@bubblebrain-ai/bubble 0.0.63 → 0.0.65

package/dist/provider-error-record.js

@@ -0,0 +1,213 @@
+import { getCurrentVersion } from "./update/index.js";
+const MAX_FIELD_CHARS = 160;
+const RUNTIME_STARTED_AT = Date.now();
+const TRANSPORT_ERROR_CODES = new Set([
+    "UND_ERR_SOCKET", "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT",
+    "ECONNRESET", "ECONNREFUSED", "EPIPE", "ETIMEDOUT", "ENOTFOUND", "EAI_AGAIN",
+]);
+const SAFE_ERROR_CODES = new Map([
+    ["authentication_error", "authentication_error"],
+    ["bad_request", "bad_request"],
+    ["context_length_exceeded", "context_length_exceeded"],
+    ["failed_precondition", "failed_precondition"],
+    ["internal_error", "internal_error"],
+    ["invalid_argument", "invalid_argument"],
+    ["invalid_request_error", "invalid_request_error"],
+    ["invalidparameter", "invalid_parameter"],
+    ["invalid_parameter", "invalid_parameter"],
+    ["location_not_supported", "location_not_supported"],
+    ["permission_denied", "permission_denied"],
+    ["rate_limit_exceeded", "rate_limit_exceeded"],
+    ["rate_limit_exhausted", "rate_limit_exhausted"],
+    ["resource_exhausted", "resource_exhausted"],
+    ["service_unavailable", "service_unavailable"],
+    ["timeout", "timeout"],
+    ["unauthenticated", "unauthenticated"],
+    ["unsupported_parameter", "unsupported_parameter"],
+    ["unsupported_value", "unsupported_value"],
+    ...Array.from(TRANSPORT_ERROR_CODES, (code) => [code.toLowerCase(), code]),
+]);
+const SAFE_PARAMETER_NAMES = new Set([
+    "contents",
+    "frequency_penalty",
+    "generationConfig",
+    "input",
+    "max_output_tokens",
+    "max_tokens",
+    "messages",
+    "model",
+    "n",
+    "presence_penalty",
+    "prompt",
+    "reasoning_effort",
+    "response_format",
+    "seed",
+    "stop",
+    "stream",
+    "temperature",
+    "thinkingConfig",
+    "thinkingLevel",
+    "thinking_level",
+    "tool_choice",
+    "tools",
+    "topP",
+    "top_p",
+]);
+/**
+ * Build the allowlisted diagnostic record written to a session log.
+ *
+ * Deliberately do not serialize the original error object: SDK errors can
+ * contain request headers, request bodies, response bodies and stacks. Only
+ * scalar identifiers plus a locally-authored error category are retained.
+ */
+export function createSanitizedProviderError(error, context) {
+    const sources = errorSources(error);
+    const rawMessage = firstString(sources, ["message"])
+        || (typeof error === "string" ? error : "Provider request failed.");
+    const httpStatus = firstHttpStatus(sources);
+    // A wrapper's unknown code must not hide an allowlisted nested transport code.
+    const code = sources.flatMap((source) => ["code", "errorCode", "type"].map((key) => typeof source[key] === "string" ? sanitizeErrorCode(source[key]) : undefined)).find((value) => value !== undefined);
+    const parameter = sanitizeParameterName(firstScalarString(sources, ["param", "parameter"]));
+    return {
+        providerId: sanitizeControlledIdentifier(context.providerId),
+        modelId: sanitizeControlledIdentifier(context.modelId),
+        ...(context.model ? { model: sanitizeControlledIdentifier(context.model) } : {}),
+        thinkingLevel: context.thinkingLevel,
+        name: "ProviderError",
+        message: code && TRANSPORT_ERROR_CODES.has(code)
+            ? code.includes("TIMEOUT") || code === "ETIMEDOUT" ? "Provider request timed out." : "Provider connection failed."
+            : sanitizeProviderErrorText(rawMessage),
+        ...(httpStatus !== undefined ? { httpStatus } : {}),
+        ...(code ? { code } : {}),
+        ...(parameter ? { parameter } : {}),
+        messageCount: Math.max(0, Math.trunc(context.messageCount)),
+        toolCount: Math.max(0, Math.trunc(context.toolCount)),
+        ...sanitizedRequestShape(sources),
+        bubbleVersion: getCurrentVersion(),
+        pid: process.pid,
+        runtimeStartedAt: RUNTIME_STARTED_AT,
+        ...(context.retry ? { retry: {
+                attempt: context.retry.attempt,
+                maxAttempts: context.retry.maxAttempts,
+            } } : {}),
+    };
+}
+function sanitizedRequestShape(sources) {
+    const raw = sources.find(source => asRecord(source.requestShape))?.requestShape;
+    const shape = asRecord(raw);
+    if (!shape)
+        return {};
+    const safe = {};
+    for (const key of ["messages", "tools", "assistant", "emptyAssistant", "reasoning", "toolCalls", "toolResults", "contentChars"]) {
+        const value = shape[key];
+        if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0)
+            safe[key] = value;
+    }
+    return { requestShape: safe };
+}
+export function sanitizeProviderErrorText(value) {
+    const text = value.replace(/[\r\n\t]+/g, " ").replace(/\s{2,}/g, " ").trim();
+    // Fail closed: provider/SDK messages can embed request headers, bodies,
+    // prompts, URLs or credentials in formats a denylist cannot anticipate.
+    // Persist only fixed, locally-authored summaries selected by broad error
+    // categories; never return any substring copied from the provider message.
+    if (/user location (?:is )?not supported|location[^.]{0,40}(?:unsupported|not supported)/i.test(text)) {
+        return "User location is not supported for API use.";
+    }
+    if (/context[_ -]?(?:length|window)|prompt (?:is )?too long|maximum context|token limit/i.test(text)) {
+        return "Provider context limit was exceeded.";
+    }
+    if (/rate limit|too many requests|quota|resource exhausted|\b429\b/i.test(text)) {
+        return "Provider rate limit was exceeded.";
+    }
+    if (/unauthori[sz]ed|authentication|invalid (?:api )?key|missing (?:api )?key|\b401\b/i.test(text)) {
+        return "Provider authentication failed.";
+    }
+    if (/forbidden|permission denied|access denied|\b403\b/i.test(text)) {
+        return "Provider denied the request.";
+    }
+    if (/unprocessable entity|\b422\b/i.test(text)) {
+        return "Provider rejected the request (unprocessable entity).";
+    }
+    if (/invalid[^.]{0,60}(?:parameter|argument)|unsupported[^.]{0,60}(?:parameter|argument)|bad request|\b400\b/i.test(text)) {
+        return "Provider rejected a request parameter.";
+    }
+    if (/timed? ?out|timeout/i.test(text)) {
+        return "Provider request timed out.";
+    }
+    if (/network|connection|socket|fetch failed|stream (?:closed|interrupted)/i.test(text)) {
+        return "Provider connection failed.";
+    }
+    if (/abort|cancel/i.test(text)) {
+        return "Provider request was cancelled.";
+    }
+    return "Provider request failed.";
+}
+function errorSources(error) {
+    const sources = [];
+    const pending = [error];
+    const seen = new Set();
+    while (pending.length && sources.length < 12) {
+        const source = asRecord(pending.shift());
+        if (!source || seen.has(source))
+            continue;
+        seen.add(source);
+        sources.push(source);
+        pending.push(source.error, source.cause);
+    }
+    return sources;
+}
+function asRecord(value) {
+    return value !== null && (typeof value === "object" || typeof value === "function")
+        ? value
+        : undefined;
+}
+function firstString(sources, keys) {
+    for (const source of sources) {
+        for (const key of keys) {
+            const value = source[key];
+            if (typeof value === "string" && value.trim())
+                return value.trim();
+        }
+    }
+    return undefined;
+}
+function firstScalarString(sources, keys) {
+    for (const source of sources) {
+        for (const key of keys) {
+            const value = source[key];
+            if ((typeof value === "string" || typeof value === "number") && String(value).trim()) {
+                return String(value).trim();
+            }
+        }
+    }
+    return undefined;
+}
+function firstHttpStatus(sources) {
+    for (const source of sources) {
+        for (const key of ["status", "statusCode", "httpStatus"]) {
+            const value = source[key];
+            const numeric = typeof value === "number" ? value : Number(value);
+            if (Number.isInteger(numeric) && numeric >= 100 && numeric <= 599)
+                return numeric;
+        }
+    }
+    return undefined;
+}
+function sanitizeControlledIdentifier(value) {
+    const normalized = value.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/.test(normalized))
+        return "unknown";
+    return normalized.slice(0, MAX_FIELD_CHARS);
+}
+function sanitizeErrorCode(value) {
+    if (!value)
+        return undefined;
+    return SAFE_ERROR_CODES.get(value.trim().toLowerCase());
+}
+function sanitizeParameterName(value) {
+    if (!value)
+        return undefined;
+    const normalized = value.trim();
+    return SAFE_PARAMETER_NAMES.has(normalized) ? normalized : undefined;
+}

package/dist/provider-grok.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Grok subscription provider support.
+ *
+ * The CLI chat proxy (cli-chat-proxy.grok.com) speaks the OpenAI
+ * chat-completions protocol, so the generic OpenAI provider does the heavy
+ * lifting. This module supplies the two Grok-specific pieces: the client
+ * identity headers the proxy gates on, and a fetch wrapper that keeps the
+ * OAuth bearer fresh across long sessions.
+ */
+import type { OAuthCredentials } from "./oauth/types.js";
+import { type ChatGptFetch } from "./network/chatgpt-transport.js";
+import { type ThinkingLevel } from "./types.js";
+export declare const GROK_SUBSCRIPTION_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+export declare const GROK_CLIENT_VERSION = "0.2.93";
+export declare function isGrokSubscriptionBaseUrl(baseURL: string): boolean;
+export declare function buildGrokSubscriptionHeaders(): Record<string, string>;
+export interface GrokAuthAdapter {
+    getCredentials: () => OAuthCredentials | undefined | Promise<OAuthCredentials | undefined>;
+    refreshCredentials: (current?: OAuthCredentials) => Promise<OAuthCredentials>;
+    isExpired?: (credentials: OAuthCredentials, graceMs: number) => boolean;
+}
+/**
+ * Wrap a fetch so every request carries a fresh subscription bearer. The
+ * OpenAI client's static apiKey would go stale after ~6h; this reads (and
+ * proactively refreshes) the stored OAuth credentials per request instead.
+ */
+export declare function createGrokSubscriptionFetch(auth: GrokAuthAdapter, baseFetch?: ChatGptFetch): ChatGptFetch;
+export interface GrokModelDescriptor {
+    id: string;
+    name?: string;
+    /** Server-declared context window (the /models `context_window` field). */
+    contextWindow?: number;
+    /** Server-declared reasoning effort ladder, sorted ascending. */
+    reasoningEfforts?: ThinkingLevel[];
+    /** Server-declared default effort (the /models `reasoning_effort` field). */
+    defaultReasoningEffort?: ThinkingLevel;
+}
+/**
+ * Fetch the model list for a Grok subscription account. The CLI chat proxy
+ * gates on the grok-cli identity headers plus a fresh OAuth bearer, so this
+ * rides the same refreshing fetch used for chat requests instead of a raw
+ * global fetch. The /models payload carries richer metadata than id+name —
+ * `context_window`, `reasoning_efforts`, and the default `reasoning_effort` —
+ * which this surfaces so discovery can stop inferring them. Throws on a
+ * non-2xx so callers fall back to the curated catalog.
+ */
+export declare function fetchGrokSubscriptionModels(baseURL: string, auth: GrokAuthAdapter, options?: {
+    timeoutMs?: number;
+    fetch?: ChatGptFetch;
+}): Promise<GrokModelDescriptor[]>;

package/dist/provider-grok.js

@@ -0,0 +1,110 @@
+/**
+ * Grok subscription provider support.
+ *
+ * The CLI chat proxy (cli-chat-proxy.grok.com) speaks the OpenAI
+ * chat-completions protocol, so the generic OpenAI provider does the heavy
+ * lifting. This module supplies the two Grok-specific pieces: the client
+ * identity headers the proxy gates on, and a fetch wrapper that keeps the
+ * OAuth bearer fresh across long sessions.
+ */
+import { waitForOAuth } from "./oauth/refresh-control.js";
+import { getChatGptFetch } from "./network/chatgpt-transport.js";
+import { THINKING_LEVELS } from "./types.js";
+export const GROK_SUBSCRIPTION_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+// The proxy rejects requests below a minimum client version; identify as the
+// same pinned CLI build Bubble verifies elsewhere.
+export const GROK_CLIENT_VERSION = "0.2.93";
+const TOKEN_REFRESH_GRACE_MS = 5 * 60 * 1000;
+export function isGrokSubscriptionBaseUrl(baseURL) {
+    const normalized = baseURL.trim().replace(/\/+$/, "");
+    return normalized === GROK_SUBSCRIPTION_BASE_URL || normalized.startsWith(`${GROK_SUBSCRIPTION_BASE_URL}/`);
+}
+export function buildGrokSubscriptionHeaders() {
+    return {
+        "User-Agent": "grok-cli",
+        "x-grok-client-version": GROK_CLIENT_VERSION,
+    };
+}
+/**
+ * Wrap a fetch so every request carries a fresh subscription bearer. The
+ * OpenAI client's static apiKey would go stale after ~6h; this reads (and
+ * proactively refreshes) the stored OAuth credentials per request instead.
+ */
+export function createGrokSubscriptionFetch(auth, baseFetch = getChatGptFetch()) {
+    let refreshPromise;
+    async function freshAccessToken() {
+        let credentials = await auth.getCredentials();
+        if (!credentials)
+            return undefined;
+        const expired = auth.isExpired
+            ? auth.isExpired(credentials, TOKEN_REFRESH_GRACE_MS)
+            : Date.now() >= credentials.expiresAt - TOKEN_REFRESH_GRACE_MS;
+        if ((expired || !credentials.accessToken) && credentials.refreshToken) {
+            if (!refreshPromise) {
+                refreshPromise = auth.refreshCredentials(credentials).finally(() => {
+                    refreshPromise = undefined;
+                });
+            }
+            credentials = await refreshPromise;
+        }
+        return credentials.accessToken || undefined;
+    }
+    return async (input, init) => {
+        const signal = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+        signal?.throwIfAborted();
+        const token = await waitForOAuth(freshAccessToken(), signal);
+        signal?.throwIfAborted();
+        if (!token) {
+            return baseFetch(input, init);
+        }
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${token}`);
+        return baseFetch(input, { ...(init ?? {}), headers });
+    };
+}
+/**
+ * Fetch the model list for a Grok subscription account. The CLI chat proxy
+ * gates on the grok-cli identity headers plus a fresh OAuth bearer, so this
+ * rides the same refreshing fetch used for chat requests instead of a raw
+ * global fetch. The /models payload carries richer metadata than id+name —
+ * `context_window`, `reasoning_efforts`, and the default `reasoning_effort` —
+ * which this surfaces so discovery can stop inferring them. Throws on a
+ * non-2xx so callers fall back to the curated catalog.
+ */
+export async function fetchGrokSubscriptionModels(baseURL, auth, options = {}) {
+    const fetchImpl = createGrokSubscriptionFetch(auth, options.fetch);
+    const base = baseURL.trim().replace(/\/+$/, "");
+    const response = await fetchImpl(`${base}/models`, {
+        headers: buildGrokSubscriptionHeaders(),
+        signal: AbortSignal.timeout(options.timeoutMs ?? 5_000),
+    });
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status}`);
+    const payload = (await response.json());
+    const entries = payload.data ?? payload.models ?? [];
+    return entries
+        .filter((entry) => typeof entry?.id === "string" && entry.id.trim().length > 0)
+        .map((entry) => {
+        const id = entry.id;
+        const rawEfforts = Array.isArray(entry.reasoning_efforts) ? entry.reasoning_efforts : [];
+        const reasoningEfforts = rawEfforts
+            .map((effort) => (effort && typeof effort === "object" && typeof effort.value === "string"
+            ? effort.value
+            : undefined))
+            .filter((value) => typeof value === "string" && THINKING_LEVELS.includes(value))
+            .sort((a, b) => THINKING_LEVELS.indexOf(a) - THINKING_LEVELS.indexOf(b));
+        const defaultReasoningEffort = typeof entry.reasoning_effort === "string"
+            && THINKING_LEVELS.includes(entry.reasoning_effort)
+            ? entry.reasoning_effort
+            : undefined;
+        return {
+            id,
+            name: typeof entry.name === "string" ? entry.name : undefined,
+            contextWindow: typeof entry.context_window === "number" && entry.context_window > 0
+                ? entry.context_window
+                : undefined,
+            reasoningEfforts: reasoningEfforts.length > 0 ? reasoningEfforts : undefined,
+            defaultReasoningEffort,
+        };
+    });
+}

package/dist/provider-model-policy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Stable provider-level model constraints.
+ *
+ * Catalog discovery describes what a provider currently lists; it is not a
+ * runtime security boundary. A fixed policy is different: Bubble deliberately
+ * exposes and permits exactly one model for that provider, across every host
+ * and caller (TUI, CLI, SDK, Feishu, parent agents, and subagents).
+ */
+export declare const OPENROUTER_MODEL_ID = "stealth/ox-alpha";
+export declare function getFixedProviderModelId(providerId: string): string | undefined;
+export declare function isProviderModelAllowed(providerId: string, modelId: string): boolean;
+export declare function providerModelPolicyError(providerId: string, modelId: string): string | undefined;
+export declare function assertProviderModelAllowed(providerId: string, modelId: string): void;
+export declare function filterProviderModels<T extends {
+    id: string;
+}>(providerId: string, models: readonly T[]): T[];

package/dist/provider-model-policy.js

@@ -0,0 +1,33 @@
+/**
+ * Stable provider-level model constraints.
+ *
+ * Catalog discovery describes what a provider currently lists; it is not a
+ * runtime security boundary. A fixed policy is different: Bubble deliberately
+ * exposes and permits exactly one model for that provider, across every host
+ * and caller (TUI, CLI, SDK, Feishu, parent agents, and subagents).
+ */
+export const OPENROUTER_MODEL_ID = "stealth/ox-alpha";
+const FIXED_PROVIDER_MODELS = {
+    openrouter: OPENROUTER_MODEL_ID,
+};
+export function getFixedProviderModelId(providerId) {
+    return FIXED_PROVIDER_MODELS[providerId.toLowerCase()];
+}
+export function isProviderModelAllowed(providerId, modelId) {
+    const fixedModelId = getFixedProviderModelId(providerId);
+    return !fixedModelId || modelId === fixedModelId;
+}
+export function providerModelPolicyError(providerId, modelId) {
+    const fixedModelId = getFixedProviderModelId(providerId);
+    if (!fixedModelId || modelId === fixedModelId)
+        return undefined;
+    return `Provider "${providerId}" is fixed to model "${fixedModelId}"; received "${modelId}".`;
+}
+export function assertProviderModelAllowed(providerId, modelId) {
+    const error = providerModelPolicyError(providerId, modelId);
+    if (error)
+        throw new Error(error);
+}
+export function filterProviderModels(providerId, models) {
+    return models.filter((model) => isProviderModelAllowed(providerId, model.id));
+}

package/dist/provider-openai-codex.d.ts

@@ -0,0 +1,66 @@
+import { type Provider, type ReasoningEffort, type ThinkingLevel, type TokenUsage } from "./types.js";
+import type { OAuthCredentials } from "./oauth/types.js";
+import { type ChatGptFetch } from "./network/chatgpt-transport.js";
+export interface CodexModelDescriptor {
+    id: string;
+    displayName?: string;
+    contextWindow?: number;
+    useResponsesLite?: boolean;
+    reasoningLevels?: ReasoningEffort[];
+    defaultReasoningLevel?: ReasoningEffort;
+    priority?: number;
+    visibility?: string;
+    minimalClientVersion?: string;
+    /** Server-declared per-tool-output token cap (truncation_policy.limit when mode=tokens). */
+    toolOutputTokenLimit?: number;
+}
+/** The Codex client version Bubble claims; the account catalog the server returns depends on it. */
+export declare function getCodexClientVersion(): string;
+export declare function isOpenAICodexBaseUrl(baseURL: string): boolean;
+export declare function getOpenAICodexFallbackModels(): string[];
+export interface OpenAICodexAuthAdapter {
+    getCredentials: () => OAuthCredentials | undefined | Promise<OAuthCredentials | undefined>;
+    refreshCredentials: (current?: OAuthCredentials) => Promise<OAuthCredentials>;
+    isExpired?: (credentials: OAuthCredentials, graceMs: number) => boolean;
+}
+export declare function extractChatGptAccountId(accessToken: string): string | undefined;
+export declare function createOpenAICodexProvider(options: {
+    providerId?: string;
+    apiKey: string;
+    baseURL: string;
+    thinkingLevel?: ThinkingLevel;
+    promptCacheKey?: string;
+    auth?: OpenAICodexAuthAdapter;
+    fetch?: ChatGptFetch;
+}): Provider;
+export declare function normalizeOpenAICodexUsage(usage: any): TokenUsage;
+export declare function buildOpenAICodexPromptCacheKey(input: {
+    seed?: string;
+    providerId?: string;
+    model: string;
+}): string | undefined;
+export declare function fetchOpenAICodexModels(options: {
+    baseURL: string;
+    accessToken: string;
+    fetch?: ChatGptFetch;
+}): Promise<CodexModelDescriptor[]>;
+export interface OpenAICodexModelCatalogResult {
+    descriptors: CodexModelDescriptor[];
+    status: "success" | "unavailable";
+    /** Why each discovery path failed, when status is "unavailable". */
+    reason?: string;
+}
+/**
+ * Fetches the account-scoped Codex catalog while preserving the distinction
+ * between an authoritative empty catalog and discovery being unavailable.
+ */
+export declare function fetchOpenAICodexModelCatalog(options: {
+    baseURL: string;
+    accessToken: string;
+    fetch?: ChatGptFetch;
+    /** Bounds both catalog GETs; a stalled warm-up must not pin the in-flight slot. */
+    signal?: AbortSignal;
+    /** Per-request timeout, so a slow first path still leaves the fallback a full window. */
+    timeoutMs?: number;
+}): Promise<OpenAICodexModelCatalogResult>;
+export declare function sortCodexModelDescriptors(descriptors: CodexModelDescriptor[]): CodexModelDescriptor[];