@asterxsk/kiln 0.2.0 → 0.3.0

package/agent.bak.20260905-190020/extensions/pi-web-access/feature-config.ts

@@ -0,0 +1,29 @@
+import { existsSync, readFileSync } from "node:fs";
+import { getWebSearchConfigPath } from "./utils.ts";
+
+const CONFIG_PATH = getWebSearchConfigPath();
+
+type FeatureConfig = { image?: { enabled?: unknown } };
+
+function loadFeatureConfig(): FeatureConfig {
+	if (!existsSync(CONFIG_PATH)) return {};
+	try {
+		const raw: unknown = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+		return raw && typeof raw === "object" ? raw as FeatureConfig : {};
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
+	}
+}
+
+export function isImageEnabled(): boolean {
+	return loadFeatureConfig().image?.enabled !== false;
+}
+
+export function canAttachImages(): boolean {
+	try {
+		return isImageEnabled();
+	} catch {
+		return false;
+	}
+}

package/agent.bak.20260905-190020/extensions/pi-web-access/fetch-params.ts

@@ -0,0 +1,111 @@
+import { normalizeProxyUrl } from "./utils.ts";
+
+export interface FetchContentParams {
+	url?: unknown;
+	urls?: unknown;
+	forceClone?: unknown;
+	prompt?: unknown;
+	timestamp?: unknown;
+	frames?: unknown;
+	model?: unknown;
+	mode?: unknown;
+	answerModel?: unknown;
+	auth?: unknown;
+	proxy?: unknown;
+}
+
+export interface NormalizedFetchContentParams {
+	urlList: string[];
+	options: {
+		forceClone?: boolean;
+		prompt?: string;
+		timestamp?: string;
+		frames?: number;
+		model?: string;
+		mode?: "readable" | "raw" | "answer";
+		answerModel?: string;
+		auth?: true | string;
+		proxy?: string;
+	};
+}
+
+export function normalizeFetchContentParams(params: FetchContentParams): NormalizedFetchContentParams {
+	const normalizedUrls = uniqueUrls(normalizeUrlArray(params.urls));
+	const urlList = normalizedUrls.length > 0 ? normalizedUrls : normalizeSingleUrl(params.url);
+	const prompt = normalizeOptionalString(params.prompt);
+	const timestamp = normalizeOptionalString(params.timestamp);
+	const frames = normalizeOptionalFrameCount(params.frames);
+
+	const shouldIncludeFrames = frames !== undefined && (timestamp !== undefined || frames > 1);
+
+	const forceClone = typeof params.forceClone === "boolean" ? params.forceClone : undefined;
+	const model = normalizeOptionalString(params.model);
+	const mode = normalizeMode(params.mode);
+	const answerModel = normalizeOptionalString(params.answerModel);
+	const auth = normalizeAuth(params.auth);
+	const proxy = normalizeProxy(params.proxy);
+
+	return {
+		urlList,
+		options: {
+			...(forceClone !== undefined ? { forceClone } : {}),
+			...(prompt !== undefined ? { prompt } : {}),
+			...(timestamp !== undefined ? { timestamp } : {}),
+			...(shouldIncludeFrames ? { frames } : {}),
+			...(model !== undefined ? { model } : {}),
+			...(mode !== undefined ? { mode } : {}),
+			...(answerModel !== undefined ? { answerModel } : {}),
+			...(auth !== undefined ? { auth } : {}),
+			...(proxy !== undefined ? { proxy } : {}),
+		},
+	};
+}
+
+function normalizeUrlArray(value: unknown): string[] {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap(normalizeSingleUrl);
+}
+
+function normalizeSingleUrl(value: unknown): string[] {
+	if (typeof value !== "string") return [];
+	const trimmed = value.trim();
+	return trimmed ? [trimmed] : [];
+}
+
+function normalizeOptionalString(value: unknown): string | undefined {
+	if (typeof value !== "string") return undefined;
+	const trimmed = value.trim();
+	return trimmed || undefined;
+}
+
+function normalizeMode(value: unknown): "readable" | "raw" | "answer" | undefined {
+	if (value === undefined) return undefined;
+	if (value === "readable" || value === "raw" || value === "answer") return value;
+	throw new Error('mode must be "readable", "raw", or "answer"');
+}
+
+function normalizeAuth(value: unknown): true | string | undefined {
+	if (value === undefined || value === false) return undefined;
+	if (value === true) return true;
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed) return trimmed;
+	}
+	throw new Error("auth must be a profile name, true, or false");
+}
+
+function normalizeProxy(value: unknown): string | undefined {
+	if (value === undefined || value === false) return undefined;
+	if (value === null) throw new Error("proxy must be an http(s) proxy URL string");
+	const normalized = normalizeProxyUrl(value, "proxy");
+	return normalized ?? "";
+}
+
+function normalizeOptionalFrameCount(value: unknown): number | undefined {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 12) return undefined;
+	return value;
+}
+
+function uniqueUrls(urls: string[]): string[] {
+	return [...new Set(urls)];
+}

package/agent.bak.20260905-190020/extensions/pi-web-access/gemini-adc.ts

@@ -0,0 +1,298 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createSign } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { getWebSearchConfigPath } from "./utils.ts";
+import { redactCredential, CredentialResolutionError } from "./credential-source.ts";
+
+const CONFIG_PATH = getWebSearchConfigPath();
+const DEFAULT_ADC_PATH = join(homedir(), ".config", "gcloud", "application_default_credentials.json");
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const VERTEX_HOST = "https://aiplatform.googleapis.com";
+const VERTEX_API_VERSION = "v1";
+const REFRESH_SKEW_MS = 60_000;
+
+interface GeminiAdcConfig {
+	geminiAuth?: unknown;
+	geminiProject?: unknown;
+	geminiLocation?: unknown;
+	geminiApiKey?: unknown;
+	geminiBaseUrl?: unknown;
+}
+
+let cachedConfig: GeminiAdcConfig | null = null;
+
+function loadConfig(): GeminiAdcConfig {
+	if (cachedConfig) return cachedConfig;
+	if (!existsSync(CONFIG_PATH)) {
+		cachedConfig = {};
+		return cachedConfig;
+	}
+	const raw = readFileSync(CONFIG_PATH, "utf-8");
+	try {
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+			throw new Error("config root must be an object");
+		}
+		cachedConfig = parsed as GeminiAdcConfig;
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
+	}
+	return cachedConfig;
+}
+
+function normalizeIdentifier(value: unknown, envName: string): string | null {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed) return trimmed;
+	}
+	const fromEnv = process.env[envName]?.trim();
+	return fromEnv ? fromEnv : null;
+}
+
+export function isAdcAuthSelected(): boolean {
+	return (loadConfig().geminiAuth ?? "").toString().trim().toLowerCase() === "adc";
+}
+
+export function getAdcProject(): string | null {
+	return (
+		normalizeIdentifier(loadConfig().geminiProject, "GOOGLE_CLOUD_PROJECT") ??
+		normalizeIdentifier(null, "GCLOUD_PROJECT")
+	);
+}
+
+export function getAdcLocation(): string | null {
+	return normalizeIdentifier(loadConfig().geminiLocation, "GOOGLE_CLOUD_LOCATION");
+}
+
+function getAdcPath(): string {
+	return process.env.GOOGLE_APPLICATION_CREDENTIALS?.trim() || DEFAULT_ADC_PATH;
+}
+
+export function getVertexApiBase(project: string, location: string): string {
+	return `${VERTEX_HOST}/${VERTEX_API_VERSION}/projects/${encodeURIComponent(project)}/locations/${encodeURIComponent(location)}/publishers/google`;
+}
+
+export function isVertexHost(origin: string): boolean {
+	return origin === VERTEX_HOST;
+}
+
+interface AdcFile {
+	type?: string;
+	client_id?: string;
+	client_secret?: string;
+	refresh_token?: string;
+	client_email?: string;
+	private_key?: string;
+	private_key_id?: string;
+	token_uri?: string;
+	universe_domain?: string;
+}
+
+function objectRecord(value: unknown): Record<string, unknown> | null {
+	return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+
+function stringField(record: Record<string, unknown>, name: string): string | undefined {
+	const value = record[name];
+	return typeof value === "string" ? value : undefined;
+}
+
+function requiredString(record: Record<string, unknown>, name: string, context: string): string {
+	const value = stringField(record, name)?.trim();
+	if (!value) throw new Error(`${context} is missing ${name}`);
+	return value;
+}
+
+function parseAdcFile(raw: string): AdcFile {
+	const parsed = objectRecord(JSON.parse(raw));
+	if (!parsed) throw new Error("credential root must be an object");
+	const type = stringField(parsed, "type") ?? "authorized_user";
+	if (type === "authorized_user") {
+		return {
+			type,
+			client_id: requiredString(parsed, "client_id", "Gemini ADC authorized_user file"),
+			client_secret: requiredString(parsed, "client_secret", "Gemini ADC authorized_user file"),
+			refresh_token: requiredString(parsed, "refresh_token", "Gemini ADC authorized_user file"),
+			universe_domain: stringField(parsed, "universe_domain"),
+		};
+	}
+	if (type === "service_account") {
+		return {
+			type,
+			client_email: requiredString(parsed, "client_email", "Gemini ADC service_account file"),
+			private_key: requiredString(parsed, "private_key", "Gemini ADC service_account file"),
+			private_key_id: stringField(parsed, "private_key_id"),
+			token_uri: stringField(parsed, "token_uri"),
+			universe_domain: stringField(parsed, "universe_domain"),
+		};
+	}
+	return { type };
+}
+
+function parseTokenExchangeResponse(text: string, context: string): CachedToken {
+	let raw: unknown;
+	try {
+		raw = JSON.parse(text);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`${context} returned invalid JSON: ${message}`);
+	}
+	const parsed = objectRecord(raw);
+	if (!parsed) throw new Error(`${context} returned a non-object response`);
+	const token = stringField(parsed, "access_token")?.trim();
+	if (!token) throw new Error(`${context} returned no access_token`);
+	const expiresIn = parsed.expires_in ?? 3600;
+	if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn)) {
+		throw new Error(`${context} returned invalid expires_in`);
+	}
+	return { token, expiresAt: Date.now() + Math.max((expiresIn * 1000) - REFRESH_SKEW_MS, 60_000) };
+}
+
+async function loadAdcFile(): Promise<AdcFile> {
+	const path = getAdcPath();
+	if (!path || !existsSync(path)) {
+		throw new Error(`Google Application Default Credentials file not found at ${path}`);
+	}
+	const raw = readFileSync(path, "utf-8");
+	try {
+		return parseAdcFile(raw);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Failed to parse Google Application Default Credentials file at ${path}: ${message}`);
+	}
+}
+
+interface CachedToken {
+	token: string;
+	expiresAt: number;
+}
+
+let cachedToken: CachedToken | null = null;
+
+export function clearAdcTokenCache(): void {
+	cachedToken = null;
+}
+
+/**
+ * Classifies a failed OAuth token exchange. Only explicit credential/authorization
+ * rejections (400 invalid_client/invalid_grant/invalid_scope, 401, 403 denied)
+ * mean the configured credentials themselves were refused — a hard credential
+ * problem callers should surface rather than silently fall back. Everything else
+ * (429 rate limit, 404, 5xx, network failures, timeouts) is transient, so it is
+ * left as a plain Error and existing per-provider fallbacks keep working.
+ */
+const OAUTH_CREDENTIAL_REJECTION_STATUSES = new Set([400, 401, 403]);
+
+function throwOnTokenExchangeFailure(res: Response, detail: string, status: number): never {
+	if (OAUTH_CREDENTIAL_REJECTION_STATUSES.has(status)) {
+		throw new CredentialResolutionError("Gemini ADC", "oauth-credential-rejected");
+	}
+	throw new Error(`Gemini ADC token exchange failed (${status}): ${detail.slice(0, 300)}`);
+}
+
+async function exchangeRefreshToken(cfg: AdcFile, signal?: AbortSignal): Promise<CachedToken> {
+	const body = new URLSearchParams({
+		client_id: cfg.client_id ?? "",
+		client_secret: cfg.client_secret ?? "",
+		refresh_token: cfg.refresh_token ?? "",
+		grant_type: "refresh_token",
+	});
+	const res = await fetch(TOKEN_ENDPOINT, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body,
+		signal,
+	});
+	const text = await res.text();
+	if (!res.ok) {
+		throwOnTokenExchangeFailure(res, text, res.status);
+	}
+	return parseTokenExchangeResponse(text, "Gemini ADC token exchange");
+}
+
+async function exchangeServiceAccountJwt(cfg: AdcFile, signal?: AbortSignal): Promise<CachedToken> {
+	if (!cfg.client_email || !cfg.private_key) {
+		throw new Error("Gemini ADC service_account file is missing client_email or private_key");
+	}
+	const now = Math.floor(Date.now() / 1000);
+	const header = { alg: "RS256", typ: "JWT" };
+	const claims = {
+		iss: cfg.client_email,
+		scope: "https://www.googleapis.com/auth/cloud-platform",
+		aud: TOKEN_ENDPOINT,
+		iat: now,
+		exp: now + 3600,
+	};
+	const encodePart = (obj: object): string =>
+		Buffer.from(JSON.stringify(obj)).toString("base64url");
+	const assertion = `${encodePart(header)}.${encodePart(claims)}`;
+	const signer = createSign("RSA-SHA256");
+	signer.update(assertion);
+	signer.end();
+	const signature = signer.sign(cfg.private_key, "base64url");
+	const jwt = `${assertion}.${signature}`;
+
+	const body = new URLSearchParams({
+		grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+		assertion: jwt,
+	});
+	const res = await fetch(cfg.token_uri || TOKEN_ENDPOINT, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body,
+		signal,
+	});
+	const text = await res.text();
+	if (!res.ok) {
+		throwOnTokenExchangeFailure(res, text, res.status);
+	}
+	return parseTokenExchangeResponse(text, "Gemini ADC service account token exchange");
+}
+
+export async function getAdcAccessToken(signal?: AbortSignal): Promise<string> {
+	if (cachedToken && cachedToken.expiresAt > Date.now()) {
+		return cachedToken.token;
+	}
+	const cfg = await loadAdcFile();
+	const type = cfg.type ?? "authorized_user";
+	if (type === "authorized_user") {
+		cachedToken = await exchangeRefreshToken(cfg, signal);
+	} else if (type === "service_account") {
+		cachedToken = await exchangeServiceAccountJwt(cfg, signal);
+	} else {
+		throw new Error(`Gemini ADC unsupported credential type "${type}" (expected authorized_user or service_account)`);
+	}
+	return cachedToken.token;
+}
+
+export function isGeminiAdcAvailable(): boolean {
+	if (!isAdcAuthSelected()) return false;
+	// An explicitly configured Gemini API key takes precedence over ADC, so
+	// existing key-based setups and their unit tests keep working unchanged.
+	if (hasGeminiApiKeySource()) return false;
+	// An explicit base URL (gateway/relay/proxy) also wins over ADC: if the
+	// user deliberately routed Gemini somewhere, honor that routing.
+	if (hasExplicitApiBase()) return false;
+	if (!getAdcProject() || !getAdcLocation()) return false;
+	return existsSync(getAdcPath());
+}
+
+function hasGeminiApiKeySource(): boolean {
+	const configured = loadConfig().geminiApiKey;
+	if (typeof configured === "string" && configured.trim()) return true;
+	const fromEnv = process.env.GEMINI_API_KEY?.trim();
+	return !!fromEnv;
+}
+
+function hasExplicitApiBase(): boolean {
+	const fromEnv = process.env.GOOGLE_GEMINI_BASE_URL?.trim();
+	if (fromEnv) return true;
+	const configured = loadConfig().geminiBaseUrl;
+	return typeof configured === "string" && configured.trim().length > 0;
+}
+
+export function redactAdcToken(text: string): string {
+	return cachedToken ? redactCredential(text, cachedToken.token) : text;
+}