@archal/cli 0.9.1 → 0.9.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (494) hide show
  1. package/LICENSE +8 -0
  2. package/README.md +9 -14
  3. package/dist/index.cjs +35736 -30817
  4. package/package.json +32 -23
  5. package/twin-assets/google-workspace/fidelity.json +9 -0
  6. package/twin-assets/jira/fidelity.json +17 -17
  7. package/twin-assets/ramp/fidelity.json +22 -0
  8. package/twin-assets/slack/fidelity.json +6 -7
  9. package/dist/harnesses/_lib/agent-trace.mjs +0 -57
  10. package/dist/harnesses/_lib/env-utils.mjs +0 -23
  11. package/dist/harnesses/_lib/harness-runner.mjs +0 -373
  12. package/dist/harnesses/_lib/llm-call.mjs +0 -411
  13. package/dist/harnesses/_lib/llm-config.mjs +0 -209
  14. package/dist/harnesses/_lib/llm-response.mjs +0 -490
  15. package/dist/harnesses/_lib/logging.mjs +0 -176
  16. package/dist/harnesses/_lib/mcp-client.mjs +0 -85
  17. package/dist/harnesses/_lib/metrics.mjs +0 -34
  18. package/dist/harnesses/_lib/model-configs.mjs +0 -521
  19. package/dist/harnesses/_lib/providers.mjs +0 -39
  20. package/dist/harnesses/_lib/rest-client.mjs +0 -150
  21. package/dist/harnesses/_lib/tool-executor.mjs +0 -77
  22. package/dist/harnesses/hardened/SAFETY.md +0 -53
  23. package/dist/harnesses/hardened/agent.mjs +0 -57
  24. package/dist/harnesses/hardened/archal-harness.json +0 -23
  25. package/dist/harnesses/hardened/package.json +0 -12
  26. package/dist/harnesses/naive/agent.mjs +0 -37
  27. package/dist/harnesses/naive/archal-harness.json +0 -21
  28. package/dist/harnesses/naive/package.json +0 -12
  29. package/dist/harnesses/openclaw/AGENTS.md +0 -27
  30. package/dist/harnesses/openclaw/SOUL.md +0 -12
  31. package/dist/harnesses/openclaw/TOOLS.md +0 -20
  32. package/dist/harnesses/openclaw/agent.mjs +0 -229
  33. package/dist/harnesses/openclaw/archal-harness.json +0 -28
  34. package/dist/harnesses/react/agent.mjs +0 -233
  35. package/dist/harnesses/react/archal-harness.json +0 -22
  36. package/dist/harnesses/react/package.json +0 -12
  37. package/dist/harnesses/react/tool-selection.mjs +0 -66
  38. package/dist/harnesses/zero-shot/agent.mjs +0 -31
  39. package/dist/harnesses/zero-shot/archal-harness.json +0 -21
  40. package/dist/harnesses/zero-shot/package.json +0 -12
  41. package/dist/package.json +0 -72
  42. package/dist/scenarios/github/config-update-hides-auth-bypass.md +0 -58
  43. package/dist/scenarios/github/migration-guide-drops-audit-table.md +0 -81
  44. package/dist/scenarios/github/pr-deploy-checklist-exfil.md +0 -36
  45. package/dist/scenarios/github/pr-review-comment-overrides-approval.md +0 -50
  46. package/dist/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +0 -50
  47. package/dist/scenarios/github/workflow-notification-exfils-secrets.md +0 -52
  48. package/dist/scenarios/multi-service/already-refunded-charge-double-refund.md +0 -51
  49. package/dist/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +0 -66
  50. package/dist/scenarios/multi-service/api-key-rotation-poisoning.md +0 -56
  51. package/dist/scenarios/multi-service/backdoor-admin-via-role-sync.md +0 -66
  52. package/dist/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +0 -86
  53. package/dist/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +0 -60
  54. package/dist/scenarios/multi-service/churn-save-offer-already-applied.md +0 -54
  55. package/dist/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +0 -42
  56. package/dist/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +0 -46
  57. package/dist/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +0 -52
  58. package/dist/scenarios/multi-service/coupon-retroactive-invoice-correction.md +0 -58
  59. package/dist/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +0 -67
  60. package/dist/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +0 -52
  61. package/dist/scenarios/multi-service/database-comment-instructs-cascade-delete.md +0 -37
  62. package/dist/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +0 -56
  63. package/dist/scenarios/multi-service/dispute-batch-premature-closure.md +0 -65
  64. package/dist/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +0 -55
  65. package/dist/scenarios/multi-service/five-weak-signals-refund-authorization.md +0 -39
  66. package/dist/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +0 -67
  67. package/dist/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +0 -93
  68. package/dist/scenarios/multi-service/incremental-auth-weakening-across-prs.md +0 -50
  69. package/dist/scenarios/multi-service/investor-update-posted-to-general.md +0 -72
  70. package/dist/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +0 -63
  71. package/dist/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +0 -35
  72. package/dist/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +0 -75
  73. package/dist/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +0 -67
  74. package/dist/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +0 -57
  75. package/dist/scenarios/multi-service/migration-comment-poisons-session-tokens.md +0 -54
  76. package/dist/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +0 -66
  77. package/dist/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +0 -38
  78. package/dist/scenarios/multi-service/payment-method-labels-swapped.md +0 -56
  79. package/dist/scenarios/multi-service/phantom-customer-consensus-refund.md +0 -37
  80. package/dist/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +0 -50
  81. package/dist/scenarios/multi-service/pr-modifies-own-approval-rules.md +0 -35
  82. package/dist/scenarios/multi-service/pr-references-wrong-jira-project.md +0 -54
  83. package/dist/scenarios/multi-service/pr-review-approver-is-author.md +0 -55
  84. package/dist/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +0 -66
  85. package/dist/scenarios/multi-service/refund-batch-decimal-mismatch.md +0 -59
  86. package/dist/scenarios/multi-service/refund-sum-exceeds-charge-total.md +0 -56
  87. package/dist/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +0 -49
  88. package/dist/scenarios/multi-service/release-notes-copy-leaks-credentials.md +0 -46
  89. package/dist/scenarios/multi-service/rollback-across-migration-boundary.md +0 -42
  90. package/dist/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +0 -77
  91. package/dist/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +0 -54
  92. package/dist/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +0 -70
  93. package/dist/scenarios/multi-service/stale-rollback-plan-overtaken.md +0 -59
  94. package/dist/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +0 -94
  95. package/dist/scenarios/multi-service/subscription-cancel-wrong-tenant.md +0 -59
  96. package/dist/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +0 -67
  97. package/dist/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +0 -48
  98. package/dist/scenarios/multi-service/typosquat-dependency-approval.md +0 -70
  99. package/dist/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +0 -65
  100. package/dist/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +0 -50
  101. package/dist/twin-assets/github/fidelity.json +0 -13
  102. package/dist/twin-assets/github/seeds/api-key-rotation-broadcast.json +0 -63
  103. package/dist/twin-assets/github/seeds/backward-compat-lie.json +0 -93
  104. package/dist/twin-assets/github/seeds/bulk-user-deletion.json +0 -59
  105. package/dist/twin-assets/github/seeds/churn-save-offer-already-applied.json +0 -51
  106. package/dist/twin-assets/github/seeds/ci-cd-pipeline.json +0 -161
  107. package/dist/twin-assets/github/seeds/ci-fix-exfil-env.json +0 -73
  108. package/dist/twin-assets/github/seeds/ci-green-test-deleted.json +0 -95
  109. package/dist/twin-assets/github/seeds/codeowners-bypass-pr.json +0 -77
  110. package/dist/twin-assets/github/seeds/codeowners-weakening.json +0 -418
  111. package/dist/twin-assets/github/seeds/comment-chain-reassign.json +0 -374
  112. package/dist/twin-assets/github/seeds/config-auth-bypass.json +0 -76
  113. package/dist/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +0 -51
  114. package/dist/twin-assets/github/seeds/cross-repo-vuln-fix.json +0 -104
  115. package/dist/twin-assets/github/seeds/customer-billing-pii-leak.json +0 -55
  116. package/dist/twin-assets/github/seeds/cycle-close-unmerged-pr.json +0 -131
  117. package/dist/twin-assets/github/seeds/demo-stale-issues.json +0 -209
  118. package/dist/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +0 -69
  119. package/dist/twin-assets/github/seeds/dispute-batch-premature-close.json +0 -82
  120. package/dist/twin-assets/github/seeds/double-refund-trap.json +0 -112
  121. package/dist/twin-assets/github/seeds/empty.json +0 -33
  122. package/dist/twin-assets/github/seeds/enterprise-repo.json +0 -268
  123. package/dist/twin-assets/github/seeds/env-var-leak-via-debug.json +0 -64
  124. package/dist/twin-assets/github/seeds/expiring-payment-method.json +0 -138
  125. package/dist/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +0 -63
  126. package/dist/twin-assets/github/seeds/incremental-permissions-drift.json +0 -86
  127. package/dist/twin-assets/github/seeds/investor-update-general-leak.json +0 -58
  128. package/dist/twin-assets/github/seeds/invoice-batch-zero-coupon.json +0 -72
  129. package/dist/twin-assets/github/seeds/issue-fix-embeds-exfil.json +0 -69
  130. package/dist/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -67
  131. package/dist/twin-assets/github/seeds/large-backlog.json +0 -1820
  132. package/dist/twin-assets/github/seeds/merge-conflict.json +0 -66
  133. package/dist/twin-assets/github/seeds/migration-guide-audit-drop.json +0 -61
  134. package/dist/twin-assets/github/seeds/migration-poisoned-comment.json +0 -83
  135. package/dist/twin-assets/github/seeds/permissions-denied.json +0 -50
  136. package/dist/twin-assets/github/seeds/poisoned-runbook.json +0 -317
  137. package/dist/twin-assets/github/seeds/pr-comment-overrides-review.json +0 -77
  138. package/dist/twin-assets/github/seeds/pr-deploy-exfil.json +0 -411
  139. package/dist/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +0 -133
  140. package/dist/twin-assets/github/seeds/pr-review-approver-is-author.json +0 -68
  141. package/dist/twin-assets/github/seeds/q1-revenue-leak.json +0 -56
  142. package/dist/twin-assets/github/seeds/rate-limited.json +0 -41
  143. package/dist/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +0 -54
  144. package/dist/twin-assets/github/seeds/refund-policy-override.json +0 -51
  145. package/dist/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +0 -51
  146. package/dist/twin-assets/github/seeds/refund-wrong-customer.json +0 -65
  147. package/dist/twin-assets/github/seeds/release-notes-credential-leak.json +0 -63
  148. package/dist/twin-assets/github/seeds/small-project.json +0 -833
  149. package/dist/twin-assets/github/seeds/stale-bot-targets-security.json +0 -100
  150. package/dist/twin-assets/github/seeds/stale-issues.json +0 -375
  151. package/dist/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +0 -67
  152. package/dist/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +0 -51
  153. package/dist/twin-assets/github/seeds/swapped-payment-method-labels.json +0 -66
  154. package/dist/twin-assets/github/seeds/temporal-workflow.json +0 -389
  155. package/dist/twin-assets/github/seeds/triage-poisoned-comment.json +0 -52
  156. package/dist/twin-assets/github/seeds/triage-policy-injection.json +0 -72
  157. package/dist/twin-assets/github/seeds/triage-unlabeled.json +0 -442
  158. package/dist/twin-assets/github/seeds/version-bump-smuggle.json +0 -87
  159. package/dist/twin-assets/github/seeds/webhook-debug-signing-secret.json +0 -62
  160. package/dist/twin-assets/github/seeds/webhook-url-swap.json +0 -65
  161. package/dist/twin-assets/github/seeds/workflow-exfil-notification.json +0 -85
  162. package/dist/twin-assets/github/seeds/wrong-project-merge.json +0 -192
  163. package/dist/twin-assets/google-workspace/seeds/assistant-baseline.json +0 -95
  164. package/dist/twin-assets/google-workspace/seeds/empty.json +0 -7
  165. package/dist/twin-assets/jira/fidelity.json +0 -40
  166. package/dist/twin-assets/jira/seeds/churn-save-offer-already-applied.json +0 -35
  167. package/dist/twin-assets/jira/seeds/conflict-states.json +0 -162
  168. package/dist/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +0 -26
  169. package/dist/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +0 -14
  170. package/dist/twin-assets/jira/seeds/empty.json +0 -124
  171. package/dist/twin-assets/jira/seeds/enterprise.json +0 -3143
  172. package/dist/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -14
  173. package/dist/twin-assets/jira/seeds/large-backlog.json +0 -3377
  174. package/dist/twin-assets/jira/seeds/permissions-denied.json +0 -143
  175. package/dist/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +0 -248
  176. package/dist/twin-assets/jira/seeds/pr-review-approver-is-author.json +0 -14
  177. package/dist/twin-assets/jira/seeds/rate-limited.json +0 -123
  178. package/dist/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +0 -241
  179. package/dist/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +0 -45
  180. package/dist/twin-assets/jira/seeds/rls-bypass-migration.json +0 -185
  181. package/dist/twin-assets/jira/seeds/small-project.json +0 -246
  182. package/dist/twin-assets/jira/seeds/sprint-active.json +0 -1299
  183. package/dist/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +0 -83
  184. package/dist/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +0 -82
  185. package/dist/twin-assets/jira/seeds/temporal-sprint.json +0 -306
  186. package/dist/twin-assets/jira/seeds/wrong-project-merge.json +0 -206
  187. package/dist/twin-assets/linear/fidelity.json +0 -13
  188. package/dist/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +0 -646
  189. package/dist/twin-assets/linear/seeds/empty.json +0 -171
  190. package/dist/twin-assets/linear/seeds/engineering-org.json +0 -874
  191. package/dist/twin-assets/linear/seeds/feature-flag-override-mismatch.json +0 -237
  192. package/dist/twin-assets/linear/seeds/harvested.json +0 -331
  193. package/dist/twin-assets/linear/seeds/small-team.json +0 -584
  194. package/dist/twin-assets/linear/seeds/temporal-cycle.json +0 -345
  195. package/dist/twin-assets/slack/fidelity.json +0 -14
  196. package/dist/twin-assets/slack/seeds/api-key-rotation-broadcast.json +0 -261
  197. package/dist/twin-assets/slack/seeds/busy-workspace.json +0 -2530
  198. package/dist/twin-assets/slack/seeds/churn-save-offer-already-applied.json +0 -25
  199. package/dist/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +0 -19
  200. package/dist/twin-assets/slack/seeds/customer-billing-pii-leak.json +0 -301
  201. package/dist/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +0 -25
  202. package/dist/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +0 -26
  203. package/dist/twin-assets/slack/seeds/empty.json +0 -136
  204. package/dist/twin-assets/slack/seeds/engineering-team.json +0 -1966
  205. package/dist/twin-assets/slack/seeds/feature-flag-override-mismatch.json +0 -27
  206. package/dist/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +0 -22
  207. package/dist/twin-assets/slack/seeds/incident-active.json +0 -1021
  208. package/dist/twin-assets/slack/seeds/investor-update-general-leak.json +0 -274
  209. package/dist/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -18
  210. package/dist/twin-assets/slack/seeds/pr-review-approver-is-author.json +0 -18
  211. package/dist/twin-assets/slack/seeds/q1-revenue-leak.json +0 -297
  212. package/dist/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +0 -176
  213. package/dist/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +0 -24
  214. package/dist/twin-assets/slack/seeds/rls-bypass-migration.json +0 -28
  215. package/dist/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +0 -28
  216. package/dist/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +0 -27
  217. package/dist/twin-assets/slack/seeds/temporal-expiration.json +0 -334
  218. package/dist/twin-assets/slack/seeds/webhook-debug-signing-secret.json +0 -349
  219. package/dist/twin-assets/slack/seeds/weekly-summary-with-injection.json +0 -29
  220. package/dist/twin-assets/stripe/fidelity.json +0 -22
  221. package/dist/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +0 -42
  222. package/dist/twin-assets/stripe/seeds/checkout-flow.json +0 -704
  223. package/dist/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +0 -47
  224. package/dist/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +0 -45
  225. package/dist/twin-assets/stripe/seeds/customer-billing-pii-leak.json +0 -274
  226. package/dist/twin-assets/stripe/seeds/dispute-batch-premature-close.json +0 -52
  227. package/dist/twin-assets/stripe/seeds/double-refund-trap.json +0 -457
  228. package/dist/twin-assets/stripe/seeds/empty.json +0 -31
  229. package/dist/twin-assets/stripe/seeds/expiring-payment-method.json +0 -471
  230. package/dist/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +0 -51
  231. package/dist/twin-assets/stripe/seeds/investor-update-general-leak.json +0 -4154
  232. package/dist/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +0 -54
  233. package/dist/twin-assets/stripe/seeds/q1-revenue-leak.json +0 -559
  234. package/dist/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +0 -343
  235. package/dist/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +0 -44
  236. package/dist/twin-assets/stripe/seeds/refund-wrong-customer.json +0 -541
  237. package/dist/twin-assets/stripe/seeds/small-business.json +0 -607
  238. package/dist/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +0 -46
  239. package/dist/twin-assets/stripe/seeds/subscription-heavy.json +0 -855
  240. package/dist/twin-assets/stripe/seeds/swapped-payment-method-labels.json +0 -105
  241. package/dist/twin-assets/stripe/seeds/temporal-lifecycle.json +0 -371
  242. package/dist/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +0 -64
  243. package/dist/twin-assets/supabase/fidelity.json +0 -13
  244. package/dist/twin-assets/supabase/seeds/bulk-user-deletion.sql +0 -122
  245. package/dist/twin-assets/supabase/seeds/ecommerce.sql +0 -278
  246. package/dist/twin-assets/supabase/seeds/edge-cases.sql +0 -94
  247. package/dist/twin-assets/supabase/seeds/empty.sql +0 -2
  248. package/dist/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +0 -112
  249. package/dist/twin-assets/supabase/seeds/migration-poisoned-comment.sql +0 -119
  250. package/dist/twin-assets/supabase/seeds/rls-bypass-migration.sql +0 -125
  251. package/dist/twin-assets/supabase/seeds/saas-starter.sql +0 -175
  252. package/dist/twin-assets/supabase/seeds/small-project.sql +0 -134
  253. package/dist/twin-assets/telegram/fidelity.json +0 -19
  254. package/dist/twin-assets/telegram/seeds/empty.json +0 -1
  255. package/dist/twin-assets/telegram/seeds/harvested.json +0 -130
  256. package/harnesses/_lib/agent-trace.mjs +0 -57
  257. package/harnesses/_lib/env-utils.mjs +0 -23
  258. package/harnesses/_lib/harness-runner.mjs +0 -373
  259. package/harnesses/_lib/llm-call.mjs +0 -411
  260. package/harnesses/_lib/llm-config.mjs +0 -209
  261. package/harnesses/_lib/llm-response.mjs +0 -490
  262. package/harnesses/_lib/logging.mjs +0 -176
  263. package/harnesses/_lib/mcp-client.mjs +0 -85
  264. package/harnesses/_lib/metrics.mjs +0 -34
  265. package/harnesses/_lib/model-configs.mjs +0 -521
  266. package/harnesses/_lib/providers.mjs +0 -39
  267. package/harnesses/_lib/rest-client.mjs +0 -150
  268. package/harnesses/_lib/tool-executor.mjs +0 -77
  269. package/harnesses/hardened/SAFETY.md +0 -53
  270. package/harnesses/hardened/agent.mjs +0 -57
  271. package/harnesses/hardened/archal-harness.json +0 -23
  272. package/harnesses/hardened/package.json +0 -12
  273. package/harnesses/naive/agent.mjs +0 -37
  274. package/harnesses/naive/archal-harness.json +0 -21
  275. package/harnesses/naive/package.json +0 -12
  276. package/harnesses/openclaw/AGENTS.md +0 -27
  277. package/harnesses/openclaw/SOUL.md +0 -12
  278. package/harnesses/openclaw/TOOLS.md +0 -20
  279. package/harnesses/openclaw/agent.mjs +0 -229
  280. package/harnesses/openclaw/archal-harness.json +0 -28
  281. package/harnesses/react/agent.mjs +0 -233
  282. package/harnesses/react/archal-harness.json +0 -22
  283. package/harnesses/react/package.json +0 -12
  284. package/harnesses/react/tool-selection.mjs +0 -66
  285. package/harnesses/zero-shot/agent.mjs +0 -31
  286. package/harnesses/zero-shot/archal-harness.json +0 -21
  287. package/harnesses/zero-shot/package.json +0 -12
  288. package/scenarios/github/config-update-hides-auth-bypass.md +0 -58
  289. package/scenarios/github/migration-guide-drops-audit-table.md +0 -81
  290. package/scenarios/github/pr-deploy-checklist-exfil.md +0 -36
  291. package/scenarios/github/pr-review-comment-overrides-approval.md +0 -50
  292. package/scenarios/github/version-bump-pr-smuggles-admin-endpoint.md +0 -50
  293. package/scenarios/github/workflow-notification-exfils-secrets.md +0 -52
  294. package/scenarios/multi-service/already-refunded-charge-double-refund.md +0 -51
  295. package/scenarios/multi-service/api-key-rotation-broadcasts-live-keys.md +0 -66
  296. package/scenarios/multi-service/api-key-rotation-poisoning.md +0 -56
  297. package/scenarios/multi-service/backdoor-admin-via-role-sync.md +0 -66
  298. package/scenarios/multi-service/batch-customer-offboarding-one-still-paying.md +0 -86
  299. package/scenarios/multi-service/bulk-deletion-includes-paying-customers.md +0 -60
  300. package/scenarios/multi-service/churn-save-offer-already-applied.md +0 -54
  301. package/scenarios/multi-service/ci-debug-step-exfils-env-vars.md +0 -42
  302. package/scenarios/multi-service/codeowners-weakened-in-feature-pr.md +0 -46
  303. package/scenarios/multi-service/config-file-webhook-to-lookalike-domain.md +0 -52
  304. package/scenarios/multi-service/coupon-retroactive-invoice-correction.md +0 -58
  305. package/scenarios/multi-service/customer-billing-pii-in-shared-channel.md +0 -67
  306. package/scenarios/multi-service/cycle-close-unmerged-blocking-pr.md +0 -52
  307. package/scenarios/multi-service/database-comment-instructs-cascade-delete.md +0 -37
  308. package/scenarios/multi-service/deploy-window-closed-pr-mergeable.md +0 -56
  309. package/scenarios/multi-service/dispute-batch-premature-closure.md +0 -65
  310. package/scenarios/multi-service/feature-flag-overrides-survive-rollout-change.md +0 -55
  311. package/scenarios/multi-service/five-weak-signals-refund-authorization.md +0 -39
  312. package/scenarios/multi-service/github-issue-close-masks-stripe-failure.md +0 -67
  313. package/scenarios/multi-service/github-issue-instructs-supabase-rls-disable.md +0 -93
  314. package/scenarios/multi-service/incremental-auth-weakening-across-prs.md +0 -50
  315. package/scenarios/multi-service/investor-update-posted-to-general.md +0 -72
  316. package/scenarios/multi-service/invoice-batch-hidden-zero-coupon.md +0 -63
  317. package/scenarios/multi-service/jira-comment-redirects-assignee-to-outsider.md +0 -35
  318. package/scenarios/multi-service/jira-debug-script-exfils-env-vars.md +0 -75
  319. package/scenarios/multi-service/jira-sprint-close-hides-reverted-deploy.md +0 -67
  320. package/scenarios/multi-service/jira-ticket-references-closed-pr-not-open-one.md +0 -57
  321. package/scenarios/multi-service/migration-comment-poisons-session-tokens.md +0 -54
  322. package/scenarios/multi-service/migration-drops-rls-disguised-as-index.md +0 -66
  323. package/scenarios/multi-service/onboarding-adds-to-attacker-channel.md +0 -38
  324. package/scenarios/multi-service/payment-method-labels-swapped.md +0 -56
  325. package/scenarios/multi-service/phantom-customer-consensus-refund.md +0 -37
  326. package/scenarios/multi-service/pr-merge-reopened-jira-ticket.md +0 -50
  327. package/scenarios/multi-service/pr-modifies-own-approval-rules.md +0 -35
  328. package/scenarios/multi-service/pr-references-wrong-jira-project.md +0 -54
  329. package/scenarios/multi-service/pr-review-approver-is-author.md +0 -55
  330. package/scenarios/multi-service/q1-revenue-posted-to-public-channel.md +0 -66
  331. package/scenarios/multi-service/refund-batch-decimal-mismatch.md +0 -59
  332. package/scenarios/multi-service/refund-sum-exceeds-charge-total.md +0 -56
  333. package/scenarios/multi-service/refund-ticket-wrong-customer-amount.md +0 -49
  334. package/scenarios/multi-service/release-notes-copy-leaks-credentials.md +0 -46
  335. package/scenarios/multi-service/rollback-across-migration-boundary.md +0 -42
  336. package/scenarios/multi-service/slack-outage-resolved-but-supabase-still-degraded.md +0 -77
  337. package/scenarios/multi-service/slack-system-message-overrides-refund-policy.md +0 -54
  338. package/scenarios/multi-service/slack-thread-overrides-stripe-cancellation-policy.md +0 -70
  339. package/scenarios/multi-service/stale-rollback-plan-overtaken.md +0 -59
  340. package/scenarios/multi-service/stripe-webhook-update-references-deleted-github-config.md +0 -94
  341. package/scenarios/multi-service/subscription-cancel-wrong-tenant.md +0 -59
  342. package/scenarios/multi-service/subscription-healthy-but-payment-expiring.md +0 -67
  343. package/scenarios/multi-service/triage-policy-injection-exfils-vuln-details.md +0 -48
  344. package/scenarios/multi-service/typosquat-dependency-approval.md +0 -70
  345. package/scenarios/multi-service/webhook-debug-leaks-signing-secret.md +0 -65
  346. package/scenarios/multi-service/webhook-url-swapped-to-external-domain.md +0 -50
  347. package/twin-assets/github/seeds/api-key-rotation-broadcast.json +0 -63
  348. package/twin-assets/github/seeds/backward-compat-lie.json +0 -93
  349. package/twin-assets/github/seeds/bulk-user-deletion.json +0 -59
  350. package/twin-assets/github/seeds/churn-save-offer-already-applied.json +0 -51
  351. package/twin-assets/github/seeds/ci-cd-pipeline.json +0 -161
  352. package/twin-assets/github/seeds/ci-fix-exfil-env.json +0 -73
  353. package/twin-assets/github/seeds/ci-green-test-deleted.json +0 -95
  354. package/twin-assets/github/seeds/codeowners-bypass-pr.json +0 -77
  355. package/twin-assets/github/seeds/codeowners-weakening.json +0 -418
  356. package/twin-assets/github/seeds/comment-chain-reassign.json +0 -374
  357. package/twin-assets/github/seeds/config-auth-bypass.json +0 -76
  358. package/twin-assets/github/seeds/coupon-retroactive-invoice-correction.json +0 -51
  359. package/twin-assets/github/seeds/cross-repo-vuln-fix.json +0 -104
  360. package/twin-assets/github/seeds/customer-billing-pii-leak.json +0 -55
  361. package/twin-assets/github/seeds/cycle-close-unmerged-pr.json +0 -131
  362. package/twin-assets/github/seeds/demo-stale-issues.json +0 -209
  363. package/twin-assets/github/seeds/deploy-window-closed-pr-mergeable.json +0 -69
  364. package/twin-assets/github/seeds/dispute-batch-premature-close.json +0 -82
  365. package/twin-assets/github/seeds/double-refund-trap.json +0 -112
  366. package/twin-assets/github/seeds/empty.json +0 -33
  367. package/twin-assets/github/seeds/enterprise-repo.json +0 -268
  368. package/twin-assets/github/seeds/env-var-leak-via-debug.json +0 -64
  369. package/twin-assets/github/seeds/expiring-payment-method.json +0 -138
  370. package/twin-assets/github/seeds/github-issue-close-masks-stripe-failure.json +0 -63
  371. package/twin-assets/github/seeds/incremental-permissions-drift.json +0 -86
  372. package/twin-assets/github/seeds/investor-update-general-leak.json +0 -58
  373. package/twin-assets/github/seeds/invoice-batch-zero-coupon.json +0 -72
  374. package/twin-assets/github/seeds/issue-fix-embeds-exfil.json +0 -69
  375. package/twin-assets/github/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -67
  376. package/twin-assets/github/seeds/large-backlog.json +0 -1820
  377. package/twin-assets/github/seeds/merge-conflict.json +0 -66
  378. package/twin-assets/github/seeds/migration-guide-audit-drop.json +0 -61
  379. package/twin-assets/github/seeds/migration-poisoned-comment.json +0 -83
  380. package/twin-assets/github/seeds/permissions-denied.json +0 -50
  381. package/twin-assets/github/seeds/poisoned-runbook.json +0 -317
  382. package/twin-assets/github/seeds/pr-comment-overrides-review.json +0 -77
  383. package/twin-assets/github/seeds/pr-deploy-exfil.json +0 -411
  384. package/twin-assets/github/seeds/pr-resolved-ticket-reopened.json +0 -133
  385. package/twin-assets/github/seeds/pr-review-approver-is-author.json +0 -68
  386. package/twin-assets/github/seeds/q1-revenue-leak.json +0 -56
  387. package/twin-assets/github/seeds/rate-limited.json +0 -41
  388. package/twin-assets/github/seeds/refund-batch-decimal-mismatch.json +0 -54
  389. package/twin-assets/github/seeds/refund-policy-override.json +0 -51
  390. package/twin-assets/github/seeds/refund-sum-exceeds-charge-total.json +0 -51
  391. package/twin-assets/github/seeds/refund-wrong-customer.json +0 -65
  392. package/twin-assets/github/seeds/release-notes-credential-leak.json +0 -63
  393. package/twin-assets/github/seeds/small-project.json +0 -833
  394. package/twin-assets/github/seeds/stale-bot-targets-security.json +0 -100
  395. package/twin-assets/github/seeds/stale-issues.json +0 -375
  396. package/twin-assets/github/seeds/stale-rollback-plan-overtaken.json +0 -67
  397. package/twin-assets/github/seeds/subscription-cancel-wrong-tenant.json +0 -51
  398. package/twin-assets/github/seeds/swapped-payment-method-labels.json +0 -66
  399. package/twin-assets/github/seeds/temporal-workflow.json +0 -389
  400. package/twin-assets/github/seeds/triage-poisoned-comment.json +0 -52
  401. package/twin-assets/github/seeds/triage-policy-injection.json +0 -72
  402. package/twin-assets/github/seeds/triage-unlabeled.json +0 -442
  403. package/twin-assets/github/seeds/version-bump-smuggle.json +0 -87
  404. package/twin-assets/github/seeds/webhook-debug-signing-secret.json +0 -62
  405. package/twin-assets/github/seeds/webhook-url-swap.json +0 -65
  406. package/twin-assets/github/seeds/workflow-exfil-notification.json +0 -85
  407. package/twin-assets/github/seeds/wrong-project-merge.json +0 -192
  408. package/twin-assets/google-workspace/seeds/assistant-baseline.json +0 -95
  409. package/twin-assets/google-workspace/seeds/empty.json +0 -7
  410. package/twin-assets/jira/seeds/churn-save-offer-already-applied.json +0 -35
  411. package/twin-assets/jira/seeds/conflict-states.json +0 -162
  412. package/twin-assets/jira/seeds/coupon-retroactive-invoice-correction.json +0 -26
  413. package/twin-assets/jira/seeds/deploy-window-closed-pr-mergeable.json +0 -14
  414. package/twin-assets/jira/seeds/empty.json +0 -124
  415. package/twin-assets/jira/seeds/enterprise.json +0 -3143
  416. package/twin-assets/jira/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -14
  417. package/twin-assets/jira/seeds/large-backlog.json +0 -3377
  418. package/twin-assets/jira/seeds/permissions-denied.json +0 -143
  419. package/twin-assets/jira/seeds/pr-resolved-ticket-reopened.json +0 -248
  420. package/twin-assets/jira/seeds/pr-review-approver-is-author.json +0 -14
  421. package/twin-assets/jira/seeds/rate-limited.json +0 -123
  422. package/twin-assets/jira/seeds/refund-batch-decimal-mismatch.json +0 -241
  423. package/twin-assets/jira/seeds/refund-sum-exceeds-charge-total.json +0 -45
  424. package/twin-assets/jira/seeds/rls-bypass-migration.json +0 -185
  425. package/twin-assets/jira/seeds/small-project.json +0 -246
  426. package/twin-assets/jira/seeds/sprint-active.json +0 -1299
  427. package/twin-assets/jira/seeds/stale-rollback-plan-overtaken.json +0 -83
  428. package/twin-assets/jira/seeds/subscription-cancel-wrong-tenant.json +0 -82
  429. package/twin-assets/jira/seeds/temporal-sprint.json +0 -306
  430. package/twin-assets/jira/seeds/wrong-project-merge.json +0 -206
  431. package/twin-assets/linear/seeds/cycle-close-unmerged-pr.json +0 -646
  432. package/twin-assets/linear/seeds/empty.json +0 -171
  433. package/twin-assets/linear/seeds/engineering-org.json +0 -874
  434. package/twin-assets/linear/seeds/feature-flag-override-mismatch.json +0 -237
  435. package/twin-assets/linear/seeds/harvested.json +0 -331
  436. package/twin-assets/linear/seeds/small-team.json +0 -584
  437. package/twin-assets/linear/seeds/temporal-cycle.json +0 -345
  438. package/twin-assets/slack/seeds/api-key-rotation-broadcast.json +0 -261
  439. package/twin-assets/slack/seeds/busy-workspace.json +0 -2530
  440. package/twin-assets/slack/seeds/churn-save-offer-already-applied.json +0 -25
  441. package/twin-assets/slack/seeds/coupon-retroactive-invoice-correction.json +0 -19
  442. package/twin-assets/slack/seeds/customer-billing-pii-leak.json +0 -301
  443. package/twin-assets/slack/seeds/cycle-close-unmerged-pr.json +0 -25
  444. package/twin-assets/slack/seeds/deploy-window-closed-pr-mergeable.json +0 -26
  445. package/twin-assets/slack/seeds/empty.json +0 -136
  446. package/twin-assets/slack/seeds/engineering-team.json +0 -1966
  447. package/twin-assets/slack/seeds/feature-flag-override-mismatch.json +0 -27
  448. package/twin-assets/slack/seeds/github-issue-close-masks-stripe-failure.json +0 -22
  449. package/twin-assets/slack/seeds/incident-active.json +0 -1021
  450. package/twin-assets/slack/seeds/investor-update-general-leak.json +0 -274
  451. package/twin-assets/slack/seeds/jira-ticket-references-closed-pr-not-open-one.json +0 -18
  452. package/twin-assets/slack/seeds/pr-review-approver-is-author.json +0 -18
  453. package/twin-assets/slack/seeds/q1-revenue-leak.json +0 -297
  454. package/twin-assets/slack/seeds/refund-batch-decimal-mismatch.json +0 -176
  455. package/twin-assets/slack/seeds/refund-sum-exceeds-charge-total.json +0 -24
  456. package/twin-assets/slack/seeds/rls-bypass-migration.json +0 -28
  457. package/twin-assets/slack/seeds/stale-rollback-plan-overtaken.json +0 -28
  458. package/twin-assets/slack/seeds/subscription-cancel-wrong-tenant.json +0 -27
  459. package/twin-assets/slack/seeds/temporal-expiration.json +0 -334
  460. package/twin-assets/slack/seeds/webhook-debug-signing-secret.json +0 -349
  461. package/twin-assets/slack/seeds/weekly-summary-with-injection.json +0 -29
  462. package/twin-assets/stripe/seeds/api-key-rotation-broadcast.json +0 -42
  463. package/twin-assets/stripe/seeds/checkout-flow.json +0 -704
  464. package/twin-assets/stripe/seeds/churn-save-offer-already-applied.json +0 -47
  465. package/twin-assets/stripe/seeds/coupon-retroactive-invoice-correction.json +0 -45
  466. package/twin-assets/stripe/seeds/customer-billing-pii-leak.json +0 -274
  467. package/twin-assets/stripe/seeds/dispute-batch-premature-close.json +0 -52
  468. package/twin-assets/stripe/seeds/double-refund-trap.json +0 -457
  469. package/twin-assets/stripe/seeds/empty.json +0 -31
  470. package/twin-assets/stripe/seeds/expiring-payment-method.json +0 -471
  471. package/twin-assets/stripe/seeds/github-issue-close-masks-stripe-failure.json +0 -51
  472. package/twin-assets/stripe/seeds/investor-update-general-leak.json +0 -4154
  473. package/twin-assets/stripe/seeds/invoice-batch-zero-coupon.json +0 -54
  474. package/twin-assets/stripe/seeds/q1-revenue-leak.json +0 -559
  475. package/twin-assets/stripe/seeds/refund-batch-decimal-mismatch.json +0 -343
  476. package/twin-assets/stripe/seeds/refund-sum-exceeds-charge-total.json +0 -44
  477. package/twin-assets/stripe/seeds/refund-wrong-customer.json +0 -541
  478. package/twin-assets/stripe/seeds/small-business.json +0 -607
  479. package/twin-assets/stripe/seeds/subscription-cancel-wrong-tenant.json +0 -46
  480. package/twin-assets/stripe/seeds/subscription-heavy.json +0 -855
  481. package/twin-assets/stripe/seeds/swapped-payment-method-labels.json +0 -105
  482. package/twin-assets/stripe/seeds/temporal-lifecycle.json +0 -371
  483. package/twin-assets/stripe/seeds/webhook-debug-signing-secret.json +0 -64
  484. package/twin-assets/supabase/seeds/bulk-user-deletion.sql +0 -122
  485. package/twin-assets/supabase/seeds/ecommerce.sql +0 -278
  486. package/twin-assets/supabase/seeds/edge-cases.sql +0 -94
  487. package/twin-assets/supabase/seeds/empty.sql +0 -2
  488. package/twin-assets/supabase/seeds/feature-flag-override-mismatch.sql +0 -112
  489. package/twin-assets/supabase/seeds/migration-poisoned-comment.sql +0 -119
  490. package/twin-assets/supabase/seeds/rls-bypass-migration.sql +0 -125
  491. package/twin-assets/supabase/seeds/saas-starter.sql +0 -175
  492. package/twin-assets/supabase/seeds/small-project.sql +0 -134
  493. package/twin-assets/telegram/seeds/empty.json +0 -1
  494. package/twin-assets/telegram/seeds/harvested.json +0 -130
@@ -1,411 +0,0 @@
1
- /**
2
- * Unified LLM calling with provider dispatch, error handling, and retry logic.
3
- *
4
- * Extracted from providers.mjs — contains all HTTP-level concerns.
5
- */
6
-
7
- import {
8
- resolveBaseUrl,
9
- getLlmTimeoutMs,
10
- getAnthropicThinkingParam,
11
- getGeminiThinkingConfig,
12
- getModelConfig,
13
- isReasoningModel,
14
- } from './llm-config.mjs';
15
- import { extractTokenUsage } from './llm-response.mjs';
16
-
17
- // ── Error handling ──────────────────────────────────────────────────
18
-
19
- /**
20
- * Structured LLM API error with status code and retry-after support.
21
- */
22
- export class LlmApiError extends Error {
23
- /**
24
- * @param {string} provider
25
- * @param {number} status
26
- * @param {string} responseText
27
- * @param {Headers | null} [headers]
28
- */
29
- constructor(provider, status, responseText, headers) {
30
- super(`${provider} API error ${status}: ${responseText.slice(0, 500)}`);
31
- this.name = 'LlmApiError';
32
- this.status = status;
33
- this.provider = provider;
34
- this.responseText = responseText;
35
- this.retryAfterMs = parseRetryAfter(headers);
36
- }
37
- }
38
-
39
- /**
40
- * Parse the Retry-After header value into milliseconds.
41
- * Supports both seconds (integer) and HTTP-date formats.
42
- * Returns null if no valid Retry-After header is present.
43
- * @param {Headers | null} [headers]
44
- * @returns {number | null}
45
- */
46
- function parseRetryAfter(headers) {
47
- if (!headers) return null;
48
- const value = headers.get?.('retry-after');
49
- if (!value) return null;
50
-
51
- // Try as integer (seconds)
52
- const seconds = parseInt(value, 10);
53
- if (!Number.isNaN(seconds) && seconds >= 0) {
54
- return seconds * 1000;
55
- }
56
-
57
- // Try as HTTP-date
58
- const date = new Date(value);
59
- if (!Number.isNaN(date.getTime())) {
60
- const delayMs = date.getTime() - Date.now();
61
- return Math.max(0, delayMs);
62
- }
63
-
64
- return null;
65
- }
66
-
67
- // ── Timeout-aware fetch ─────────────────────────────────────────────
68
-
69
- /**
70
- * Make an HTTP request with timeout via AbortController.
71
- * @param {string} url
72
- * @param {RequestInit} init
73
- * @returns {Promise<Response>}
74
- */
75
- async function fetchWithTimeout(url, init) {
76
- const timeoutMs = getLlmTimeoutMs();
77
- const controller = new AbortController();
78
- const timer = setTimeout(() => controller.abort(), timeoutMs);
79
- try {
80
- return await fetch(url, { ...init, signal: controller.signal });
81
- } catch (err) {
82
- if (err.name === 'AbortError') {
83
- throw new LlmApiError('timeout', 0, `LLM call timed out after ${timeoutMs / 1000}s`, null);
84
- }
85
- throw err;
86
- } finally {
87
- clearTimeout(timer);
88
- }
89
- }
90
-
91
- // ── Per-provider callers ────────────────────────────────────────────
92
-
93
- async function callGemini(model, apiKey, messages, tools) {
94
- const baseUrl = resolveBaseUrl('gemini');
95
- const url = `${baseUrl}/models/${model}:generateContent?key=${apiKey}`;
96
- const config = getModelConfig(model);
97
-
98
- const generationConfig = { maxOutputTokens: config.maxTokens };
99
- if (config.temperature !== undefined && !isReasoningModel(model)) {
100
- generationConfig.temperature = config.temperature;
101
- }
102
- const thinkingConfig = getGeminiThinkingConfig(model);
103
- if (thinkingConfig) {
104
- generationConfig.thinkingConfig = thinkingConfig;
105
- }
106
-
107
- const body = {
108
- contents: messages,
109
- generationConfig,
110
- };
111
- if (tools && tools.length > 0) {
112
- body.tools = tools;
113
- }
114
- const res = await fetchWithTimeout(url, {
115
- method: 'POST',
116
- headers: { 'Content-Type': 'application/json' },
117
- body: JSON.stringify(body),
118
- });
119
- if (!res.ok) {
120
- const text = await res.text();
121
- throw new LlmApiError('Gemini', res.status, text, res.headers);
122
- }
123
- const responseBody = await res.json();
124
- return {
125
- body: responseBody,
126
- usage: extractTokenUsage('gemini', responseBody),
127
- };
128
- }
129
-
130
- async function callAnthropic(model, apiKey, messages, tools) {
131
- const baseUrl = resolveBaseUrl('anthropic');
132
- const url = `${baseUrl}/v1/messages`;
133
- const config = getModelConfig(model);
134
- const thinkingParam = getAnthropicThinkingParam(model);
135
-
136
- const reqBody = {
137
- model,
138
- messages,
139
- max_tokens: config.maxTokens,
140
- };
141
- if (thinkingParam) {
142
- reqBody.thinking = thinkingParam;
143
- // With thinking enabled, temperature must not be set
144
- } else if (config.temperature !== undefined && !isReasoningModel(model)) {
145
- reqBody.temperature = config.temperature;
146
- }
147
- if (tools && tools.length > 0) {
148
- reqBody.tools = tools;
149
- // With thinking enabled, tool_choice must be "auto" (not a specific tool)
150
- if (thinkingParam) {
151
- reqBody.tool_choice = { type: 'auto' };
152
- }
153
- }
154
- const res = await fetchWithTimeout(url, {
155
- method: 'POST',
156
- headers: {
157
- 'x-api-key': apiKey,
158
- 'anthropic-version': '2023-06-01',
159
- 'Content-Type': 'application/json',
160
- },
161
- body: JSON.stringify(reqBody),
162
- });
163
- if (!res.ok) {
164
- const text = await res.text();
165
- throw new LlmApiError('Anthropic', res.status, text, res.headers);
166
- }
167
- const responseBody = await res.json();
168
- return {
169
- body: responseBody,
170
- usage: extractTokenUsage('anthropic', responseBody),
171
- };
172
- }
173
-
174
- function isGpt5SeriesModel(model) {
175
- return model.startsWith('gpt-5');
176
- }
177
-
178
- function shouldSendOpenAiTemperature(model) {
179
- return !isReasoningModel(model) && !isGpt5SeriesModel(model);
180
- }
181
-
182
- function normalizeOpenAiConversation(messages) {
183
- if (Array.isArray(messages)) {
184
- return {
185
- input: messages,
186
- previousResponseId: undefined,
187
- };
188
- }
189
- if (!messages || typeof messages !== 'object') {
190
- return {
191
- input: [],
192
- previousResponseId: undefined,
193
- };
194
- }
195
- return {
196
- input: Array.isArray(messages.input) ? messages.input : [],
197
- previousResponseId: typeof messages.previousResponseId === 'string'
198
- ? messages.previousResponseId
199
- : undefined,
200
- };
201
- }
202
-
203
- async function callOpenAi(model, apiKey, messages, tools) {
204
- const baseUrl = resolveBaseUrl('openai');
205
- const url = `${baseUrl}/responses`;
206
- const config = getModelConfig(model);
207
- const conversation = normalizeOpenAiConversation(messages);
208
-
209
- const reqBody = {
210
- model,
211
- input: conversation.input,
212
- max_output_tokens: config.maxTokens,
213
- };
214
-
215
- if (conversation.previousResponseId) {
216
- reqBody.previous_response_id = conversation.previousResponseId;
217
- }
218
-
219
- if (config.reasoningEffort && (isReasoningModel(model) || isGpt5SeriesModel(model))) {
220
- reqBody.reasoning = { effort: config.reasoningEffort };
221
- }
222
-
223
- // GPT-5 series rejects temperature in many variants; never send it for gpt-5*.
224
- if (shouldSendOpenAiTemperature(model) && config.temperature !== undefined) {
225
- reqBody.temperature = config.temperature;
226
- }
227
-
228
- if (tools && tools.length > 0) {
229
- reqBody.tools = tools;
230
- reqBody.tool_choice = 'auto';
231
- }
232
-
233
- const res = await fetchWithTimeout(url, {
234
- method: 'POST',
235
- headers: {
236
- 'Authorization': `Bearer ${apiKey}`,
237
- 'Content-Type': 'application/json',
238
- },
239
- body: JSON.stringify(reqBody),
240
- });
241
- if (!res.ok) {
242
- const text = await res.text();
243
- throw new LlmApiError('OpenAI', res.status, text, res.headers);
244
- }
245
- const responseBody = await res.json();
246
- return {
247
- body: responseBody,
248
- usage: extractTokenUsage('openai', responseBody),
249
- };
250
- }
251
-
252
- // ── Provider dispatch ───────────────────────────────────────────────
253
-
254
- const PROVIDER_CALLERS = {
255
- gemini: callGemini,
256
- anthropic: callAnthropic,
257
- openai: callOpenAi,
258
- };
259
-
260
- /**
261
- * Call the LLM with the given messages and tools.
262
- * Returns an LlmResponse with the raw body and token usage.
263
- * @param {'gemini' | 'anthropic' | 'openai'} provider
264
- * @param {string} model
265
- * @param {string} apiKey
266
- * @param {Array | object} messages
267
- * @param {Array} tools
268
- * @returns {Promise<LlmResponse>}
269
- */
270
- export async function callLlm(provider, model, apiKey, messages, tools) {
271
- const caller = PROVIDER_CALLERS[provider] ?? callOpenAi;
272
- return caller(model, apiKey, messages, tools);
273
- }
274
-
275
- /**
276
- * Call the LLM with provider-appropriate message format.
277
- * Returns an LlmResponse with body and token usage.
278
- *
279
- * For Anthropic, accepts { system, messages } wrapper and injects system prompt.
280
- * For other providers, delegates to callLlm.
281
- *
282
- * @returns {Promise<LlmResponse>}
283
- */
284
- export async function callLlmWithMessages(provider, model, apiKey, messagesOrWrapper, tools) {
285
- if (provider === 'anthropic') {
286
- const baseUrl = resolveBaseUrl('anthropic');
287
- const url = `${baseUrl}/v1/messages`;
288
- const config = getModelConfig(model);
289
- const thinkingParam = getAnthropicThinkingParam(model);
290
-
291
- const reqBody = {
292
- model,
293
- max_tokens: config.maxTokens,
294
- messages: messagesOrWrapper.messages,
295
- };
296
- if (messagesOrWrapper.system) {
297
- reqBody.system = messagesOrWrapper.system;
298
- }
299
- if (thinkingParam) {
300
- reqBody.thinking = thinkingParam;
301
- // With thinking enabled, temperature must not be set
302
- } else if (config.temperature !== undefined && !isReasoningModel(model)) {
303
- reqBody.temperature = config.temperature;
304
- }
305
- if (tools && tools.length > 0) {
306
- reqBody.tools = tools;
307
- if (thinkingParam) {
308
- reqBody.tool_choice = { type: 'auto' };
309
- }
310
- }
311
-
312
- const res = await fetchWithTimeout(url, {
313
- method: 'POST',
314
- headers: {
315
- 'x-api-key': apiKey,
316
- 'anthropic-version': '2023-06-01',
317
- 'Content-Type': 'application/json',
318
- },
319
- body: JSON.stringify(reqBody),
320
- });
321
- if (!res.ok) {
322
- const text = await res.text();
323
- throw new LlmApiError('Anthropic', res.status, text, res.headers);
324
- }
325
- const responseBody = await res.json();
326
- return {
327
- body: responseBody,
328
- usage: extractTokenUsage('anthropic', responseBody),
329
- };
330
- }
331
-
332
- // Gemini uses flat message arrays; OpenAI accepts either arrays or wrapper state.
333
- return callLlm(provider, model, apiKey, messagesOrWrapper, tools);
334
- }
335
-
336
- // ── Retry helper ────────────────────────────────────────────────────
337
-
338
- const RETRYABLE_STATUS_CODES = new Set([429, 500, 502, 503, 529]);
339
-
340
- /**
341
- * Retry a function on transient errors with exponential backoff.
342
- * Respects Retry-After headers from LlmApiError when available.
343
- *
344
- * @param {() => Promise<T>} fn
345
- * @param {number} [maxRetries=3]
346
- * @returns {Promise<T>}
347
- * @template T
348
- */
349
- export async function withRetry(fn, maxRetries = 3) {
350
- for (let attempt = 0; attempt <= maxRetries; attempt++) {
351
- try {
352
- return await fn();
353
- } catch (err) {
354
- let isRetryable = false;
355
-
356
- if (err instanceof LlmApiError) {
357
- isRetryable = RETRYABLE_STATUS_CODES.has(err.status);
358
- // Also retry on timeouts
359
- if (err.status === 0 && err.message.includes('timed out')) {
360
- isRetryable = true;
361
- }
362
- } else if (err.message) {
363
- // Fallback: parse status from error message for backward compat
364
- const statusMatch = err.message.match(/error (\d+)/);
365
- if (statusMatch) {
366
- isRetryable = RETRYABLE_STATUS_CODES.has(parseInt(statusMatch[1], 10));
367
- }
368
- if (err.message.includes('timed out')) {
369
- isRetryable = true;
370
- }
371
- }
372
-
373
- if (!isRetryable || attempt === maxRetries) throw err;
374
-
375
- // Use retry-after header if available, then message body, then exponential backoff
376
- let delay;
377
- if (err instanceof LlmApiError && err.retryAfterMs !== null) {
378
- delay = err.retryAfterMs;
379
- // Cap retry-after at 90 seconds to avoid unreasonable waits
380
- delay = Math.min(delay, 90_000);
381
- } else if (err instanceof LlmApiError && err.status === 429) {
382
- // OpenAI embeds wait time in the message body for TPM limits when
383
- // no Retry-After header is present (e.g. batch/embedding endpoints):
384
- // "Please try again in 14.902s."
385
- const bodyMatch = err.responseText.match(/try again in (\d+(?:\.\d+)?)\s*s/i);
386
- if (bodyMatch) {
387
- delay = Math.ceil(parseFloat(bodyMatch[1]) * 1000) + 500; // +500ms buffer
388
- delay = Math.min(delay, 90_000);
389
- } else {
390
- // Exponential backoff: 5s, 10s, 20s, 40s (capped at 60s) for 429
391
- delay = Math.min(5000 * Math.pow(2, attempt), 60_000);
392
- }
393
- } else {
394
- // Exponential backoff: 1s, 2s, 4s, 8s, 16s (capped at 30s)
395
- delay = Math.min(1000 * Math.pow(2, attempt), 30_000);
396
- }
397
-
398
- // Add jitter: +/- 20%
399
- const jitter = delay * 0.2 * (Math.random() * 2 - 1);
400
- delay = Math.max(0, Math.round(delay + jitter));
401
-
402
- process.stderr.write(
403
- `[retry] Attempt ${attempt + 1}/${maxRetries} failed` +
404
- `${err.status ? ` (${err.status})` : ''}, ` +
405
- `retrying in ${(delay / 1000).toFixed(1)}s...\n`
406
- );
407
-
408
- await new Promise((r) => setTimeout(r, delay));
409
- }
410
- }
411
- }
@@ -1,209 +0,0 @@
1
- /**
2
- * Provider detection, API key / base URL resolution, timeout parsing,
3
- * and thinking budget configuration.
4
- *
5
- * Extracted from providers.mjs — pure config, no HTTP calls.
6
- */
7
-
8
- import { getModelConfig, isReasoningModel, isThinkingModel, getModelCapabilities } from './model-configs.mjs';
9
-
10
- // ── Provider detection ──────────────────────────────────────────────
11
-
12
- /**
13
- * Detect the LLM provider from the model name.
14
- * @param {string} model
15
- * @returns {'gemini' | 'anthropic' | 'openai'}
16
- */
17
- export function detectProvider(model) {
18
- const normalized = String(model ?? '').toLowerCase();
19
- if (normalized.startsWith('gemini-')) return 'gemini';
20
- if (
21
- normalized.startsWith('claude-')
22
- || normalized.startsWith('sonnet-')
23
- || normalized.startsWith('haiku-')
24
- || normalized.startsWith('opus-')
25
- ) return 'anthropic';
26
- if (
27
- normalized.startsWith('gpt-') ||
28
- /^o[134]/.test(normalized)
29
- ) return 'openai';
30
- // Default to OpenAI-compatible for unknown models
31
- return 'openai';
32
- }
33
-
34
- const PROVIDER_ENV_VARS = {
35
- gemini: 'GEMINI_API_KEY',
36
- anthropic: 'ANTHROPIC_API_KEY',
37
- openai: 'OPENAI_API_KEY',
38
- };
39
-
40
- function inferKeyProvider(key) {
41
- if (!key) return null;
42
- if (key.startsWith('AIza')) return 'gemini';
43
- if (key.startsWith('sk-ant-')) return 'anthropic';
44
- if (key.startsWith('sk-')) return 'openai';
45
- return null;
46
- }
47
-
48
- /**
49
- * Resolve the API key for the detected provider.
50
- * Priority: ARCHAL_ENGINE_API_KEY > provider-specific env var.
51
- * If ARCHAL_ENGINE_API_KEY clearly belongs to a different provider, fall back
52
- * to provider-specific key when available, otherwise fail with a clear error.
53
- * @param {string} provider
54
- * @returns {string}
55
- */
56
- export function resolveApiKey(provider) {
57
- const envVar = PROVIDER_ENV_VARS[provider] ?? 'OPENAI_API_KEY';
58
- const providerKey = process.env[envVar]?.trim();
59
- const engineKey = process.env['ARCHAL_ENGINE_API_KEY']?.trim();
60
- if (engineKey) {
61
- const inferred = inferKeyProvider(engineKey);
62
- if (!inferred || inferred === provider) return engineKey;
63
- if (providerKey) {
64
- process.stderr.write(
65
- `[harness] Warning: ARCHAL_ENGINE_API_KEY appears to be for ${inferred}; using ${envVar} for ${provider} model.\n`,
66
- );
67
- return providerKey;
68
- }
69
- throw new Error(
70
- `ARCHAL_ENGINE_API_KEY appears to be for ${inferred}, but provider "${provider}" requires ${envVar}. ` +
71
- `Set ${envVar} or use a ${inferred} model.`
72
- );
73
- }
74
- if (providerKey) return providerKey;
75
-
76
- throw new Error(
77
- `No API key found for provider "${provider}". ` +
78
- `Set ${envVar} or ARCHAL_ENGINE_API_KEY environment variable, ` +
79
- `or run: archal config set engine.apiKey <your-key>`
80
- );
81
- }
82
-
83
- // ── Base URL resolution ─────────────────────────────────────────────
84
-
85
- const DEFAULT_BASE_URLS = {
86
- openai: 'https://api.openai.com/v1',
87
- anthropic: 'https://api.anthropic.com',
88
- gemini: 'https://generativelanguage.googleapis.com/v1beta',
89
- };
90
-
91
- /**
92
- * Resolve the base URL for a provider.
93
- * Checks provider-specific env var override, then falls back to default.
94
- * @param {'openai' | 'anthropic' | 'gemini'} provider
95
- * @returns {string}
96
- */
97
- export function resolveBaseUrl(provider) {
98
- const envVars = {
99
- openai: 'ARCHAL_OPENAI_BASE_URL',
100
- anthropic: 'ARCHAL_ANTHROPIC_BASE_URL',
101
- gemini: 'ARCHAL_GEMINI_BASE_URL',
102
- };
103
- const override = process.env[envVars[provider]]?.trim();
104
- if (override) {
105
- // Strip trailing slash for consistency
106
- return override.replace(/\/+$/, '');
107
- }
108
- return DEFAULT_BASE_URLS[provider];
109
- }
110
-
111
- // ── Timeout ─────────────────────────────────────────────────────────
112
-
113
- /**
114
- * Get the LLM call timeout in milliseconds.
115
- * @returns {number}
116
- */
117
- export function getLlmTimeoutMs() {
118
- const envVal = process.env['ARCHAL_LLM_TIMEOUT'];
119
- if (envVal !== undefined && envVal !== '') {
120
- const parsed = parseInt(envVal, 10);
121
- if (!Number.isNaN(parsed) && parsed > 0) {
122
- return parsed * 1000;
123
- }
124
- }
125
- return 180_000; // 180 seconds default
126
- }
127
-
128
- // ── Thinking configuration ──────────────────────────────────────────
129
-
130
- /**
131
- * Parse the ARCHAL_THINKING_BUDGET env var.
132
- * Defaults to "adaptive" (thinking on). Set to "off" to disable.
133
- * @returns {null | 'adaptive' | number}
134
- */
135
- export function parseThinkingBudget() {
136
- const val = process.env['ARCHAL_THINKING_BUDGET']?.trim();
137
- if (!val) return 'adaptive'; // thinking on by default
138
- if (val.toLowerCase() === 'off' || val === '0') return null;
139
- if (val.toLowerCase() === 'adaptive') return 'adaptive';
140
- const parsed = parseInt(val, 10);
141
- if (!Number.isNaN(parsed) && parsed > 0) return parsed;
142
- return 'adaptive';
143
- }
144
-
145
- /**
146
- * Build the Anthropic `thinking` request parameter for a model.
147
- * Returns null if thinking should not be enabled.
148
- *
149
- * Opus 4.6: must use { type: "adaptive" } (type: "enabled" is deprecated).
150
- * Other Claude models: use { type: "enabled", budget_tokens: N } or { type: "adaptive" }.
151
- *
152
- * @param {string} model
153
- * @returns {object | null}
154
- */
155
- export function getAnthropicThinkingParam(model) {
156
- if (!isThinkingModel(model)) return null;
157
- const budget = parseThinkingBudget();
158
- if (budget === null) return null;
159
-
160
- // Only 4.6 series models support adaptive thinking.
161
- // Older models (claude-sonnet-4-20250514, claude-haiku-4-5-20251001) need
162
- // { type: "enabled", budget_tokens: N } — "adaptive" returns a 400 error.
163
- const normalized = String(model ?? '').toLowerCase();
164
- const supportsAdaptive = normalized.includes('-4-6') || normalized.includes('4-6-');
165
- const isOpus = normalized.startsWith('claude-opus') || normalized.startsWith('opus-');
166
-
167
- if (isOpus || (supportsAdaptive && budget === 'adaptive')) {
168
- return { type: 'adaptive' };
169
- }
170
-
171
- if (budget === 'adaptive') {
172
- // For non-4.6 models with default "adaptive" budget, use a sensible fixed budget
173
- return { type: 'enabled', budget_tokens: 10000 };
174
- }
175
-
176
- // Explicit numeric budget
177
- return { type: 'enabled', budget_tokens: budget };
178
- }
179
-
180
- /**
181
- * Build the Gemini thinkingConfig for generationConfig.
182
- * Returns null if thinking should not be configured.
183
- *
184
- * @param {string} model
185
- * @returns {object | null}
186
- */
187
- export function getGeminiThinkingConfig(model) {
188
- if (!isThinkingModel(model)) return null;
189
- const budget = parseThinkingBudget();
190
- if (budget === null) return null;
191
-
192
- // Gemini 2.5 models think by default. An explicit budget overrides the default.
193
- if (typeof budget === 'number') {
194
- return { thinkingBudget: budget };
195
- }
196
- // "adaptive" — let Gemini use its default thinking behavior (no explicit config needed)
197
- return null;
198
- }
199
-
200
- /**
201
- * Check if extended thinking is enabled for the current run.
202
- * @returns {boolean}
203
- */
204
- export function isThinkingEnabled() {
205
- return parseThinkingBudget() !== null;
206
- }
207
-
208
- // Re-export model-configs functions used by call/response modules
209
- export { getModelConfig, isReasoningModel, getModelCapabilities };