Nexus Orchestrator

Dependency security patches: npm audit fix plus tsx 4.21.0 → 4.23.1 (pulls esbuild 0.28.1), clearing 7 advisories (hono, qs, vite, esbuild, @babel/core) — npm audit reports 0 vulnerabilities. Chat messages now render in a centered max-w-4xl column. HTML docs (architecture/changelog/roadmap) moved into docs/. Roadmap corrected: Ollama backend abort is an upstream limitation (ollama#2876), not a Nexus bug; Nexus-as-MCP-server direction dropped.

fetch_url tool added alongside web_search. The LLM can now chain search → fetch → answer in up to 8 tool calls per turn. Tool-calling path refactored from a single-call branch to a multi-turn agentic loop (MAX_TOOL_ITERATIONS=8). Fetch behavior: HTML stripped to plain text, content capped at 50 KB, 15-second timeout, SSRF-protected (blocks cloud metadata endpoints; allows LAN). Shares the globe toggle. Sources panel covers both search results and fetched pages.

Live reasoning display for models that support it. Server sends think: true to confirmed Ollama instances via the native /api/chat endpoint; Ollama streams reasoning in message.thinking chunks synthesized server-side into <think>...</think> tags. Models that natively emit <think> tags (DeepSeek R1) are parsed identically. Reasoning appears in a collapsible purple section above the response. Global default on, per-chat Brain icon override. Models that reject think: true (400) silently retry without it. FAST category always excluded.

Removed unused imports, dead state, and no-op code across server and frontend hooks with no behaviour changes. Removed readConfig, writeConfig, getUserCount, fileURLToPath, __filename/__dirname, and hasAttachments from server.ts. Dropped unused ModelCategory import from useConfig.ts. Removed dead ping surface (runPing, isPinging, pingResult) from useConnection.ts. Removed totalCount, activeConversationIdRef, and updateActiveConversationMessages from useConversations.ts. Fixed a no-op ternary and removed isMasked/MASKED_PATTERN from ProviderConfig.tsx. Removed @types/express-rate-limit dev dependency.

Code blocks in chat responses now scroll horizontally when content is wider than the container. Previously wide code was clipped with no way to reach the overflow. Copy and language badge buttons are positioned inside the block at top-right so they remain reachable regardless of scroll position.

Changing a provider URL in the Models tab now automatically updates all category model assignments that referenced the old URL. Previously CategoryModel stored the provider URL at assignment time, so renaming a provider left stale hostnames in category pools causing intermittent routing failures. The fix runs on every config save.

Bumped express-rate-limit to ^8.5.1 to resolve ip-address XSS (GHSA-v2v4-37r5-5v8g). Added overrides.postcss: ^8.5.10 to patch CSS stringify XSS in the transitive postcss dependency (GHSA-qx2v-qp2m-jg93). npm audit reports 0 vulnerabilities.

Nexus can now consume external MCP servers as LLM tools alongside web_search and fetch_url. Configure up to 10 MCP servers per user in the Models tab: name, URL, bearer token, and custom headers. Each server's tools are prefixed as <serverName>__<toolName> so the LLM can target any tool unambiguously. Tool list is cached per user per server with a 5-minute TTL; a refresh button invalidates the cache immediately. The agentic loop iteration cap was raised from 4 → 8 to support multi-step MCP workflows. Mid-response status shows Searching…; completed messages show an MCP error badge (red) on failure. The Sources panel now lists every MCP tool call with server name, tool name, arguments, error kind, and duration. Security guardrails: SSRF blocked (cloud metadata hosts, IPv6 loopback); header name blocklist enforced; CR/LF and non-printable header value characters rejected; cleartext HTTP warning shown for non-LAN MCP hosts; bearer tokens redacted from structured logs. New standalone mcpClient.ts module — testable without booting the HTTP server. 28 unit tests + 4 opt-in integration tests (run with RUN_INTEGRATION_TESTS=1). Uses @modelcontextprotocol/sdk@1.29.0 with Streamable HTTP transport.

Live reasoning display for models that support it. The server sends think: true to confirmed Ollama instances using the native /api/chat endpoint; Ollama streams reasoning in message.thinking chunks which are synthesized server-side into <think>...</think> tags before forwarding to the client. Models that natively emit <think> tags (DeepSeek R1) are parsed identically. The reasoning appears in a collapsible purple section above the response, capped at a scrollable max height. Two toggle levels: a global default (on by default) in the System tab, and a per-chat override via the Brain icon. Models that do not support thinking silently fall back. FAST category always skips thinking.

Provider health check now probes /api/tags before /v1/models. Previously Ollama's OpenAI-compatible /v1/models endpoint responded first, causing Ollama instances to be misidentified as generic providers and routed to /v1/chat/completions instead of the native /api/chat endpoint. This prevented think: true from ever being sent.

Moved all frontend/build/type packages to devDependencies and added npm prune --production in the Dockerfile builder stage. Runtime dependencies reduced to 7 packages: better-sqlite3, cookie, dotenv, express, express-rate-limit, pino, zod. Removed unused node-fetch dependency. Image reduced from 127 MB to ~86 MB.

Added CONTRIBUTING.md (getting started, project structure, commit format, PR guidelines, design principles), SECURITY.md (supported versions, reporting via GitHub private advisories, scope definitions), and GitHub issue templates (bug report, feature request; blank issues disabled).

A Copy button appears on hover in the top-right corner of every code block in the chat. Clicking copies the raw code to the clipboard. The button shows a check icon and "Copied" for 2 seconds then resets.

FAST is now restricted to pure micro-interactions (greetings, one-word replies, trivial arithmetic). Any prompt requiring knowledge retrieval, explanation, or a multi-sentence answer routes to GENERAL instead. Prevents FAST from incorrectly capturing prompts that need a capable model.

Multiple server-side security improvements with no user-facing behaviour changes:

All sections in the Models tab can now be collapsed and expanded. Collapse state persists across page refreshes via localStorage.

The selected tab (Chat, Models, System) is remembered across page refreshes via localStorage.

Replaced the dense 4-column card grid with a provider-grouped list. Models are grouped under their provider with collapsible sections. Active router model is highlighted. Size pills are colour-coded by parameter tier. Generic family tags (LIBRARY, unknown) are suppressed.

Removed hardcoded http://localhost:11434 default from the frontend bundle and stripped http:// protocol from placeholder text. Resolves browser mixed content warnings on HTTPS deployments.

Health check and model discovery now correctly probe /v1/models for providers whose base URL ends with /v1 (llama-swap, LM Studio, etc.). Previous logic appended /api/models causing 404s and "offline" status. Model display names from llama-swap shown in UI while routing key sent in API requests. Model IDs trimmed of whitespace at source. Long model names no longer overflow their grid cards.

Per-attempt chat timeout raised from 60s to 300s, configurable via CHAT_TIMEOUT_MS env var. Overall request timeout scales to 4× the per-attempt value. Model-loading retry backoff extended from 3 retries at 5s intervals to 5 retries at 30s intervals (up to 150s wait) to accommodate providers like llama-swap that take time to swap models.

Configure Ollama, llama-swap, llama.cpp, and any other OpenAI-compatible endpoint simultaneously. Model discovery aggregates across all providers and tags each model with its source. Category assignments store the provider URL alongside the model name so routing targets the correct endpoint. Fallback chains work across providers. Config shape: localProviders: [{ name, url, key }]. Existing localUrl/localKey configs migrate automatically on first load.

After a web search completes, a collapsible Sources toggle appears below the assistant response showing the SearXNG results used to answer the question. Each source lists the title (as a link), URL, and snippet. Click "Sources (N)" to expand or collapse.

LLMs can now search the web using a self-hosted SearXNG instance. Configure the SearXNG URL in the Models tab under Web Search. Two modes: Always On (search tool included in every request) or per-chat toggle (globe icon in the chat input bar). The LLM decides when to call the tool — the server handles the full agentic loop and streams the final response. FAST category always skips search. Compatible with Ollama and any OpenAI-compatible provider with tool-calling support.

Each user now has a per-user FIFO queue for chat requests. Concurrent requests are processed in order rather than racing. Maximum of 5 pending requests per user; a 6th returns a 503. Requests cancelled by the client while waiting in queue are skipped automatically.

Signing out now fully clears all in-memory state (conversations, messages, projects, config) before invalidating the session. The login modal can no longer be dismissed when authentication is required, and the main UI is hidden while logged out.

Nexus now supports multiple users with per-user isolation. Each user gets their own provider config, category mappings, conversations, and projects — completely independent from other users.

Three correctness fixes with no user-facing config changes required:

Organize conversations into named project folders in the sidebar. Click to collapse/expand, double-click to rename, right-click any conversation to move it to a project or remove it. Deleting a project lets you choose to keep the chats or delete them all. Projects and assignments persist across restarts.

Each tab (Chat, Models, System) is now wrapped in an error boundary. A crash in one tab shows a fallback card with a "Try again" button instead of blanking the entire UI.

Root-level TypeScript files now copied with *.ts glob instead of individual filenames. Prevents missing module errors when new backend files are added.

Added Configuration Guide to README covering Local Provider, Cloud Provider, Intent Router, Discovered Models, and Category Mappings with usage instructions and a category reference table.

Per-attempt timeout increased from 15s to 60s for all categories. Prevents cold model load failures on first request to a large model.

Sidebar now loads conversations in pages of 50 with a "Load More" button. Messages are fetched on demand when you select a conversation. New GET /api/conversations?limit=50&offset=0 returns metadata only; GET /api/conversations/:id returns full messages.

Identical routing prompts return cached results for 5 minutes (in-memory LRU, max 100 entries). Off by default — enable via toggle in the System tab. Useful for saving API calls when using a paid cloud router.

FAST — new built-in category for trivial/quick responses. Assign your smallest, fastest model for greetings, yes/no answers, and simple lookups. SECURITY — new built-in category for security analysis, vulnerability assessment, threat modeling, CTF challenges, penetration testing guidance, and cybersecurity topics.

All API endpoints now validate request bodies with Zod schemas. Malformed requests get a clear 400 error before hitting any business logic. Login endpoint limited to 20 attempts per 15 minutes. Chat, router, and API endpoints limited to 60 requests per minute with standard Retry-After headers.

Vitest with 18 tests covering all validation schemas. Run with npm test.

If a model in a category pool fails (unavailable, error, timeout), the server automatically tries the next model in the pool before giving up. Logs each fallback attempt. Error messages list all models tried.

Textarea auto-grows as you type (up to 192px) and shrinks when text is deleted. Shows character count and line count below the input. Smooth height transitions.

Replaced JSON file storage with SQLite (better-sqlite3). Conversations and config stored in data/nexus.db with WAL mode. Eliminates read-modify-write race conditions, supports atomic transactions, enables future pagination. Existing JSON files are auto-migrated on first startup and renamed to .migrated.

Server now reads process.env.PORT instead of hardcoding 3000. SSRF self-loop detection also uses the dynamic port.

When a category provider is set to Cloud, the local model picker is replaced with a "Cloud not configured" warning or a "Cloud Provider Active" hint. X button moved outside the card corner to avoid overlapping the provider dropdown. Removing a category now shows a confirmation dialog.

Models and System tabs now scroll full-width; scrollbar sits at the window edge. Clicking a conversation or "New Orchestration" in the sidebar automatically switches back to the Chat tab.

Red stop button replaces the send button while a response is generating. Aborts the SSE stream cleanly, keeps any partial response in chat, resets loading state.

Intelligent intent routing — classifies prompts into CODING, REASONING, CREATIVE, VISION, DOCUMENT, GENERAL and dispatches to the right model. Hybrid local + cloud orchestration — per-category Local/Cloud provider toggle. MIME-based attachment routing — images force VISION, documents force DOCUMENT before the router runs. Vision and document support. Router model visibility per response. Router configurable via env vars (ROUTER_MODEL, ROUTER_URL, ROUTER_KEY). Chat rename — double-click or pencil icon; auto-name from first message. Model loading retry — up to 3× with backoff. Cookie-based auth — httpOnly session cookies, timing-safe key comparison. CORS middleware. SSRF protection. KaTeX LaTeX rendering. Structured Pino logging. AES-256-GCM encryption for stored conversations and config. Docker + Unraid community template support. No hardcoded cloud defaults.