@abelxiaoxing/cadence 2.0.9 → 2.0.10

package/README.md

@@ -379,6 +379,7 @@ Byte values are UTF-8/encoded bounds where specified; they are not targets to si
 | Token source the user edits (`CADENCE_TOKEN` in `.env`)        | Read once before binding, never bound for the run: an edit cannot fence Stop        |
 | Saved port/token source differs from `.env`                    | Only when stopped, reselect just those under the reservation; running ones refuse   |
 | User-made `.env` (0755/0644, umask 002, dotfiles links)        | Like Pi's sources: ownership only, links followed; each refusal names its reason    |
+| Credential value inside a provider/model ID (Ollama `ollama`)  | Withhold and count only that catalog entry; choosing it refuses; others selectable  |
 
 Good: current context → explicit grant → durable acceptance → genuine original native/storage settlement → exact retained dependency → real checks → human review.
 Base: a client leaves and another reattaches to the same accepted run without launching it again.
@@ -424,6 +425,14 @@ Review the independently enumerated package member list and every emitted body,
 Keep public Pi peers external for the extension, the exact Undici/ws runtime edges, the exact optional SDK pins for the standalone owner and all upstream/font/vendor notices.
 Preserve original license bytes through their precise Git attributes; line-ending normalization must not invalidate audited source/notice hashes.
 
+### Release 2.0.10 acceptance snapshot
+
+Full `verify` passed on the 2.0.10 release tree (`4843334` plus the version bump), in the 2.0.3 environment below.
+It ran 1949 root tests in 78 files (27 Windows-only controls skipped on Linux), 116 web tests, 5 real-browser scenarios and the 132-member pack audit, and CI 40278386880 passed 12/12 on the candidate `3cd94f4` (this commit before its snapshot).
+That CI run's first Windows Node 22 `parallel` attempt failed only `workspace-landing`'s cleanup (EBUSY removing the just-stopped landing workspace), as in 2.0.6's first run; the job passed when rerun.
+The fix answers a 2.0.9 report: an Ollama `"apiKey": "ollama"` under a provider named `ollama` made the whole model catalog refuse `unsupported-context`.
+An isolated owner with that `models.json` beside a second provider reproduced the refusal on 2.0.9; on 2.0.10 Chromium listed the second provider's models and explained the one withheld entry in English and Chinese.
+
 ### Release 2.0.9 acceptance snapshot
 
 Full `verify` passed on the 2.0.9 release tree (`0e720a1` plus the version bump), in the 2.0.3 environment below.

package/docs/service-management.md

@@ -152,6 +152,9 @@ At sign-out or shutdown Windows ends the owner without orderly Stop, which can l
   `models.json` may use only fields the pinned SDK supports.
   `supportsMidConvoSystemMessages` from newer Pi is accepted because the pinned SDK has no system-role conversation message; other unknown fields refuse rather than being silently ignored.
   The owner model choice offers every thinking level the pinned SDK supports for a model, `off` through `xhigh` and `max`; a model whose `thinkingLevelMap` maps only `max` (as some DeepSeek configurations do) is chosen at `max`, and a child runs only at exactly that level.
+  A model whose provider or model ID contains a known credential value is withheld from the catalog, since showing the ID would reveal that value; the catalog says how many models are withheld, and the rest stay selectable.
+  Credential values are `auth.json` keys, `models.json` `apiKey` and header values (and the variables they name) and service-environment variables whose names contain `KEY`, `TOKEN`, `SECRET`, `PASS`, `AUTH` or `COOKIE`.
+  The common Ollama placeholder `"apiKey": "ollama"` under a provider named `ollama` is such a case: give the placeholder a value that matches no provider or model ID (for example `"local-no-auth"`), then restart the service.
   The owner loads `models.json` once at start: after it changes, the model catalog, the chosen model and the workspace view refuse as `stale` (credential changes in `auth.json` are read fresh).
   Restart the service to reload it (`cadence server restart`, or `stop` then `start`), then choose the owner model again.
 - A foreground owner can be managed from another terminal.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "description": "Shared Pi task workspace: native terminal and WebUI, persistent service, checks and human review.",
   "license": "MIT",
   "type": "module",

package/src/native-build.ts

@@ -2,5 +2,5 @@
 export const nativeBuild = {
   kind: "native",
   contractHash:
-    "ff017feffc6b6b4521e470d82514d0ca008e15472fa1442ec498b243b0f7cf87",
+    "c2bb81519387005a71e88a64364dff47d5c39dab17812833ca898bc51055e59d",
 } as const;

package/src/service/contracts/models.ts

@@ -43,6 +43,9 @@ export interface ModelCandidate {
 export interface ModelCatalog extends ModelChoiceState {
   status: "complete" | "capacity";
   entries: ModelCandidate[];
+  /** Models left out because a provider/model ID contains a known credential
+   * literal or control characters; never their identifiers. */
+  withheld: number;
 }
 export interface ChooseModelRequest {
   expected: ChoiceVersion;
@@ -119,11 +122,19 @@ export function decodeModelCandidate(value: unknown): ModelCandidate {
 }
 export function decodeModelCatalog(value: unknown): ModelCatalog {
   canonicalJson({ kind: "ok", value }, LIMITS.pageBytes);
-  const o = closed(value, ["version", "selected", "status", "entries"]);
+  const o = closed(value, [
+    "version",
+    "selected",
+    "status",
+    "entries",
+    "withheld",
+  ]);
   const entries = list(o.entries, LIMITS.maxPageEntries, decodeModelCandidate);
   const status = oneOf(o.status, ["complete", "capacity"]);
+  const withheld = integer(o.withheld, 0, LIMITS.maxPageEntries);
   if (
-    (status === "capacity" && entries.length) ||
+    (status === "capacity" && (entries.length || withheld)) ||
+    entries.length + withheld > LIMITS.maxPageEntries ||
     new Set(entries.map((e) => canonicalJson([e.provider, e.model]))).size !==
       entries.length
   )
@@ -133,5 +144,6 @@ export function decodeModelCatalog(value: unknown): ModelCatalog {
     selected: nullable(o.selected, decodeModelSelection),
     status,
     entries,
+    withheld,
   };
 }

package/src/service-host.mjs

@@ -4019,16 +4019,24 @@ function decodeModelCandidate(value) {
 }
 function decodeModelCatalog(value) {
   canonicalJson({ kind: "ok", value }, LIMITS.pageBytes);
-  const o = closed(value, ["version", "selected", "status", "entries"]);
+  const o = closed(value, [
+    "version",
+    "selected",
+    "status",
+    "entries",
+    "withheld"
+  ]);
   const entries = list(o.entries, LIMITS.maxPageEntries, decodeModelCandidate);
   const status = oneOf(o.status, ["complete", "capacity"]);
-  if (status === "capacity" && entries.length || new Set(entries.map((e) => canonicalJson([e.provider, e.model]))).size !== entries.length)
+  const withheld = integer(o.withheld, 0, LIMITS.maxPageEntries);
+  if (status === "capacity" && (entries.length || withheld) || entries.length + withheld > LIMITS.maxPageEntries || new Set(entries.map((e) => canonicalJson([e.provider, e.model]))).size !== entries.length)
     invalid();
   return {
     version: decodeChoiceVersion(o.version),
     selected: nullable(o.selected, decodeModelSelection),
     status,
-    entries
+    entries,
+    withheld
   };
 }
 // src/history/admission.ts
@@ -17959,19 +17967,22 @@ class OwnerModelContext {
           throw new ContractError("unsupported-context");
         count2 += runtime.getModels(provider).length;
         if (count2 > LIMITS.maxPageEntries)
-          return { status: "capacity", entries: [] };
+          return { status: "capacity", entries: [], withheld: 0 };
       }
       const literals = this.catalogLiterals(current2);
       const entries = [];
+      let withheld = 0;
       for (const provider of providers) {
         const models = runtime.getModels(provider);
-        if (entries.length + models.length > LIMITS.maxPageEntries)
+        if (entries.length + withheld + models.length > LIMITS.maxPageEntries)
           throw new ContractError("capacity");
         for (const model of models) {
           if (model.provider !== provider)
             throw new ContractError("unsupported-context");
-          this.publicIdentifier(provider, literals);
-          this.publicIdentifier(model.id, literals);
+          if (!this.isPublicIdentifier(provider, literals) || !this.isPublicIdentifier(model.id, literals)) {
+            withheld++;
+            continue;
+          }
           const api = modelApis.find((api2) => api2 === model.api) ?? null;
           const levels = this.#thinking(model);
           if (levels.length > 7)
@@ -18018,7 +18029,7 @@ class OwnerModelContext {
       const after = this.catalogSource();
       if (after.auth.identity !== current2.auth.identity || after.auth.stamp !== current2.auth.stamp)
         throw new ContractError("stale");
-      return { status: "complete", entries };
+      return { status: "complete", entries, withheld };
     } catch (error) {
       throw new ContractError(error instanceof ContractError ? error.code : "corrupt-selected");
     }
@@ -18089,8 +18100,11 @@ class OwnerModelContext {
         add(value);
     return [...literals];
   }
+  isPublicIdentifier(value, literals) {
+    return !/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value) && diagnosticText(value, 512, literals) === value && sanitizeText(value, literals) === value;
+  }
   publicIdentifier(value, literals) {
-    if (/[\p{Cc}\p{Cf}\p{Cs}]/u.test(value) || diagnosticText(value, 512, literals) !== value || sanitizeText(value, literals) !== value)
+    if (!this.isPublicIdentifier(value, literals))
       throw new ContractError("unsupported-context");
   }
   replaceSelection(input, beforeInstall) {
@@ -22871,7 +22885,7 @@ function refuseAt(stage, step) {
   }
 }
 async function createServiceHost(value, sourceBuild) {
-  const embedded = "ff017feffc6b6b4521e470d82514d0ca008e15472fa1442ec498b243b0f7cf87";
+  const embedded = "c2bb81519387005a71e88a64364dff47d5c39dab17812833ca898bc51055e59d";
   if (embedded && sourceBuild)
     throw new ContractError("unsupported-context");
   const contractHash = decodeHash(embedded ?? sourceBuild?.contractHash);

package/src/task-shell.ts

@@ -579,7 +579,7 @@ export function registerTaskShell(pi: ExtensionAPI): void {
               `${e.provider}/${e.model} • ${e.api ?? "unsupported"} • ${e.eligibility}`,
           );
           const selected = await ui.select(
-            `Exact OWNER model (Pi conversation model is independent) • ${catalog.status}\nCurrent ${pretty(catalog.selected)}`,
+            `Exact OWNER model (Pi conversation model is independent) • ${catalog.status}\nCurrent ${pretty(catalog.selected)}${catalog.withheld ? `\n${catalog.withheld} withheld: a provider/model ID contains a credential value (such as an apiKey equal to the provider name) or control characters. Give each credential a value that matches no ID; restart the service after editing models.json.` : ""}`,
             [...labels, "Return"],
           );
           if (!selected || !labels.includes(selected)) return;