Merge remote-tracking branch 'origin/release/v2' into feat/pr-6691-hardening

# Conflicts: # apps/nextjs/src/app/[locale]/layout.tsx # packages/api/src/router/widgets/anchor-notes.ts # packages/api/src/router/widgets/archive-team-warrior.ts # packages/api/src/router/widgets/audio-stats.ts # packages/api/src/router/widgets/bazarr.ts # packages/api/src/router/widgets/coolify.ts # packages/api/src/router/widgets/firewall.ts # packages/api/src/router/widgets/immich.ts # packages/api/src/router/widgets/paperless-ngx.ts # packages/api/src/router/widgets/patchmon.ts # packages/api/src/router/widgets/speedtest-tracker.ts # packages/api/src/router/widgets/tracearr.ts # packages/api/src/router/widgets/traefik.ts # packages/api/src/router/widgets/umami.ts # packages/api/src/router/widgets/uptime-kuma.ts # packages/api/src/router/widgets/vpn.ts # packages/api/src/router/widgets/wud.ts # packages/definitions/src/widget-integration-map.ts # packages/widgets/src/anchor-note/index.ts # packages/widgets/src/archive-team-warrior/index.ts # packages/widgets/src/audio-stats/index.ts # packages/widgets/src/bazarr/index.ts # packages/widgets/src/coolify/index.ts # packages/widgets/src/firewall/index.ts # packages/widgets/src/immich/album-carousel/index.ts # packages/widgets/src/immich/server-stats/index.ts # packages/widgets/src/paperless-ngx/index.ts # packages/widgets/src/patchmon/index.ts # packages/widgets/src/speedtest-tracker/index.ts # packages/widgets/src/system-disks/index.ts # packages/widgets/src/system-resources/index.ts # packages/widgets/src/tracearr/index.ts # packages/widgets/src/traefik/index.ts # packages/widgets/src/umami/index.ts # packages/widgets/src/uptime-kuma/index.ts # packages/widgets/src/vpn/index.ts # packages/widgets/src/wud/index.ts
2026-08-26 15:12:49 +02:00
commit ac7e3f2ef4
@@ -89,8 +89,9 @@ const repairIconSearchInput = <T extends AssistantToolCallInput>(toolCall: T): T
  };
 };

-const repairCustomWidgetToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null => {
-  if (!toolCall.toolName.startsWith("customWidget_")) return null;
+const repairMultilineToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null => {
+  const isCustomWidgetTool = toolCall.toolName.startsWith("customWidget_");
+  if (!isCustomWidgetTool && toolCall.toolName !== "configure_board_settings") return null;
  if (customWidgetNoInputToolNames.has(toolCall.toolName)) {
    try {
      const input = JSON.parse(toolCall.input) as unknown;
@@ -114,4 +115,4 @@ const repairCustomWidgetToolInput = <T extends AssistantToolCallInput>(toolCall:
 };

 export const repairAssistantToolInput = <T extends AssistantToolCallInput>(toolCall: T): T | null =>
-  repairIconSearchInput(toolCall) ?? repairCustomWidgetToolInput(toolCall);
+  repairIconSearchInput(toolCall) ?? repairMultilineToolInput(toolCall);
@@ -4,6 +4,7 @@ import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
 import type { MetadataExtractor } from "@ai-sdk/openai-compatible";
 import type { ToolSet, UIMessage } from "ai";
 import { createUIMessageStream, createUIMessageStreamResponse, jsonSchema, stepCountIs, streamText, tool } from "ai";
+import { cookies } from "next/headers";
 import { z } from "zod/v4";

 import { createTRPCContext, mcpRouter } from "@homarr/api/mcp";
@@ -24,6 +25,10 @@ import {
  assistantProviderRequiresApiKey,
  assistantReasoningModes,
 } from "@homarr/definitions";
+import { localeCookieKey } from "@homarr/definitions/cookie";
+import type { SupportedLanguage } from "@homarr/translation";
+import { fallbackLocale, isLocaleSupported } from "@homarr/translation";
+import { getI18n } from "@homarr/translation/server";
 import { resolveHomarrUrlConfig } from "@homarr/workshop/schema";

 import { browserToolContracts } from "~/components/assistant/assistant-tool-contracts";
@@ -146,12 +151,12 @@ Homarr concepts:

 Action rules:
 - Prefer read-only tools before actions.
- Whenever you need an answer from the user before choosing the next action, call ask_user. Never end a prose response with a question that expects the user to type a reply. Offer distinct choices, categorize agreement or proceeding as affirmative, refusal as negative, and unrelated selections as alternative, then leave the freeform Other answer enabled. A confirmation question must have exactly one affirmative option. Purely rhetorical questions and open-ended conversation that does not block an action may remain prose, but optional next steps should be stated declaratively instead of phrased as a question.
+- Whenever you need an answer from the user before choosing the next action, call ask_user. Never use ask_user to confirm a board settings or custom CSS change before configure_board_settings, or to confirm another change whose inputs are already sufficient for its native review form or mutating tool. Never end a prose response with a question that expects the user to type a reply. Offer distinct choices, categorize agreement or proceeding as affirmative, refusal as negative, and unrelated selections as alternative, then leave the freeform Other answer enabled. A confirmation question must have exactly one affirmative option. Purely rhetorical questions and open-ended conversation that does not block an action may remain prose, but optional next steps should be stated declaratively instead of phrased as a question.
 - Mutating Homarr tools already pause for native user approval. Calling a mutation only proposes the action; it cannot execute until the user selects Approve and run. Once the requested change is sufficiently specified, call the mutation immediately so the approval UI appears.
 - A prose response such as "Please confirm if you would like me to proceed", "Would you like me to proceed?", or a parameter summary that asks for confirmation is incorrect. Never ask for a second textual confirmation before an approval-gated tool call.
 - Do not retry a denied action.
 - Before creating an app, call configure_app with the app name and every useful default you can infer, including its description, href, pingUrl, and an icon URL returned by icon_findIcons. The user reviews Homarr's native app form. Its icon picker searches Homarr's local icon repository. Use the returned values for app_create. If the user asked to place it on a board, call configure_widget afterward with kind "app" and options { appId: the returned appId }.
- Before changing a board's custom CSS or visual and behavior settings, call board_getBoardSettings to read the current values, then call configure_board_settings with only the requested proposed changes. The user can edit the complete CSS and settings in Homarr's native form. Use its returned flat object for board_savePartialBoardSettings, which then shows the mutation approval. Never overwrite existing CSS rules unless the user explicitly requests replacement.
+- Before changing a board's custom CSS or visual and behavior settings, call board_getBoardSettings to read the current values, then immediately call configure_board_settings with only the requested proposed changes. For a custom CSS request, include the complete resulting stylesheet in changes.customCss so the native form is prefilled and previews the proposed CSS. The native form is the user's review and confirmation step, so never insert ask_user between these calls when the requested change is known. Use the form's returned flat object for board_savePartialBoardSettings, which then shows the mutation approval. Never overwrite existing CSS rules unless the user explicitly requests replacement.
 - Before adding any widget to a board, call configure_widget with the target board, widget kind, proposed options, and any integration IDs selected from integration_all. Homarr's native widget editor applies defaults, validates the options, and restricts the picker to compatible integrations the user can access. Use the returned boardId, kind, options, and integrationIds exactly as the input to board_addItem. If configure_widget returns cancelled, do not add the widget.
 - To create a formatted note on a dashboard, call configure_widget with kind "notebook". Put valid Tiptap-compatible HTML in options.content and set options.showToolbar and options.allowReadOnlyCheck when useful. Use semantic paragraphs, headings, lists, task lists, blockquotes, tables, links, emphasis, and images as appropriate. Never include scripts, styles, iframes, event handlers, or unsafe URL protocols.
 - When choosing an app icon without configure_app, call the Homarr icon findIcons tool first and use one of its returned local icon URLs. Never invent a third-party icon CDN URL.
@@ -356,7 +361,7 @@ export async function POST(request: Request) {

  const session = await auth();
  if (!session) {
-    return Response.json({ error: "Sign in to use Homarr Assistant." }, { status: 401 });
+    return Response.json({ error: "Sign in to use Assistant." }, { status: 401 });
  }

  const requestBody = await request.text();
@@ -401,7 +406,11 @@ export async function POST(request: Request) {

  const requiresApiKey = configuration ? assistantProviderRequiresApiKey(configuration.provider) : false;
  if (!configuration?.enabled || !configuration.modelId || (requiresApiKey && !configuration.encryptedApiKey)) {
-    return Response.json({ error: "Homarr Assistant is not configured." }, { status: 503 });
+    const requestedLocale = (await cookies()).get(localeCookieKey)?.value;
+    let locale: SupportedLanguage = fallbackLocale;
+    if (requestedLocale && isLocaleSupported(requestedLocale)) locale = requestedLocale;
+    const t = await getI18n({ locale, namespace: "assistant.unavailable" });
+    return Response.json({ error: t("notConfigured") }, { status: 503 });
  }

  let homarrProviderToken: string | null | undefined;