kward 0.79.0 → 0.80.0

data/lib/kward/model/provider_catalog.rb

@@ -0,0 +1,114 @@
+# Namespace for Kward model-provider definitions.
+module Kward
+  # Stable, frontend-neutral descriptions of providers Kward can present to users.
+  # Runtime request and authentication mechanics remain in their respective clients.
+  module ProviderCatalog
+    Definition = Struct.new(
+      :id,
+      :name,
+      :api_key_env,
+      :protocol,
+      :oauth_name,
+      :requires_setup,
+      keyword_init: true
+    ) do
+      def api_key?
+        !api_key_env.empty?
+      end
+
+      def oauth?
+        !oauth_name.nil?
+      end
+    end
+
+    Runtime = Struct.new(:id, :model_config_key, :reasoning_config_key, :chat_url, :model_list_url, :model_discovery, keyword_init: true) do
+      def automatic_model_discovery?
+        model_discovery == :live
+      end
+    end
+
+    CHAT_URLS = {
+      "anthropic" => "https://api.anthropic.com/v1/messages",
+      "cerebras" => "https://api.cerebras.ai/v1/chat/completions",
+      "deepseek" => "https://api.deepseek.com/chat/completions",
+      "fireworks" => "https://api.fireworks.ai/inference/v1/chat/completions",
+      "gemini" => "https://generativelanguage.googleapis.com/v1beta",
+      "groq" => "https://api.groq.com/openai/v1/chat/completions",
+      "mistral" => "https://api.mistral.ai/v1/chat/completions",
+      "nvidia" => "https://integrate.api.nvidia.com/v1/chat/completions",
+      "openai" => "https://api.openai.com/v1/responses",
+      "openrouter" => "https://openrouter.ai/api/v1/chat/completions",
+      "together" => "https://api.together.xyz/v1/chat/completions",
+      "xai" => "https://api.x.ai/v1/chat/completions"
+    }.freeze
+    MODEL_LIST_URLS = {
+      "anthropic" => "https://api.anthropic.com/v1/models",
+      "cerebras" => "https://api.cerebras.ai/v1/models",
+      "deepseek" => "https://api.deepseek.com/models",
+      "fireworks" => "https://api.fireworks.ai/inference/v1/models",
+      "gemini" => "https://generativelanguage.googleapis.com/v1beta/models",
+      "groq" => "https://api.groq.com/openai/v1/models",
+      "mistral" => "https://api.mistral.ai/v1/models",
+      "nvidia" => "https://integrate.api.nvidia.com/v1/models",
+      "openai" => "https://api.openai.com/v1/models",
+      "together" => "https://api.together.xyz/v1/models",
+      "xai" => "https://api.x.ai/v1/models"
+    }.freeze
+
+    DEFINITIONS = [
+      Definition.new(id: "anthropic", name: "Anthropic", api_key_env: ["ANTHROPIC_API_KEY"], protocol: "anthropic_messages", oauth_name: "Anthropic Claude"),
+      Definition.new(id: "azure_openai", name: "Azure OpenAI", api_key_env: ["AZURE_OPENAI_API_KEY"], protocol: "azure_openai", requires_setup: true),
+      Definition.new(id: "cerebras", name: "Cerebras", api_key_env: ["CEREBRAS_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "deepseek", name: "DeepSeek", api_key_env: ["DEEPSEEK_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "fireworks", name: "Fireworks AI", api_key_env: ["FIREWORKS_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "gemini", name: "Google Gemini", api_key_env: ["GEMINI_API_KEY"], protocol: "gemini"),
+      Definition.new(id: "groq", name: "Groq", api_key_env: ["GROQ_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "mistral", name: "Mistral", api_key_env: ["MISTRAL_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "nvidia", name: "NVIDIA NIM", api_key_env: ["NVIDIA_API_KEY", "NGC_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "openai", name: "OpenAI", api_key_env: ["OPENAI_API_KEY"], protocol: "openai_responses", oauth_name: "ChatGPT"),
+      Definition.new(id: "openrouter", name: "OpenRouter", api_key_env: ["OPENROUTER_API_KEY"], protocol: "openai_chat", oauth_name: "OpenRouter"),
+      Definition.new(id: "together", name: "Together AI", api_key_env: ["TOGETHER_API_KEY"], protocol: "openai_chat"),
+      Definition.new(id: "xai", name: "xAI", api_key_env: ["XAI_API_KEY"], protocol: "openai_chat", oauth_name: "xAI Grok"),
+      Definition.new(id: "copilot", name: "GitHub Copilot", api_key_env: [], protocol: "copilot", oauth_name: "GitHub Copilot")
+    ].freeze
+
+    module_function
+
+    def all
+      DEFINITIONS
+    end
+
+    def fetch(id)
+      find(id) || raise(ArgumentError, "Unknown provider: #{id}")
+    end
+
+    def find(id)
+      DEFINITIONS.find { |provider| provider.id == id.to_s }
+    end
+
+    def find_by_name(name)
+      DEFINITIONS.find { |provider| provider.name.casecmp?(name.to_s) }
+    end
+
+    def runtime(id)
+      provider = fetch(id)
+      runtime_id = provider.id == "openai" ? "openai_api" : provider.id
+      Runtime.new(
+        id: runtime_id,
+        model_config_key: "#{runtime_id}_model",
+        reasoning_config_key: "#{runtime_id}_reasoning_effort",
+        chat_url: CHAT_URLS[provider.id],
+        model_list_url: MODEL_LIST_URLS[provider.id],
+        model_discovery: provider.id == "azure_openai" ? :configured : (MODEL_LIST_URLS.key?(provider.id) ? :live : :curated)
+      )
+    end
+
+    def api_key_providers
+      DEFINITIONS.select(&:api_key?)
+    end
+
+    def oauth_providers
+      DEFINITIONS.select(&:oauth?)
+    end
+  end
+end

data/lib/kward/model/sources.rb

@@ -0,0 +1,70 @@
+require_relative "catalog"
+require_relative "model_info"
+require_relative "provider_catalog"
+
+# Namespace for Kward model catalogs.
+module Kward
+  # Combines live, cached, and curated provider models for selection UIs.
+  class ModelSources
+    CURATED_MODELS = {
+      "anthropic" => %w[claude-sonnet-5 claude-opus-4-8 claude-haiku-4-5],
+      "azure_openai" => [],
+      "cerebras" => [],
+      "deepseek" => %w[deepseek-chat deepseek-reasoner],
+      "fireworks" => [],
+      "gemini" => %w[gemini-2.5-pro gemini-2.5-flash],
+      "groq" => [],
+      "mistral" => %w[mistral-large-latest],
+      "nvidia" => [],
+      "openai" => ModelInfo::OPENAI_MODEL_CHOICES,
+      "openrouter" => [],
+      "together" => [],
+      "xai" => %w[grok-3 grok-3-mini],
+      "copilot" => ModelInfo::COPILOT_MODEL_CHOICES
+    }.freeze
+
+    def initialize(provider_id:, api_key: nil, catalog: nil)
+      @provider = ProviderCatalog.fetch(provider_id)
+      @catalog = catalog || ModelCatalog.new(provider_id: @provider.id, api_key: api_key)
+    end
+
+    def models
+      merge(cached_models, curated_models)
+    end
+
+    def refresh
+      merge(live_models, curated_models)
+    rescue StandardError
+      models
+    end
+
+    def manual(id)
+      value = id.to_s.strip
+      raise ArgumentError, "Model ID must be a non-empty string" if value.empty?
+
+      { "provider" => @provider.id, "id" => value, "name" => value, "source" => "manual" }
+    end
+
+    private
+
+    def live_models
+      @catalog.refresh.map { |model| model.merge("source" => "live") }
+    end
+
+    def cached_models
+      @catalog.models.map { |model| model.merge("source" => "cached") }
+    end
+
+    def curated_models
+      CURATED_MODELS.fetch(@provider.id, []).map do |id|
+        { "provider" => @provider.id, "id" => id, "name" => id, "source" => "curated" }
+      end
+    end
+
+    def merge(*groups)
+      groups.flatten.each_with_object({}) do |model, result|
+        result[model.fetch("id")] ||= model
+      end.values.sort_by { |model| model.fetch("id") }
+    end
+  end
+end

data/lib/kward/model/stream_parser.rb

@@ -77,15 +77,15 @@ module Kward
       result
     end
 
-    def parse_codex_sse(body, on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, show_raw_reasoning: false, usage_normalizer: nil, request_error_class: nil)
+    def parse_codex_sse(body, provider_label: "Codex", on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, show_raw_reasoning: false, usage_normalizer: nil, request_error_class: nil)
       state = codex_sse_state(show_raw_reasoning: show_raw_reasoning)
       body.split(/\r?\n\r?\n/).each do |block|
-        process_codex_sse_block(block, state, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class)
+        process_codex_sse_block(block, state, provider_label: provider_label, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class)
       end
       flush_codex_reasoning_delta(state, on_reasoning_delta: on_reasoning_delta)
       codex_sse_message(state)
     rescue JSON::ParserError => e
-      raise "Codex OAuth returned invalid SSE JSON: #{e.message}"
+      raise "#{provider_label} returned invalid SSE JSON: #{e.message}"
     end
 
     # Incrementally parses a Codex/Responses SSE HTTP response body.
@@ -93,7 +93,7 @@ module Kward
     # Deltas are yielded as soon as complete SSE blocks arrive so interactive
     # frontends can render streamed assistant and reasoning text without waiting
     # for the provider to close the response.
-    def parse_codex_sse_stream(response, on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, cancellation: nil, show_raw_reasoning: false, usage_normalizer: nil, request_error_class: nil)
+    def parse_codex_sse_stream(response, provider_label: "Codex", on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, cancellation: nil, show_raw_reasoning: false, usage_normalizer: nil, request_error_class: nil)
       state = codex_sse_state(show_raw_reasoning: show_raw_reasoning)
       buffer = +""
 
@@ -104,15 +104,15 @@ module Kward
           delimiter = Regexp.last_match[0]
           block = buffer[0...index]
           buffer = buffer[(index + delimiter.length)..] || +""
-          process_codex_sse_block(block, state, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class)
+          process_codex_sse_block(block, state, provider_label: provider_label, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class)
         end
       end
       cancellation&.raise_if_cancelled!
-      process_codex_sse_block(buffer, state, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class) unless buffer.empty?
+      process_codex_sse_block(buffer, state, provider_label: provider_label, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, usage_normalizer: usage_normalizer, request_error_class: request_error_class) unless buffer.empty?
       flush_codex_reasoning_delta(state, on_reasoning_delta: on_reasoning_delta)
       codex_sse_message(state)
     rescue JSON::ParserError => e
-      raise "Codex OAuth returned invalid SSE JSON: #{e.message}"
+      raise "#{provider_label} returned invalid SSE JSON: #{e.message}"
     end
 
     def parse_anthropic_sse_stream(response, on_reasoning_delta: nil, on_assistant_delta: nil, cancellation: nil, usage_normalizer: nil, request_error_class: nil)
@@ -135,6 +135,71 @@ module Kward
       raise "Anthropic returned invalid SSE JSON: #{e.message}"
     end
 
+    def parse_gemini_sse_stream(response, on_assistant_delta: nil, cancellation: nil, usage_normalizer: nil)
+      state = { content: +"", calls: {}, usage: nil }
+      buffer = +""
+      response.read_body do |chunk|
+        cancellation&.raise_if_cancelled!
+        buffer << chunk
+        while (index = buffer.index(/\r?\n\r?\n/))
+          delimiter = Regexp.last_match[0]
+          block = buffer[0...index]
+          buffer = buffer[(index + delimiter.length)..] || +""
+          process_gemini_sse_block(block, state, on_assistant_delta: on_assistant_delta, cancellation: cancellation, usage_normalizer: usage_normalizer)
+        end
+      end
+      cancellation&.raise_if_cancelled!
+      process_gemini_sse_block(buffer, state, on_assistant_delta: on_assistant_delta, cancellation: cancellation, usage_normalizer: usage_normalizer) unless buffer.empty?
+      gemini_sse_message(state)
+    rescue JSON::ParserError => e
+      raise "Google Gemini returned invalid SSE JSON: #{e.message}"
+    end
+
+    def process_gemini_sse_block(block, state, on_assistant_delta:, cancellation:, usage_normalizer:)
+      data = block.lines.filter_map { |line| line.start_with?("data:") ? line.delete_prefix("data:").strip : nil }.join("\n")
+      return if data.empty? || data == "[DONE]"
+
+      cancellation&.raise_if_cancelled!
+      event = JSON.parse(data)
+      Array(event["candidates"]).each_with_index do |candidate, candidate_index|
+        Array(candidate.dig("content", "parts")).each_with_index do |part, part_index|
+          text = part["text"].to_s
+          unless text.empty?
+            state[:content] << text
+            on_assistant_delta&.call(text)
+          end
+          merge_gemini_function_call(state[:calls], part["functionCall"], candidate_index: candidate_index, part_index: part_index)
+        end
+      end
+      state[:usage] = usage_normalizer&.call(event["usageMetadata"]) || state[:usage]
+    end
+
+    def merge_gemini_function_call(calls, function_call, candidate_index:, part_index:)
+      return unless function_call.is_a?(Hash)
+
+      key = function_call["id"] || "#{candidate_index}:#{part_index}:#{function_call["name"]}"
+      call = calls[key] ||= { "id" => function_call["id"] || "call_gemini_#{candidate_index}_#{part_index}", "name" => function_call["name"].to_s, "args" => {}, "args_buffer" => +"" }
+      call["name"] = function_call["name"].to_s unless function_call["name"].to_s.empty?
+      args = function_call["args"]
+      if args.is_a?(Hash)
+        call["args"].merge!(args)
+      elsif !args.nil?
+        call["args_buffer"] << args.to_s
+      end
+    end
+
+    def gemini_sse_message(state)
+      message = { "role" => "assistant", "content" => state[:content] }
+      unless state[:calls].empty?
+        message["tool_calls"] = state[:calls].values.map do |call|
+          arguments = call["args_buffer"].empty? ? JSON.dump(call["args"]) : call["args_buffer"]
+          { "id" => call["id"], "type" => "function", "function" => { "name" => call["name"], "arguments" => arguments } }
+        end
+      end
+      message["usage"] = state[:usage] if state[:usage]
+      message
+    end
+
     def anthropic_sse_state
       { content: +"", reasoning_summary: +"", blocks: {}, tool_calls: [], usage: nil }
     end
@@ -233,7 +298,7 @@ module Kward
 
     def merge_streaming_tool_call(tool_calls, delta)
       index = (delta["index"] || tool_calls.length).to_i
-      tool_calls[index] ||= { "id" => nil, "type" => "function", "function" => { "name" => "", "arguments" => "" } }
+      tool_calls[index] ||= { "id" => nil, "type" => "function", "function" => { "name" => +"", "arguments" => +"" } }
       current = tool_calls[index]
       current["id"] = delta["id"] if delta["id"]
       current["type"] = delta["type"] if delta["type"]
@@ -271,7 +336,7 @@ module Kward
       }
     end
 
-    def process_codex_sse_block(block, state, on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, usage_normalizer: nil, request_error_class: nil)
+    def process_codex_sse_block(block, state, provider_label: "Codex", on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, usage_normalizer: nil, request_error_class: nil)
       data = block.lines.filter_map { |line| line.start_with?("data:") ? line.delete_prefix("data:").strip : nil }.join("\n")
       return if data.empty? || data == "[DONE]"
 
@@ -309,11 +374,11 @@ module Kward
           end
         end
       when "response.failed", "response.incomplete"
-        raise codex_sse_error(event, request_error_class: request_error_class)
+        raise codex_sse_error(event, provider_label: provider_label, request_error_class: request_error_class)
       end
     end
 
-    def codex_sse_error(event, request_error_class: nil)
+    def codex_sse_error(event, provider_label: "Codex", request_error_class: nil)
       response = event["response"]
       error = event["error"] || (response["error"] if response.is_a?(Hash)) || {}
       message = if error.is_a?(Hash)
@@ -324,7 +389,7 @@ module Kward
       message = event["type"].to_s if message.empty?
       code = error.is_a?(Hash) && error["code"].to_s == "server_error" ? 500 : 400
       if request_error_class
-        request_error_class.new(provider: "Codex", code: code, body: "#{event["type"]}: #{message}")
+        request_error_class.new(provider: provider_label, code: code, body: "#{event["type"]}: #{message}")
       else
         "#{event["type"]}: #{message}"
       end
@@ -364,6 +429,10 @@ module Kward
         part["type"] ||= "output_text"
         text_key = part["type"] == "refusal" ? "refusal" : "text"
         part[text_key] = part[text_key].to_s + text
+        if codex_streamable_message_item?(item)
+          on_assistant_delta&.call(text)
+          state[:emitted_message_keys] << codex_item_key(item)
+        end
       end
       state[:raw_content] << text
     end
@@ -701,7 +770,8 @@ module Kward
     end
 
     def codex_streamable_message_item?(item)
-      codex_message_phase(item) == "final_answer"
+      phase = codex_message_phase(item)
+      phase.empty? || phase == "final_answer"
     end
 
     def codex_message_phase(item)

data/lib/kward/permissions/policy.rb

@@ -13,6 +13,7 @@ module Kward
       MODES = %w[ask read-only workspace-write deny-by-default].freeze
       NETWORK_TOOLS = %w[web_search fetch_content fetch_raw].freeze
       FILE_CHANGE_TOOLS = %w[write_file edit_file].freeze
+      MUTATING_TOOLS = (FILE_CHANGE_TOOLS + ["git_commit"]).freeze
 
       Decision = Struct.new(:action, :reason, keyword_init: true) do
         def allowed?
@@ -96,13 +97,15 @@ module Kward
       def request_for(tool_name, arguments, source:)
         name = tool_name.to_s
         args = arguments.to_h
-        {
+        request = {
           "tool" => name,
           "path" => args["path"] || args[:path],
           "host" => request_host(name, args),
           "command" => args["command"] || args[:command],
           "source" => source.to_s
         }.compact.transform_values(&:to_s)
+        request["paths"] = args["paths"] || args[:paths] if name == "git_commit"
+        request
       end
 
       def request_host(name, arguments)
@@ -135,11 +138,11 @@ module Kward
         return Decision.new(action: :deny, reason: "read-only mode") if @mode == "read-only" && risky?(request)
         return Decision.new(action: :deny, reason: "deny-by-default mode") if @mode == "deny-by-default" && risky?(request)
 
-        if file_change?(request) && outside_write_scopes?(request)
+        if mutating?(request) && outside_write_scopes?(request)
           return Decision.new(action: :deny, reason: "path outside write scopes")
         end
 
-        if @mode == "workspace-write" && file_change?(request)
+        if @mode == "workspace-write" && mutating?(request)
           return Decision.new(action: :allow, reason: "workspace write mode")
         end
 
@@ -152,17 +155,28 @@ module Kward
         FILE_CHANGE_TOOLS.include?(request.fetch("tool"))
       end
 
+      def mutating?(request)
+        MUTATING_TOOLS.include?(request.fetch("tool"))
+      end
+
       def network?(request)
         NETWORK_TOOLS.include?(request.fetch("tool")) || request["source"] == "mcp"
       end
 
       def risky?(request)
-        file_change?(request) || request.fetch("tool") == "run_shell_command" || network?(request)
+        mutating?(request) || request.fetch("tool") == "run_shell_command" || network?(request)
       end
 
       def outside_write_scopes?(request)
         return false if @write_scopes.nil?
 
+        if request.fetch("tool") == "git_commit"
+          paths = request["paths"]
+          return true unless paths.is_a?(Array) && !paths.empty?
+
+          return paths.any? { |path| !@write_scopes.any? { |scope| glob_match?(scope, path) } }
+        end
+
         path = request["path"]
         path.nil? || !@write_scopes.any? { |scope| glob_match?(scope, path) }
       end