feat: file upload retry, secure file tokens, UI polish

- Add HMAC-based file token auth for secure AI model file access
- Add file upload retry with exponential backoff (max 3 retries)
- File endpoint now requires session auth or signed token
- Support assistant role messages in chat input
- Optimistic UI for attachments on message send
- Verify topic ownership before allowing messages
- Switch web scraping to Firecrawl API
- Agent profile page layout fixes (proper flex overflow)
- Add quick switcher (Ctrl+K) to sidenav
- Clean up longcat.ts and stale comments

app/components/FileSelector.vue

@@ -1,6 +1,9 @@
 <script setup lang="ts">
 import { nanoid } from 'nanoid';
 
+const MAX_RETRIES = 3;
+const RETRY_BASE_DELAY_MS = 1000;
+
 const props = defineProps<{
     selectedModel?: ModelWithProvider | null;
 }>();
@@ -15,10 +18,12 @@ const files = defineModel<{
     status: 'uploading' | 'uploaded' | 'error';
     url: string;
     progress: number;
+    retryCount: number;
 }[]>({ required: false, default: [] });
 const rawFiles = ref<File[]>([]);
 
 const activeUploads = ref<Map<string, XMLHttpRequest>>(new Map());
+const pendingFiles = ref<Map<string, File>>(new Map());
 
 const uploadWithProgress = (file: File, url: string, id: string) => {
     return new Promise((resolve, reject) => {
@@ -39,12 +44,16 @@ const uploadWithProgress = (file: File, url: string, id: string) => {
 
         xhr.onload = () => {
             activeUploads.value.delete(id);
-            resolve(xhr);
+            if (xhr.status >= 400) {
+                reject(new Error(`Upload failed with status ${xhr.status}`));
+            } else {
+                resolve(xhr);
+            }
         };
 
         xhr.onerror = () => {
             activeUploads.value.delete(id);
-            reject(xhr);
+            reject(new Error('Network error during upload'));
         };
 
         xhr.onabort = () => {
@@ -57,68 +66,122 @@ const uploadWithProgress = (file: File, url: string, id: string) => {
     });
 };
 
-const uploadFile = async (file: File) => {
-    try {
-        const id = nanoid();
-        const fileName = file.name || `${id}.png`;
-        const fileType = file.type || 'application/octet-stream';
+const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));
 
-        files.value.push({
+const uploadFileAttempt = async (file: File, id: string, fileName: string, fileType: string) => {
+    const { url: uploadUrl, assetUrl } = await $fetch('/api/upload/presigned', {
+        method: 'POST',
+        body: {
+            file: {
+                name: fileName,
+                mimeType: fileType,
+            }
+        },
+    }) as { url: string; assetUrl: string };
+
+    await uploadWithProgress(file, uploadUrl, id);
+
+    await $fetch('/api/file', {
+        method: 'POST',
+        body: {
             id,
             name: fileName,
             mimeType: fileType,
-            status: 'uploading',
-            url: URL.createObjectURL(file),
-            progress: 0
-        });
+            size: file.size,
+            url: assetUrl,
+        },
+    });
+};
 
-        const { url: uploadUrl, assetUrl } = await $fetch('/api/upload/presigned', {
-            method: 'POST',
-            body: {
-                file: {
-                    name: fileName,
-                    mimeType: fileType,
-                }
-            },
-        }) as { url: string; assetUrl: string };
+const uploadFile = async (file: File) => {
+    const id = nanoid();
+    const fileName = file.name || `${id}.png`;
+    const fileType = file.type || 'application/octet-stream';
 
-        await uploadWithProgress(file, uploadUrl, id);
+    files.value.push({
+        id,
+        name: fileName,
+        mimeType: fileType,
+        status: 'uploading',
+        url: URL.createObjectURL(file),
+        progress: 0,
+        retryCount: 0,
+    });
+    pendingFiles.value.set(id, file);
 
-        await $fetch('/api/file', {
-            method: 'POST',
-            body: {
-                id,
-                name: fileName,
-                mimeType: fileType,
-                size: file.size,
-                url: assetUrl,
-            },
-        })
+    await attemptUpload(file, id, fileName, fileType);
+};
+
+const attemptUpload = async (file: File, id: string, fileName: string, fileType: string, attempt = 0) => {
+    try {
+        await uploadFileAttempt(file, id, fileName, fileType);
 
         files.value = files.value.map(f => {
-            if (f.name === file.name) {
-                return {
-                    ...f,
-                    status: 'uploaded',
-                    progress: 100
-                };
+            if (f.id === id) {
+                return { ...f, status: 'uploaded' as const, progress: 100 };
             }
             return f;
         });
+        pendingFiles.value.delete(id);
     } catch (error) {
-        files.value = files.value.map(f => {
-            if (f.name === file.name) {
-                return {
-                    ...f,
-                    status: 'error'
-                };
-            }
-            return f;
-        });
-    }
-}
+        if (error instanceof Error && error.message === 'Upload aborted') {
+            pendingFiles.value.delete(id);
+            return;
+        }
 
-defineExpose({ uploadFile });
+        const nextAttempt = attempt + 1;
+
+        if (nextAttempt < MAX_RETRIES) {
+            files.value = files.value.map(f => {
+                if (f.id === id) {
+                    return { ...f, retryCount: nextAttempt, progress: 0 };
+                }
+                return f;
+            });
+
+            const delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt);
+            await sleep(delay);
+
+            const stillExists = files.value.some(f => f.id === id);
+            if (!stillExists) return;
+
+            files.value = files.value.map(f => {
+                if (f.id === id) {
+                    return { ...f, status: 'uploading' as const };
+                }
+                return f;
+            });
+
+            await attemptUpload(file, id, fileName, fileType, nextAttempt);
+        } else {
+            files.value = files.value.map(f => {
+                if (f.id === id) {
+                    return { ...f, status: 'error' as const };
+                }
+                return f;
+            });
+        }
+    }
+};
+
+const retryFile = async (id: string) => {
+    const file = pendingFiles.value.get(id);
+    if (!file) return;
+
+    const entry = files.value.find(f => f.id === id);
+    if (!entry) return;
+
+    files.value = files.value.map(f => {
+        if (f.id === id) {
+            return { ...f, status: 'uploading' as const, progress: 0, retryCount: 0 };
+        }
+        return f;
+    });
+
+    await attemptUpload(file, id, entry.name, entry.mimeType);
+};
+
+defineExpose({ uploadFile, retryFile });
 
 watch(rawFiles, async (newFiles, oldFiles) => {
     const diff = newFiles.filter(f =>
@@ -146,6 +209,8 @@ watch(files, async (newFiles, oldFiles) => {
             activeUploads.value.delete(removedFile.id);
         }
 
+        pendingFiles.value.delete(removedFile.id);
+
         if (removedFile.url.startsWith('blob:')) {
             URL.revokeObjectURL(removedFile.url);
         }