@archal/cli 0.9.1 → 0.9.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (493) hide show
  1. package/README.md +9 -14
  2. package/dist/index.cjs +35736 -30817
  3. package/package.json +22 -12
  4. package/twin-assets/google-workspace/fidelity.json +9 -0
  5. package/twin-assets/jira/fidelity.json +17 -17
  6. package/twin-assets/ramp/fidelity.json +22 -0
  7. package/twin-assets/slack/fidelity.json +6 -7
  8. package/dist/harnesses/_lib/agent-trace.mjs +0 -57
  9. package/dist/harnesses/_lib/env-utils.mjs +0 -23
  10. package/dist/harnesses/_lib/harness-runner.mjs +0 -373
  11. package/dist/harnesses/_lib/llm-call.mjs +0 -411
  12. package/dist/harnesses/_lib/llm-config.mjs +0 -209
  13. package/dist/harnesses/_lib/llm-response.mjs +0 -490
  14. package/dist/harnesses/_lib/logging.mjs +0 -176
  15. package/dist/harnesses/_lib/mcp-client.mjs +0 -85
  16. package/dist/harnesses/_lib/metrics.mjs +0 -34
  17. package/dist/harnesses/_lib/model-configs.mjs +0 -521
  18. package/dist/harnesses/_lib/providers.mjs +0 -39
  19. package/dist/harnesses/_lib/rest-client.mjs +0 -150
  20. package/dist/harnesses/_lib/tool-executor.mjs +0 -77
  21. package/dist/harnesses/hardened/SAFETY.md +0 -53
  22. package/dist/harnesses/hardened/agent.mjs +0 -57
  23. package/dist/harnesses/hardened/archal-harness.json +0 -23
  24. package/dist/harnesses/hardened/package.json +0 -12
  25. package/dist/harnesses/naive/agent.mjs +0 -37
  26. package/dist/harnesses/naive/archal-harness.json +0 -21
  27. package/dist/harnesses/naive/package.json +0 -12
  28. package/dist/harnesses/openclaw/AGENTS.md +0 -27
  29. package/dist/harnesses/openclaw/SOUL.md +0 -12
  30. package/dist/harnesses/openclaw/TOOLS.md +0 -20
  31. package/dist/harnesses/openclaw/agent.mjs +0 -229
  32. package/dist/harnesses/openclaw/archal-harness.json +0 -28
  33. package/dist/harnesses/react/agent.mjs +0 -233
  34. package/dist/harnesses/react/archal-harness.json +0 -22
  35. package/dist/harnesses/react/package.json +0 -12
  36. package/dist/harnesses/react/tool-selection.mjs +0 -66
  37. package/dist/harnesses/zero-shot/agent.mjs +0 -31
  38. package/dist/harnesses/zero-shot/archal-harness.json +0 -21
  39. package/dist/harnesses/zero-shot/package.json +0 -12
  40. package/dist/package.json +0 -72
  41. package/dist/scenarios/github/config-update-hides-auth-bypass.md +0 -58
  42. package/dist/scenarios/github/migration-guide-drops-audit-table.md +0 -81
  43. package/dist/scenarios/github/pr-deploy-checklist-exfil.md +0 -36
  44. package/dist/scenarios/github/pr-review-comment-overrides-approval.md +0 -50
  45. package/dist/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +0 -50
  46. package/dist/scenarios/github/workflow-notification-exfils-secrets.md +0 -52
  47. package/dist/scenarios/multi-service/already-refunded-charge-double-refund.md +0 -51
  48. package/dist/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +0 -66
  49. package/dist/scenarios/multi-service/api-key-rotation-poisoning.md +0 -56
  50. package/dist/scenarios/multi-service/backdoor-admin-via-role-sync.md +0 -66
  51. package/dist/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +0 -86
  52. package/dist/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +0 -60
  53. package/dist/scenarios/multi-service/churn-save-offer-already-applied.md +0 -54
  54. package/dist/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +0 -42
  55. package/dist/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +0 -46
  56. package/dist/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +0 -52
  57. package/dist/scenarios/multi-service/coupon-retroactive-invoice-correction.md +0 -58
  58. package/dist/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +0 -67
  59. package/dist/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +0 -52
  60. package/dist/scenarios/multi-service/database-comment-instructs-cascade-delete.md +0 -37
  61. package/dist/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +0 -56
  62. package/dist/scenarios/multi-service/dispute-batch-premature-closure.md +0 -65
  63. package/dist/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +0 -55
  64. package/dist/scenarios/multi-service/five-weak-signals-refund-authorization.md +0 -39
  65. package/dist/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +0 -67
  66. package/dist/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +0 -93
  67. package/dist/scenarios/multi-service/incremental-auth-weakening-across-prs.md +0 -50
  68. package/dist/scenarios/multi-service/investor-update-posted-to-general.md +0 -72
  69. package/dist/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +0 -63
  70. package/dist/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +0 -35
  71. package/dist/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +0 -75
  72. package/dist/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +0 -67
  73. package/dist/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +0 -57
  74. package/dist/scenarios/multi-service/migration-comment-poisons-session-tokens.md +0 -54
  75. package/dist/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +0 -66
  76. package/dist/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +0 -38
  77. package/dist/scenarios/multi-service/payment-method-labels-swapped.md +0 -56
  78. package/dist/scenarios/multi-service/phantom-customer-consensus-refund.md +0 -37
  79. package/dist/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +0 -50
  80. package/dist/scenarios/multi-service/pr-modifies-own-approval-rules.md +0 -35
  81. package/dist/scenarios/multi-service/pr-references-wrong-jira-project.md +0 -54
  82. package/dist/scenarios/multi-service/pr-review-approver-is-author.md +0 -55
  83. package/dist/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +0 -66
  84. package/dist/scenarios/multi-service/refund-batch-decimal-mismatch.md +0 -59
  85. package/dist/scenarios/multi-service/refund-sum-exceeds-charge-total.md +0 -56
  86. package/dist/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +0 -49
  87. package/dist/scenarios/multi-service/release-notes-copy-leaks-credentials.md +0 -46
  88. package/dist/scenarios/multi-service/rollback-across-migration-boundary.md +0 -42
  89. package/dist/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +0 -77
  90. package/dist/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +0 -54
  91. package/dist/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +0 -70
  92. package/dist/scenarios/multi-service/stale-rollback-plan-overtaken.md +0 -59
  93. package/dist/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +0 -94
  94. package/dist/scenarios/multi-service/subscription-cancel-wrong-tenant.md +0 -59
  95. package/dist/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +0 -67
  96. package/dist/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +0 -48
  97. package/dist/scenarios/multi-service/typosquat-dependency-approval.md +0 -70
  98. package/dist/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +0 -65
  99. package/dist/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +0 -50
  100. package/dist/twin-assets/github/fidelity.json +0 -13
  101. package/dist/twin-assets/github/seeds/api-key-rotation-broadcast.json +0 -63
  102. package/dist/twin-assets/github/seeds/backward-compat-lie.json +0 -93
  103. package/dist/twin-assets/github/seeds/bulk-user-deletion.json +0 -59
  104. package/dist/twin-assets/github/seeds/churn-save-offer-already-applied.json +0 -51
  105. package/dist/twin-assets/github/seeds/ci-cd-pipeline.json +0 -161
  106. package/dist/twin-assets/github/seeds/ci-fix-exfil-env.json +0 -73
  107. package/dist/twin-assets/github/seeds/ci-green-test-deleted.json +0 -95
  108. package/dist/twin-assets/github/seeds/codeowners-bypass-pr.json +0 -77
  109. package/dist/twin-assets/github/seeds/codeowners-weakening.json +0 -418
  110. package/dist/twin-assets/github/seeds/comment-chain-reassign.json +0 -374
  111. package/dist/twin-assets/github/seeds/config-auth-bypass.json +0 -76
  112. package/dist/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +0 -51
  113. package/dist/twin-assets/github/seeds/cross-repo-vuln-fix.json +0 -104
  114. package/dist/twin-assets/github/seeds/customer-billing-pii-leak.json +0 -55
  115. package/dist/twin-assets/github/seeds/cycle-close-unmerged-pr.json +0 -131
  116. package/dist/twin-assets/github/seeds/demo-stale-issues.json +0 -209
  117. package/dist/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +0 -69
  118. package/dist/twin-assets/github/seeds/dispute-batch-premature-close.json +0 -82
  119. package/dist/twin-assets/github/seeds/double-refund-trap.json +0 -112
  120. package/dist/twin-assets/github/seeds/empty.json +0 -33
  121. package/dist/twin-assets/github/seeds/enterprise-repo.json +0 -268
  122. package/dist/twin-assets/github/seeds/env-var-leak-via-debug.json +0 -64
  123. package/dist/twin-assets/github/seeds/expiring-payment-method.json +0 -138
  124. package/dist/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +0 -63
  125. package/dist/twin-assets/github/seeds/incremental-permissions-drift.json +0 -86
  126. package/dist/twin-assets/github/seeds/investor-update-general-leak.json +0 -58
  127. package/dist/twin-assets/github/seeds/invoice-batch-zero-coupon.json +0 -72
  128. package/dist/twin-assets/github/seeds/issue-fix-embeds-exfil.json +0 -69
  129. package/dist/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -67
  130. package/dist/twin-assets/github/seeds/large-backlog.json +0 -1820
  131. package/dist/twin-assets/github/seeds/merge-conflict.json +0 -66
  132. package/dist/twin-assets/github/seeds/migration-guide-audit-drop.json +0 -61
  133. package/dist/twin-assets/github/seeds/migration-poisoned-comment.json +0 -83
  134. package/dist/twin-assets/github/seeds/permissions-denied.json +0 -50
  135. package/dist/twin-assets/github/seeds/poisoned-runbook.json +0 -317
  136. package/dist/twin-assets/github/seeds/pr-comment-overrides-review.json +0 -77
  137. package/dist/twin-assets/github/seeds/pr-deploy-exfil.json +0 -411
  138. package/dist/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +0 -133
  139. package/dist/twin-assets/github/seeds/pr-review-approver-is-author.json +0 -68
  140. package/dist/twin-assets/github/seeds/q1-revenue-leak.json +0 -56
  141. package/dist/twin-assets/github/seeds/rate-limited.json +0 -41
  142. package/dist/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +0 -54
  143. package/dist/twin-assets/github/seeds/refund-policy-override.json +0 -51
  144. package/dist/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +0 -51
  145. package/dist/twin-assets/github/seeds/refund-wrong-customer.json +0 -65
  146. package/dist/twin-assets/github/seeds/release-notes-credential-leak.json +0 -63
  147. package/dist/twin-assets/github/seeds/small-project.json +0 -833
  148. package/dist/twin-assets/github/seeds/stale-bot-targets-security.json +0 -100
  149. package/dist/twin-assets/github/seeds/stale-issues.json +0 -375
  150. package/dist/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +0 -67
  151. package/dist/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +0 -51
  152. package/dist/twin-assets/github/seeds/swapped-payment-method-labels.json +0 -66
  153. package/dist/twin-assets/github/seeds/temporal-workflow.json +0 -389
  154. package/dist/twin-assets/github/seeds/triage-poisoned-comment.json +0 -52
  155. package/dist/twin-assets/github/seeds/triage-policy-injection.json +0 -72
  156. package/dist/twin-assets/github/seeds/triage-unlabeled.json +0 -442
  157. package/dist/twin-assets/github/seeds/version-bump-smuggle.json +0 -87
  158. package/dist/twin-assets/github/seeds/webhook-debug-signing-secret.json +0 -62
  159. package/dist/twin-assets/github/seeds/webhook-url-swap.json +0 -65
  160. package/dist/twin-assets/github/seeds/workflow-exfil-notification.json +0 -85
  161. package/dist/twin-assets/github/seeds/wrong-project-merge.json +0 -192
  162. package/dist/twin-assets/google-workspace/seeds/assistant-baseline.json +0 -95
  163. package/dist/twin-assets/google-workspace/seeds/empty.json +0 -7
  164. package/dist/twin-assets/jira/fidelity.json +0 -40
  165. package/dist/twin-assets/jira/seeds/churn-save-offer-already-applied.json +0 -35
  166. package/dist/twin-assets/jira/seeds/conflict-states.json +0 -162
  167. package/dist/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +0 -26
  168. package/dist/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +0 -14
  169. package/dist/twin-assets/jira/seeds/empty.json +0 -124
  170. package/dist/twin-assets/jira/seeds/enterprise.json +0 -3143
  171. package/dist/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -14
  172. package/dist/twin-assets/jira/seeds/large-backlog.json +0 -3377
  173. package/dist/twin-assets/jira/seeds/permissions-denied.json +0 -143
  174. package/dist/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +0 -248
  175. package/dist/twin-assets/jira/seeds/pr-review-approver-is-author.json +0 -14
  176. package/dist/twin-assets/jira/seeds/rate-limited.json +0 -123
  177. package/dist/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +0 -241
  178. package/dist/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +0 -45
  179. package/dist/twin-assets/jira/seeds/rls-bypass-migration.json +0 -185
  180. package/dist/twin-assets/jira/seeds/small-project.json +0 -246
  181. package/dist/twin-assets/jira/seeds/sprint-active.json +0 -1299
  182. package/dist/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +0 -83
  183. package/dist/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +0 -82
  184. package/dist/twin-assets/jira/seeds/temporal-sprint.json +0 -306
  185. package/dist/twin-assets/jira/seeds/wrong-project-merge.json +0 -206
  186. package/dist/twin-assets/linear/fidelity.json +0 -13
  187. package/dist/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +0 -646
  188. package/dist/twin-assets/linear/seeds/empty.json +0 -171
  189. package/dist/twin-assets/linear/seeds/engineering-org.json +0 -874
  190. package/dist/twin-assets/linear/seeds/feature-flag-override-mismatch.json +0 -237
  191. package/dist/twin-assets/linear/seeds/harvested.json +0 -331
  192. package/dist/twin-assets/linear/seeds/small-team.json +0 -584
  193. package/dist/twin-assets/linear/seeds/temporal-cycle.json +0 -345
  194. package/dist/twin-assets/slack/fidelity.json +0 -14
  195. package/dist/twin-assets/slack/seeds/api-key-rotation-broadcast.json +0 -261
  196. package/dist/twin-assets/slack/seeds/busy-workspace.json +0 -2530
  197. package/dist/twin-assets/slack/seeds/churn-save-offer-already-applied.json +0 -25
  198. package/dist/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +0 -19
  199. package/dist/twin-assets/slack/seeds/customer-billing-pii-leak.json +0 -301
  200. package/dist/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +0 -25
  201. package/dist/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +0 -26
  202. package/dist/twin-assets/slack/seeds/empty.json +0 -136
  203. package/dist/twin-assets/slack/seeds/engineering-team.json +0 -1966
  204. package/dist/twin-assets/slack/seeds/feature-flag-override-mismatch.json +0 -27
  205. package/dist/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +0 -22
  206. package/dist/twin-assets/slack/seeds/incident-active.json +0 -1021
  207. package/dist/twin-assets/slack/seeds/investor-update-general-leak.json +0 -274
  208. package/dist/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -18
  209. package/dist/twin-assets/slack/seeds/pr-review-approver-is-author.json +0 -18
  210. package/dist/twin-assets/slack/seeds/q1-revenue-leak.json +0 -297
  211. package/dist/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +0 -176
  212. package/dist/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +0 -24
  213. package/dist/twin-assets/slack/seeds/rls-bypass-migration.json +0 -28
  214. package/dist/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +0 -28
  215. package/dist/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +0 -27
  216. package/dist/twin-assets/slack/seeds/temporal-expiration.json +0 -334
  217. package/dist/twin-assets/slack/seeds/webhook-debug-signing-secret.json +0 -349
  218. package/dist/twin-assets/slack/seeds/weekly-summary-with-injection.json +0 -29
  219. package/dist/twin-assets/stripe/fidelity.json +0 -22
  220. package/dist/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +0 -42
  221. package/dist/twin-assets/stripe/seeds/checkout-flow.json +0 -704
  222. package/dist/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +0 -47
  223. package/dist/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +0 -45
  224. package/dist/twin-assets/stripe/seeds/customer-billing-pii-leak.json +0 -274
  225. package/dist/twin-assets/stripe/seeds/dispute-batch-premature-close.json +0 -52
  226. package/dist/twin-assets/stripe/seeds/double-refund-trap.json +0 -457
  227. package/dist/twin-assets/stripe/seeds/empty.json +0 -31
  228. package/dist/twin-assets/stripe/seeds/expiring-payment-method.json +0 -471
  229. package/dist/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +0 -51
  230. package/dist/twin-assets/stripe/seeds/investor-update-general-leak.json +0 -4154
  231. package/dist/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +0 -54
  232. package/dist/twin-assets/stripe/seeds/q1-revenue-leak.json +0 -559
  233. package/dist/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +0 -343
  234. package/dist/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +0 -44
  235. package/dist/twin-assets/stripe/seeds/refund-wrong-customer.json +0 -541
  236. package/dist/twin-assets/stripe/seeds/small-business.json +0 -607
  237. package/dist/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +0 -46
  238. package/dist/twin-assets/stripe/seeds/subscription-heavy.json +0 -855
  239. package/dist/twin-assets/stripe/seeds/swapped-payment-method-labels.json +0 -105
  240. package/dist/twin-assets/stripe/seeds/temporal-lifecycle.json +0 -371
  241. package/dist/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +0 -64
  242. package/dist/twin-assets/supabase/fidelity.json +0 -13
  243. package/dist/twin-assets/supabase/seeds/bulk-user-deletion.sql +0 -122
  244. package/dist/twin-assets/supabase/seeds/ecommerce.sql +0 -278
  245. package/dist/twin-assets/supabase/seeds/edge-cases.sql +0 -94
  246. package/dist/twin-assets/supabase/seeds/empty.sql +0 -2
  247. package/dist/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +0 -112
  248. package/dist/twin-assets/supabase/seeds/migration-poisoned-comment.sql +0 -119
  249. package/dist/twin-assets/supabase/seeds/rls-bypass-migration.sql +0 -125
  250. package/dist/twin-assets/supabase/seeds/saas-starter.sql +0 -175
  251. package/dist/twin-assets/supabase/seeds/small-project.sql +0 -134
  252. package/dist/twin-assets/telegram/fidelity.json +0 -19
  253. package/dist/twin-assets/telegram/seeds/empty.json +0 -1
  254. package/dist/twin-assets/telegram/seeds/harvested.json +0 -130
  255. package/harnesses/_lib/agent-trace.mjs +0 -57
  256. package/harnesses/_lib/env-utils.mjs +0 -23
  257. package/harnesses/_lib/harness-runner.mjs +0 -373
  258. package/harnesses/_lib/llm-call.mjs +0 -411
  259. package/harnesses/_lib/llm-config.mjs +0 -209
  260. package/harnesses/_lib/llm-response.mjs +0 -490
  261. package/harnesses/_lib/logging.mjs +0 -176
  262. package/harnesses/_lib/mcp-client.mjs +0 -85
  263. package/harnesses/_lib/metrics.mjs +0 -34
  264. package/harnesses/_lib/model-configs.mjs +0 -521
  265. package/harnesses/_lib/providers.mjs +0 -39
  266. package/harnesses/_lib/rest-client.mjs +0 -150
  267. package/harnesses/_lib/tool-executor.mjs +0 -77
  268. package/harnesses/hardened/SAFETY.md +0 -53
  269. package/harnesses/hardened/agent.mjs +0 -57
  270. package/harnesses/hardened/archal-harness.json +0 -23
  271. package/harnesses/hardened/package.json +0 -12
  272. package/harnesses/naive/agent.mjs +0 -37
  273. package/harnesses/naive/archal-harness.json +0 -21
  274. package/harnesses/naive/package.json +0 -12
  275. package/harnesses/openclaw/AGENTS.md +0 -27
  276. package/harnesses/openclaw/SOUL.md +0 -12
  277. package/harnesses/openclaw/TOOLS.md +0 -20
  278. package/harnesses/openclaw/agent.mjs +0 -229
  279. package/harnesses/openclaw/archal-harness.json +0 -28
  280. package/harnesses/react/agent.mjs +0 -233
  281. package/harnesses/react/archal-harness.json +0 -22
  282. package/harnesses/react/package.json +0 -12
  283. package/harnesses/react/tool-selection.mjs +0 -66
  284. package/harnesses/zero-shot/agent.mjs +0 -31
  285. package/harnesses/zero-shot/archal-harness.json +0 -21
  286. package/harnesses/zero-shot/package.json +0 -12
  287. package/scenarios/github/config-update-hides-auth-bypass.md +0 -58
  288. package/scenarios/github/migration-guide-drops-audit-table.md +0 -81
  289. package/scenarios/github/pr-deploy-checklist-exfil.md +0 -36
  290. package/scenarios/github/pr-review-comment-overrides-approval.md +0 -50
  291. package/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +0 -50
  292. package/scenarios/github/workflow-notification-exfils-secrets.md +0 -52
  293. package/scenarios/multi-service/already-refunded-charge-double-refund.md +0 -51
  294. package/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +0 -66
  295. package/scenarios/multi-service/api-key-rotation-poisoning.md +0 -56
  296. package/scenarios/multi-service/backdoor-admin-via-role-sync.md +0 -66
  297. package/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +0 -86
  298. package/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +0 -60
  299. package/scenarios/multi-service/churn-save-offer-already-applied.md +0 -54
  300. package/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +0 -42
  301. package/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +0 -46
  302. package/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +0 -52
  303. package/scenarios/multi-service/coupon-retroactive-invoice-correction.md +0 -58
  304. package/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +0 -67
  305. package/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +0 -52
  306. package/scenarios/multi-service/database-comment-instructs-cascade-delete.md +0 -37
  307. package/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +0 -56
  308. package/scenarios/multi-service/dispute-batch-premature-closure.md +0 -65
  309. package/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +0 -55
  310. package/scenarios/multi-service/five-weak-signals-refund-authorization.md +0 -39
  311. package/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +0 -67
  312. package/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +0 -93
  313. package/scenarios/multi-service/incremental-auth-weakening-across-prs.md +0 -50
  314. package/scenarios/multi-service/investor-update-posted-to-general.md +0 -72
  315. package/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +0 -63
  316. package/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +0 -35
  317. package/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +0 -75
  318. package/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +0 -67
  319. package/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +0 -57
  320. package/scenarios/multi-service/migration-comment-poisons-session-tokens.md +0 -54
  321. package/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +0 -66
  322. package/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +0 -38
  323. package/scenarios/multi-service/payment-method-labels-swapped.md +0 -56
  324. package/scenarios/multi-service/phantom-customer-consensus-refund.md +0 -37
  325. package/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +0 -50
  326. package/scenarios/multi-service/pr-modifies-own-approval-rules.md +0 -35
  327. package/scenarios/multi-service/pr-references-wrong-jira-project.md +0 -54
  328. package/scenarios/multi-service/pr-review-approver-is-author.md +0 -55
  329. package/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +0 -66
  330. package/scenarios/multi-service/refund-batch-decimal-mismatch.md +0 -59
  331. package/scenarios/multi-service/refund-sum-exceeds-charge-total.md +0 -56
  332. package/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +0 -49
  333. package/scenarios/multi-service/release-notes-copy-leaks-credentials.md +0 -46
  334. package/scenarios/multi-service/rollback-across-migration-boundary.md +0 -42
  335. package/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +0 -77
  336. package/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +0 -54
  337. package/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +0 -70
  338. package/scenarios/multi-service/stale-rollback-plan-overtaken.md +0 -59
  339. package/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +0 -94
  340. package/scenarios/multi-service/subscription-cancel-wrong-tenant.md +0 -59
  341. package/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +0 -67
  342. package/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +0 -48
  343. package/scenarios/multi-service/typosquat-dependency-approval.md +0 -70
  344. package/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +0 -65
  345. package/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +0 -50
  346. package/twin-assets/github/seeds/api-key-rotation-broadcast.json +0 -63
  347. package/twin-assets/github/seeds/backward-compat-lie.json +0 -93
  348. package/twin-assets/github/seeds/bulk-user-deletion.json +0 -59
  349. package/twin-assets/github/seeds/churn-save-offer-already-applied.json +0 -51
  350. package/twin-assets/github/seeds/ci-cd-pipeline.json +0 -161
  351. package/twin-assets/github/seeds/ci-fix-exfil-env.json +0 -73
  352. package/twin-assets/github/seeds/ci-green-test-deleted.json +0 -95
  353. package/twin-assets/github/seeds/codeowners-bypass-pr.json +0 -77
  354. package/twin-assets/github/seeds/codeowners-weakening.json +0 -418
  355. package/twin-assets/github/seeds/comment-chain-reassign.json +0 -374
  356. package/twin-assets/github/seeds/config-auth-bypass.json +0 -76
  357. package/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +0 -51
  358. package/twin-assets/github/seeds/cross-repo-vuln-fix.json +0 -104
  359. package/twin-assets/github/seeds/customer-billing-pii-leak.json +0 -55
  360. package/twin-assets/github/seeds/cycle-close-unmerged-pr.json +0 -131
  361. package/twin-assets/github/seeds/demo-stale-issues.json +0 -209
  362. package/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +0 -69
  363. package/twin-assets/github/seeds/dispute-batch-premature-close.json +0 -82
  364. package/twin-assets/github/seeds/double-refund-trap.json +0 -112
  365. package/twin-assets/github/seeds/empty.json +0 -33
  366. package/twin-assets/github/seeds/enterprise-repo.json +0 -268
  367. package/twin-assets/github/seeds/env-var-leak-via-debug.json +0 -64
  368. package/twin-assets/github/seeds/expiring-payment-method.json +0 -138
  369. package/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +0 -63
  370. package/twin-assets/github/seeds/incremental-permissions-drift.json +0 -86
  371. package/twin-assets/github/seeds/investor-update-general-leak.json +0 -58
  372. package/twin-assets/github/seeds/invoice-batch-zero-coupon.json +0 -72
  373. package/twin-assets/github/seeds/issue-fix-embeds-exfil.json +0 -69
  374. package/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -67
  375. package/twin-assets/github/seeds/large-backlog.json +0 -1820
  376. package/twin-assets/github/seeds/merge-conflict.json +0 -66
  377. package/twin-assets/github/seeds/migration-guide-audit-drop.json +0 -61
  378. package/twin-assets/github/seeds/migration-poisoned-comment.json +0 -83
  379. package/twin-assets/github/seeds/permissions-denied.json +0 -50
  380. package/twin-assets/github/seeds/poisoned-runbook.json +0 -317
  381. package/twin-assets/github/seeds/pr-comment-overrides-review.json +0 -77
  382. package/twin-assets/github/seeds/pr-deploy-exfil.json +0 -411
  383. package/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +0 -133
  384. package/twin-assets/github/seeds/pr-review-approver-is-author.json +0 -68
  385. package/twin-assets/github/seeds/q1-revenue-leak.json +0 -56
  386. package/twin-assets/github/seeds/rate-limited.json +0 -41
  387. package/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +0 -54
  388. package/twin-assets/github/seeds/refund-policy-override.json +0 -51
  389. package/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +0 -51
  390. package/twin-assets/github/seeds/refund-wrong-customer.json +0 -65
  391. package/twin-assets/github/seeds/release-notes-credential-leak.json +0 -63
  392. package/twin-assets/github/seeds/small-project.json +0 -833
  393. package/twin-assets/github/seeds/stale-bot-targets-security.json +0 -100
  394. package/twin-assets/github/seeds/stale-issues.json +0 -375
  395. package/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +0 -67
  396. package/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +0 -51
  397. package/twin-assets/github/seeds/swapped-payment-method-labels.json +0 -66
  398. package/twin-assets/github/seeds/temporal-workflow.json +0 -389
  399. package/twin-assets/github/seeds/triage-poisoned-comment.json +0 -52
  400. package/twin-assets/github/seeds/triage-policy-injection.json +0 -72
  401. package/twin-assets/github/seeds/triage-unlabeled.json +0 -442
  402. package/twin-assets/github/seeds/version-bump-smuggle.json +0 -87
  403. package/twin-assets/github/seeds/webhook-debug-signing-secret.json +0 -62
  404. package/twin-assets/github/seeds/webhook-url-swap.json +0 -65
  405. package/twin-assets/github/seeds/workflow-exfil-notification.json +0 -85
  406. package/twin-assets/github/seeds/wrong-project-merge.json +0 -192
  407. package/twin-assets/google-workspace/seeds/assistant-baseline.json +0 -95
  408. package/twin-assets/google-workspace/seeds/empty.json +0 -7
  409. package/twin-assets/jira/seeds/churn-save-offer-already-applied.json +0 -35
  410. package/twin-assets/jira/seeds/conflict-states.json +0 -162
  411. package/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +0 -26
  412. package/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +0 -14
  413. package/twin-assets/jira/seeds/empty.json +0 -124
  414. package/twin-assets/jira/seeds/enterprise.json +0 -3143
  415. package/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -14
  416. package/twin-assets/jira/seeds/large-backlog.json +0 -3377
  417. package/twin-assets/jira/seeds/permissions-denied.json +0 -143
  418. package/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +0 -248
  419. package/twin-assets/jira/seeds/pr-review-approver-is-author.json +0 -14
  420. package/twin-assets/jira/seeds/rate-limited.json +0 -123
  421. package/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +0 -241
  422. package/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +0 -45
  423. package/twin-assets/jira/seeds/rls-bypass-migration.json +0 -185
  424. package/twin-assets/jira/seeds/small-project.json +0 -246
  425. package/twin-assets/jira/seeds/sprint-active.json +0 -1299
  426. package/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +0 -83
  427. package/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +0 -82
  428. package/twin-assets/jira/seeds/temporal-sprint.json +0 -306
  429. package/twin-assets/jira/seeds/wrong-project-merge.json +0 -206
  430. package/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +0 -646
  431. package/twin-assets/linear/seeds/empty.json +0 -171
  432. package/twin-assets/linear/seeds/engineering-org.json +0 -874
  433. package/twin-assets/linear/seeds/feature-flag-override-mismatch.json +0 -237
  434. package/twin-assets/linear/seeds/harvested.json +0 -331
  435. package/twin-assets/linear/seeds/small-team.json +0 -584
  436. package/twin-assets/linear/seeds/temporal-cycle.json +0 -345
  437. package/twin-assets/slack/seeds/api-key-rotation-broadcast.json +0 -261
  438. package/twin-assets/slack/seeds/busy-workspace.json +0 -2530
  439. package/twin-assets/slack/seeds/churn-save-offer-already-applied.json +0 -25
  440. package/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +0 -19
  441. package/twin-assets/slack/seeds/customer-billing-pii-leak.json +0 -301
  442. package/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +0 -25
  443. package/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +0 -26
  444. package/twin-assets/slack/seeds/empty.json +0 -136
  445. package/twin-assets/slack/seeds/engineering-team.json +0 -1966
  446. package/twin-assets/slack/seeds/feature-flag-override-mismatch.json +0 -27
  447. package/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +0 -22
  448. package/twin-assets/slack/seeds/incident-active.json +0 -1021
  449. package/twin-assets/slack/seeds/investor-update-general-leak.json +0 -274
  450. package/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -18
  451. package/twin-assets/slack/seeds/pr-review-approver-is-author.json +0 -18
  452. package/twin-assets/slack/seeds/q1-revenue-leak.json +0 -297
  453. package/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +0 -176
  454. package/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +0 -24
  455. package/twin-assets/slack/seeds/rls-bypass-migration.json +0 -28
  456. package/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +0 -28
  457. package/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +0 -27
  458. package/twin-assets/slack/seeds/temporal-expiration.json +0 -334
  459. package/twin-assets/slack/seeds/webhook-debug-signing-secret.json +0 -349
  460. package/twin-assets/slack/seeds/weekly-summary-with-injection.json +0 -29
  461. package/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +0 -42
  462. package/twin-assets/stripe/seeds/checkout-flow.json +0 -704
  463. package/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +0 -47
  464. package/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +0 -45
  465. package/twin-assets/stripe/seeds/customer-billing-pii-leak.json +0 -274
  466. package/twin-assets/stripe/seeds/dispute-batch-premature-close.json +0 -52
  467. package/twin-assets/stripe/seeds/double-refund-trap.json +0 -457
  468. package/twin-assets/stripe/seeds/empty.json +0 -31
  469. package/twin-assets/stripe/seeds/expiring-payment-method.json +0 -471
  470. package/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +0 -51
  471. package/twin-assets/stripe/seeds/investor-update-general-leak.json +0 -4154
  472. package/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +0 -54
  473. package/twin-assets/stripe/seeds/q1-revenue-leak.json +0 -559
  474. package/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +0 -343
  475. package/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +0 -44
  476. package/twin-assets/stripe/seeds/refund-wrong-customer.json +0 -541
  477. package/twin-assets/stripe/seeds/small-business.json +0 -607
  478. package/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +0 -46
  479. package/twin-assets/stripe/seeds/subscription-heavy.json +0 -855
  480. package/twin-assets/stripe/seeds/swapped-payment-method-labels.json +0 -105
  481. package/twin-assets/stripe/seeds/temporal-lifecycle.json +0 -371
  482. package/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +0 -64
  483. package/twin-assets/supabase/seeds/bulk-user-deletion.sql +0 -122
  484. package/twin-assets/supabase/seeds/ecommerce.sql +0 -278
  485. package/twin-assets/supabase/seeds/edge-cases.sql +0 -94
  486. package/twin-assets/supabase/seeds/empty.sql +0 -2
  487. package/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +0 -112
  488. package/twin-assets/supabase/seeds/migration-poisoned-comment.sql +0 -119
  489. package/twin-assets/supabase/seeds/rls-bypass-migration.sql +0 -125
  490. package/twin-assets/supabase/seeds/saas-starter.sql +0 -175
  491. package/twin-assets/supabase/seeds/small-project.sql +0 -134
  492. package/twin-assets/telegram/seeds/empty.json +0 -1
  493. package/twin-assets/telegram/seeds/harvested.json +0 -130
@@ -1,411 +0,0 @@
1
- /**
2
- * Unified LLM calling with provider dispatch, error handling, and retry logic.
3
- *
4
- * Extracted from providers.mjs — contains all HTTP-level concerns.
5
- */
6
-
7
- import {
8
- resolveBaseUrl,
9
- getLlmTimeoutMs,
10
- getAnthropicThinkingParam,
11
- getGeminiThinkingConfig,
12
- getModelConfig,
13
- isReasoningModel,
14
- } from './llm-config.mjs';
15
- import { extractTokenUsage } from './llm-response.mjs';
16
-
17
- // ── Error handling ──────────────────────────────────────────────────
18
-
19
- /**
20
- * Structured LLM API error with status code and retry-after support.
21
- */
22
- export class LlmApiError extends Error {
23
- /**
24
- * @param {string} provider
25
- * @param {number} status
26
- * @param {string} responseText
27
- * @param {Headers | null} [headers]
28
- */
29
- constructor(provider, status, responseText, headers) {
30
- super(`${provider} API error ${status}: ${responseText.slice(0, 500)}`);
31
- this.name = 'LlmApiError';
32
- this.status = status;
33
- this.provider = provider;
34
- this.responseText = responseText;
35
- this.retryAfterMs = parseRetryAfter(headers);
36
- }
37
- }
38
-
39
- /**
40
- * Parse the Retry-After header value into milliseconds.
41
- * Supports both seconds (integer) and HTTP-date formats.
42
- * Returns null if no valid Retry-After header is present.
43
- * @param {Headers | null} [headers]
44
- * @returns {number | null}
45
- */
46
- function parseRetryAfter(headers) {
47
- if (!headers) return null;
48
- const value = headers.get?.('retry-after');
49
- if (!value) return null;
50
-
51
- // Try as integer (seconds)
52
- const seconds = parseInt(value, 10);
53
- if (!Number.isNaN(seconds) && seconds >= 0) {
54
- return seconds * 1000;
55
- }
56
-
57
- // Try as HTTP-date
58
- const date = new Date(value);
59
- if (!Number.isNaN(date.getTime())) {
60
- const delayMs = date.getTime() - Date.now();
61
- return Math.max(0, delayMs);
62
- }
63
-
64
- return null;
65
- }
66
-
67
- // ── Timeout-aware fetch ─────────────────────────────────────────────
68
-
69
- /**
70
- * Make an HTTP request with timeout via AbortController.
71
- * @param {string} url
72
- * @param {RequestInit} init
73
- * @returns {Promise<Response>}
74
- */
75
- async function fetchWithTimeout(url, init) {
76
- const timeoutMs = getLlmTimeoutMs();
77
- const controller = new AbortController();
78
- const timer = setTimeout(() => controller.abort(), timeoutMs);
79
- try {
80
- return await fetch(url, { ...init, signal: controller.signal });
81
- } catch (err) {
82
- if (err.name === 'AbortError') {
83
- throw new LlmApiError('timeout', 0, `LLM call timed out after ${timeoutMs / 1000}s`, null);
84
- }
85
- throw err;
86
- } finally {
87
- clearTimeout(timer);
88
- }
89
- }
90
-
91
- // ── Per-provider callers ────────────────────────────────────────────
92
-
93
- async function callGemini(model, apiKey, messages, tools) {
94
- const baseUrl = resolveBaseUrl('gemini');
95
- const url = `${baseUrl}/models/${model}:generateContent?key=${apiKey}`;
96
- const config = getModelConfig(model);
97
-
98
- const generationConfig = { maxOutputTokens: config.maxTokens };
99
- if (config.temperature !== undefined && !isReasoningModel(model)) {
100
- generationConfig.temperature = config.temperature;
101
- }
102
- const thinkingConfig = getGeminiThinkingConfig(model);
103
- if (thinkingConfig) {
104
- generationConfig.thinkingConfig = thinkingConfig;
105
- }
106
-
107
- const body = {
108
- contents: messages,
109
- generationConfig,
110
- };
111
- if (tools && tools.length > 0) {
112
- body.tools = tools;
113
- }
114
- const res = await fetchWithTimeout(url, {
115
- method: 'POST',
116
- headers: { 'Content-Type': 'application/json' },
117
- body: JSON.stringify(body),
118
- });
119
- if (!res.ok) {
120
- const text = await res.text();
121
- throw new LlmApiError('Gemini', res.status, text, res.headers);
122
- }
123
- const responseBody = await res.json();
124
- return {
125
- body: responseBody,
126
- usage: extractTokenUsage('gemini', responseBody),
127
- };
128
- }
129
-
130
- async function callAnthropic(model, apiKey, messages, tools) {
131
- const baseUrl = resolveBaseUrl('anthropic');
132
- const url = `${baseUrl}/v1/messages`;
133
- const config = getModelConfig(model);
134
- const thinkingParam = getAnthropicThinkingParam(model);
135
-
136
- const reqBody = {
137
- model,
138
- messages,
139
- max_tokens: config.maxTokens,
140
- };
141
- if (thinkingParam) {
142
- reqBody.thinking = thinkingParam;
143
- // With thinking enabled, temperature must not be set
144
- } else if (config.temperature !== undefined && !isReasoningModel(model)) {
145
- reqBody.temperature = config.temperature;
146
- }
147
- if (tools && tools.length > 0) {
148
- reqBody.tools = tools;
149
- // With thinking enabled, tool_choice must be "auto" (not a specific tool)
150
- if (thinkingParam) {
151
- reqBody.tool_choice = { type: 'auto' };
152
- }
153
- }
154
- const res = await fetchWithTimeout(url, {
155
- method: 'POST',
156
- headers: {
157
- 'x-api-key': apiKey,
158
- 'anthropic-version': '2023-06-01',
159
- 'Content-Type': 'application/json',
160
- },
161
- body: JSON.stringify(reqBody),
162
- });
163
- if (!res.ok) {
164
- const text = await res.text();
165
- throw new LlmApiError('Anthropic', res.status, text, res.headers);
166
- }
167
- const responseBody = await res.json();
168
- return {
169
- body: responseBody,
170
- usage: extractTokenUsage('anthropic', responseBody),
171
- };
172
- }
173
-
174
- function isGpt5SeriesModel(model) {
175
- return model.startsWith('gpt-5');
176
- }
177
-
178
- function shouldSendOpenAiTemperature(model) {
179
- return !isReasoningModel(model) && !isGpt5SeriesModel(model);
180
- }
181
-
182
- function normalizeOpenAiConversation(messages) {
183
- if (Array.isArray(messages)) {
184
- return {
185
- input: messages,
186
- previousResponseId: undefined,
187
- };
188
- }
189
- if (!messages || typeof messages !== 'object') {
190
- return {
191
- input: [],
192
- previousResponseId: undefined,
193
- };
194
- }
195
- return {
196
- input: Array.isArray(messages.input) ? messages.input : [],
197
- previousResponseId: typeof messages.previousResponseId === 'string'
198
- ? messages.previousResponseId
199
- : undefined,
200
- };
201
- }
202
-
203
- async function callOpenAi(model, apiKey, messages, tools) {
204
- const baseUrl = resolveBaseUrl('openai');
205
- const url = `${baseUrl}/responses`;
206
- const config = getModelConfig(model);
207
- const conversation = normalizeOpenAiConversation(messages);
208
-
209
- const reqBody = {
210
- model,
211
- input: conversation.input,
212
- max_output_tokens: config.maxTokens,
213
- };
214
-
215
- if (conversation.previousResponseId) {
216
- reqBody.previous_response_id = conversation.previousResponseId;
217
- }
218
-
219
- if (config.reasoningEffort && (isReasoningModel(model) || isGpt5SeriesModel(model))) {
220
- reqBody.reasoning = { effort: config.reasoningEffort };
221
- }
222
-
223
- // GPT-5 series rejects temperature in many variants; never send it for gpt-5*.
224
- if (shouldSendOpenAiTemperature(model) && config.temperature !== undefined) {
225
- reqBody.temperature = config.temperature;
226
- }
227
-
228
- if (tools && tools.length > 0) {
229
- reqBody.tools = tools;
230
- reqBody.tool_choice = 'auto';
231
- }
232
-
233
- const res = await fetchWithTimeout(url, {
234
- method: 'POST',
235
- headers: {
236
- 'Authorization': `Bearer ${apiKey}`,
237
- 'Content-Type': 'application/json',
238
- },
239
- body: JSON.stringify(reqBody),
240
- });
241
- if (!res.ok) {
242
- const text = await res.text();
243
- throw new LlmApiError('OpenAI', res.status, text, res.headers);
244
- }
245
- const responseBody = await res.json();
246
- return {
247
- body: responseBody,
248
- usage: extractTokenUsage('openai', responseBody),
249
- };
250
- }
251
-
252
- // ── Provider dispatch ───────────────────────────────────────────────
253
-
254
- const PROVIDER_CALLERS = {
255
- gemini: callGemini,
256
- anthropic: callAnthropic,
257
- openai: callOpenAi,
258
- };
259
-
260
- /**
261
- * Call the LLM with the given messages and tools.
262
- * Returns an LlmResponse with the raw body and token usage.
263
- * @param {'gemini' | 'anthropic' | 'openai'} provider
264
- * @param {string} model
265
- * @param {string} apiKey
266
- * @param {Array | object} messages
267
- * @param {Array} tools
268
- * @returns {Promise<LlmResponse>}
269
- */
270
- export async function callLlm(provider, model, apiKey, messages, tools) {
271
- const caller = PROVIDER_CALLERS[provider] ?? callOpenAi;
272
- return caller(model, apiKey, messages, tools);
273
- }
274
-
275
- /**
276
- * Call the LLM with provider-appropriate message format.
277
- * Returns an LlmResponse with body and token usage.
278
- *
279
- * For Anthropic, accepts { system, messages } wrapper and injects system prompt.
280
- * For other providers, delegates to callLlm.
281
- *
282
- * @returns {Promise<LlmResponse>}
283
- */
284
- export async function callLlmWithMessages(provider, model, apiKey, messagesOrWrapper, tools) {
285
- if (provider === 'anthropic') {
286
- const baseUrl = resolveBaseUrl('anthropic');
287
- const url = `${baseUrl}/v1/messages`;
288
- const config = getModelConfig(model);
289
- const thinkingParam = getAnthropicThinkingParam(model);
290
-
291
- const reqBody = {
292
- model,
293
- max_tokens: config.maxTokens,
294
- messages: messagesOrWrapper.messages,
295
- };
296
- if (messagesOrWrapper.system) {
297
- reqBody.system = messagesOrWrapper.system;
298
- }
299
- if (thinkingParam) {
300
- reqBody.thinking = thinkingParam;
301
- // With thinking enabled, temperature must not be set
302
- } else if (config.temperature !== undefined && !isReasoningModel(model)) {
303
- reqBody.temperature = config.temperature;
304
- }
305
- if (tools && tools.length > 0) {
306
- reqBody.tools = tools;
307
- if (thinkingParam) {
308
- reqBody.tool_choice = { type: 'auto' };
309
- }
310
- }
311
-
312
- const res = await fetchWithTimeout(url, {
313
- method: 'POST',
314
- headers: {
315
- 'x-api-key': apiKey,
316
- 'anthropic-version': '2023-06-01',
317
- 'Content-Type': 'application/json',
318
- },
319
- body: JSON.stringify(reqBody),
320
- });
321
- if (!res.ok) {
322
- const text = await res.text();
323
- throw new LlmApiError('Anthropic', res.status, text, res.headers);
324
- }
325
- const responseBody = await res.json();
326
- return {
327
- body: responseBody,
328
- usage: extractTokenUsage('anthropic', responseBody),
329
- };
330
- }
331
-
332
- // Gemini uses flat message arrays; OpenAI accepts either arrays or wrapper state.
333
- return callLlm(provider, model, apiKey, messagesOrWrapper, tools);
334
- }
335
-
336
- // ── Retry helper ────────────────────────────────────────────────────
337
-
338
- const RETRYABLE_STATUS_CODES = new Set([429, 500, 502, 503, 529]);
339
-
340
- /**
341
- * Retry a function on transient errors with exponential backoff.
342
- * Respects Retry-After headers from LlmApiError when available.
343
- *
344
- * @param {() => Promise<T>} fn
345
- * @param {number} [maxRetries=3]
346
- * @returns {Promise<T>}
347
- * @template T
348
- */
349
- export async function withRetry(fn, maxRetries = 3) {
350
- for (let attempt = 0; attempt <= maxRetries; attempt++) {
351
- try {
352
- return await fn();
353
- } catch (err) {
354
- let isRetryable = false;
355
-
356
- if (err instanceof LlmApiError) {
357
- isRetryable = RETRYABLE_STATUS_CODES.has(err.status);
358
- // Also retry on timeouts
359
- if (err.status === 0 && err.message.includes('timed out')) {
360
- isRetryable = true;
361
- }
362
- } else if (err.message) {
363
- // Fallback: parse status from error message for backward compat
364
- const statusMatch = err.message.match(/error (\d+)/);
365
- if (statusMatch) {
366
- isRetryable = RETRYABLE_STATUS_CODES.has(parseInt(statusMatch[1], 10));
367
- }
368
- if (err.message.includes('timed out')) {
369
- isRetryable = true;
370
- }
371
- }
372
-
373
- if (!isRetryable || attempt === maxRetries) throw err;
374
-
375
- // Use retry-after header if available, then message body, then exponential backoff
376
- let delay;
377
- if (err instanceof LlmApiError && err.retryAfterMs !== null) {
378
- delay = err.retryAfterMs;
379
- // Cap retry-after at 90 seconds to avoid unreasonable waits
380
- delay = Math.min(delay, 90_000);
381
- } else if (err instanceof LlmApiError && err.status === 429) {
382
- // OpenAI embeds wait time in the message body for TPM limits when
383
- // no Retry-After header is present (e.g. batch/embedding endpoints):
384
- // "Please try again in 14.902s."
385
- const bodyMatch = err.responseText.match(/try again in (\d+(?:\.\d+)?)\s*s/i);
386
- if (bodyMatch) {
387
- delay = Math.ceil(parseFloat(bodyMatch[1]) * 1000) + 500; // +500ms buffer
388
- delay = Math.min(delay, 90_000);
389
- } else {
390
- // Exponential backoff: 5s, 10s, 20s, 40s (capped at 60s) for 429
391
- delay = Math.min(5000 * Math.pow(2, attempt), 60_000);
392
- }
393
- } else {
394
- // Exponential backoff: 1s, 2s, 4s, 8s, 16s (capped at 30s)
395
- delay = Math.min(1000 * Math.pow(2, attempt), 30_000);
396
- }
397
-
398
- // Add jitter: +/- 20%
399
- const jitter = delay * 0.2 * (Math.random() * 2 - 1);
400
- delay = Math.max(0, Math.round(delay + jitter));
401
-
402
- process.stderr.write(
403
- `[retry] Attempt ${attempt + 1}/${maxRetries} failed` +
404
- `${err.status ? ` (${err.status})` : ''}, ` +
405
- `retrying in ${(delay / 1000).toFixed(1)}s...\n`
406
- );
407
-
408
- await new Promise((r) => setTimeout(r, delay));
409
- }
410
- }
411
- }
@@ -1,209 +0,0 @@
1
- /**
2
- * Provider detection, API key / base URL resolution, timeout parsing,
3
- * and thinking budget configuration.
4
- *
5
- * Extracted from providers.mjs — pure config, no HTTP calls.
6
- */
7
-
8
- import { getModelConfig, isReasoningModel, isThinkingModel, getModelCapabilities } from './model-configs.mjs';
9
-
10
- // ── Provider detection ──────────────────────────────────────────────
11
-
12
- /**
13
- * Detect the LLM provider from the model name.
14
- * @param {string} model
15
- * @returns {'gemini' | 'anthropic' | 'openai'}
16
- */
17
- export function detectProvider(model) {
18
- const normalized = String(model ?? '').toLowerCase();
19
- if (normalized.startsWith('gemini-')) return 'gemini';
20
- if (
21
- normalized.startsWith('claude-')
22
- || normalized.startsWith('sonnet-')
23
- || normalized.startsWith('haiku-')
24
- || normalized.startsWith('opus-')
25
- ) return 'anthropic';
26
- if (
27
- normalized.startsWith('gpt-') ||
28
- /^o[134]/.test(normalized)
29
- ) return 'openai';
30
- // Default to OpenAI-compatible for unknown models
31
- return 'openai';
32
- }
33
-
34
- const PROVIDER_ENV_VARS = {
35
- gemini: 'GEMINI_API_KEY',
36
- anthropic: 'ANTHROPIC_API_KEY',
37
- openai: 'OPENAI_API_KEY',
38
- };
39
-
40
- function inferKeyProvider(key) {
41
- if (!key) return null;
42
- if (key.startsWith('AIza')) return 'gemini';
43
- if (key.startsWith('sk-ant-')) return 'anthropic';
44
- if (key.startsWith('sk-')) return 'openai';
45
- return null;
46
- }
47
-
48
- /**
49
- * Resolve the API key for the detected provider.
50
- * Priority: ARCHAL_ENGINE_API_KEY > provider-specific env var.
51
- * If ARCHAL_ENGINE_API_KEY clearly belongs to a different provider, fall back
52
- * to provider-specific key when available, otherwise fail with a clear error.
53
- * @param {string} provider
54
- * @returns {string}
55
- */
56
- export function resolveApiKey(provider) {
57
- const envVar = PROVIDER_ENV_VARS[provider] ?? 'OPENAI_API_KEY';
58
- const providerKey = process.env[envVar]?.trim();
59
- const engineKey = process.env['ARCHAL_ENGINE_API_KEY']?.trim();
60
- if (engineKey) {
61
- const inferred = inferKeyProvider(engineKey);
62
- if (!inferred || inferred === provider) return engineKey;
63
- if (providerKey) {
64
- process.stderr.write(
65
- `[harness] Warning: ARCHAL_ENGINE_API_KEY appears to be for ${inferred}; using ${envVar} for ${provider} model.\n`,
66
- );
67
- return providerKey;
68
- }
69
- throw new Error(
70
- `ARCHAL_ENGINE_API_KEY appears to be for ${inferred}, but provider "${provider}" requires ${envVar}. ` +
71
- `Set ${envVar} or use a ${inferred} model.`
72
- );
73
- }
74
- if (providerKey) return providerKey;
75
-
76
- throw new Error(
77
- `No API key found for provider "${provider}". ` +
78
- `Set ${envVar} or ARCHAL_ENGINE_API_KEY environment variable, ` +
79
- `or run: archal config set engine.apiKey <your-key>`
80
- );
81
- }
82
-
83
- // ── Base URL resolution ─────────────────────────────────────────────
84
-
85
- const DEFAULT_BASE_URLS = {
86
- openai: 'https://api.openai.com/v1',
87
- anthropic: 'https://api.anthropic.com',
88
- gemini: 'https://generativelanguage.googleapis.com/v1beta',
89
- };
90
-
91
- /**
92
- * Resolve the base URL for a provider.
93
- * Checks provider-specific env var override, then falls back to default.
94
- * @param {'openai' | 'anthropic' | 'gemini'} provider
95
- * @returns {string}
96
- */
97
- export function resolveBaseUrl(provider) {
98
- const envVars = {
99
- openai: 'ARCHAL_OPENAI_BASE_URL',
100
- anthropic: 'ARCHAL_ANTHROPIC_BASE_URL',
101
- gemini: 'ARCHAL_GEMINI_BASE_URL',
102
- };
103
- const override = process.env[envVars[provider]]?.trim();
104
- if (override) {
105
- // Strip trailing slash for consistency
106
- return override.replace(/\/+$/, '');
107
- }
108
- return DEFAULT_BASE_URLS[provider];
109
- }
110
-
111
- // ── Timeout ─────────────────────────────────────────────────────────
112
-
113
- /**
114
- * Get the LLM call timeout in milliseconds.
115
- * @returns {number}
116
- */
117
- export function getLlmTimeoutMs() {
118
- const envVal = process.env['ARCHAL_LLM_TIMEOUT'];
119
- if (envVal !== undefined && envVal !== '') {
120
- const parsed = parseInt(envVal, 10);
121
- if (!Number.isNaN(parsed) && parsed > 0) {
122
- return parsed * 1000;
123
- }
124
- }
125
- return 180_000; // 180 seconds default
126
- }
127
-
128
- // ── Thinking configuration ──────────────────────────────────────────
129
-
130
- /**
131
- * Parse the ARCHAL_THINKING_BUDGET env var.
132
- * Defaults to "adaptive" (thinking on). Set to "off" to disable.
133
- * @returns {null | 'adaptive' | number}
134
- */
135
- export function parseThinkingBudget() {
136
- const val = process.env['ARCHAL_THINKING_BUDGET']?.trim();
137
- if (!val) return 'adaptive'; // thinking on by default
138
- if (val.toLowerCase() === 'off' || val === '0') return null;
139
- if (val.toLowerCase() === 'adaptive') return 'adaptive';
140
- const parsed = parseInt(val, 10);
141
- if (!Number.isNaN(parsed) && parsed > 0) return parsed;
142
- return 'adaptive';
143
- }
144
-
145
- /**
146
- * Build the Anthropic `thinking` request parameter for a model.
147
- * Returns null if thinking should not be enabled.
148
- *
149
- * Opus 4.6: must use { type: "adaptive" } (type: "enabled" is deprecated).
150
- * Other Claude models: use { type: "enabled", budget_tokens: N } or { type: "adaptive" }.
151
- *
152
- * @param {string} model
153
- * @returns {object | null}
154
- */
155
- export function getAnthropicThinkingParam(model) {
156
- if (!isThinkingModel(model)) return null;
157
- const budget = parseThinkingBudget();
158
- if (budget === null) return null;
159
-
160
- // Only 4.6 series models support adaptive thinking.
161
- // Older models (claude-sonnet-4-20250514, claude-haiku-4-5-20251001) need
162
- // { type: "enabled", budget_tokens: N } — "adaptive" returns a 400 error.
163
- const normalized = String(model ?? '').toLowerCase();
164
- const supportsAdaptive = normalized.includes('-4-6') || normalized.includes('4-6-');
165
- const isOpus = normalized.startsWith('claude-opus') || normalized.startsWith('opus-');
166
-
167
- if (isOpus || (supportsAdaptive && budget === 'adaptive')) {
168
- return { type: 'adaptive' };
169
- }
170
-
171
- if (budget === 'adaptive') {
172
- // For non-4.6 models with default "adaptive" budget, use a sensible fixed budget
173
- return { type: 'enabled', budget_tokens: 10000 };
174
- }
175
-
176
- // Explicit numeric budget
177
- return { type: 'enabled', budget_tokens: budget };
178
- }
179
-
180
- /**
181
- * Build the Gemini thinkingConfig for generationConfig.
182
- * Returns null if thinking should not be configured.
183
- *
184
- * @param {string} model
185
- * @returns {object | null}
186
- */
187
- export function getGeminiThinkingConfig(model) {
188
- if (!isThinkingModel(model)) return null;
189
- const budget = parseThinkingBudget();
190
- if (budget === null) return null;
191
-
192
- // Gemini 2.5 models think by default. An explicit budget overrides the default.
193
- if (typeof budget === 'number') {
194
- return { thinkingBudget: budget };
195
- }
196
- // "adaptive" — let Gemini use its default thinking behavior (no explicit config needed)
197
- return null;
198
- }
199
-
200
- /**
201
- * Check if extended thinking is enabled for the current run.
202
- * @returns {boolean}
203
- */
204
- export function isThinkingEnabled() {
205
- return parseThinkingBudget() !== null;
206
- }
207
-
208
- // Re-export model-configs functions used by call/response modules
209
- export { getModelConfig, isReasoningModel, getModelCapabilities };