
+                          placeholder={t("headers.valuePlaceholder")}
+                          autoComplete="off"
+                        />
+                        <Tooltip label={t("headers.remove")}>
+                          <ActionIcon
+                            size="lg"
+                            variant="subtle"
+                            color="red"
+                            aria-label={t("headers.remove")}
+                            onClick={() => setHeaders((current) => current.filter((item) => item.id !== header.id))}
+                          >
+                            <IconTrash size={17} />
+                          </ActionIcon>
+                        </Tooltip>
+                      </Group>
+                    ))}
+                    {configuration?.customHeadersConfigured && headers.length === 0 && (
+                      <Button
+                        variant="light"
+                        color={clearHeaders ? "gray" : "red"}
+                        onClick={() => setClearHeaders(!clearHeaders)}
+                      >
+                        {clearHeaders ? t("headers.keep") : t("headers.clear")}
+                      </Button>
+                    )}
+                  </Stack>
+                </Accordion.Panel>
+              </Accordion.Item>
+            </Accordion>
+          )}
        </ConfigurationSection>

        <ConfigurationSection
@@ -5,7 +5,7 @@ import { assistantExecutionPolicy } from "./assistant-execution-policy";
 describe("assistantExecutionPolicy", () => {
  test("allows a sizeable batch of tool calls to finish in one request", () => {
    expect(assistantExecutionPolicy.maxSteps).toBeGreaterThanOrEqual(32);
-    expect(assistantExecutionPolicy.maxOutputTokens).toBeGreaterThanOrEqual(65_536);
+    expect(assistantExecutionPolicy.maxOutputTokens).toBe(32_768);
    expect(assistantExecutionPolicy.totalTimeoutMs).toBeGreaterThan(assistantExecutionPolicy.stepTimeoutMs);
    expect(assistantExecutionPolicy.toolTimeoutMs).toBeGreaterThanOrEqual(60_000);
  });
@@ -1,6 +1,6 @@
 export const assistantExecutionPolicy = {
  maxSteps: 32,
-  maxOutputTokens: 65_536,
+  maxOutputTokens: 32_768,
  totalTimeoutMs: 240_000,
  stepTimeoutMs: 60_000,
  toolTimeoutMs: 60_000,
@@ -1,6 +1,12 @@
 import { describe, expect, test } from "vitest";

-import { toProviderOptionsKey } from "./assistant-provider-options";
+import { assistantHomarrProviderTokenHeader } from "@homarr/definitions";
+
+import {
+  getHomarrProviderBaseUrl,
+  resolveHomarrProviderToken,
+  toProviderOptionsKey,
+} from "./assistant-provider-options";

 describe("toProviderOptionsKey", () => {
  test("converts the hyphenated provider name to the camelCase AI SDK provider option key", () => {
@@ -16,3 +22,55 @@ describe("toProviderOptionsKey", () => {
    expect(toProviderOptionsKey("homarr")).toBe("homarr");
  });
 });
+
+describe("resolveHomarrProviderToken", () => {
+  test("accepts a Workshop token only for the matching Homarr provider endpoint", () => {
+    const headers = new Headers({ [assistantHomarrProviderTokenHeader]: "workshop-token" });
+    expect(
+      resolveHomarrProviderToken({
+        provider: "homarr",
+        configuredBaseUrl: "https://homarr.dev/api/ai/v1/",
+        workshopApiUrl: "https://homarr.dev",
+        headers,
+      }),
+    ).toBe("workshop-token");
+    expect(getHomarrProviderBaseUrl("https://homarr.dev/")).toBe("https://homarr.dev/api/ai/v1");
+  });
+
+  test.each([
+    [undefined, null],
+    ["", null],
+    ["   ", null],
+    ["a".repeat(4096), "a".repeat(4096)],
+    ["a".repeat(4097), null],
+  ])("validates the Workshop token header %s", (token, expected) => {
+    const headers = new Headers(token === undefined ? undefined : { [assistantHomarrProviderTokenHeader]: token });
+    expect(
+      resolveHomarrProviderToken({
+        provider: "homarr",
+        configuredBaseUrl: "https://homarr.dev/api/ai/v1",
+        workshopApiUrl: "https://homarr.dev",
+        headers,
+      }),
+    ).toBe(expected);
+  });
+
+  test("never forwards a Workshop token to another endpoint", () => {
+    expect(() =>
+      resolveHomarrProviderToken({
+        provider: "homarr",
+        configuredBaseUrl: "https://attacker.example/v1",
+        workshopApiUrl: "https://homarr.dev",
+        headers: new Headers({ [assistantHomarrProviderTokenHeader]: "workshop-token" }),
+      }),
+    ).toThrow("does not match");
+    expect(
+      resolveHomarrProviderToken({
+        provider: "openrouter",
+        configuredBaseUrl: "https://openrouter.ai/api/v1",
+        workshopApiUrl: "https://homarr.dev",
+        headers: new Headers({ [assistantHomarrProviderTokenHeader]: "workshop-token" }),
+      }),
+    ).toBeUndefined();
+  });
+});
@@ -1,3 +1,5 @@
+import { assistantHomarrProviderTokenHeader } from "@homarr/definitions";
+
 /**
 * The AI SDK resolves provider options by the provider name registered on the
 * language model. The @ai-sdk/openai-compatible provider converts the raw
@@ -15,3 +17,24 @@ export const toProviderOptionsKey = (name: string) =>
      return segment.charAt(0).toUpperCase() + segment.slice(1);
    })
    .join("");
+
+export const getHomarrProviderBaseUrl = (workshopApiUrl: string) => `${workshopApiUrl.replace(/\/+$/u, "")}/api/ai/v1`;
+
+export const resolveHomarrProviderToken = ({
+  provider,
+  configuredBaseUrl,
+  workshopApiUrl,
+  headers,
+}: {
+  provider: string;
+  configuredBaseUrl: string;
+  workshopApiUrl: string;
+  headers: Headers;
+}) => {
+  if (provider !== "homarr") return undefined;
+  if (configuredBaseUrl.replace(/\/+$/u, "") !== getHomarrProviderBaseUrl(workshopApiUrl)) {
+    throw new Error("The Homarr provider endpoint does not match the configured Workshop server.");
+  }
+  const token = headers.get(assistantHomarrProviderTokenHeader)?.trim();
+  return token && token.length <= 4096 ? token : null;
+};
@@ -45,7 +45,7 @@ import {
  withOpenRouterToolRequestOptions,
  withOpenRouterWebSearch,
 } from "./assistant-openrouter";
-import { toProviderOptionsKey } from "./assistant-provider-options";
+import { resolveHomarrProviderToken, toProviderOptionsKey } from "./assistant-provider-options";
 import { assistantExecutionPolicy } from "./assistant-execution-policy";
 import { getAssistantStreamErrorMessage } from "./assistant-stream-error";
 import { getSafeAssistantToolError } from "./assistant-tool-error";
@@ -72,6 +72,7 @@ export const maxDuration = 300;
 const assistantRequestMaxBytes = 12_000_000;

 const logger = createLogger({ module: "assistant" });
+const getAssistantLogErrorType = (error: unknown) => (error instanceof Error ? error.name : typeof error);
 const getToolApprovalSecret = () =>
  Buffer.from(
    hkdfSync("sha256", Buffer.from(env.SECRET_ENCRYPTION_KEY, "hex"), "", "assistant-tool-approval", 32),
@@ -424,6 +425,28 @@ export async function POST(request: Request) {
    return Response.json({ error: "Homarr Assistant is not configured." }, { status: 503 });
  }

+  let homarrProviderToken: string | null | undefined;
+  try {
+    homarrProviderToken = resolveHomarrProviderToken({
+      provider: configuration.provider,
+      configuredBaseUrl: configuration.baseUrl,
+      workshopApiUrl: appEnv.WORKSHOP_API_URL ?? appEnv.HOMARR_WEBSITE_URL,
+      headers: request.headers,
+    });
+  } catch (error) {
+    logger.warn("Rejected an unsafe Homarr provider endpoint", {
+      provider: configuration.provider,
+      errorType: getAssistantLogErrorType(error),
+    });
+    return Response.json({ error: "The Homarr provider endpoint is not configured safely." }, { status: 503 });
+  }
+  if (homarrProviderToken === null) {
+    return Response.json(
+      { error: "Sign in to the Homarr Community Workshop to use the Homarr provider." },
+      { status: 401 },
+    );
+  }
+
  const context = createTRPCContext({ headers: request.headers, session });
  const requestStartedAt = Date.now();
  const requestId = crypto.randomUUID();
@@ -440,7 +463,7 @@ export async function POST(request: Request) {
      requestId,
      provider: configuration.provider,
      modelId: requestedModelId,
-      error: modelLookup.error,
+      errorType: getAssistantLogErrorType(modelLookup.error),
    });
  }
  const selectedModel = modelLookup.model;
@@ -514,7 +537,7 @@ export async function POST(request: Request) {
            } catch (error) {
              logger.error("Assistant tool call failed", {
                toolName: mcpTool.name,
-                error: error instanceof Error ? error.message : String(error),
+                errorType: getAssistantLogErrorType(error),
              });
              return { error: getSafeAssistantToolError(error, { toolName: mcpTool.name }) };
            }
@@ -559,13 +582,18 @@ export async function POST(request: Request) {
      ...(configuration.provider === "openrouter" || openRouterServerToolsEnabled
        ? {
            "HTTP-Referer": "https://homarr.dev",
-            "X-Title": "Homarr Assistant",
+            "X-OpenRouter-Title": "Homarr AI Assistant",
            "X-OpenRouter-Metadata": "enabled",
          }
        : {}),
      ...customHeaders,
    };
-    const providerApiKey = configuration.encryptedApiKey ? decryptSecret(configuration.encryptedApiKey) : undefined;
+    const providerApiKey =
+      configuration.provider === "homarr"
+        ? homarrProviderToken
+        : configuration.encryptedApiKey
+          ? decryptSecret(configuration.encryptedApiKey)
+          : undefined;
    const providerName = `homarr-${configuration.provider}`;
    const provider = createOpenAICompatible({
      name: providerName,
@@ -720,7 +748,7 @@ export async function POST(request: Request) {
          requestId,
          provider: configuration.provider,
          modelId,
-          error: error instanceof Error ? error.message : String(error),
+          errorType: getAssistantLogErrorType(error),
        });
      },
      onFinish: async () => {
@@ -732,7 +760,7 @@ export async function POST(request: Request) {
        } catch (error) {
          logger.error("Failed to update assistant conversation metadata", {
            threadId: thread.id,
-            error: error instanceof Error ? error.message : String(error),
+            errorType: getAssistantLogErrorType(error),
          });
        }
      },
@@ -839,7 +867,7 @@ export async function POST(request: Request) {
    });
  } catch (error) {
    logger.error("Assistant response could not start", {
-      error: error instanceof Error ? error.message : String(error),
+      errorType: getAssistantLogErrorType(error),
    });
    return Response.json(
      {