@chatcode/cco-llm-chatcode-config 0.1.0

package/vendor/dsh-llm-pi-ai/tests/loader-composition.spec.ts

@@ -0,0 +1,244 @@
+/**
+ * Real-composition guard for the dormant pi-ai posture: LlmRuntime,
+ * settings-file, credentials-local, and a bare `llm-pi-ai` row boot from a
+ * test-only cordis.yml through the actual Loader + Include path, an external
+ * edit of settings.yaml registers the route live, and the next request
+ * carries the credential the credentials document supplies. A hand-mounted `ctx.plugin` cannot
+ * catch Loader export-shape failures, which is why the twin adapter has the
+ * same guard.
+ */
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import Loader from '@deepseek-ai/cordis-plugin-loader'
+import Include from '@deepseek-ai/cordis-plugin-include'
+import LlmRuntime, { createMessage, createUserMessage } from '@deepseek-ai/dsh-llm'
+import LocalCredentialProvider from '@deepseek-ai/dsh-credentials-local'
+import FileSettingsProvider from '@deepseek-ai/dsh-settings-file'
+import * as LlmPiAi from '@deepseek-ai/dsh-llm-pi-ai'
+import { assemble } from './assemble.ts'
+import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
+
+/** One text block, then a tool call truncated by the output-token ceiling. */
+const truncatedToolCallEvents = [
+  '{"choices":[{"delta":{"role":"assistant","content":""},"index":0,"finish_reason":null}]}',
+  '{"choices":[{"delta":{"content":"partial"},"index":0,"finish_reason":null}]}',
+  '{"choices":[{"delta":{"tool_calls":[{"index":0,"id":"call-1","type":"function","function":{"name":"echo","arguments":"{\\"text\\":"}}]},"index":0,"finish_reason":null}]}',
+  '{"choices":[{"delta":{},"index":0,"finish_reason":"length"}],"usage":{"prompt_tokens":3,"completion_tokens":4}}',
+  '[DONE]',
+]
+
+let root: string | undefined
+let context: Context | undefined
+
+afterEach(async () => {
+  await context?.fiber.dispose()
+  context = undefined
+  if (root !== undefined) await rm(root, { recursive: true, force: true })
+  root = undefined
+  await closeMockServers()
+  vi.unstubAllEnvs()
+})
+
+/** Boot the dormant composition: a bare `llm-pi-ai` row with no config at all. */
+async function loadComposition(): Promise<{ ctx: Context; settingsPath: string }> {
+  root = await mkdtemp(join(tmpdir(), 'dsh-pi-composition-'))
+  const settingsPath = join(root, 'settings.yaml')
+  await writeFile(settingsPath, '# personal settings\n')
+  await writeFile(join(root, '.credentials.yaml'), 'version: 1\nrefs:\n  PI_COMPOSITION_KEY: key-from-store\n', { mode: 0o600 })
+
+  const configPath = join(root, 'cordis.yml')
+  await writeFile(configPath, [
+    '- id: llm',
+    "  name: 'test-llm-service'",
+    '- id: settings',
+    "  name: '@deepseek-ai/dsh-settings-file'",
+    '  config:',
+    `    path: ${JSON.stringify(settingsPath)}`,
+    '    debounceMs: 10',
+    '- id: credentials',
+    "  name: '@deepseek-ai/dsh-credentials-local'",
+    '  config:',
+    `    path: ${JSON.stringify(join(root, '.credentials.yaml'))}`,
+    '    debounceMs: 10',
+    '- id: llm-pi-ai',
+    "  name: '@deepseek-ai/dsh-llm-pi-ai'",
+    '',
+  ].join('\n'))
+
+  const ctx = new Context()
+  context = ctx
+  ctx.baseUrl = pathToFileURL(root).href + '/'
+  await ctx.plugin(Loader)
+  ctx.loader.builtins.include = Include
+  const modules = new Map<string, unknown>([
+    ['test-llm-service', LlmRuntime],
+    ['@deepseek-ai/dsh-settings-file', FileSettingsProvider],
+    ['@deepseek-ai/dsh-credentials-local', LocalCredentialProvider],
+    ['@deepseek-ai/dsh-llm-pi-ai', LlmPiAi],
+  ])
+  ctx.loader.internal = {
+    version: 'v2',
+    async import(specifier: string) {
+      if (!modules.has(specifier)) throw new Error(`unexpected Loader import: ${specifier}`)
+      return modules.get(specifier)
+    },
+  } as unknown as NonNullable<typeof ctx.loader.internal>
+  await ctx.loader.create({
+    name: 'cordis:include',
+    config: { path: pathToFileURL(configPath).href },
+  })
+  await ctx.loader.await()
+  return { ctx, settingsPath }
+}
+
+describe('llm-pi-ai real dormant composition', () => {
+  it('boots with zero routes and registers one the moment settings supply a profile', async () => {
+    vi.stubEnv('PI_COMPOSITION_KEY', '')
+    const server = await mockServer([{ events: textEvents }])
+    const { ctx, settingsPath } = await loadComposition()
+
+    // The shipped posture: the adapter exists, no route does.
+    expect(ctx.llm.listProviders()).toEqual([])
+
+    // Exactly what the web Models page leaves on disk.
+    await writeFile(settingsPath, [
+      'llm-pi-ai:',
+      '  providers:',
+      '    deepseek:',
+      '      apiKeyEnv: PI_COMPOSITION_KEY',
+      `      baseURL: ${server.url}`,
+      '',
+    ].join('\n'))
+    await vi.waitFor(() => {
+      expect(ctx.llm.listProviders().map(provider => provider.id)).toEqual(['deepseek'])
+    }, { timeout: 5000 })
+
+    const result = await assemble(ctx, { provider: 'deepseek', model: 'deepseek-v4-flash', messages: [] })
+    expect(result.message.content).toEqual([{ type: 'text', text: 'hello' }])
+    expect(server.headers[0]?.authorization).toBe('Bearer key-from-store')
+  })
+
+  it('continues natively after max-token assembly drops a tool call, with pruned replay metadata', async () => {
+    vi.stubEnv('PI_COMPOSITION_KEY', '')
+    const server = await mockServer([
+      { events: truncatedToolCallEvents },
+      { events: textEvents },
+    ])
+    const { ctx, settingsPath } = await loadComposition()
+    await writeFile(settingsPath, [
+      'llm-pi-ai:',
+      '  providers:',
+      '    deepseek:',
+      '      apiKeyEnv: PI_COMPOSITION_KEY',
+      `      baseURL: ${server.url}`,
+      '',
+    ].join('\n'))
+    await vi.waitFor(() => {
+      expect(ctx.llm.listProviders().map(provider => provider.id)).toEqual(['deepseek'])
+    }, { timeout: 5000 })
+
+    const truncated = await assemble(ctx, {
+      provider: 'deepseek',
+      model: 'deepseek-v4-flash',
+      messages: [],
+    })
+    expect(truncated.finish).toEqual({ kind: 'max-tokens' })
+    expect(truncated.message.content).toEqual([{ type: 'text', text: 'partial' }])
+    expect(truncated.message.source).toEqual({
+      kind: 'model',
+      provider: 'deepseek',
+      model: 'deepseek-v4-flash',
+      replayState: {
+        response: {
+          kind: 'pi-ai',
+          version: 2,
+          api: 'openai-completions',
+          provider: 'deepseek',
+          model: 'deepseek-v4-flash',
+          stopReason: 'length',
+        },
+        blocks: [{ type: 'text' }],
+      },
+    })
+
+    const continued = await assemble(ctx, {
+      provider: 'deepseek',
+      model: 'deepseek-v4-flash',
+      messages: [
+        truncated.message,
+        createUserMessage({ content: [{ type: 'text', text: 'continue' }], source: { kind: 'user' } }),
+      ],
+    })
+    expect(continued.message.content).toEqual([{ type: 'text', text: 'hello' }])
+    expect(server.requests).toHaveLength(2)
+    expect(server.requests[1]).toMatchObject({
+      messages: [
+        { role: 'assistant', content: 'partial' },
+        { role: 'user', content: 'continue' },
+      ],
+    })
+    const followup = server.requests[1] as { messages?: unknown[] }
+    expect(followup.messages?.[0]).not.toHaveProperty('tool_calls')
+  })
+
+  it('continues a legacy session whose stored replay state no longer matches its content', async () => {
+    vi.stubEnv('PI_COMPOSITION_KEY', '')
+    const server = await mockServer([{ events: textEvents }])
+    const { ctx, settingsPath } = await loadComposition()
+    await writeFile(settingsPath, [
+      'llm-pi-ai:',
+      '  providers:',
+      '    deepseek:',
+      '      apiKeyEnv: PI_COMPOSITION_KEY',
+      `      baseURL: ${server.url}`,
+      '',
+    ].join('\n'))
+    await vi.waitFor(() => {
+      expect(ctx.llm.listProviders().map(provider => provider.id)).toEqual(['deepseek'])
+    }, { timeout: 5000 })
+
+    // A pre-envelope session log entry: max-token assembly dropped the tool
+    // call from content while the flat v1 state still describes both blocks.
+    const poisoned = createMessage({
+      role: 'assistant',
+      content: [{ type: 'text', text: 'partial' }],
+      source: {
+        kind: 'model',
+        ...{
+          provider: 'deepseek',
+          model: 'deepseek-v4-flash',
+          replayState: {
+            kind: 'pi-ai',
+            version: 1,
+            api: 'openai-completions',
+            provider: 'deepseek',
+            model: 'deepseek-v4-flash',
+            stopReason: 'length',
+            blocks: [{ type: 'text' }, { type: 'tool-call' }],
+          },
+        },
+      },
+    })
+    const continued = await assemble(ctx, {
+      provider: 'deepseek',
+      model: 'deepseek-v4-flash',
+      messages: [
+        poisoned,
+        createUserMessage({ content: [{ type: 'text', text: 'continue' }], source: { kind: 'user' } }),
+      ],
+    })
+    expect(continued.finish).toEqual({ kind: 'stop' })
+    expect(continued.message.content).toEqual([{ type: 'text', text: 'hello' }])
+    expect(server.requests[0]).toMatchObject({
+      messages: [
+        { role: 'assistant', content: 'partial' },
+        { role: 'user', content: 'continue' },
+      ],
+    })
+  })
+})

package/vendor/dsh-llm-pi-ai/tests/login.spec.ts

@@ -0,0 +1,198 @@
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import AuthorizationService from '@deepseek-ai/dsh-authorization'
+import type { AuthorizationInteraction, AuthorizationNotice, AuthorizationPrompt } from '@deepseek-ai/dsh-authorization'
+import LocalCredentialProvider from '@deepseek-ai/dsh-credentials-local'
+import type { CredentialKey } from '@deepseek-ai/dsh-credentials'
+import type { AuthEvent, AuthInteraction, AuthPrompt, AuthType, Credential } from '@earendil-works/pi-ai'
+
+const login = vi.hoisted(() => vi.fn())
+
+// The whole of what this module does with pi-ai is run one provider's login
+// against a collection built with the harness store, so the collection is the
+// boundary worth observing; a real login would open a browser.
+vi.mock('@earendil-works/pi-ai', async importOriginal => ({
+  ...await importOriginal<typeof import('@earendil-works/pi-ai')>(),
+  createModels: () => ({ setProvider: () => {}, login }),
+}))
+
+const { credentialStoreFrom, authContextFrom, recordKeyFor } = await import('../src/auth.ts')
+const { registerPiAiFlows } = await import('../src/login.ts')
+
+const CODEX = recordKeyFor('openai-codex')
+const dirs: string[] = []
+
+/** A context with the record store, the seam, and every pi-ai login flow. */
+async function harness(): Promise<Context> {
+  const dir = await mkdtemp(join(tmpdir(), 'dsh-pi-login-'))
+  dirs.push(dir)
+  const ctx = new Context()
+  await ctx.plugin(LocalCredentialProvider, { path: join(dir, '.credentials.yaml'), watch: false })
+  await ctx.plugin(AuthorizationService)
+  registerPiAiFlows(ctx, { credentials: credentialStoreFrom(ctx), authContext: authContextFrom(ctx) })
+  return ctx
+}
+
+/** An interaction recording everything a flow says, answering every question. */
+function surface(answer = 'typed'): AuthorizationInteraction & {
+  notices: AuthorizationNotice[]
+  prompts: AuthorizationPrompt[]
+} {
+  const notices: AuthorizationNotice[] = []
+  const prompts: AuthorizationPrompt[] = []
+  return {
+    notices,
+    prompts,
+    notify: (notice) => { notices.push(notice) },
+    prompt: (prompt) => {
+      prompts.push(prompt)
+      return Promise.resolve(answer)
+    },
+  }
+}
+
+/** Drive one attempt, letting the mocked login talk back through `converse`. */
+async function attempt(
+  ctx: Context,
+  converse: (interaction: AuthInteraction) => Promise<void>,
+  request: { key?: CredentialKey; method?: string } = {},
+): Promise<ReturnType<typeof surface>> {
+  const ui = surface()
+  login.mockImplementation(async (providerId: string, _type: AuthType, interaction: AuthInteraction) => {
+    await converse(interaction)
+    const granted: Credential = { type: 'oauth', access: 'at', refresh: 'rt', expires: 1 }
+    await credentialStoreFrom(ctx).modify(providerId, () => Promise.resolve(granted))
+    return granted
+  })
+  await expect(ctx.authorization.begin({
+    key: request.key ?? CODEX,
+    interaction: ui,
+    ...request.method === undefined ? {} : { method: request.method },
+  })).resolves.toEqual({ status: 'authorized' })
+  return ui
+}
+
+afterEach(async () => {
+  login.mockReset()
+  await Promise.all(dirs.splice(0).map(dir => rm(dir, { recursive: true, force: true })))
+})
+
+describe('pi-ai login flows', () => {
+  it('offers one flow per installed provider, with the methods that provider ships', async () => {
+    const ctx = await harness()
+    const offered = ctx.authorization.list()
+
+    // The OAuth-only provider is exactly the case this exists for: nothing
+    // else could ever configure it.
+    expect(offered.find(entry => entry.key === CODEX)?.methods)
+      .toEqual([{ id: 'oauth', label: expect.stringContaining('ChatGPT') as string }])
+    // A provider offering both keeps both, the subscription login first.
+    expect(offered.find(entry => entry.key === recordKeyFor('anthropic'))?.methods.map(one => one.id))
+      .toEqual(['oauth', 'api-key'])
+    // A key-only provider still gets a flow, because pi-ai collects the key
+    // through its own prompt rather than leaving it to the settings form.
+    expect(offered.find(entry => entry.key === recordKeyFor('deepseek'))?.methods.map(one => one.id))
+      .toEqual(['api-key'])
+  })
+
+  it('runs the pi-ai auth type the chosen method names', async () => {
+    const ctx = await harness()
+
+    await attempt(ctx, () => Promise.resolve())
+    expect(login).toHaveBeenLastCalledWith('openai-codex', 'oauth', expect.anything())
+
+    await attempt(ctx, () => Promise.resolve(), { key: recordKeyFor('anthropic'), method: 'api-key' })
+    expect(login).toHaveBeenLastCalledWith('anthropic', 'api_key', expect.anything())
+  })
+
+  it('commits what the login produced, where the adapter reads it back', async () => {
+    const ctx = await harness()
+
+    await attempt(ctx, () => Promise.resolve())
+
+    await expect(ctx.credentials.readRecord(CODEX)).resolves.toEqual({
+      kind: 'grant',
+      payload: { type: 'oauth', access: 'at', refresh: 'rt', expires: 1 },
+    })
+  })
+
+  it('restates every pi-ai login event in the neutral vocabulary', async () => {
+    const ctx = await harness()
+    const events: AuthEvent[] = [
+      { type: 'info', message: 'Read this first', links: [{ url: 'https://help.example' }] },
+      { type: 'info', message: 'Nothing to open' },
+      { type: 'auth_url', url: 'https://auth.example/start', instructions: 'Approve in the tab' },
+      { type: 'auth_url', url: 'https://auth.example/plain' },
+      { type: 'device_code', userCode: 'WXYZ-1234', verificationUri: 'https://device.example' },
+      { type: 'progress', message: 'Exchanging the code' },
+      // pi-ai's event union is open; an unrecognised member must still show
+      // the human that something is happening.
+      { type: 'quantum-handshake' } as unknown as AuthEvent,
+    ]
+
+    const ui = await attempt(ctx, (interaction) => {
+      for (const event of events) interaction.notify(event)
+      return Promise.resolve()
+    })
+
+    expect(ui.notices).toEqual([
+      { message: 'Read this first', url: 'https://help.example' },
+      { message: 'Nothing to open' },
+      { message: 'Approve in the tab', url: 'https://auth.example/start' },
+      { message: 'Open this page to continue signing in.', url: 'https://auth.example/plain' },
+      {
+        message: 'Enter this code on the verification page to finish signing in.',
+        url: 'https://device.example',
+        code: 'WXYZ-1234',
+      },
+      { message: 'Exchanging the code' },
+      { message: 'Signing in…' },
+    ])
+  })
+
+  it('restates every pi-ai prompt, carrying the per-prompt withdrawal signal', async () => {
+    const ctx = await harness()
+    const withdraw = new AbortController()
+    const prompts: AuthPrompt[] = [
+      { type: 'text', message: 'Your workspace', placeholder: 'acme' },
+      { type: 'secret', message: 'Paste the key' },
+      { type: 'secret', message: 'Paste the token', placeholder: 'sk-…' },
+      { type: 'select', message: 'Which account?', options: [{ id: 'a', label: 'Work' }] },
+      // The manual-code question a browser callback can win the race against.
+      { type: 'manual_code', message: 'Paste the code', signal: withdraw.signal },
+    ]
+
+    const ui = await attempt(ctx, async (interaction) => {
+      for (const prompt of prompts) await interaction.prompt(prompt)
+    })
+
+    expect(ui.prompts).toEqual([
+      { kind: 'text', message: 'Your workspace', placeholder: 'acme' },
+      { kind: 'secret', message: 'Paste the key' },
+      { kind: 'secret', message: 'Paste the token', placeholder: 'sk-…' },
+      { kind: 'select', message: 'Which account?', options: [{ id: 'a', label: 'Work' }] },
+      { kind: 'text', message: 'Paste the code', signal: withdraw.signal },
+    ])
+  })
+
+  it('hands the flow the attempt-wide cancellation signal', async () => {
+    const ctx = await harness()
+    let seen: AbortSignal | undefined
+    const controller = new AbortController()
+    login.mockImplementation((_id: string, _type: AuthType, interaction: AuthInteraction) => {
+      seen = interaction.signal
+      controller.abort()
+      return new Promise(() => {})
+    })
+
+    await expect(ctx.authorization.begin({
+      key: CODEX,
+      interaction: surface(),
+      signal: controller.signal,
+    })).resolves.toEqual({ status: 'cancelled' })
+    expect(seen?.aborted).toBe(true)
+  })
+})

package/vendor/dsh-llm-pi-ai/tests/mock-server.ts

@@ -0,0 +1,82 @@
+import { createServer } from 'node:http'
+import type { IncomingMessage, Server, ServerResponse } from 'node:http'
+
+export interface MockServer {
+  url: string
+  paths: string[]
+  requests: unknown[]
+  headers: IncomingMessage['headers'][]
+  readonly closedResponses: number
+  responseClosed: Promise<void>
+}
+
+const servers: Server[] = []
+
+/** Close every server opened since the last call; run from each spec's afterEach. */
+export async function closeMockServers(): Promise<void> {
+  await Promise.all(servers.splice(0).map(server => new Promise(resolve => server.close(resolve))))
+}
+
+/** A minimal complete text generation in pi-ai's chat-completions shape. */
+export const textEvents = [
+  '{"choices":[{"delta":{"role":"assistant","content":""},"index":0,"finish_reason":null}]}',
+  '{"choices":[{"delta":{"content":"hello"},"index":0,"finish_reason":null}]}',
+  '{"choices":[{"delta":{},"index":0,"finish_reason":"stop"}],"usage":{"prompt_tokens":3,"completion_tokens":1}}',
+  '[DONE]',
+]
+
+/** Local provider stand-in: replays scripted behaviors per request. */
+export async function mockServer(script: {
+  status?: number
+  events?: string[]
+  body?: string
+  delayMs?: number
+  headers?: Record<string, string>
+}[]): Promise<MockServer> {
+  const paths: string[] = []
+  const requests: unknown[] = []
+  const headers: IncomingMessage['headers'][] = []
+  let closedResponses = 0
+  const responseClosed = Promise.withResolvers<undefined>()
+  const server = createServer((request: IncomingMessage, response: ServerResponse) => {
+    response.on('close', () => {
+      closedResponses += 1
+      responseClosed.resolve(undefined)
+    })
+    let body = ''
+    request.on('data', (chunk: Buffer) => { body += chunk.toString('utf8') })
+    request.on('end', () => {
+      paths.push(request.url ?? '')
+      requests.push(body.length === 0 ? undefined : JSON.parse(body))
+      headers.push(request.headers)
+      const behavior = script.shift() ?? { status: 500, body: 'script exhausted' }
+      if (behavior.status !== undefined && behavior.status !== 200) {
+        response.writeHead(behavior.status, { 'content-type': 'application/json', ...behavior.headers })
+        response.end(behavior.body ?? '{}')
+        return
+      }
+      response.writeHead(200, { 'content-type': 'text/event-stream' })
+      let index = 0
+      const writeNext = (): void => {
+        const event = behavior.events?.[index++]
+        if (event === undefined) { response.end(); return }
+        response.write(`data: ${event}\n\n`)
+        if (behavior.delayMs === undefined) writeNext()
+        else setTimeout(writeNext, behavior.delayMs)
+      }
+      writeNext()
+    })
+  })
+  servers.push(server)
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('no port')
+  return {
+    url: `http://127.0.0.1:${address.port}`,
+    paths,
+    requests,
+    headers,
+    responseClosed: responseClosed.promise,
+    get closedResponses() { return closedResponses },
+  }
+}