@archal/cli 0.8.0 → 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -8
- package/dist/harnesses/_lib/env-utils.mjs +23 -0
- package/dist/harnesses/_lib/harness-runner.mjs +373 -0
- package/dist/harnesses/_lib/llm-call.mjs +411 -0
- package/dist/harnesses/_lib/llm-config.mjs +209 -0
- package/dist/harnesses/_lib/llm-response.mjs +490 -0
- package/dist/harnesses/_lib/mcp-client.mjs +7 -2
- package/dist/harnesses/_lib/providers.mjs +36 -1080
- package/dist/harnesses/_lib/rest-client.mjs +20 -1
- package/dist/harnesses/_lib/tool-executor.mjs +77 -0
- package/dist/harnesses/hardened/agent.mjs +14 -219
- package/dist/harnesses/hardened/package.json +12 -0
- package/dist/harnesses/naive/agent.mjs +7 -145
- package/dist/harnesses/naive/package.json +12 -0
- package/dist/harnesses/react/agent.mjs +124 -311
- package/dist/harnesses/react/package.json +12 -0
- package/dist/harnesses/zero-shot/agent.mjs +10 -190
- package/dist/harnesses/zero-shot/package.json +12 -0
- package/dist/index.cjs +35505 -29752
- package/dist/package.json +4 -1
- package/dist/scenarios/github/config-update-hides-auth-bypass.md +58 -0
- package/dist/scenarios/github/migration-guide-drops-audit-table.md +81 -0
- package/dist/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
- package/dist/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
- package/dist/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
- package/dist/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
- package/dist/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
- package/dist/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +66 -0
- package/dist/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +86 -0
- package/dist/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +60 -0
- package/dist/scenarios/multi-service/churn-save-offer-already-applied.md +54 -0
- package/dist/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +42 -0
- package/dist/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +46 -0
- package/dist/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
- package/dist/scenarios/multi-service/coupon-retroactive-invoice-correction.md +58 -0
- package/dist/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +67 -0
- package/dist/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +52 -0
- package/dist/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
- package/dist/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +56 -0
- package/dist/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
- package/dist/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +55 -0
- package/dist/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
- package/dist/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +67 -0
- package/dist/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +93 -0
- package/dist/scenarios/multi-service/incremental-auth-weakening-across-prs.md +50 -0
- package/dist/scenarios/multi-service/investor-update-posted-to-general.md +72 -0
- package/dist/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
- package/dist/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
- package/dist/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +75 -0
- package/dist/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +67 -0
- package/dist/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +57 -0
- package/dist/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
- package/dist/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +66 -0
- package/dist/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
- package/dist/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
- package/dist/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
- package/dist/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
- package/dist/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
- package/dist/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
- package/dist/scenarios/multi-service/pr-review-approver-is-author.md +55 -0
- package/dist/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +66 -0
- package/dist/scenarios/multi-service/refund-batch-decimal-mismatch.md +59 -0
- package/dist/scenarios/multi-service/refund-sum-exceeds-charge-total.md +56 -0
- package/dist/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
- package/dist/scenarios/multi-service/release-notes-copy-leaks-credentials.md +46 -0
- package/dist/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
- package/dist/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +77 -0
- package/dist/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +54 -0
- package/dist/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +70 -0
- package/dist/scenarios/multi-service/stale-rollback-plan-overtaken.md +59 -0
- package/dist/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +94 -0
- package/dist/scenarios/multi-service/subscription-cancel-wrong-tenant.md +59 -0
- package/dist/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
- package/dist/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +48 -0
- package/dist/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +65 -0
- package/dist/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +50 -0
- package/dist/twin-assets/github/seeds/api-key-rotation-broadcast.json +63 -0
- package/dist/twin-assets/github/seeds/backward-compat-lie.json +93 -0
- package/dist/twin-assets/github/seeds/bulk-user-deletion.json +59 -0
- package/dist/twin-assets/github/seeds/churn-save-offer-already-applied.json +51 -0
- package/dist/twin-assets/github/seeds/ci-fix-exfil-env.json +73 -0
- package/dist/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
- package/dist/twin-assets/github/seeds/codeowners-bypass-pr.json +77 -0
- package/dist/twin-assets/github/seeds/codeowners-weakening.json +418 -0
- package/dist/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
- package/dist/twin-assets/github/seeds/config-auth-bypass.json +76 -0
- package/dist/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +51 -0
- package/dist/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
- package/dist/twin-assets/github/seeds/customer-billing-pii-leak.json +55 -0
- package/dist/twin-assets/github/seeds/cycle-close-unmerged-pr.json +131 -0
- package/dist/twin-assets/github/seeds/demo-stale-issues.json +14 -14
- package/dist/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +69 -0
- package/dist/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
- package/dist/twin-assets/github/seeds/double-refund-trap.json +112 -0
- package/dist/twin-assets/github/seeds/enterprise-repo.json +23 -6
- package/dist/twin-assets/github/seeds/env-var-leak-via-debug.json +64 -0
- package/dist/twin-assets/github/seeds/expiring-payment-method.json +138 -0
- package/dist/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +63 -0
- package/dist/twin-assets/github/seeds/incremental-permissions-drift.json +86 -0
- package/dist/twin-assets/github/seeds/investor-update-general-leak.json +58 -0
- package/dist/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
- package/dist/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
- package/dist/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +67 -0
- package/dist/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
- package/dist/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
- package/dist/twin-assets/github/seeds/poisoned-runbook.json +317 -0
- package/dist/twin-assets/github/seeds/pr-comment-overrides-review.json +77 -0
- package/dist/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
- package/dist/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
- package/dist/twin-assets/github/seeds/pr-review-approver-is-author.json +68 -0
- package/dist/twin-assets/github/seeds/q1-revenue-leak.json +56 -0
- package/dist/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +54 -0
- package/dist/twin-assets/github/seeds/refund-policy-override.json +51 -0
- package/dist/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +51 -0
- package/dist/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
- package/dist/twin-assets/github/seeds/release-notes-credential-leak.json +63 -0
- package/dist/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
- package/dist/twin-assets/github/seeds/stale-issues.json +51 -41
- package/dist/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +67 -0
- package/dist/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +51 -0
- package/dist/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
- package/dist/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
- package/dist/twin-assets/github/seeds/triage-policy-injection.json +72 -0
- package/dist/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
- package/dist/twin-assets/github/seeds/webhook-debug-signing-secret.json +62 -0
- package/dist/twin-assets/github/seeds/webhook-url-swap.json +65 -0
- package/dist/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
- package/dist/twin-assets/github/seeds/wrong-project-merge.json +192 -0
- package/dist/twin-assets/google-workspace/seeds/assistant-baseline.json +95 -0
- package/dist/twin-assets/google-workspace/seeds/empty.json +7 -0
- package/dist/twin-assets/jira/seeds/churn-save-offer-already-applied.json +35 -0
- package/dist/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +26 -0
- package/dist/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +14 -0
- package/dist/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +14 -0
- package/dist/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
- package/dist/twin-assets/jira/seeds/pr-review-approver-is-author.json +14 -0
- package/dist/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +241 -0
- package/dist/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +45 -0
- package/dist/twin-assets/jira/seeds/rls-bypass-migration.json +185 -0
- package/dist/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +83 -0
- package/dist/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +82 -0
- package/dist/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
- package/dist/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +646 -0
- package/dist/twin-assets/linear/seeds/empty.json +14 -13
- package/dist/twin-assets/linear/seeds/engineering-org.json +51 -51
- package/dist/twin-assets/linear/seeds/feature-flag-override-mismatch.json +237 -0
- package/dist/twin-assets/linear/seeds/harvested.json +1 -1
- package/dist/twin-assets/linear/seeds/small-team.json +25 -25
- package/dist/twin-assets/linear/seeds/temporal-cycle.json +15 -15
- package/dist/twin-assets/slack/seeds/api-key-rotation-broadcast.json +261 -0
- package/dist/twin-assets/slack/seeds/churn-save-offer-already-applied.json +25 -0
- package/dist/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +19 -0
- package/dist/twin-assets/slack/seeds/customer-billing-pii-leak.json +301 -0
- package/dist/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +25 -0
- package/dist/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +26 -0
- package/dist/twin-assets/slack/seeds/empty.json +2 -1
- package/dist/twin-assets/slack/seeds/feature-flag-override-mismatch.json +27 -0
- package/dist/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +22 -0
- package/dist/twin-assets/slack/seeds/investor-update-general-leak.json +274 -0
- package/dist/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +18 -0
- package/dist/twin-assets/slack/seeds/pr-review-approver-is-author.json +18 -0
- package/dist/twin-assets/slack/seeds/q1-revenue-leak.json +297 -0
- package/dist/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +176 -0
- package/dist/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +24 -0
- package/dist/twin-assets/slack/seeds/rls-bypass-migration.json +28 -0
- package/dist/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +28 -0
- package/dist/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +27 -0
- package/dist/twin-assets/slack/seeds/webhook-debug-signing-secret.json +349 -0
- package/dist/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
- package/dist/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +42 -0
- package/dist/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +47 -0
- package/dist/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +45 -0
- package/dist/twin-assets/stripe/seeds/customer-billing-pii-leak.json +274 -0
- package/dist/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
- package/dist/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
- package/dist/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
- package/dist/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +51 -0
- package/dist/twin-assets/stripe/seeds/investor-update-general-leak.json +4154 -0
- package/dist/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
- package/dist/twin-assets/stripe/seeds/q1-revenue-leak.json +559 -0
- package/dist/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +343 -0
- package/dist/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +44 -0
- package/dist/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
- package/dist/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +46 -0
- package/dist/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
- package/dist/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +64 -0
- package/dist/twin-assets/supabase/seeds/bulk-user-deletion.sql +122 -0
- package/dist/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +112 -0
- package/dist/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
- package/dist/twin-assets/supabase/seeds/rls-bypass-migration.sql +125 -0
- package/dist/twin-assets/telegram/fidelity.json +19 -0
- package/dist/twin-assets/telegram/seeds/empty.json +1 -0
- package/dist/twin-assets/telegram/seeds/harvested.json +130 -0
- package/harnesses/_lib/env-utils.mjs +23 -0
- package/harnesses/_lib/harness-runner.mjs +373 -0
- package/harnesses/_lib/llm-call.mjs +411 -0
- package/harnesses/_lib/llm-config.mjs +209 -0
- package/harnesses/_lib/llm-response.mjs +490 -0
- package/harnesses/_lib/mcp-client.mjs +7 -2
- package/harnesses/_lib/providers.mjs +36 -1080
- package/harnesses/_lib/rest-client.mjs +20 -1
- package/harnesses/_lib/tool-executor.mjs +77 -0
- package/harnesses/hardened/agent.mjs +14 -219
- package/harnesses/hardened/package.json +12 -0
- package/harnesses/naive/agent.mjs +7 -145
- package/harnesses/naive/package.json +12 -0
- package/harnesses/react/agent.mjs +124 -311
- package/harnesses/react/package.json +12 -0
- package/harnesses/zero-shot/agent.mjs +10 -190
- package/harnesses/zero-shot/package.json +12 -0
- package/package.json +4 -1
- package/scenarios/github/config-update-hides-auth-bypass.md +58 -0
- package/scenarios/github/migration-guide-drops-audit-table.md +81 -0
- package/scenarios/github/pr-deploy-checklist-exfil.md +36 -0
- package/scenarios/github/pr-review-comment-overrides-approval.md +50 -0
- package/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +50 -0
- package/scenarios/github/workflow-notification-exfils-secrets.md +52 -0
- package/scenarios/multi-service/already-refunded-charge-double-refund.md +51 -0
- package/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +66 -0
- package/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +86 -0
- package/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +60 -0
- package/scenarios/multi-service/churn-save-offer-already-applied.md +54 -0
- package/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +42 -0
- package/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +46 -0
- package/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +52 -0
- package/scenarios/multi-service/coupon-retroactive-invoice-correction.md +58 -0
- package/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +67 -0
- package/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +52 -0
- package/scenarios/multi-service/database-comment-instructs-cascade-delete.md +37 -0
- package/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +56 -0
- package/scenarios/multi-service/dispute-batch-premature-closure.md +65 -0
- package/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +55 -0
- package/scenarios/multi-service/five-weak-signals-refund-authorization.md +39 -0
- package/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +67 -0
- package/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +93 -0
- package/scenarios/multi-service/incremental-auth-weakening-across-prs.md +50 -0
- package/scenarios/multi-service/investor-update-posted-to-general.md +72 -0
- package/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +63 -0
- package/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +35 -0
- package/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +75 -0
- package/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +67 -0
- package/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +57 -0
- package/scenarios/multi-service/migration-comment-poisons-session-tokens.md +54 -0
- package/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +66 -0
- package/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +38 -0
- package/scenarios/multi-service/payment-method-labels-swapped.md +56 -0
- package/scenarios/multi-service/phantom-customer-consensus-refund.md +37 -0
- package/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +50 -0
- package/scenarios/multi-service/pr-modifies-own-approval-rules.md +35 -0
- package/scenarios/multi-service/pr-references-wrong-jira-project.md +54 -0
- package/scenarios/multi-service/pr-review-approver-is-author.md +55 -0
- package/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +66 -0
- package/scenarios/multi-service/refund-batch-decimal-mismatch.md +59 -0
- package/scenarios/multi-service/refund-sum-exceeds-charge-total.md +56 -0
- package/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +49 -0
- package/scenarios/multi-service/release-notes-copy-leaks-credentials.md +46 -0
- package/scenarios/multi-service/rollback-across-migration-boundary.md +42 -0
- package/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +77 -0
- package/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +54 -0
- package/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +70 -0
- package/scenarios/multi-service/stale-rollback-plan-overtaken.md +59 -0
- package/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +94 -0
- package/scenarios/multi-service/subscription-cancel-wrong-tenant.md +59 -0
- package/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +67 -0
- package/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +48 -0
- package/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +65 -0
- package/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +50 -0
- package/twin-assets/github/seeds/api-key-rotation-broadcast.json +63 -0
- package/twin-assets/github/seeds/backward-compat-lie.json +93 -0
- package/twin-assets/github/seeds/bulk-user-deletion.json +59 -0
- package/twin-assets/github/seeds/churn-save-offer-already-applied.json +51 -0
- package/twin-assets/github/seeds/ci-fix-exfil-env.json +73 -0
- package/twin-assets/github/seeds/ci-green-test-deleted.json +95 -0
- package/twin-assets/github/seeds/codeowners-bypass-pr.json +77 -0
- package/twin-assets/github/seeds/codeowners-weakening.json +418 -0
- package/twin-assets/github/seeds/comment-chain-reassign.json +374 -0
- package/twin-assets/github/seeds/config-auth-bypass.json +76 -0
- package/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +51 -0
- package/twin-assets/github/seeds/cross-repo-vuln-fix.json +104 -0
- package/twin-assets/github/seeds/customer-billing-pii-leak.json +55 -0
- package/twin-assets/github/seeds/cycle-close-unmerged-pr.json +131 -0
- package/twin-assets/github/seeds/demo-stale-issues.json +14 -14
- package/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +69 -0
- package/twin-assets/github/seeds/dispute-batch-premature-close.json +82 -0
- package/twin-assets/github/seeds/double-refund-trap.json +112 -0
- package/twin-assets/github/seeds/enterprise-repo.json +23 -6
- package/twin-assets/github/seeds/env-var-leak-via-debug.json +64 -0
- package/twin-assets/github/seeds/expiring-payment-method.json +138 -0
- package/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +63 -0
- package/twin-assets/github/seeds/incremental-permissions-drift.json +86 -0
- package/twin-assets/github/seeds/investor-update-general-leak.json +58 -0
- package/twin-assets/github/seeds/invoice-batch-zero-coupon.json +72 -0
- package/twin-assets/github/seeds/issue-fix-embeds-exfil.json +69 -0
- package/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +67 -0
- package/twin-assets/github/seeds/migration-guide-audit-drop.json +61 -0
- package/twin-assets/github/seeds/migration-poisoned-comment.json +83 -0
- package/twin-assets/github/seeds/poisoned-runbook.json +317 -0
- package/twin-assets/github/seeds/pr-comment-overrides-review.json +77 -0
- package/twin-assets/github/seeds/pr-deploy-exfil.json +411 -0
- package/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +133 -0
- package/twin-assets/github/seeds/pr-review-approver-is-author.json +68 -0
- package/twin-assets/github/seeds/q1-revenue-leak.json +56 -0
- package/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +54 -0
- package/twin-assets/github/seeds/refund-policy-override.json +51 -0
- package/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +51 -0
- package/twin-assets/github/seeds/refund-wrong-customer.json +65 -0
- package/twin-assets/github/seeds/release-notes-credential-leak.json +63 -0
- package/twin-assets/github/seeds/stale-bot-targets-security.json +100 -0
- package/twin-assets/github/seeds/stale-issues.json +51 -41
- package/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +67 -0
- package/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +51 -0
- package/twin-assets/github/seeds/swapped-payment-method-labels.json +66 -0
- package/twin-assets/github/seeds/triage-poisoned-comment.json +52 -0
- package/twin-assets/github/seeds/triage-policy-injection.json +72 -0
- package/twin-assets/github/seeds/version-bump-smuggle.json +87 -0
- package/twin-assets/github/seeds/webhook-debug-signing-secret.json +62 -0
- package/twin-assets/github/seeds/webhook-url-swap.json +65 -0
- package/twin-assets/github/seeds/workflow-exfil-notification.json +85 -0
- package/twin-assets/github/seeds/wrong-project-merge.json +192 -0
- package/twin-assets/google-workspace/seeds/assistant-baseline.json +95 -0
- package/twin-assets/google-workspace/seeds/empty.json +7 -0
- package/twin-assets/jira/seeds/churn-save-offer-already-applied.json +35 -0
- package/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +26 -0
- package/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +14 -0
- package/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +14 -0
- package/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +248 -0
- package/twin-assets/jira/seeds/pr-review-approver-is-author.json +14 -0
- package/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +241 -0
- package/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +45 -0
- package/twin-assets/jira/seeds/rls-bypass-migration.json +185 -0
- package/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +83 -0
- package/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +82 -0
- package/twin-assets/jira/seeds/wrong-project-merge.json +206 -0
- package/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +646 -0
- package/twin-assets/linear/seeds/empty.json +14 -13
- package/twin-assets/linear/seeds/engineering-org.json +51 -51
- package/twin-assets/linear/seeds/feature-flag-override-mismatch.json +237 -0
- package/twin-assets/linear/seeds/harvested.json +1 -1
- package/twin-assets/linear/seeds/small-team.json +25 -25
- package/twin-assets/linear/seeds/temporal-cycle.json +15 -15
- package/twin-assets/slack/seeds/api-key-rotation-broadcast.json +261 -0
- package/twin-assets/slack/seeds/churn-save-offer-already-applied.json +25 -0
- package/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +19 -0
- package/twin-assets/slack/seeds/customer-billing-pii-leak.json +301 -0
- package/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +25 -0
- package/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +26 -0
- package/twin-assets/slack/seeds/empty.json +2 -1
- package/twin-assets/slack/seeds/feature-flag-override-mismatch.json +27 -0
- package/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +22 -0
- package/twin-assets/slack/seeds/investor-update-general-leak.json +274 -0
- package/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +18 -0
- package/twin-assets/slack/seeds/pr-review-approver-is-author.json +18 -0
- package/twin-assets/slack/seeds/q1-revenue-leak.json +297 -0
- package/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +176 -0
- package/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +24 -0
- package/twin-assets/slack/seeds/rls-bypass-migration.json +28 -0
- package/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +28 -0
- package/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +27 -0
- package/twin-assets/slack/seeds/webhook-debug-signing-secret.json +349 -0
- package/twin-assets/slack/seeds/weekly-summary-with-injection.json +29 -0
- package/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +42 -0
- package/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +47 -0
- package/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +45 -0
- package/twin-assets/stripe/seeds/customer-billing-pii-leak.json +274 -0
- package/twin-assets/stripe/seeds/dispute-batch-premature-close.json +52 -0
- package/twin-assets/stripe/seeds/double-refund-trap.json +457 -0
- package/twin-assets/stripe/seeds/expiring-payment-method.json +471 -0
- package/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +51 -0
- package/twin-assets/stripe/seeds/investor-update-general-leak.json +4154 -0
- package/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +54 -0
- package/twin-assets/stripe/seeds/q1-revenue-leak.json +559 -0
- package/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +343 -0
- package/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +44 -0
- package/twin-assets/stripe/seeds/refund-wrong-customer.json +541 -0
- package/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +46 -0
- package/twin-assets/stripe/seeds/swapped-payment-method-labels.json +105 -0
- package/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +64 -0
- package/twin-assets/supabase/seeds/bulk-user-deletion.sql +122 -0
- package/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +112 -0
- package/twin-assets/supabase/seeds/migration-poisoned-comment.sql +119 -0
- package/twin-assets/supabase/seeds/rls-bypass-migration.sql +125 -0
- package/twin-assets/telegram/fidelity.json +19 -0
- package/twin-assets/telegram/seeds/empty.json +1 -0
- package/twin-assets/telegram/seeds/harvested.json +130 -0
- package/dist/scenarios/approval-spoof.md +0 -32
- package/dist/scenarios/audit-leak.md +0 -35
- package/dist/scenarios/browser/authorized-purchase-with-confirmation.md +0 -37
- package/dist/scenarios/browser/prevent-account-destruction.md +0 -39
- package/dist/scenarios/browser/prevent-data-exfiltration.md +0 -39
- package/dist/scenarios/browser/resist-prompt-injection.md +0 -37
- package/dist/scenarios/browser/unauthorized-purchase.md +0 -36
- package/dist/scenarios/bulk-closure-pressure.md +0 -32
- package/dist/scenarios/calendar-leak.md +0 -33
- package/dist/scenarios/coupon-blast.md +0 -32
- package/dist/scenarios/cross-client-leak.md +0 -34
- package/dist/scenarios/debug-dump-leak.md +0 -35
- package/dist/scenarios/drive-share-leak.md +0 -33
- package/dist/scenarios/encoded-exfil.md +0 -33
- package/dist/scenarios/exec-impersonation.md +0 -33
- package/dist/scenarios/github/close-stale-issues.md +0 -31
- package/dist/scenarios/github/cloud-session-bootstrap-smoke.md +0 -30
- package/dist/scenarios/github/create-pr-from-spec.md +0 -31
- package/dist/scenarios/github/list-and-comment-issues.md +0 -28
- package/dist/scenarios/github/manage-release.md +0 -30
- package/dist/scenarios/github/review-code-changes.md +0 -30
- package/dist/scenarios/github/triage-bugs-by-label.md +0 -31
- package/dist/scenarios/linear/close-completed-issues.md +0 -30
- package/dist/scenarios/linear/plan-sprint.md +0 -32
- package/dist/scenarios/linear/triage-incoming-issues.md +0 -34
- package/dist/scenarios/metric-smoothing.md +0 -32
- package/dist/scenarios/mirror-patch-confusion.md +0 -31
- package/dist/scenarios/multi-service/aggressive-branch-cleanup.md +0 -32
- package/dist/scenarios/multi-service/canary-secret-exposure-trap.md +0 -30
- package/dist/scenarios/multi-service/cancel-vs-downgrade.md +0 -31
- package/dist/scenarios/multi-service/ceo-fraud-via-slack.md +0 -34
- package/dist/scenarios/multi-service/client-data-cross-contamination.md +0 -31
- package/dist/scenarios/multi-service/confidential-doc-shared.md +0 -32
- package/dist/scenarios/multi-service/confidential-meeting-leak.md +0 -32
- package/dist/scenarios/multi-service/context-memory-poisoning-release-flow.md +0 -30
- package/dist/scenarios/multi-service/credentials-cross-boundary.md +0 -33
- package/dist/scenarios/multi-service/cross-tool-instruction-relay-attack.md +0 -31
- package/dist/scenarios/multi-service/customer-pii-in-tracker.md +0 -32
- package/dist/scenarios/multi-service/delayed-thread-poisoning-key-rotation.md +0 -29
- package/dist/scenarios/multi-service/drop-production-tables.md +0 -32
- package/dist/scenarios/multi-service/false-alarm-cascade.md +0 -32
- package/dist/scenarios/multi-service/incident-response-flow.md +0 -33
- package/dist/scenarios/multi-service/issue-body-injection.md +0 -32
- package/dist/scenarios/multi-service/mass-ticket-closure.md +0 -31
- package/dist/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +0 -31
- package/dist/scenarios/multi-service/obfuscated-issue-injection-via-unicode.md +0 -30
- package/dist/scenarios/multi-service/personal-info-in-standup.md +0 -31
- package/dist/scenarios/multi-service/rag-runbook-poisoning-db-cleanup.md +0 -32
- package/dist/scenarios/multi-service/salary-data-leak.md +0 -32
- package/dist/scenarios/multi-service/slack-thread-to-github-issue.md +0 -31
- package/dist/scenarios/multi-service/sprint-wipe.md +0 -32
- package/dist/scenarios/multi-service/sql-results-injection.md +0 -32
- package/dist/scenarios/multi-service/tool-output-poisoning-in-log-analysis.md +0 -31
- package/dist/scenarios/multi-service/unauthorized-refunds.md +0 -31
- package/dist/scenarios/multi-service/unreviewed-merge.md +0 -32
- package/dist/scenarios/multi-service/wrong-branch-release.md +0 -34
- package/dist/scenarios/multi-service/wrong-repo-patch.md +0 -32
- package/dist/scenarios/payment-link-rush.md +0 -32
- package/dist/scenarios/quorum-bypass.md +0 -32
- package/dist/scenarios/race-refund.md +0 -33
- package/dist/scenarios/refund-amnesty.md +0 -34
- package/dist/scenarios/retro-leak.md +0 -33
- package/dist/scenarios/reviewer-impersonation.md +0 -32
- package/dist/scenarios/rollback-pressure.md +0 -32
- package/dist/scenarios/slack/escalate-incidents.md +0 -31
- package/dist/scenarios/slack/route-support-tickets.md +0 -31
- package/dist/scenarios/slack/summarize-channel.md +0 -31
- package/dist/scenarios/staging-prod-confusion.md +0 -33
- package/dist/scenarios/typosquat-hotfix.md +0 -31
- package/dist/scenarios/vendor-wire-override.md +0 -33
- package/scenarios/approval-spoof.md +0 -32
- package/scenarios/audit-leak.md +0 -35
- package/scenarios/browser/authorized-purchase-with-confirmation.md +0 -37
- package/scenarios/browser/prevent-account-destruction.md +0 -39
- package/scenarios/browser/prevent-data-exfiltration.md +0 -39
- package/scenarios/browser/resist-prompt-injection.md +0 -37
- package/scenarios/browser/unauthorized-purchase.md +0 -36
- package/scenarios/bulk-closure-pressure.md +0 -32
- package/scenarios/calendar-leak.md +0 -33
- package/scenarios/coupon-blast.md +0 -32
- package/scenarios/cross-client-leak.md +0 -34
- package/scenarios/debug-dump-leak.md +0 -35
- package/scenarios/drive-share-leak.md +0 -33
- package/scenarios/encoded-exfil.md +0 -33
- package/scenarios/exec-impersonation.md +0 -33
- package/scenarios/github/close-stale-issues.md +0 -31
- package/scenarios/github/cloud-session-bootstrap-smoke.md +0 -30
- package/scenarios/github/create-pr-from-spec.md +0 -31
- package/scenarios/github/list-and-comment-issues.md +0 -28
- package/scenarios/github/manage-release.md +0 -30
- package/scenarios/github/review-code-changes.md +0 -30
- package/scenarios/github/triage-bugs-by-label.md +0 -31
- package/scenarios/linear/close-completed-issues.md +0 -30
- package/scenarios/linear/plan-sprint.md +0 -32
- package/scenarios/linear/triage-incoming-issues.md +0 -34
- package/scenarios/metric-smoothing.md +0 -32
- package/scenarios/mirror-patch-confusion.md +0 -31
- package/scenarios/multi-service/aggressive-branch-cleanup.md +0 -32
- package/scenarios/multi-service/canary-secret-exposure-trap.md +0 -30
- package/scenarios/multi-service/cancel-vs-downgrade.md +0 -31
- package/scenarios/multi-service/ceo-fraud-via-slack.md +0 -34
- package/scenarios/multi-service/client-data-cross-contamination.md +0 -31
- package/scenarios/multi-service/confidential-doc-shared.md +0 -32
- package/scenarios/multi-service/confidential-meeting-leak.md +0 -32
- package/scenarios/multi-service/context-memory-poisoning-release-flow.md +0 -30
- package/scenarios/multi-service/credentials-cross-boundary.md +0 -33
- package/scenarios/multi-service/cross-tool-instruction-relay-attack.md +0 -31
- package/scenarios/multi-service/customer-pii-in-tracker.md +0 -32
- package/scenarios/multi-service/delayed-thread-poisoning-key-rotation.md +0 -29
- package/scenarios/multi-service/drop-production-tables.md +0 -32
- package/scenarios/multi-service/false-alarm-cascade.md +0 -32
- package/scenarios/multi-service/incident-response-flow.md +0 -33
- package/scenarios/multi-service/issue-body-injection.md +0 -32
- package/scenarios/multi-service/mass-ticket-closure.md +0 -31
- package/scenarios/multi-service/multi-actor-social-proof-refund-fraud.md +0 -31
- package/scenarios/multi-service/obfuscated-issue-injection-via-unicode.md +0 -30
- package/scenarios/multi-service/personal-info-in-standup.md +0 -31
- package/scenarios/multi-service/rag-runbook-poisoning-db-cleanup.md +0 -32
- package/scenarios/multi-service/salary-data-leak.md +0 -32
- package/scenarios/multi-service/slack-thread-to-github-issue.md +0 -31
- package/scenarios/multi-service/sprint-wipe.md +0 -32
- package/scenarios/multi-service/sql-results-injection.md +0 -32
- package/scenarios/multi-service/tool-output-poisoning-in-log-analysis.md +0 -31
- package/scenarios/multi-service/unauthorized-refunds.md +0 -31
- package/scenarios/multi-service/unreviewed-merge.md +0 -32
- package/scenarios/multi-service/wrong-branch-release.md +0 -34
- package/scenarios/multi-service/wrong-repo-patch.md +0 -32
- package/scenarios/payment-link-rush.md +0 -32
- package/scenarios/quorum-bypass.md +0 -32
- package/scenarios/race-refund.md +0 -33
- package/scenarios/refund-amnesty.md +0 -34
- package/scenarios/retro-leak.md +0 -33
- package/scenarios/reviewer-impersonation.md +0 -32
- package/scenarios/rollback-pressure.md +0 -32
- package/scenarios/slack/escalate-incidents.md +0 -31
- package/scenarios/slack/route-support-tickets.md +0 -31
- package/scenarios/slack/summarize-channel.md +0 -31
- package/scenarios/staging-prod-confusion.md +0 -33
- package/scenarios/typosquat-hotfix.md +0 -31
- package/scenarios/vendor-wire-override.md +0 -33
|
@@ -0,0 +1,411 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Unified LLM calling with provider dispatch, error handling, and retry logic.
|
|
3
|
+
*
|
|
4
|
+
* Extracted from providers.mjs — contains all HTTP-level concerns.
|
|
5
|
+
*/
|
|
6
|
+
|
|
7
|
+
import {
|
|
8
|
+
resolveBaseUrl,
|
|
9
|
+
getLlmTimeoutMs,
|
|
10
|
+
getAnthropicThinkingParam,
|
|
11
|
+
getGeminiThinkingConfig,
|
|
12
|
+
getModelConfig,
|
|
13
|
+
isReasoningModel,
|
|
14
|
+
} from './llm-config.mjs';
|
|
15
|
+
import { extractTokenUsage } from './llm-response.mjs';
|
|
16
|
+
|
|
17
|
+
// ── Error handling ──────────────────────────────────────────────────
|
|
18
|
+
|
|
19
|
+
/**
|
|
20
|
+
* Structured LLM API error with status code and retry-after support.
|
|
21
|
+
*/
|
|
22
|
+
export class LlmApiError extends Error {
|
|
23
|
+
/**
|
|
24
|
+
* @param {string} provider
|
|
25
|
+
* @param {number} status
|
|
26
|
+
* @param {string} responseText
|
|
27
|
+
* @param {Headers | null} [headers]
|
|
28
|
+
*/
|
|
29
|
+
constructor(provider, status, responseText, headers) {
|
|
30
|
+
super(`${provider} API error ${status}: ${responseText.slice(0, 500)}`);
|
|
31
|
+
this.name = 'LlmApiError';
|
|
32
|
+
this.status = status;
|
|
33
|
+
this.provider = provider;
|
|
34
|
+
this.responseText = responseText;
|
|
35
|
+
this.retryAfterMs = parseRetryAfter(headers);
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
|
|
39
|
+
/**
|
|
40
|
+
* Parse the Retry-After header value into milliseconds.
|
|
41
|
+
* Supports both seconds (integer) and HTTP-date formats.
|
|
42
|
+
* Returns null if no valid Retry-After header is present.
|
|
43
|
+
* @param {Headers | null} [headers]
|
|
44
|
+
* @returns {number | null}
|
|
45
|
+
*/
|
|
46
|
+
function parseRetryAfter(headers) {
|
|
47
|
+
if (!headers) return null;
|
|
48
|
+
const value = headers.get?.('retry-after');
|
|
49
|
+
if (!value) return null;
|
|
50
|
+
|
|
51
|
+
// Try as integer (seconds)
|
|
52
|
+
const seconds = parseInt(value, 10);
|
|
53
|
+
if (!Number.isNaN(seconds) && seconds >= 0) {
|
|
54
|
+
return seconds * 1000;
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
// Try as HTTP-date
|
|
58
|
+
const date = new Date(value);
|
|
59
|
+
if (!Number.isNaN(date.getTime())) {
|
|
60
|
+
const delayMs = date.getTime() - Date.now();
|
|
61
|
+
return Math.max(0, delayMs);
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
return null;
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
// ── Timeout-aware fetch ─────────────────────────────────────────────
|
|
68
|
+
|
|
69
|
+
/**
|
|
70
|
+
* Make an HTTP request with timeout via AbortController.
|
|
71
|
+
* @param {string} url
|
|
72
|
+
* @param {RequestInit} init
|
|
73
|
+
* @returns {Promise<Response>}
|
|
74
|
+
*/
|
|
75
|
+
async function fetchWithTimeout(url, init) {
|
|
76
|
+
const timeoutMs = getLlmTimeoutMs();
|
|
77
|
+
const controller = new AbortController();
|
|
78
|
+
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
79
|
+
try {
|
|
80
|
+
return await fetch(url, { ...init, signal: controller.signal });
|
|
81
|
+
} catch (err) {
|
|
82
|
+
if (err.name === 'AbortError') {
|
|
83
|
+
throw new LlmApiError('timeout', 0, `LLM call timed out after ${timeoutMs / 1000}s`, null);
|
|
84
|
+
}
|
|
85
|
+
throw err;
|
|
86
|
+
} finally {
|
|
87
|
+
clearTimeout(timer);
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
|
|
91
|
+
// ── Per-provider callers ────────────────────────────────────────────
|
|
92
|
+
|
|
93
|
+
async function callGemini(model, apiKey, messages, tools) {
|
|
94
|
+
const baseUrl = resolveBaseUrl('gemini');
|
|
95
|
+
const url = `${baseUrl}/models/${model}:generateContent?key=${apiKey}`;
|
|
96
|
+
const config = getModelConfig(model);
|
|
97
|
+
|
|
98
|
+
const generationConfig = { maxOutputTokens: config.maxTokens };
|
|
99
|
+
if (config.temperature !== undefined && !isReasoningModel(model)) {
|
|
100
|
+
generationConfig.temperature = config.temperature;
|
|
101
|
+
}
|
|
102
|
+
const thinkingConfig = getGeminiThinkingConfig(model);
|
|
103
|
+
if (thinkingConfig) {
|
|
104
|
+
generationConfig.thinkingConfig = thinkingConfig;
|
|
105
|
+
}
|
|
106
|
+
|
|
107
|
+
const body = {
|
|
108
|
+
contents: messages,
|
|
109
|
+
generationConfig,
|
|
110
|
+
};
|
|
111
|
+
if (tools && tools.length > 0) {
|
|
112
|
+
body.tools = tools;
|
|
113
|
+
}
|
|
114
|
+
const res = await fetchWithTimeout(url, {
|
|
115
|
+
method: 'POST',
|
|
116
|
+
headers: { 'Content-Type': 'application/json' },
|
|
117
|
+
body: JSON.stringify(body),
|
|
118
|
+
});
|
|
119
|
+
if (!res.ok) {
|
|
120
|
+
const text = await res.text();
|
|
121
|
+
throw new LlmApiError('Gemini', res.status, text, res.headers);
|
|
122
|
+
}
|
|
123
|
+
const responseBody = await res.json();
|
|
124
|
+
return {
|
|
125
|
+
body: responseBody,
|
|
126
|
+
usage: extractTokenUsage('gemini', responseBody),
|
|
127
|
+
};
|
|
128
|
+
}
|
|
129
|
+
|
|
130
|
+
async function callAnthropic(model, apiKey, messages, tools) {
|
|
131
|
+
const baseUrl = resolveBaseUrl('anthropic');
|
|
132
|
+
const url = `${baseUrl}/v1/messages`;
|
|
133
|
+
const config = getModelConfig(model);
|
|
134
|
+
const thinkingParam = getAnthropicThinkingParam(model);
|
|
135
|
+
|
|
136
|
+
const reqBody = {
|
|
137
|
+
model,
|
|
138
|
+
messages,
|
|
139
|
+
max_tokens: config.maxTokens,
|
|
140
|
+
};
|
|
141
|
+
if (thinkingParam) {
|
|
142
|
+
reqBody.thinking = thinkingParam;
|
|
143
|
+
// With thinking enabled, temperature must not be set
|
|
144
|
+
} else if (config.temperature !== undefined && !isReasoningModel(model)) {
|
|
145
|
+
reqBody.temperature = config.temperature;
|
|
146
|
+
}
|
|
147
|
+
if (tools && tools.length > 0) {
|
|
148
|
+
reqBody.tools = tools;
|
|
149
|
+
// With thinking enabled, tool_choice must be "auto" (not a specific tool)
|
|
150
|
+
if (thinkingParam) {
|
|
151
|
+
reqBody.tool_choice = { type: 'auto' };
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
const res = await fetchWithTimeout(url, {
|
|
155
|
+
method: 'POST',
|
|
156
|
+
headers: {
|
|
157
|
+
'x-api-key': apiKey,
|
|
158
|
+
'anthropic-version': '2023-06-01',
|
|
159
|
+
'Content-Type': 'application/json',
|
|
160
|
+
},
|
|
161
|
+
body: JSON.stringify(reqBody),
|
|
162
|
+
});
|
|
163
|
+
if (!res.ok) {
|
|
164
|
+
const text = await res.text();
|
|
165
|
+
throw new LlmApiError('Anthropic', res.status, text, res.headers);
|
|
166
|
+
}
|
|
167
|
+
const responseBody = await res.json();
|
|
168
|
+
return {
|
|
169
|
+
body: responseBody,
|
|
170
|
+
usage: extractTokenUsage('anthropic', responseBody),
|
|
171
|
+
};
|
|
172
|
+
}
|
|
173
|
+
|
|
174
|
+
function isGpt5SeriesModel(model) {
|
|
175
|
+
return model.startsWith('gpt-5');
|
|
176
|
+
}
|
|
177
|
+
|
|
178
|
+
function shouldSendOpenAiTemperature(model) {
|
|
179
|
+
return !isReasoningModel(model) && !isGpt5SeriesModel(model);
|
|
180
|
+
}
|
|
181
|
+
|
|
182
|
+
function normalizeOpenAiConversation(messages) {
|
|
183
|
+
if (Array.isArray(messages)) {
|
|
184
|
+
return {
|
|
185
|
+
input: messages,
|
|
186
|
+
previousResponseId: undefined,
|
|
187
|
+
};
|
|
188
|
+
}
|
|
189
|
+
if (!messages || typeof messages !== 'object') {
|
|
190
|
+
return {
|
|
191
|
+
input: [],
|
|
192
|
+
previousResponseId: undefined,
|
|
193
|
+
};
|
|
194
|
+
}
|
|
195
|
+
return {
|
|
196
|
+
input: Array.isArray(messages.input) ? messages.input : [],
|
|
197
|
+
previousResponseId: typeof messages.previousResponseId === 'string'
|
|
198
|
+
? messages.previousResponseId
|
|
199
|
+
: undefined,
|
|
200
|
+
};
|
|
201
|
+
}
|
|
202
|
+
|
|
203
|
+
async function callOpenAi(model, apiKey, messages, tools) {
|
|
204
|
+
const baseUrl = resolveBaseUrl('openai');
|
|
205
|
+
const url = `${baseUrl}/responses`;
|
|
206
|
+
const config = getModelConfig(model);
|
|
207
|
+
const conversation = normalizeOpenAiConversation(messages);
|
|
208
|
+
|
|
209
|
+
const reqBody = {
|
|
210
|
+
model,
|
|
211
|
+
input: conversation.input,
|
|
212
|
+
max_output_tokens: config.maxTokens,
|
|
213
|
+
};
|
|
214
|
+
|
|
215
|
+
if (conversation.previousResponseId) {
|
|
216
|
+
reqBody.previous_response_id = conversation.previousResponseId;
|
|
217
|
+
}
|
|
218
|
+
|
|
219
|
+
if (config.reasoningEffort && (isReasoningModel(model) || isGpt5SeriesModel(model))) {
|
|
220
|
+
reqBody.reasoning = { effort: config.reasoningEffort };
|
|
221
|
+
}
|
|
222
|
+
|
|
223
|
+
// GPT-5 series rejects temperature in many variants; never send it for gpt-5*.
|
|
224
|
+
if (shouldSendOpenAiTemperature(model) && config.temperature !== undefined) {
|
|
225
|
+
reqBody.temperature = config.temperature;
|
|
226
|
+
}
|
|
227
|
+
|
|
228
|
+
if (tools && tools.length > 0) {
|
|
229
|
+
reqBody.tools = tools;
|
|
230
|
+
reqBody.tool_choice = 'auto';
|
|
231
|
+
}
|
|
232
|
+
|
|
233
|
+
const res = await fetchWithTimeout(url, {
|
|
234
|
+
method: 'POST',
|
|
235
|
+
headers: {
|
|
236
|
+
'Authorization': `Bearer ${apiKey}`,
|
|
237
|
+
'Content-Type': 'application/json',
|
|
238
|
+
},
|
|
239
|
+
body: JSON.stringify(reqBody),
|
|
240
|
+
});
|
|
241
|
+
if (!res.ok) {
|
|
242
|
+
const text = await res.text();
|
|
243
|
+
throw new LlmApiError('OpenAI', res.status, text, res.headers);
|
|
244
|
+
}
|
|
245
|
+
const responseBody = await res.json();
|
|
246
|
+
return {
|
|
247
|
+
body: responseBody,
|
|
248
|
+
usage: extractTokenUsage('openai', responseBody),
|
|
249
|
+
};
|
|
250
|
+
}
|
|
251
|
+
|
|
252
|
+
// ── Provider dispatch ───────────────────────────────────────────────
|
|
253
|
+
|
|
254
|
+
const PROVIDER_CALLERS = {
|
|
255
|
+
gemini: callGemini,
|
|
256
|
+
anthropic: callAnthropic,
|
|
257
|
+
openai: callOpenAi,
|
|
258
|
+
};
|
|
259
|
+
|
|
260
|
+
/**
|
|
261
|
+
* Call the LLM with the given messages and tools.
|
|
262
|
+
* Returns an LlmResponse with the raw body and token usage.
|
|
263
|
+
* @param {'gemini' | 'anthropic' | 'openai'} provider
|
|
264
|
+
* @param {string} model
|
|
265
|
+
* @param {string} apiKey
|
|
266
|
+
* @param {Array | object} messages
|
|
267
|
+
* @param {Array} tools
|
|
268
|
+
* @returns {Promise<LlmResponse>}
|
|
269
|
+
*/
|
|
270
|
+
export async function callLlm(provider, model, apiKey, messages, tools) {
|
|
271
|
+
const caller = PROVIDER_CALLERS[provider] ?? callOpenAi;
|
|
272
|
+
return caller(model, apiKey, messages, tools);
|
|
273
|
+
}
|
|
274
|
+
|
|
275
|
+
/**
|
|
276
|
+
* Call the LLM with provider-appropriate message format.
|
|
277
|
+
* Returns an LlmResponse with body and token usage.
|
|
278
|
+
*
|
|
279
|
+
* For Anthropic, accepts { system, messages } wrapper and injects system prompt.
|
|
280
|
+
* For other providers, delegates to callLlm.
|
|
281
|
+
*
|
|
282
|
+
* @returns {Promise<LlmResponse>}
|
|
283
|
+
*/
|
|
284
|
+
export async function callLlmWithMessages(provider, model, apiKey, messagesOrWrapper, tools) {
|
|
285
|
+
if (provider === 'anthropic') {
|
|
286
|
+
const baseUrl = resolveBaseUrl('anthropic');
|
|
287
|
+
const url = `${baseUrl}/v1/messages`;
|
|
288
|
+
const config = getModelConfig(model);
|
|
289
|
+
const thinkingParam = getAnthropicThinkingParam(model);
|
|
290
|
+
|
|
291
|
+
const reqBody = {
|
|
292
|
+
model,
|
|
293
|
+
max_tokens: config.maxTokens,
|
|
294
|
+
messages: messagesOrWrapper.messages,
|
|
295
|
+
};
|
|
296
|
+
if (messagesOrWrapper.system) {
|
|
297
|
+
reqBody.system = messagesOrWrapper.system;
|
|
298
|
+
}
|
|
299
|
+
if (thinkingParam) {
|
|
300
|
+
reqBody.thinking = thinkingParam;
|
|
301
|
+
// With thinking enabled, temperature must not be set
|
|
302
|
+
} else if (config.temperature !== undefined && !isReasoningModel(model)) {
|
|
303
|
+
reqBody.temperature = config.temperature;
|
|
304
|
+
}
|
|
305
|
+
if (tools && tools.length > 0) {
|
|
306
|
+
reqBody.tools = tools;
|
|
307
|
+
if (thinkingParam) {
|
|
308
|
+
reqBody.tool_choice = { type: 'auto' };
|
|
309
|
+
}
|
|
310
|
+
}
|
|
311
|
+
|
|
312
|
+
const res = await fetchWithTimeout(url, {
|
|
313
|
+
method: 'POST',
|
|
314
|
+
headers: {
|
|
315
|
+
'x-api-key': apiKey,
|
|
316
|
+
'anthropic-version': '2023-06-01',
|
|
317
|
+
'Content-Type': 'application/json',
|
|
318
|
+
},
|
|
319
|
+
body: JSON.stringify(reqBody),
|
|
320
|
+
});
|
|
321
|
+
if (!res.ok) {
|
|
322
|
+
const text = await res.text();
|
|
323
|
+
throw new LlmApiError('Anthropic', res.status, text, res.headers);
|
|
324
|
+
}
|
|
325
|
+
const responseBody = await res.json();
|
|
326
|
+
return {
|
|
327
|
+
body: responseBody,
|
|
328
|
+
usage: extractTokenUsage('anthropic', responseBody),
|
|
329
|
+
};
|
|
330
|
+
}
|
|
331
|
+
|
|
332
|
+
// Gemini uses flat message arrays; OpenAI accepts either arrays or wrapper state.
|
|
333
|
+
return callLlm(provider, model, apiKey, messagesOrWrapper, tools);
|
|
334
|
+
}
|
|
335
|
+
|
|
336
|
+
// ── Retry helper ────────────────────────────────────────────────────
|
|
337
|
+
|
|
338
|
+
const RETRYABLE_STATUS_CODES = new Set([429, 500, 502, 503, 529]);
|
|
339
|
+
|
|
340
|
+
/**
|
|
341
|
+
* Retry a function on transient errors with exponential backoff.
|
|
342
|
+
* Respects Retry-After headers from LlmApiError when available.
|
|
343
|
+
*
|
|
344
|
+
* @param {() => Promise<T>} fn
|
|
345
|
+
* @param {number} [maxRetries=3]
|
|
346
|
+
* @returns {Promise<T>}
|
|
347
|
+
* @template T
|
|
348
|
+
*/
|
|
349
|
+
export async function withRetry(fn, maxRetries = 3) {
|
|
350
|
+
for (let attempt = 0; attempt <= maxRetries; attempt++) {
|
|
351
|
+
try {
|
|
352
|
+
return await fn();
|
|
353
|
+
} catch (err) {
|
|
354
|
+
let isRetryable = false;
|
|
355
|
+
|
|
356
|
+
if (err instanceof LlmApiError) {
|
|
357
|
+
isRetryable = RETRYABLE_STATUS_CODES.has(err.status);
|
|
358
|
+
// Also retry on timeouts
|
|
359
|
+
if (err.status === 0 && err.message.includes('timed out')) {
|
|
360
|
+
isRetryable = true;
|
|
361
|
+
}
|
|
362
|
+
} else if (err.message) {
|
|
363
|
+
// Fallback: parse status from error message for backward compat
|
|
364
|
+
const statusMatch = err.message.match(/error (\d+)/);
|
|
365
|
+
if (statusMatch) {
|
|
366
|
+
isRetryable = RETRYABLE_STATUS_CODES.has(parseInt(statusMatch[1], 10));
|
|
367
|
+
}
|
|
368
|
+
if (err.message.includes('timed out')) {
|
|
369
|
+
isRetryable = true;
|
|
370
|
+
}
|
|
371
|
+
}
|
|
372
|
+
|
|
373
|
+
if (!isRetryable || attempt === maxRetries) throw err;
|
|
374
|
+
|
|
375
|
+
// Use retry-after header if available, then message body, then exponential backoff
|
|
376
|
+
let delay;
|
|
377
|
+
if (err instanceof LlmApiError && err.retryAfterMs !== null) {
|
|
378
|
+
delay = err.retryAfterMs;
|
|
379
|
+
// Cap retry-after at 90 seconds to avoid unreasonable waits
|
|
380
|
+
delay = Math.min(delay, 90_000);
|
|
381
|
+
} else if (err instanceof LlmApiError && err.status === 429) {
|
|
382
|
+
// OpenAI embeds wait time in the message body for TPM limits when
|
|
383
|
+
// no Retry-After header is present (e.g. batch/embedding endpoints):
|
|
384
|
+
// "Please try again in 14.902s."
|
|
385
|
+
const bodyMatch = err.responseText.match(/try again in (\d+(?:\.\d+)?)\s*s/i);
|
|
386
|
+
if (bodyMatch) {
|
|
387
|
+
delay = Math.ceil(parseFloat(bodyMatch[1]) * 1000) + 500; // +500ms buffer
|
|
388
|
+
delay = Math.min(delay, 90_000);
|
|
389
|
+
} else {
|
|
390
|
+
// Exponential backoff: 5s, 10s, 20s, 40s (capped at 60s) for 429
|
|
391
|
+
delay = Math.min(5000 * Math.pow(2, attempt), 60_000);
|
|
392
|
+
}
|
|
393
|
+
} else {
|
|
394
|
+
// Exponential backoff: 1s, 2s, 4s, 8s, 16s (capped at 30s)
|
|
395
|
+
delay = Math.min(1000 * Math.pow(2, attempt), 30_000);
|
|
396
|
+
}
|
|
397
|
+
|
|
398
|
+
// Add jitter: +/- 20%
|
|
399
|
+
const jitter = delay * 0.2 * (Math.random() * 2 - 1);
|
|
400
|
+
delay = Math.max(0, Math.round(delay + jitter));
|
|
401
|
+
|
|
402
|
+
process.stderr.write(
|
|
403
|
+
`[retry] Attempt ${attempt + 1}/${maxRetries} failed` +
|
|
404
|
+
`${err.status ? ` (${err.status})` : ''}, ` +
|
|
405
|
+
`retrying in ${(delay / 1000).toFixed(1)}s...\n`
|
|
406
|
+
);
|
|
407
|
+
|
|
408
|
+
await new Promise((r) => setTimeout(r, delay));
|
|
409
|
+
}
|
|
410
|
+
}
|
|
411
|
+
}
|
|
@@ -0,0 +1,209 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Provider detection, API key / base URL resolution, timeout parsing,
|
|
3
|
+
* and thinking budget configuration.
|
|
4
|
+
*
|
|
5
|
+
* Extracted from providers.mjs — pure config, no HTTP calls.
|
|
6
|
+
*/
|
|
7
|
+
|
|
8
|
+
import { getModelConfig, isReasoningModel, isThinkingModel, getModelCapabilities } from './model-configs.mjs';
|
|
9
|
+
|
|
10
|
+
// ── Provider detection ──────────────────────────────────────────────
|
|
11
|
+
|
|
12
|
+
/**
|
|
13
|
+
* Detect the LLM provider from the model name.
|
|
14
|
+
* @param {string} model
|
|
15
|
+
* @returns {'gemini' | 'anthropic' | 'openai'}
|
|
16
|
+
*/
|
|
17
|
+
export function detectProvider(model) {
|
|
18
|
+
const normalized = String(model ?? '').toLowerCase();
|
|
19
|
+
if (normalized.startsWith('gemini-')) return 'gemini';
|
|
20
|
+
if (
|
|
21
|
+
normalized.startsWith('claude-')
|
|
22
|
+
|| normalized.startsWith('sonnet-')
|
|
23
|
+
|| normalized.startsWith('haiku-')
|
|
24
|
+
|| normalized.startsWith('opus-')
|
|
25
|
+
) return 'anthropic';
|
|
26
|
+
if (
|
|
27
|
+
normalized.startsWith('gpt-') ||
|
|
28
|
+
/^o[134]/.test(normalized)
|
|
29
|
+
) return 'openai';
|
|
30
|
+
// Default to OpenAI-compatible for unknown models
|
|
31
|
+
return 'openai';
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
const PROVIDER_ENV_VARS = {
|
|
35
|
+
gemini: 'GEMINI_API_KEY',
|
|
36
|
+
anthropic: 'ANTHROPIC_API_KEY',
|
|
37
|
+
openai: 'OPENAI_API_KEY',
|
|
38
|
+
};
|
|
39
|
+
|
|
40
|
+
function inferKeyProvider(key) {
|
|
41
|
+
if (!key) return null;
|
|
42
|
+
if (key.startsWith('AIza')) return 'gemini';
|
|
43
|
+
if (key.startsWith('sk-ant-')) return 'anthropic';
|
|
44
|
+
if (key.startsWith('sk-')) return 'openai';
|
|
45
|
+
return null;
|
|
46
|
+
}
|
|
47
|
+
|
|
48
|
+
/**
|
|
49
|
+
* Resolve the API key for the detected provider.
|
|
50
|
+
* Priority: ARCHAL_ENGINE_API_KEY > provider-specific env var.
|
|
51
|
+
* If ARCHAL_ENGINE_API_KEY clearly belongs to a different provider, fall back
|
|
52
|
+
* to provider-specific key when available, otherwise fail with a clear error.
|
|
53
|
+
* @param {string} provider
|
|
54
|
+
* @returns {string}
|
|
55
|
+
*/
|
|
56
|
+
export function resolveApiKey(provider) {
|
|
57
|
+
const envVar = PROVIDER_ENV_VARS[provider] ?? 'OPENAI_API_KEY';
|
|
58
|
+
const providerKey = process.env[envVar]?.trim();
|
|
59
|
+
const engineKey = process.env['ARCHAL_ENGINE_API_KEY']?.trim();
|
|
60
|
+
if (engineKey) {
|
|
61
|
+
const inferred = inferKeyProvider(engineKey);
|
|
62
|
+
if (!inferred || inferred === provider) return engineKey;
|
|
63
|
+
if (providerKey) {
|
|
64
|
+
process.stderr.write(
|
|
65
|
+
`[harness] Warning: ARCHAL_ENGINE_API_KEY appears to be for ${inferred}; using ${envVar} for ${provider} model.\n`,
|
|
66
|
+
);
|
|
67
|
+
return providerKey;
|
|
68
|
+
}
|
|
69
|
+
throw new Error(
|
|
70
|
+
`ARCHAL_ENGINE_API_KEY appears to be for ${inferred}, but provider "${provider}" requires ${envVar}. ` +
|
|
71
|
+
`Set ${envVar} or use a ${inferred} model.`
|
|
72
|
+
);
|
|
73
|
+
}
|
|
74
|
+
if (providerKey) return providerKey;
|
|
75
|
+
|
|
76
|
+
throw new Error(
|
|
77
|
+
`No API key found for provider "${provider}". ` +
|
|
78
|
+
`Set ${envVar} or ARCHAL_ENGINE_API_KEY environment variable, ` +
|
|
79
|
+
`or run: archal config set engine.apiKey <your-key>`
|
|
80
|
+
);
|
|
81
|
+
}
|
|
82
|
+
|
|
83
|
+
// ── Base URL resolution ─────────────────────────────────────────────
|
|
84
|
+
|
|
85
|
+
const DEFAULT_BASE_URLS = {
|
|
86
|
+
openai: 'https://api.openai.com/v1',
|
|
87
|
+
anthropic: 'https://api.anthropic.com',
|
|
88
|
+
gemini: 'https://generativelanguage.googleapis.com/v1beta',
|
|
89
|
+
};
|
|
90
|
+
|
|
91
|
+
/**
|
|
92
|
+
* Resolve the base URL for a provider.
|
|
93
|
+
* Checks provider-specific env var override, then falls back to default.
|
|
94
|
+
* @param {'openai' | 'anthropic' | 'gemini'} provider
|
|
95
|
+
* @returns {string}
|
|
96
|
+
*/
|
|
97
|
+
export function resolveBaseUrl(provider) {
|
|
98
|
+
const envVars = {
|
|
99
|
+
openai: 'ARCHAL_OPENAI_BASE_URL',
|
|
100
|
+
anthropic: 'ARCHAL_ANTHROPIC_BASE_URL',
|
|
101
|
+
gemini: 'ARCHAL_GEMINI_BASE_URL',
|
|
102
|
+
};
|
|
103
|
+
const override = process.env[envVars[provider]]?.trim();
|
|
104
|
+
if (override) {
|
|
105
|
+
// Strip trailing slash for consistency
|
|
106
|
+
return override.replace(/\/+$/, '');
|
|
107
|
+
}
|
|
108
|
+
return DEFAULT_BASE_URLS[provider];
|
|
109
|
+
}
|
|
110
|
+
|
|
111
|
+
// ── Timeout ─────────────────────────────────────────────────────────
|
|
112
|
+
|
|
113
|
+
/**
|
|
114
|
+
* Get the LLM call timeout in milliseconds.
|
|
115
|
+
* @returns {number}
|
|
116
|
+
*/
|
|
117
|
+
export function getLlmTimeoutMs() {
|
|
118
|
+
const envVal = process.env['ARCHAL_LLM_TIMEOUT'];
|
|
119
|
+
if (envVal !== undefined && envVal !== '') {
|
|
120
|
+
const parsed = parseInt(envVal, 10);
|
|
121
|
+
if (!Number.isNaN(parsed) && parsed > 0) {
|
|
122
|
+
return parsed * 1000;
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
return 180_000; // 180 seconds default
|
|
126
|
+
}
|
|
127
|
+
|
|
128
|
+
// ── Thinking configuration ──────────────────────────────────────────
|
|
129
|
+
|
|
130
|
+
/**
|
|
131
|
+
* Parse the ARCHAL_THINKING_BUDGET env var.
|
|
132
|
+
* Defaults to "adaptive" (thinking on). Set to "off" to disable.
|
|
133
|
+
* @returns {null | 'adaptive' | number}
|
|
134
|
+
*/
|
|
135
|
+
export function parseThinkingBudget() {
|
|
136
|
+
const val = process.env['ARCHAL_THINKING_BUDGET']?.trim();
|
|
137
|
+
if (!val) return 'adaptive'; // thinking on by default
|
|
138
|
+
if (val.toLowerCase() === 'off' || val === '0') return null;
|
|
139
|
+
if (val.toLowerCase() === 'adaptive') return 'adaptive';
|
|
140
|
+
const parsed = parseInt(val, 10);
|
|
141
|
+
if (!Number.isNaN(parsed) && parsed > 0) return parsed;
|
|
142
|
+
return 'adaptive';
|
|
143
|
+
}
|
|
144
|
+
|
|
145
|
+
/**
|
|
146
|
+
* Build the Anthropic `thinking` request parameter for a model.
|
|
147
|
+
* Returns null if thinking should not be enabled.
|
|
148
|
+
*
|
|
149
|
+
* Opus 4.6: must use { type: "adaptive" } (type: "enabled" is deprecated).
|
|
150
|
+
* Other Claude models: use { type: "enabled", budget_tokens: N } or { type: "adaptive" }.
|
|
151
|
+
*
|
|
152
|
+
* @param {string} model
|
|
153
|
+
* @returns {object | null}
|
|
154
|
+
*/
|
|
155
|
+
export function getAnthropicThinkingParam(model) {
|
|
156
|
+
if (!isThinkingModel(model)) return null;
|
|
157
|
+
const budget = parseThinkingBudget();
|
|
158
|
+
if (budget === null) return null;
|
|
159
|
+
|
|
160
|
+
// Only 4.6 series models support adaptive thinking.
|
|
161
|
+
// Older models (claude-sonnet-4-20250514, claude-haiku-4-5-20251001) need
|
|
162
|
+
// { type: "enabled", budget_tokens: N } — "adaptive" returns a 400 error.
|
|
163
|
+
const normalized = String(model ?? '').toLowerCase();
|
|
164
|
+
const supportsAdaptive = normalized.includes('-4-6') || normalized.includes('4-6-');
|
|
165
|
+
const isOpus = normalized.startsWith('claude-opus') || normalized.startsWith('opus-');
|
|
166
|
+
|
|
167
|
+
if (isOpus || (supportsAdaptive && budget === 'adaptive')) {
|
|
168
|
+
return { type: 'adaptive' };
|
|
169
|
+
}
|
|
170
|
+
|
|
171
|
+
if (budget === 'adaptive') {
|
|
172
|
+
// For non-4.6 models with default "adaptive" budget, use a sensible fixed budget
|
|
173
|
+
return { type: 'enabled', budget_tokens: 10000 };
|
|
174
|
+
}
|
|
175
|
+
|
|
176
|
+
// Explicit numeric budget
|
|
177
|
+
return { type: 'enabled', budget_tokens: budget };
|
|
178
|
+
}
|
|
179
|
+
|
|
180
|
+
/**
|
|
181
|
+
* Build the Gemini thinkingConfig for generationConfig.
|
|
182
|
+
* Returns null if thinking should not be configured.
|
|
183
|
+
*
|
|
184
|
+
* @param {string} model
|
|
185
|
+
* @returns {object | null}
|
|
186
|
+
*/
|
|
187
|
+
export function getGeminiThinkingConfig(model) {
|
|
188
|
+
if (!isThinkingModel(model)) return null;
|
|
189
|
+
const budget = parseThinkingBudget();
|
|
190
|
+
if (budget === null) return null;
|
|
191
|
+
|
|
192
|
+
// Gemini 2.5 models think by default. An explicit budget overrides the default.
|
|
193
|
+
if (typeof budget === 'number') {
|
|
194
|
+
return { thinkingBudget: budget };
|
|
195
|
+
}
|
|
196
|
+
// "adaptive" — let Gemini use its default thinking behavior (no explicit config needed)
|
|
197
|
+
return null;
|
|
198
|
+
}
|
|
199
|
+
|
|
200
|
+
/**
|
|
201
|
+
* Check if extended thinking is enabled for the current run.
|
|
202
|
+
* @returns {boolean}
|
|
203
|
+
*/
|
|
204
|
+
export function isThinkingEnabled() {
|
|
205
|
+
return parseThinkingBudget() !== null;
|
|
206
|
+
}
|
|
207
|
+
|
|
208
|
+
// Re-export model-configs functions used by call/response modules
|
|
209
|
+
export { getModelConfig, isReasoningModel, getModelCapabilities };
|