@andrew.ng/symbion 0.1.0

package/apps/daemon/dist/llm/ollamaProvider.js

@@ -0,0 +1,213 @@
+/**
+ * OllamaProvider — calls a local Ollama instance over HTTP using Node's native
+ * fetch + AbortController. No API key. The v1 default provider (STATE §9).
+ *
+ * listModels() queries the real local Ollama's `GET /api/tags` per
+ * docs/loops/ollama-dynamic-models-STATE.md §6.2 — the old hardcoded 3-entry
+ * placeholder constant has been removed entirely (no fallback to it on any
+ * failure path, per that STATE's §3 "never silently fail" constraint).
+ */
+import { LlmError } from "./types.js";
+export const OLLAMA_DEFAULT_BASE_URL = "http://127.0.0.1:11434";
+/** Same 3000ms convention as `checkOllamaReachable` (providerStatus.ts) — this is a
+ *  cheap "what's there" probe, not a generate() call, per STATE §6.1/§6.2. */
+const OLLAMA_LIST_MODELS_TIMEOUT_MS = 3000;
+/** Matches a parameter-count hint at the end of an Ollama tag, e.g. "8b", "1b", "70b",
+ *  "3.8b", "0.5b" — case-insensitive. Per STATE §6.3. */
+const PARAM_SIZE_RE = /(\d+(?:\.\d+)?)\s*b\b/i;
+/**
+ * inferTierFromTag — infers a coarse speed/capability tier from an Ollama tag's
+ * parameter-count hint when one is confidently parseable; otherwise returns
+ * `undefined` rather than guessing (STATE §6.3 — "omit tier" over "invent a default").
+ * Thresholds: <=3b fast, <=13b balanced, >13b best.
+ */
+function inferTierFromTag(tag) {
+    const match = tag.match(PARAM_SIZE_RE);
+    if (!match)
+        return undefined;
+    const billions = parseFloat(match[1]);
+    if (Number.isNaN(billions))
+        return undefined;
+    if (billions <= 3)
+        return "fast";
+    if (billions <= 13)
+        return "balanced";
+    return "best";
+}
+/** Maps a raw Ollama tag string (e.g. "llama3.1:8b") to an `LlmModelOption` — label is
+ *  the raw tag itself (no attempt at vendor-name prettification, STATE §6.3). */
+function ollamaTagToModelOption(tag) {
+    return { id: tag, label: tag, tier: inferTierFromTag(tag) };
+}
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1"]);
+/**
+ * isLoopbackUrl — true iff `value` parses as a URL whose hostname is one of
+ * 127.0.0.1 / localhost / ::1 (case-insensitive). Used to confine the
+ * env-var-sourced Ollama base URL to loopback only, since that path is
+ * influenceable by anything that can set the daemon process's environment
+ * (see docs/loops/auto-generate-body-STATE.md §13 — SSRF finding).
+ */
+function isLoopbackUrl(value) {
+    try {
+        const url = new URL(value);
+        const hostname = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+        return LOOPBACK_HOSTNAMES.has(hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * resolveOllamaBaseUrl — the env-var/loopback-guard/default resolution logic that used to
+ * live inline in `OllamaProvider`'s constructor (extracted per
+ * docs/loops/connect-providers-STATE.md §10.3, a structure-only refactor, no behavior
+ * change). Exported so `providerStatus.ts`'s reachability check reuses the exact same
+ * SSRF-guarded resolution instead of re-implementing it — one implementation, not two.
+ *
+ * Throws `LlmError("provider-not-running", ...)` if `SYMBION_OLLAMA_BASE_URL` is set to a
+ * non-loopback host (see `isLoopbackUrl` doc comment for the threat this guards against).
+ */
+export function resolveOllamaBaseUrl() {
+    // Env override (SYMBION_OLLAMA_BASE_URL) lets tests/dev tooling point this at a fake
+    // server without needing to thread a constructor param through the registry factory.
+    // Because this path is influenceable by anything that can set the daemon process's
+    // environment (poisoned .env, malicious postinstall, misconfigured deploy), it MUST be
+    // restricted to loopback hosts — never silently fall back to OLLAMA_DEFAULT_BASE_URL,
+    // since that would mask a misconfiguration as "everything's fine, just using localhost."
+    const envBaseUrl = process.env["SYMBION_OLLAMA_BASE_URL"];
+    if (envBaseUrl !== undefined) {
+        if (!isLoopbackUrl(envBaseUrl)) {
+            throw new LlmError("provider-not-running", `SYMBION_OLLAMA_BASE_URL phải là một địa chỉ loopback (127.0.0.1/localhost/::1); giá trị hiện tại không hợp lệ và bị từ chối: "${envBaseUrl}".`);
+        }
+        return envBaseUrl;
+    }
+    return OLLAMA_DEFAULT_BASE_URL;
+}
+export class OllamaProvider {
+    id = "ollama";
+    baseUrl;
+    constructor(opts = {}) {
+        // An explicit constructor `baseUrl` (only ever set by trusted code, e.g. test
+        // fixtures) always wins and is NOT subject to the loopback check below — it is
+        // not reachable by an external actor.
+        if (opts.baseUrl !== undefined) {
+            this.baseUrl = opts.baseUrl;
+            return;
+        }
+        this.baseUrl = resolveOllamaBaseUrl();
+    }
+    /**
+     * listModels — queries Ollama's real `GET /api/tags` (per
+     * docs/loops/ollama-dynamic-models-STATE.md §6.2), bounded by a 3000ms
+     * AbortController timeout (same convention as `checkOllamaReachable`). Uses
+     * `this.baseUrl`, already resolved through the SAME loopback-guarded
+     * `resolveOllamaBaseUrl()` the constructor uses — no second SSRF-guard
+     * implementation.
+     *
+     * Error mapping:
+     * - connection-refused / DNS failure / our own abort-on-timeout all collapse to
+     *   `LlmError("provider-not-running", ...)` — both mean "ModelPicker cannot get a
+     *   model list from Ollama right now," and AC4 only requires the existing
+     *   "unreachable" shape be unregressed, not a distinct timeout code (STATE §9.1).
+     * - non-2xx HTTP status -> `LlmError("invalid-response", ...)`.
+     * - non-JSON body -> `LlmError("invalid-response", ...)`.
+     * - missing/wrong-type `models` field on an otherwise-200 response ->
+     *   `LlmError("invalid-response", ...)` — distinct from "genuinely zero models,"
+     *   which is a well-formed `{ models: [] }` that resolves normally (empty array,
+     *   no throw) per STATE §3's "never silently fail ... not an empty array
+     *   indistinguishable from genuinely zero" constraint.
+     */
+    async listModels() {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), OLLAMA_LIST_MODELS_TIMEOUT_MS);
+        try {
+            let res;
+            try {
+                res = await fetch(`${this.baseUrl}/api/tags`, { signal: controller.signal });
+            }
+            catch {
+                throw new LlmError("provider-not-running", "Không thể kết nối tới Ollama — đảm bảo Ollama đang chạy trên máy.");
+            }
+            if (!res.ok) {
+                throw new LlmError("invalid-response", `Ollama trả về lỗi HTTP ${res.status} khi lấy danh sách mô hình.`);
+            }
+            let json;
+            try {
+                json = (await res.json());
+            }
+            catch {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ Ollama (không phải JSON) khi lấy danh sách mô hình.");
+            }
+            if (!Array.isArray(json.models)) {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ Ollama (thiếu trường models) khi lấy danh sách mô hình.");
+            }
+            return json.models
+                .map((m) => m.name ?? m.model)
+                .filter((name) => typeof name === "string" && name.length > 0)
+                .map(ollamaTagToModelOption);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async generate(req) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), req.timeoutMs);
+        try {
+            let res;
+            try {
+                res = await fetch(`${this.baseUrl}/api/generate`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        model: req.model,
+                        prompt: req.userPrompt,
+                        system: req.systemPrompt,
+                        stream: false,
+                        // Important for Qwen3 reasoning models:
+                        // prevents long thinking output that can exceed Symbion's timeout.
+                        think: false,
+                        // Keep generation bounded for paraphrase / short text rewrite use cases.
+                        // Nhanh, ngắn, ổn định — hợp cho UI form/autofill
+                        options: {
+                            num_ctx: 2048, //size of context window
+                            num_predict: 256, //maximum number of tokens to predict when generating text
+                            temperature: 0.5, //creative level
+                        },
+                        // Keeps the model warm after the first request.
+                        keep_alive: "10m",
+                    }),
+                    signal: controller.signal,
+                });
+            }
+            catch {
+                if (controller.signal.aborted) {
+                    throw new LlmError("timeout", `Quá thời gian chờ (${req.timeoutMs}ms) khi gọi Ollama.`);
+                }
+                throw new LlmError("provider-not-running", "Không thể kết nối tới Ollama — đảm bảo Ollama đang chạy trên máy.");
+            }
+            if (res.status === 404) {
+                throw new LlmError("invalid-response", `Mô hình "${req.model}" không tồn tại trên Ollama (404).`);
+            }
+            if (!res.ok) {
+                const text = await res.text().catch(() => "");
+                throw new LlmError("invalid-response", `Ollama trả về lỗi HTTP ${res.status}${text ? `: ${text}` : "."}`);
+            }
+            let json;
+            try {
+                json = (await res.json());
+            }
+            catch {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ Ollama (không phải JSON).");
+            }
+            if (typeof json.response !== "string") {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ Ollama (thiếu trường response).");
+            }
+            return { text: json.response };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=ollamaProvider.js.map

package/apps/daemon/dist/llm/ollamaProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ollamaProvider.js","sourceRoot":"","sources":["../../src/llm/ollamaProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAA0F,MAAM,YAAY,CAAC;AAE9H,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE;8EAC8E;AAC9E,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAE3C;yDACyD;AACzD,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,QAAQ,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;iFACiF;AACjF,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC;AAuBD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAClC,qFAAqF;IACrF,qFAAqF;IACrF,mFAAmF;IACnF,uFAAuF;IACvF,sFAAsF;IACtF,yFAAyF;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,iIAAiI,UAAU,IAAI,CAChJ,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,QAAiB,CAAC;IACf,OAAO,CAAS;IAEjC,YAAY,OAA8B,EAAE;QAC1C,8EAA8E;QAC9E,+EAA+E;QAC/E,sCAAsC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,6BAA6B,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,0BAA0B,GAAG,CAAC,MAAM,6BAA6B,CAAC,CAAC;YAC5G,CAAC;YACD,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,8EAA8E,CAC/E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,MAAM;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;iBAC7B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBAC7E,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAuB;QACpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,IAAI,GAAa,CAAC;YAElB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,eAAe,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,MAAM,EAAE,GAAG,CAAC,UAAU;wBACtB,MAAM,EAAE,GAAG,CAAC,YAAY;wBACxB,MAAM,EAAE,KAAK;wBAEb,wCAAwC;wBACxC,mEAAmE;wBACnE,KAAK,EAAE,KAAK;wBAEZ,yEAAyE;wBACzE,kDAAkD;wBAClD,OAAO,EAAE;4BACP,OAAO,EAAE,IAAI,EAAE,wBAAwB;4BACvC,WAAW,EAAE,GAAG,EAAE,0DAA0D;4BAC5E,WAAW,EAAE,GAAG,EAAE,gBAAgB;yBACnC;wBAED,gDAAgD;wBAChD,UAAU,EAAE,KAAK;qBAClB,CAAC;oBACF,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,sBAAsB,GAAG,CAAC,SAAS,qBAAqB,CAAC,CAAC;gBAC1F,CAAC;gBAED,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,YAAY,GAAG,CAAC,KAAK,oCAAoC,CAAC,CAAC;YACpG,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,0BAA0B,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;YAED,IAAI,IAA4B,CAAC;YAEjC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,oDAAoD,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;YACrG,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CAEF"}

package/apps/daemon/dist/llm/openaiProvider.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OpenAiProvider — LlmProvider implementation for OpenAI, per
+ * docs/loops/multi-provider-settings-STATE.md §3.2. Reads its API key from
+ * the secrets store (apps/daemon/src/llm/secrets.ts) at construction time —
+ * never from process.env, never persisted by this class. Calls the
+ * `/v1/chat/completions` endpoint with `Authorization: Bearer <key>` (dev's
+ * call on exact endpoint per STATE §3.2 — not an architecture decision).
+ *
+ * Model ids below are placeholder/dev-time content decisions (same framing
+ * as ollamaProvider.ts's model list) — Checker should independently verify
+ * these are reasonable current OpenAI model ids at review time.
+ */
+import { type LlmGenerateRequest, type LlmGenerateResult, type LlmModelOption, type LlmProvider } from "./types.js";
+export interface OpenAiProviderOptions {
+    /** injectable for tests; defaults to the real OpenAI chat-completions endpoint. */
+    baseUrl?: string;
+}
+export declare class OpenAiProvider implements LlmProvider {
+    readonly id: "openai";
+    private readonly baseUrl;
+    constructor(opts?: OpenAiProviderOptions);
+    listModels(): Promise<LlmModelOption[]>;
+    generate(req: LlmGenerateRequest): Promise<LlmGenerateResult>;
+}
+//# sourceMappingURL=openaiProvider.d.ts.map

package/apps/daemon/dist/llm/openaiProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openaiProvider.d.ts","sourceRoot":"","sources":["../../src/llm/openaiProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAY,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAW9H,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,cAAe,YAAW,WAAW;IAChD,QAAQ,CAAC,EAAE,EAAG,QAAQ,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,IAAI,GAAE,qBAA0B;IAItC,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIvC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA8DpE"}

package/apps/daemon/dist/llm/openaiProvider.js

@@ -0,0 +1,90 @@
+/**
+ * OpenAiProvider — LlmProvider implementation for OpenAI, per
+ * docs/loops/multi-provider-settings-STATE.md §3.2. Reads its API key from
+ * the secrets store (apps/daemon/src/llm/secrets.ts) at construction time —
+ * never from process.env, never persisted by this class. Calls the
+ * `/v1/chat/completions` endpoint with `Authorization: Bearer <key>` (dev's
+ * call on exact endpoint per STATE §3.2 — not an architecture decision).
+ *
+ * Model ids below are placeholder/dev-time content decisions (same framing
+ * as ollamaProvider.ts's model list) — Checker should independently verify
+ * these are reasonable current OpenAI model ids at review time.
+ */
+import { LlmError } from "./types.js";
+import { loadProvidersConfig } from "./secrets.js";
+const OPENAI_DEFAULT_BASE_URL = "https://api.openai.com/v1/chat/completions";
+const OPENAI_MODELS = [
+    { id: "gpt-4o-mini", label: "GPT-4o mini (nhanh)", tier: "fast" },
+    { id: "gpt-4o", label: "GPT-4o (cân bằng)", tier: "balanced" },
+    { id: "gpt-4.1", label: "GPT-4.1 (tốt nhất)", tier: "best" },
+];
+export class OpenAiProvider {
+    id = "openai";
+    baseUrl;
+    constructor(opts = {}) {
+        this.baseUrl = opts.baseUrl ?? OPENAI_DEFAULT_BASE_URL;
+    }
+    async listModels() {
+        return OPENAI_MODELS;
+    }
+    async generate(req) {
+        const apiKey = loadProvidersConfig().providers.openai?.apiKey;
+        if (!apiKey) {
+            throw new LlmError("not-configured", "Chưa cấu hình API key cho OpenAI.");
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), req.timeoutMs);
+        try {
+            let res;
+            try {
+                res = await fetch(this.baseUrl, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        Authorization: `Bearer ${apiKey}`,
+                    },
+                    body: JSON.stringify({
+                        model: req.model,
+                        messages: [
+                            { role: "system", content: req.systemPrompt },
+                            { role: "user", content: req.userPrompt },
+                        ],
+                        ...(req.maxTokens != null ? { max_tokens: req.maxTokens } : {}),
+                    }),
+                    signal: controller.signal,
+                });
+            }
+            catch {
+                if (controller.signal.aborted) {
+                    throw new LlmError("timeout", `Quá thời gian chờ (${req.timeoutMs}ms) khi gọi OpenAI.`);
+                }
+                throw new LlmError("network", "Lỗi mạng khi gọi OpenAI.");
+            }
+            if (res.status === 401 || res.status === 403) {
+                throw new LlmError("auth", "Thiếu hoặc sai cấu hình API key cho OpenAI.");
+            }
+            if (res.status === 429) {
+                throw new LlmError("rate-limit", "Bị giới hạn tần suất gọi — thử lại sau.");
+            }
+            if (!res.ok) {
+                throw new LlmError("invalid-response", `OpenAI trả về lỗi HTTP ${res.status}.`);
+            }
+            let json;
+            try {
+                json = (await res.json());
+            }
+            catch {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ OpenAI (không phải JSON).");
+            }
+            const text = json.choices?.[0]?.message?.content;
+            if (typeof text !== "string") {
+                throw new LlmError("invalid-response", "Phản hồi không hợp lệ từ OpenAI.");
+            }
+            return { text };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=openaiProvider.js.map

package/apps/daemon/dist/llm/openaiProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openaiProvider.js","sourceRoot":"","sources":["../../src/llm/openaiProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAA0F,MAAM,YAAY,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,uBAAuB,GAAG,4CAA4C,CAAC;AAE7E,MAAM,aAAa,GAAqB;IACtC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,EAAE;IACjE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE;IAC9D,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE;CAC7D,CAAC;AAOF,MAAM,OAAO,cAAc;IAChB,EAAE,GAAG,QAAiB,CAAC;IACf,OAAO,CAAS;IAEjC,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,uBAAuB,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAuB;QACpC,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;oBAC9B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;qBAClC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,QAAQ,EAAE;4BACR,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE;4BAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;yBAC1C;wBACD,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE,CAAC;oBACF,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,sBAAsB,GAAG,CAAC,SAAS,qBAAqB,CAAC,CAAC;gBAC1F,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,0BAA0B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,IAA6D,CAAC;YAClE,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4D,CAAC;YACvF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,oDAAoD,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;YACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;YAC7E,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/apps/daemon/dist/llm/providerStatus.d.ts

@@ -0,0 +1,60 @@
+/**
+ * providerStatus — lightweight reachability checks backing the
+ * `checkProviderStatus` RPC. Ollama path (docs/loops/connect-providers-STATE.md
+ * §10.3) is unchanged: deliberately does NOT go through
+ * `getProvider("ollama")`/`OllamaProvider.generate()` — a real `generate()` call loads a
+ * model and can take seconds-to-minutes, the wrong shape for "is anything listening."
+ * Instead: a single `GET {baseUrl}/` with a short AbortController timeout.
+ *
+ * Reuses `resolveOllamaBaseUrl()` exported from `ollamaProvider.ts` — the same
+ * env-var/loopback-guarded resolution `OllamaProvider`'s constructor uses — so the
+ * SSRF/loopback discipline has exactly one implementation, not two independently
+ * maintained copies.
+ *
+ * `checkApiKeyProviderReachable` (new, docs/loops/multi-provider-settings-STATE.md §3.2/§4b)
+ * is the sibling check for the 3 api-key-kind providers: ONE cheap authenticated call
+ * (reuses `listModels()`'s static list plus a minimal authenticated POST — same
+ * "generate" call shape but with a tiny prompt/short token budget, since none of the 3
+ * vendors' SDKs expose a free no-op auth-check endpoint that doesn't also require picking
+ * SOME model id; dev's call on exact endpoint per provider, not an architecture decision),
+ * mapped through the same LlmErrorCode taxonomy generate() already uses.
+ */
+import { resolveOllamaBaseUrl } from "./ollamaProvider.js";
+import { type LlmErrorCode, type LlmProvider } from "./types.js";
+export { resolveOllamaBaseUrl as resolveOllamaBaseUrlForStatusCheck };
+/**
+ * checkOllamaReachable — resolves `true` if `GET {baseUrl}/` returns ANY HTTP response
+ * (200, 404, whatever — Ollama responding at all to the root path proves a process is
+ * listening and speaking HTTP, which is the only claim this check makes; NOT gated on
+ * status===200 specifically, since that risks a false "not reachable" if Ollama's
+ * root-path response shape changes across versions).
+ *
+ * Resolves `false` (never throws) on connection-refused, DNS failure, abort/timeout, or
+ * any other fetch rejection — a not-running/unreachable provider is an expected steady
+ * state for this check, not an exceptional one.
+ */
+export declare function checkOllamaReachable(baseUrl: string, timeoutMs: number): Promise<boolean>;
+export interface ApiKeyProviderReachability {
+    reachable: boolean;
+    errorCode?: LlmErrorCode;
+}
+/**
+ * checkApiKeyProviderReachable — performs ONE cheap authenticated call against
+ * an already-constructed api-key-kind LlmProvider (the caller is responsible
+ * for first checking secrets.ts has a key for that provider — see handlers.ts's
+ * `checkProviderStatus`, which short-circuits to `not-configured` WITHOUT
+ * calling this function at all when no key is stored, per STATE §4b step 3a).
+ *
+ * Uses the provider's own `generate()` with a minimal prompt and the first
+ * model from its `listModels()` — the smallest "real" authenticated call
+ * every adapter already implements, instead of duplicating bespoke
+ * ping/list-models HTTP logic per vendor. Maps the outcome through the exact
+ * same LlmErrorCode taxonomy generate() already uses; never throws.
+ *
+ * `maxTokens: 1` caps output cost — this call only needs to observe whether
+ * the request was accepted (auth/billing valid), not read the response text,
+ * per the cost-risk finding raised in `/review` (a 401/403 check call should
+ * not risk burning a full generate-call's worth of output tokens).
+ */
+export declare function checkApiKeyProviderReachable(provider: LlmProvider, timeoutMs: number): Promise<ApiKeyProviderReachability>;
+//# sourceMappingURL=providerStatus.d.ts.map

package/apps/daemon/dist/llm/providerStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerStatus.d.ts","sourceRoot":"","sources":["../../src/llm/providerStatus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAY,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,EAAE,oBAAoB,IAAI,kCAAkC,EAAE,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,WAAW,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,0BAA0B,CAAC,CAkBrC"}

package/apps/daemon/dist/llm/providerStatus.js

@@ -0,0 +1,88 @@
+/**
+ * providerStatus — lightweight reachability checks backing the
+ * `checkProviderStatus` RPC. Ollama path (docs/loops/connect-providers-STATE.md
+ * §10.3) is unchanged: deliberately does NOT go through
+ * `getProvider("ollama")`/`OllamaProvider.generate()` — a real `generate()` call loads a
+ * model and can take seconds-to-minutes, the wrong shape for "is anything listening."
+ * Instead: a single `GET {baseUrl}/` with a short AbortController timeout.
+ *
+ * Reuses `resolveOllamaBaseUrl()` exported from `ollamaProvider.ts` — the same
+ * env-var/loopback-guarded resolution `OllamaProvider`'s constructor uses — so the
+ * SSRF/loopback discipline has exactly one implementation, not two independently
+ * maintained copies.
+ *
+ * `checkApiKeyProviderReachable` (new, docs/loops/multi-provider-settings-STATE.md §3.2/§4b)
+ * is the sibling check for the 3 api-key-kind providers: ONE cheap authenticated call
+ * (reuses `listModels()`'s static list plus a minimal authenticated POST — same
+ * "generate" call shape but with a tiny prompt/short token budget, since none of the 3
+ * vendors' SDKs expose a free no-op auth-check endpoint that doesn't also require picking
+ * SOME model id; dev's call on exact endpoint per provider, not an architecture decision),
+ * mapped through the same LlmErrorCode taxonomy generate() already uses.
+ */
+import { resolveOllamaBaseUrl } from "./ollamaProvider.js";
+import { LlmError } from "./types.js";
+export { resolveOllamaBaseUrl as resolveOllamaBaseUrlForStatusCheck };
+/**
+ * checkOllamaReachable — resolves `true` if `GET {baseUrl}/` returns ANY HTTP response
+ * (200, 404, whatever — Ollama responding at all to the root path proves a process is
+ * listening and speaking HTTP, which is the only claim this check makes; NOT gated on
+ * status===200 specifically, since that risks a false "not reachable" if Ollama's
+ * root-path response shape changes across versions).
+ *
+ * Resolves `false` (never throws) on connection-refused, DNS failure, abort/timeout, or
+ * any other fetch rejection — a not-running/unreachable provider is an expected steady
+ * state for this check, not an exceptional one.
+ */
+export async function checkOllamaReachable(baseUrl, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        await fetch(`${baseUrl}/`, { signal: controller.signal });
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * checkApiKeyProviderReachable — performs ONE cheap authenticated call against
+ * an already-constructed api-key-kind LlmProvider (the caller is responsible
+ * for first checking secrets.ts has a key for that provider — see handlers.ts's
+ * `checkProviderStatus`, which short-circuits to `not-configured` WITHOUT
+ * calling this function at all when no key is stored, per STATE §4b step 3a).
+ *
+ * Uses the provider's own `generate()` with a minimal prompt and the first
+ * model from its `listModels()` — the smallest "real" authenticated call
+ * every adapter already implements, instead of duplicating bespoke
+ * ping/list-models HTTP logic per vendor. Maps the outcome through the exact
+ * same LlmErrorCode taxonomy generate() already uses; never throws.
+ *
+ * `maxTokens: 1` caps output cost — this call only needs to observe whether
+ * the request was accepted (auth/billing valid), not read the response text,
+ * per the cost-risk finding raised in `/review` (a 401/403 check call should
+ * not risk burning a full generate-call's worth of output tokens).
+ */
+export async function checkApiKeyProviderReachable(provider, timeoutMs) {
+    const models = await provider.listModels();
+    const modelId = models[0]?.id ?? "";
+    try {
+        await provider.generate({
+            systemPrompt: "ping",
+            userPrompt: "ping",
+            model: modelId,
+            timeoutMs,
+            maxTokens: 1,
+        });
+        return { reachable: true };
+    }
+    catch (err) {
+        if (err instanceof LlmError) {
+            return { reachable: false, errorCode: err.code };
+        }
+        return { reachable: false, errorCode: "unknown" };
+    }
+}
+//# sourceMappingURL=providerStatus.js.map

package/apps/daemon/dist/llm/providerStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerStatus.js","sourceRoot":"","sources":["../../src/llm/providerStatus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAuC,MAAM,YAAY,CAAC;AAE3E,OAAO,EAAE,oBAAoB,IAAI,kCAAkC,EAAE,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC3E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAOD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,QAAqB,EACrB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC;YACtB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,OAAO;YACd,SAAS;YACT,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;AACH,CAAC"}

package/apps/daemon/dist/llm/registry.d.ts

@@ -0,0 +1,14 @@
+import type { LlmProvider } from "./types.js";
+export interface ProviderDescriptorInternal {
+    id: LlmProvider["id"];
+    label: string;
+    kind: "local" | "api-key";
+    factory: () => LlmProvider;
+}
+export declare function getProvider(id: LlmProvider["id"]): LlmProvider;
+export declare function listProviderDescriptors(): Array<{
+    id: LlmProvider["id"];
+    label: string;
+    kind: "local" | "api-key";
+}>;
+//# sourceMappingURL=registry.d.ts.map

package/apps/daemon/dist/llm/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/llm/registry.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,MAAM,WAAW,CAAC;CAC5B;AASD,wBAAgB,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,WAAW,CAM9D;AAED,wBAAgB,uBAAuB,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC,CAEpH"}

package/apps/daemon/dist/llm/registry.js

@@ -0,0 +1,35 @@
+/**
+ * getProvider — registry-driven factory resolving a provider id to its
+ * LlmProvider implementation. Generalized per
+ * docs/loops/multi-provider-settings-STATE.md §3.2/§3.4: a descriptor array
+ * replaces the hardcoded switch so `listProviders` (RPC) and the registry
+ * share one source of truth for id/label/kind metadata.
+ *
+ * Each api-key-kind provider's constructor calls secrets.ts's
+ * loadProvidersConfig() internally to read its own key/model at construction
+ * time (mirrors OllamaProvider's existing "resolve config in the
+ * constructor" pattern) — getProvider() itself stays a pure id->instance
+ * lookup with no secrets-file knowledge, keeping the registry/secrets
+ * responsibilities separated.
+ */
+import { OllamaProvider } from "./ollamaProvider.js";
+import { OpenAiProvider } from "./openaiProvider.js";
+import { AnthropicProvider } from "./anthropicProvider.js";
+import { GeminiProvider } from "./geminiProvider.js";
+const REGISTRY = [
+    { id: "ollama", label: "Ollama", kind: "local", factory: () => new OllamaProvider() },
+    { id: "openai", label: "OpenAI", kind: "api-key", factory: () => new OpenAiProvider() },
+    { id: "anthropic", label: "Anthropic", kind: "api-key", factory: () => new AnthropicProvider() },
+    { id: "gemini", label: "Gemini", kind: "api-key", factory: () => new GeminiProvider() },
+];
+export function getProvider(id) {
+    const descriptor = REGISTRY.find((d) => d.id === id);
+    if (!descriptor) {
+        throw new Error(`Unknown LLM provider id: ${id}`);
+    }
+    return descriptor.factory();
+}
+export function listProviderDescriptors() {
+    return REGISTRY.map(({ id, label, kind }) => ({ id, label, kind }));
+}
+//# sourceMappingURL=registry.js.map

package/apps/daemon/dist/llm/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/llm/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAUrD,MAAM,QAAQ,GAAiC;IAC7C,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,EAAE;IACrF,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,EAAE;IACvF,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,iBAAiB,EAAE,EAAE;IAChG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,EAAE;CACxF,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,EAAqB;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/apps/daemon/dist/llm/remoteProvider.d.ts

@@ -0,0 +1,25 @@
+/**
+ * RemoteProvider — stub-grade in v1 per STATE §9 ("doesn't need a finished
+ * provider-switch UI" but the interface/seam must be real, not a TODO).
+ * Implements the same LlmProvider interface against Anthropic's Messages API
+ * shape, as a concrete placeholder for "some remote vendor."
+ *
+ * The API key is read EXCLUSIVELY from process.env.SYMBION_REMOTE_LLM_API_KEY
+ * at call time — never persisted to disk, never accepted as a request param,
+ * never read from apps/web. If unset, generate() throws LlmError("auth", ...)
+ * immediately, with NO network call attempted (TC-D7).
+ */
+import { type LlmGenerateRequest, type LlmGenerateResult, type LlmModelOption, type LlmProvider } from "./types.js";
+export declare const REMOTE_API_KEY_ENV_VAR = "SYMBION_REMOTE_LLM_API_KEY";
+export interface RemoteProviderOptions {
+    /** injectable for tests; defaults to the real Anthropic Messages endpoint. */
+    baseUrl?: string;
+}
+export declare class RemoteProvider implements LlmProvider {
+    readonly id: "remote";
+    private readonly baseUrl;
+    constructor(opts?: RemoteProviderOptions);
+    listModels(): LlmModelOption[];
+    generate(req: LlmGenerateRequest): Promise<LlmGenerateResult>;
+}
+//# sourceMappingURL=remoteProvider.d.ts.map

package/apps/daemon/dist/llm/remoteProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteProvider.d.ts","sourceRoot":"","sources":["../../src/llm/remoteProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAY,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9H,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAUnE,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,cAAe,YAAW,WAAW;IAChD,QAAQ,CAAC,EAAE,EAAG,QAAQ,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,IAAI,GAAE,qBAA0B;IAI5C,UAAU,IAAI,cAAc,EAAE;IAIxB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;CA6DpE"}