@botconnector/bccli 0.5.0-rc.4 → 0.5.1

package/proxy.mjs

@@ -1,242 +0,0 @@
-import { randomBytes, timingSafeEqual } from 'node:crypto'
-import { createServer } from 'node:http'
-import { GATEWAY } from './gateway.mjs'
-import { ALLOWED_PROVIDER_ENDPOINTS } from './providers.mjs'
-
-// This proxy lives only for one Qwen Code session. Real provider keys remain in
-// the launcher process; MCP and bash subprocesses can see only a short-lived
-// local bearer token. The proxy cannot be redirected to arbitrary hosts.
-const ALLOWED_PATHS = new Set(['/v1/models', '/v1/chat/completions', '/v1/responses'])
-const MAX_REQUEST_BYTES = 16 * 1024 * 1024
-
-// Qwen 0.26.3 produces get_goal without parameters and read_file with
-// optional JSON-schema type unions such as ["integer", "null"]. Strict
-// OpenAI-compatible providers reject both formats while parsing tools.
-// Normalize only the incompatible pieces, preserving all coding tools.
-function normalizeOptionalNullableSchema(schema) {
-  if (!schema || typeof schema !== 'object' || Array.isArray(schema)) return schema
-  let out = schema
-  if (schema.properties && typeof schema.properties === 'object' && !Array.isArray(schema.properties)) {
-    const required = new Set(Array.isArray(schema.required) ? schema.required : [])
-    let properties = schema.properties
-    for (const [name, field] of Object.entries(schema.properties)) {
-      if (!field || typeof field !== 'object' || Array.isArray(field)) continue
-      let candidate = field
-      // The optional absence of a field already represents null; dropping
-      // "null" from this one optional JSON-Schema union is safe. Do not rewrite
-      // required nullable fields or multi-type unions (fail closed upstream).
-      if (!required.has(name) && Array.isArray(field.type) && field.type.length === 2
-        && field.type.includes('null')) {
-        const primitive = field.type.find((type) => type !== 'null')
-        if (['string', 'number', 'integer', 'boolean', 'object', 'array'].includes(primitive)) {
-          candidate = { ...field, type: primitive }
-        }
-      }
-      candidate = normalizeOptionalNullableSchema(candidate)
-      if (candidate !== field) {
-        if (properties === schema.properties) properties = { ...properties }
-        properties[name] = candidate
-      }
-    }
-    if (properties !== schema.properties) out = { ...out, properties }
-  }
-  if (schema.items && typeof schema.items === 'object' && !Array.isArray(schema.items)) {
-    const items = normalizeOptionalNullableSchema(schema.items)
-    if (items !== schema.items) out = { ...out, items }
-  }
-  return out
-}
-
-export function normalizeZeroArgFunctionTools(requestBody) {
-  if (!requestBody || typeof requestBody !== 'object' || !Array.isArray(requestBody.tools)) return requestBody
-  let changed = false
-  const tools = requestBody.tools.map((tool) => {
-    const fn = tool?.type === 'function' ? tool.function : null
-    if (!fn || typeof fn.name !== 'string') return tool
-    const parameters = fn.parameters == null
-      ? { type: 'object', properties: {} }
-      : normalizeOptionalNullableSchema(fn.parameters)
-    if (parameters === fn.parameters) return tool
-    changed = true
-    return { ...tool, function: { ...fn, parameters } }
-  })
-  return changed ? { ...requestBody, tools } : requestBody
-}
-
-// The model can be switched with /model without restarting the coding agent.
-// Annotate each request with the ACTUAL model chosen by Qwen Config, rather
-// than retaining a stale --append-system-prompt model from CLI startup.
-export function attachRuntimeModelContext(payload) {
-  if (!payload || typeof payload !== 'object' || !Array.isArray(payload.messages)) return payload
-  const model = payload.model
-  if (typeof model !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._:/+-]{0,255}$/.test(model)) return payload
-  const index = payload.messages.findIndex(item => item?.role === 'system' && typeof item.content === 'string')
-  if (index === -1) return payload
-  const runtime = '\n\nRuntime metadata (not model instructions): active_model_id=' + model + '; client_app=BCCLI; transport=local-proxy.'
-  const messages = [...payload.messages]
-  messages[index] = { ...messages[index], content: messages[index].content + runtime }
-  return { ...payload, messages }
-}
-
-// Qwen 0.26.3 sends max_tokens=64000 for many model IDs. Several Gateway
-// upstream routes reject that value (e.g. GLM Flash). Bound the requested
-// output conservatively for coding-agent interoperability; never increase it.
-// This does not change the context window or input-token budget.
-const DEFAULT_OUTPUT_TOKEN_CEILING = 4096
-export function boundChatOutputTokens(payload) {
-  if (!payload || typeof payload !== 'object') return payload
-  const legacy = payload.max_tokens
-  const modern = payload.max_completion_tokens
-  const valid = (value) => Number.isInteger(value) && value > 0
-
-  // Real Gateway's exact Kimi route rejects legacy max_tokens. Keep parity
-  // with PAYG validation for positive decimal numeric strings, without
-  // changing the output-ceiling policy for any other model.
-  if (payload.model === 'kimi-k2.7-code') {
-    const parsed = (value) => {
-      if (typeof value !== 'number' && !(typeof value === 'string' && /^[0-9]+$/.test(value))) return null
-      const n = Number(value)
-      return Number.isSafeInteger(n) && n > 0 ? n : null
-    }
-    const legacyValue = parsed(legacy)
-    const modernValue = parsed(modern)
-    if (legacyValue != null) {
-      const requested = modernValue != null ? Math.min(legacyValue, modernValue) : legacyValue
-      const { max_tokens: _ignored, ...rest } = payload
-      return { ...rest, max_completion_tokens: Math.min(requested, DEFAULT_OUTPUT_TOKEN_CEILING) }
-    }
-    if (modernValue != null && (typeof modern !== 'number' || modernValue > DEFAULT_OUTPUT_TOKEN_CEILING)) {
-      return { ...payload, max_completion_tokens: Math.min(modernValue, DEFAULT_OUTPUT_TOKEN_CEILING) }
-    }
-  }
-  if (valid(legacy) && legacy > DEFAULT_OUTPUT_TOKEN_CEILING) {
-    return { ...payload, max_tokens: DEFAULT_OUTPUT_TOKEN_CEILING }
-  }
-  if (valid(modern) && modern > DEFAULT_OUTPUT_TOKEN_CEILING) {
-    return { ...payload, max_completion_tokens: DEFAULT_OUTPUT_TOKEN_CEILING }
-  }
-  return payload
-}
-
-function waitForDrainOrClose(res) {
-  if (res.destroyed) return Promise.resolve()
-  return new Promise((resolve) => {
-    const done = () => {
-      res.off('drain', done)
-      res.off('close', done)
-      resolve()
-    }
-    res.once('drain', done)
-    res.once('close', done)
-  })
-}
-
-function matchesToken(auth, token) {
-  if (typeof auth !== 'string') return false
-  const actual = Buffer.from(auth)
-  const expected = Buffer.from('Bearer ' + token)
-  return actual.length === expected.length && timingSafeEqual(actual, expected)
-}
-
-export async function startGatewayProxy({ key, endpoint = GATEWAY, token = randomBytes(32).toString('hex'), fetchImpl = fetch } = {}) {
-  if (!ALLOWED_PROVIDER_ENDPOINTS.includes(endpoint)) throw Error('Unapproved provider endpoint; local proxy refused to start.')
-  if (typeof key !== 'string' || !key.trim()) throw Error('Gateway key is required for local proxy.')
-  if (typeof token !== 'string' || token.length < 6 || token === key) throw Error('Invalid or non-isolated proxy token.')
-
-  const server = createServer(async (req, res) => {
-    const fail = (status, body) => {
-      if (res.headersSent || res.destroyed) return
-      res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' })
-      res.end(JSON.stringify({ error: body }))
-    }
-
-    if (!matchesToken(req.headers.authorization, token)) {
-      fail(401, 'Local session token is required.')
-      return
-    }
-    if (!ALLOWED_PATHS.has(req.url ?? '')) {
-      fail(404, 'Unsupported local gateway route.')
-      return
-    }
-    const method = req.url === '/v1/models' ? 'GET' : 'POST'
-    if (req.method !== method) {
-      fail(405, 'Unsupported request method.')
-      return
-    }
-    if (req.headers['content-length'] && Number(req.headers['content-length']) > MAX_REQUEST_BYTES) {
-      fail(413, 'Request too large.')
-      return
-    }
-
-    const abort = new AbortController()
-    const onClose = () => { if (!res.writableEnded) abort.abort() }
-    res.once('close', onClose)
-    try {
-      let body
-      if (method === 'POST') {
-        const buffers = []
-        let bytes = 0
-        for await (const chunk of req) {
-          bytes += chunk.length
-          if (bytes > MAX_REQUEST_BYTES) {
-            fail(413, 'Request too large.')
-            return
-          }
-          buffers.push(chunk)
-        }
-        body = Buffer.concat(buffers)
-        if (req.url === '/v1/chat/completions') {
-          let parsed
-          try { parsed = JSON.parse(body.toString('utf8')) }
-          catch { fail(400, 'Invalid JSON request.'); return }
-          const normalized = boundChatOutputTokens(attachRuntimeModelContext(normalizeZeroArgFunctionTools(parsed)))
-          if (normalized !== parsed) body = Buffer.from(JSON.stringify(normalized))
-        }
-      }
-      const upstream = await fetchImpl(endpoint + req.url.slice(3), {
-        method,
-        headers: {
-          authorization: 'Bearer ' + key,
-          accept: 'application/json, text/event-stream',
-          ...(method === 'POST' ? { 'content-type': 'application/json' } : {}),
-        },
-        body,
-        redirect: 'error',
-        signal: abort.signal,
-      })
-      res.writeHead(upstream.status, {
-        'content-type': upstream.headers.get('content-type') ?? 'application/json',
-        'cache-control': 'no-store',
-      })
-      if (upstream.body) {
-        for await (const chunk of upstream.body) {
-          if (res.destroyed) break
-          if (!res.write(chunk)) await waitForDrainOrClose(res)
-        }
-      }
-      res.end()
-    } catch {
-      if (res.headersSent) res.destroy()
-      else fail(502, 'Provider connection failed.')
-    } finally {
-      res.off('close', onClose)
-    }
-  })
-
-  await new Promise((resolve, reject) => {
-    const onError = (error) => { server.off('listening', onListening); reject(error) }
-    const onListening = () => { server.off('error', onError); resolve() }
-    server.once('error', onError)
-    server.once('listening', onListening)
-    server.listen(0, '127.0.0.1')
-  })
-  const port = server.address()?.port
-  return {
-    token,
-    baseUrl: 'http://127.0.0.1:' + port + '/v1',
-    async close() {
-      server.closeAllConnections()
-      await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()))
-    },
-  }
-}

package/startup-menu.mjs

@@ -1,120 +0,0 @@
-// In-terminal BCCLI first-run / provider-switch menu.
-// This runs in the parent process BEFORE the coding agent is launched; real
-// API keys never enter Qwen's process or any coding/MCP subprocess.
-import { createInterface } from 'node:readline/promises'
-import { PROVIDERS, isConfigured, resolveProvider, selectedProvider, selectedModel, saveSelectedModel, saveProviderKey, useProvider } from './providers.mjs'
-import { hiddenApiKey } from './provider-cli.mjs'
-import { DEFAULT_MODEL, discoverModels, selectModel } from './core.mjs'
-
-export const PROVIDER_SWITCH_EXIT = 51
-
-// Returning users go straight to chat with the selected provider and model.
-// Eligibility is still verified against the live provider's available models.
-export async function autoSelectStartup({
-  providerId = selectedProvider(),
-  configured = isConfigured,
-  remembered = selectedModel,
-  resolve = resolveProvider,
-  list = discoverModels,
-  defaultModel = DEFAULT_MODEL,
-  env = process.env,
-} = {}) {
-  if (!configured(providerId)) return undefined
-  const requested = providerId === 'botconnector'
-    ? (env.BOTCONNECTOR_MODEL_ID || remembered(providerId) || defaultModel)
-    : remembered(providerId)
-  if (!requested) return undefined
-  const profile = resolve(providerId)
-  const models = await list({ key: profile.key, endpoint: profile.endpoint })
-  if (!models.some(item => item.id === requested)) return undefined
-  return { providerId, model: selectModel(models, requested), key: profile.key, endpoint: profile.endpoint }
-}
-
-export async function terminalQuestion(label, { input = process.stdin, output = process.stdout } = {}) {
-  const rl = createInterface({ input, output, terminal: !!input.isTTY })
-  try { return (await rl.question(label)).trim() }
-  finally { rl.close() }
-}
-
-function selectedName(answer, choices, defaultValue) {
-  if (!answer) return defaultValue
-  const clean = answer.replace(/!$/, '').trim().toLowerCase()
-  if (/^[0-9]+$/.test(clean)) return choices[Number(clean) - 1]
-  return choices.includes(clean) ? clean : undefined
-}
-
-export async function startupMenu({
-  ask = terminalQuestion,
-  askSecret = hiddenApiKey,
-  out = value => console.log(value),
-  currentProvider = selectedProvider,
-  configured = isConfigured,
-  saveKey = saveProviderKey,
-  use = useProvider,
-  remembered = selectedModel,
-  saveModel = saveSelectedModel,
-  resolve = resolveProvider,
-  list = discoverModels,
-  defaultModel = DEFAULT_MODEL,
-} = {}) {
-  const ids = Object.keys(PROVIDERS)
-  const active = currentProvider()
-  out('')
-  out('BCCLI  |  Provider dan model')
-  out('Pilih provider. Masukkan tanda ! setelah angka untuk mengganti API key yang sudah tersimpan.')
-  ids.forEach((id, idx) => {
-    out('  ' + (idx + 1) + '. ' + PROVIDERS[id].name +
-      (configured(id) ? '  [key tersedia]' : '  [perlu API key]') +
-      (id === active ? '  [aktif]' : ''))
-  })
-  let providerId
-  let replace
-  for (;;) {
-    const value = await ask('Provider (angka/nama; Enter = aktif; Ctrl+C untuk batal): ')
-    providerId = selectedName(value, ids, active)
-    if (!providerId) { out('Pilihan provider tidak dikenal.'); continue }
-    replace = value.endsWith('!')
-    if (providerId === 'botconnector' && replace) {
-      out('Gunakan bccli-legacy login bc-cloud untuk mengubah key BotConnector lama; key tidak akan diubah dari menu ini.')
-      continue
-    }
-    break
-  }
-  if ((replace || !configured(providerId)) && providerId !== 'botconnector') {
-    out('Masukkan API key ' + PROVIDERS[providerId].name + ' (input tersembunyi).')
-    const key = await askSecret()
-    // A cancel or missing key cannot silently select an unusable provider.
-    if (!key) throw Error('Tidak ada API key; provider tidak diubah.')
-    saveKey(providerId, key)
-    out('API key disimpan terlindungi untuk akun Windows. Tidak ada request AI.')
-  }
-  if (!configured(providerId)) throw Error('Provider ' + providerId + ' belum memiliki API key. Tidak ada permintaan AI.')
-  const profile = resolve(providerId)
-  const models = await list({ key: profile.key, endpoint: profile.endpoint })
-  if (!models.length) throw Error('Tidak ada model untuk provider ini.')
-  const all = [...models].sort((a, b) => a.id.localeCompare(b.id))
-  const previous = remembered(providerId)
-  const preferred = all.some(m => m.id === previous) ? previous :
-    providerId === 'botconnector' && all.some(m => m.id === defaultModel) ? defaultModel : undefined
-  let filtered = all
-  for (;;) {
-    out('')
-    out('Model ' + PROVIDERS[providerId].name + ' (' + filtered.length + ' dari ' + all.length + ' model):')
-    filtered.slice(0, 14).forEach((m, i) => out('  ' + (i + 1) + '. ' + m.id + (m.id === preferred ? '  [default]' : '')))
-    if (filtered.length > 14) out('  ... ketik ?kata untuk mencari model.')
-    const value = await ask('Model (nomor/ID/?cari' + (preferred ? '/Enter = ' + preferred : '') + '): ')
-    if (value.startsWith('?')) {
-      const term = value.slice(1).trim().toLowerCase()
-      filtered = term ? all.filter(m => m.id.toLowerCase().includes(term) || m.name?.toLowerCase().includes(term)) : all
-      if (!filtered.length) { out('Tidak ada model yang cocok.'); filtered = all }
-      continue
-    }
-    const candidate = !value ? preferred : /^[0-9]+$/.test(value) ? filtered[Number(value) - 1]?.id : value
-    if (!candidate || !all.some(m => m.id === candidate)) { out('Pilih nomor atau ID model yang tampil.'); continue }
-    selectModel(all, candidate)
-    // Save active provider only after valid credentials and model are confirmed.
-    use(providerId)
-    saveModel(providerId, candidate)
-    return { providerId, model: candidate, key: profile.key, endpoint: profile.endpoint }
-  }
-}