@chatpanel/events 0.102.0 → 0.103.1

package/model-candidates.js

@@ -1,358 +1 @@
-// WHAT A MODEL IS, GUESSED FROM WHAT THE USER CONFIGURED — one answer for every client.
-//
-// Routing needs attributes nobody types in: how far a request travels to reach a model,
-// what it can probably do, roughly what it costs, how good it is likely to be. The extension
-// inferred these from names and URLs for its own endpoint and agent records; the desktop
-// needed the same inference over the gateway's model list, and a second copy of a guess is
-// two guesses that drift. So the heuristics live here and each client hands in its own
-// shape: `inferCandidate(target, kind, { override, health })` takes anything with
-// `{ id?, name?, model?, baseUrl?|url?, kind?, enabled?, bridgeAgent? }` and returns a router
-// model. Health (rate-limited, observed down) is INJECTED, because measuring it is a host's
-// job — the extension keeps a health map, the desktop asks the gateway.
-//
-// Everything below is a starting point the user corrects (`applyOverride`), never a verdict.
-
-import { classifySource } from './sources.js';
-import { defineModel } from './router.js';
-
-/** Where a request must travel to reach this target — the only attribute privacy depends on. */
-export function reachOf(target) {
-  // A bridge agent runs a CLI on the user's own machine; the model behind it may still be
-  // remote, which is why this says 'trusted' rather than 'device'. Claiming otherwise would
-  // let a device-only request reach a cloud model through a local process.
-  if (target.kind === 'bridge') return 'trusted';
-  const url = String(target.baseUrl || target.url || '');
-  if (/^https?:\/\/(localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0)(:|\/|$)/i.test(url)) return 'device';
-  // A .local or on-LAN host is the user's own machine or network — not a third party, but
-  // not the device either. Same private-address rules as the source classifier, so
-  // "internal" cannot mean one thing for a page and another for an endpoint.
-  //
-  // BUT THE FAIL-SAFE DIRECTION IS OPPOSITE HERE. classifySource fails CLOSED — an
-  // unreadable URL counts as internal, because a source we cannot identify must not be sent
-  // out. A DESTINATION we cannot identify is the reverse: calling it 'trusted' would admit
-  // it to a restricted turn. So an unparseable endpoint is treated as the furthest reach.
-  const c = classifySource(url);
-  return c.internal && c.matched !== 'unparseable' ? 'trusted' : 'any';
-}
-
-/**
- * The levers a user can pull, and what each one means for routing.
- *
- * Named rather than free-form: a capability only matters if something asks for it, and a
- * typo in a free-text field would silently make a model ineligible forever with no way to
- * see why.
- */
-export const KNOWN_CAPABILITIES = Object.freeze([
-  { id: 'tools', label: 'Tools', hint: 'Can call functions — needed for page actions, search and MCP.' },
-  { id: 'vision', label: 'Vision', hint: 'Can read images and screenshots.' },
-  { id: 'reasoning', label: 'Reasoning', hint: 'Thinks before answering — worth the wait on hard tasks.' },
-  { id: 'long-context', label: 'Long context', hint: 'Handles large documents and long meetings.' },
-  { id: 'coding', label: 'Coding', hint: 'Strong at writing and refactoring code.' },
-  { id: 'json', label: 'Structured output', hint: 'Reliably returns valid JSON.' },
-  // The media capabilities (architecture-pillars.md §13.2). Never guessed from a name: a
-  // model earns these by proof (the ledger's `capability` entries) or by the person's word.
-  { id: 'speech-in', label: 'Speech in', hint: 'Takes audio as input — a meeting, a voice note.' },
-  { id: 'speech-out', label: 'Speech out', hint: 'Speaks its answer.' },
-  { id: 'audio', label: 'Audio', hint: 'Understands audio content beyond speech — music, sounds.' },
-  { id: 'image-out', label: 'Image out', hint: 'Generates images.' },
-]);
-
-/**
- * What a model can probably do, guessed from its name.
- *
- * Conservative on purpose: an unproven capability claimed here becomes a failed turn, and a
- * missing one only means the router does not volunteer it. The user corrects both — these
- * are a starting point, not a verdict.
- */
-export function capabilitiesOf(target) {
-  const m = String(target.model || '').toLowerCase();
-  const caps = new Set(['json']);
-  // Bridge agents relay tools through the bridge's MCP server; API endpoints vary, so tool
-  // support is assumed only where the user has actually configured a model for it.
-  if (target.kind === 'bridge' || target.model) caps.add('tools');
-  if (/gpt-4|gpt-5|claude|gemini|vision|vl\b|llava|pixtral/.test(m)) caps.add('vision');
-  if (/o1|o3|r1|reason|think|opus|sonnet|deepseek-r/.test(m)) caps.add('reasoning');
-  if (/200k|1m\b|long|gemini|claude|gpt-4\.1|gpt-5/.test(m)) caps.add('long-context');
-  if (/code|coder|codex|deepseek|qwen|opus|sonnet/.test(m)) caps.add('coding');
-  // A CLI coding agent is a coding agent, whatever its model is called.
-  if (target.kind === 'bridge') { caps.add('coding'); caps.add('reasoning'); }
-  return [...caps];
-}
-
-/**
- * Which provider to prefer when two of them offer the same model. Lower wins.
- *
- * Ties were breaking alphabetically, which is not a preference — it is the absence of one,
- * and it sent every equal choice to whichever provider happened to sort first. The order
- * below is a starting point with a reason behind each rung; the user overrides it per model.
- *
- * FEWER HOPS FIRST. A direct API is one network call to the people who run the model; an
- * aggregator adds a hop, its own quotas, and its own outages on top of the provider's. When
- * everything else is equal, the shorter path is the more reliable one.
- */
-const PROVIDER_ORDER = [
-  // The user's own machine: no quota, no outage, no third party.
-  /localhost|127\.0\.0\.1|ollama|lm.?studio/i,
-  // First-party APIs.
-  /anthropic|openai\.com|api\.deepseek|googleapis|x\.ai/i,
-  // Local CLI agents — capable, but they spawn a process and run their own loop.
-  /(^|\W)bridge(\W|$)/i,
-  // Aggregators and gateways: an extra hop and someone else's quota.
-  /openrouter|huggingface|together|groq|fireworks|nvidia|replicate/i,
-];
-
-// Inferred ranks sit ABOVE every number the settings UI can produce (it offers 1..N), so
-// an order someone chose by hand always outranks one we guessed. Sharing the range meant
-// picking "Order: 1" still lost to a local model we had silently rated 0 — the setting looked
-// like the top priority and was not.
-const INFERRED_RANK_FLOOR = 1000;
-
-export function providerRankOf(target, kind) {
-  const hay = `${target.baseUrl || target.url || ''} ${target.name || ''} ${kind || target.kind || ''}`;
-  for (let i = 0; i < PROVIDER_ORDER.length; i++) {
-    if (PROVIDER_ORDER[i].test(hay)) return INFERRED_RANK_FLOOR + i * 10;
-  }
-  // Unrecognised: mid-table, so a provider we have no opinion on is not buried.
-  return INFERRED_RANK_FLOOR + 50;
-}
-
-/**
- * Roughly how capable a model is, guessed from its name.
- *
- * Shipping the quality lever with no default meant every model scored the same, so a
- * frontier model that declined was replaced by an 8B instant model with equal standing —
- * "same capabilities, cheaper" is what the ranking saw, and it is nonsense. A wrong guess a
- * user can correct beats a blank that makes every model interchangeable.
- *
- * Names are a crude signal and deliberately so: this only has to ORDER models, not score
- * them, and the ordering it needs is the obvious one everybody already knows.
- */
-export function qualityOf(target) {
-  const m = `${target.model || ''} ${target.name || ''}`.toLowerCase();
-
-  // Parameter count, READ AS A NUMBER rather than pattern-matched. A regex for "any digits
-  // followed by b" cannot tell 8B from 26B from 405B, and the first version of this scored
-  // a 26B model as tiny for exactly that reason. Size is a number; treat it as one.
-  const size = Number(/(\d+(?:\.\d+)?)\s*b\b/.exec(m)?.[1]);
-  if (Number.isFinite(size)) {
-    if (size >= 60) return 0.85;   // frontier-scale open weights
-    if (size >= 20) return 0.6;    // the solid mid-range most people run locally
-    return 0.3;                    // small and fast, never a stand-in for a frontier model
-  }
-
-  // Named tiers, for hosted models that do not advertise a size.
-  if (/instant|mini|nano|tiny|lite|-small\b|haiku/.test(m)) return 0.3;
-  if (/opus|gpt-5|o1|o3|\bpro\b|ultra|deepseek-r|thinking/.test(m)) return 0.9;
-  if (/sonnet|gpt-4|flash|gemini|deepseek|qwen|mistral|codestral/.test(m)) return 0.6;
-  // A CLI HARNESS IS NOT AN UNKNOWN MODEL, and the harness's NAME is not its model's name.
-  //
-  // Claude Code, Codex and the rest usually carry no `model` string — the CLI picks that
-  // itself — and 'Claude Code' matches none of the tiers above, so every coding agent landed
-  // on the "genuinely unknown" 0.5 below. requirementsFor puts a 0.55 quality floor on
-  // complex, code and structured turns, so 0.5 meant a CLI coding agent was ELIMINATED from
-  // precisely the tasks it exists for — rejected as "below the quality this task needs" while
-  // the work went to an API model. A harness running a frontier model behind its own loop is
-  // not the weakest thing configured.
-  //
-  // LAST, not first: an agent that names its model has told us something better than this
-  // default, and overriding it would make a declared `opus` indistinguishable from a bare
-  // harness — which is exactly the distance failover ranks by.
-  if (target.kind === 'bridge') return 0.8;
-
-  return 0.5;   // genuinely unknown: mid-table, so it is neither buried nor promoted
-}
-
-/** Rough relative cost — unitless, and only ever compared against its siblings. */
-/**
- * Roughly how long this model takes, from the two things that actually decide it.
- *
- * This used to read WHERE a model runs and nothing else — every hosted model 700ms, every
- * local one 1500ms — so an 8B and a frontier model at the same provider were equally fast.
- * Asking the router for speed could therefore never find the small model, which is the one
- * thing "prefer latency" exists to do.
- *
- * SIZE IS THE OTHER HALF. A frontier model thinks for longer than an 8B wherever it runs,
- * and quality is the only size signal available here — it is already inferred from the
- * parameter count in the name (see qualityOf), and already correctable by the user, so
- * deriving from it keeps one number to fix rather than two.
- *
- * Still a guess, deliberately crude: this only has to ORDER models. Health can measure the
- * real thing later and override it per model, which is exactly why it is a plain field.
- */
-export function latencyOf(reach, quality) {
-  // A local model is slower to first token than a hosted one far more often than not: no
-  // warm pool, and usually a laptop rather than a datacentre.
-  const base = reach === 'device' ? 1500 : 700;
-  const q = Number.isFinite(quality) ? quality : 0.5;
-  // 0.6 + q: an 8B (0.3) is ~0.9x the base, a frontier model (0.9) ~1.5x. A spread of under
-  // two to one, because the difference is real but not the order of magnitude a bigger
-  // coefficient would claim.
-  return Math.round(base * (0.6 + q));
-}
-
-export function costOf(target, reach) {
-  if (reach === 'device') return 0;
-  const m = String(target.model || '').toLowerCase();
-  if (/opus|gpt-4|pro\b/.test(m)) return 5;
-  if (/sonnet|mini|flash|haiku/.test(m)) return 1;
-  return 2;
-}
-
-/**
- * Everything the router infers about one model, and what the user said instead.
- *
- * Defaults are guesses — a name matched against a regex, a URL judged local. They are right
- * often enough to be useful and wrong often enough that someone who knows their own setup
- * must be able to say so. A router that cannot be corrected is one people work around.
- *
- * OVERRIDES CAN ONLY MOVE REACH OUTWARD. Every other attribute is the user's to set, but
- * reach is what privacy depends on, and the two directions are not symmetric:
- *
- *   'this cloud endpoint is really on my device'  — would let a device-only request reach a
- *       third party, from one typo or one synced settings file. Refused.
- *   'this local-looking endpoint actually goes out' — makes FEWER requests eligible for it.
- *       Always allowed, because a user is entitled to trust their own setup less than we do.
- *
- * A model that reaches further can serve fewer kinds of request, so outward is the safe
- * direction and inward is the one that has to be earned rather than declared.
- */
-/**
- * A number the user actually SET, or null for "cleared — use what we inferred".
- *
- * CLEARING AN OVERRIDE WAS SETTING IT TO ZERO. The settings selects write `null` for their
- * "default" option, and the guard here was `Number.isFinite(Number(v))` — but `Number(null)`
- * is 0 and 0 is finite, so every cleared field became a real, extreme value. Picking
- * "Speed: default" made a model claim it answers in 0 ms; "Cost: default" made it free;
- * "Quality: default" made it worthless; and clearing Order pinned it at position 0, ahead of
- * everything, flagged as a deliberate choice.
- *
- * It stayed invisible while the balanced score multiplied cost by latency — every free model
- * scored 0 anyway. The moment a request could ask for SPEED, a model with a cleared speed
- * field beat everything that had a real one, and "hi" went to the most expensive model
- * configured. An unset field must read as unset.
- */
-export function numericOverride(v) {
-  if (v === null || v === undefined || v === '' || typeof v === 'boolean') return null;
-  const n = Number(v);
-  return Number.isFinite(n) ? n : null;
-}
-
-export function applyOverride(inferred, override = {}) {
-  if (!override || typeof override !== 'object') return inferred;
-  const out = { ...inferred };
-  const rank = numericOverride(override.providerRank);
-  if (rank !== null) {
-    out.providerRank = rank;
-    // Flagged as chosen, not guessed: the router honours a hand-set order outright between
-    // two routes to one model, and treats the order we inferred as a tie-break only.
-    out.orderPinned = true;
-  }
-  if (Array.isArray(override.capabilities)) out.capabilities = [...override.capabilities];
-  for (const key of ['costPer1k', 'latencyMs', 'quality']) {
-    const n = numericOverride(override[key]);
-    if (n !== null) out[key] = n;
-  }
-  if (typeof override.available === 'boolean') out.available = override.available;
-  if (override.reach && REACH_RANK[override.reach] > REACH_RANK[inferred.reach]) {
-    // Outward only. See the note above.
-    out.reach = override.reach;
-  }
-  return out;
-}
-
-// ── The engine card over the guess (model-ledger.js, architecture-pillars.md §13.2) ──────
-
-import { DEFAULT_MIN_CALLS, cardOverride } from './model-ledger.js';
-export { DEFAULT_MIN_CALLS };
-
-export { cardOverride } from './model-ledger.js';
-
-/**
- * A router model with its card applied: `applyOverride` with what the card observed, then
- * withdrawn capabilities removed (a proof beats a guess in both directions). A person's own
- * override (`userOverride`) is applied LAST — what they said outranks what was observed —
- * except reach, which `applyOverride` already keeps outward-only. The result carries
- * `observed: [...]` so the Context Ledger can say guess or observed per field.
- */
-export function applyCard(inferred, card, { minCalls = DEFAULT_MIN_CALLS, jobKind = null, userOverride = null } = {}) {
-  const { override, observed } = cardOverride(card, { minCalls, jobKind });
-  let out = applyOverride(inferred, override);
-  const withdrawn = new Set(card?.capabilities?.withdrawn || []);
-  if (withdrawn.size && Array.isArray(out.capabilities)) { out = { ...out, capabilities: out.capabilities.filter((c) => !withdrawn.has(c)) }; observed.push('capabilities'); }
-  if (userOverride) out = applyOverride(out, userOverride);
-  return { ...out, observed };
-}
-
-export const REACH_RANK = { device: 0, trusted: 1, any: 2 };
-const REACH_STEPS = ['device', 'trusted', 'any'];
-
-/**
- * The reach values a user may declare for a model we detected as `detected`.
- *
- * The rule and the CONTROL that offers it have to come from one place. They did not: the
- * settings page built its options by slicing from the model's CURRENT reach, which is the
- * value after the override has been applied — so saving 'any' left 'any' as the only option
- * and the correction could never be taken back. Enforcing outward-only in applyOverride while
- * a second copy of the rule decided what to offer is what turned a safety rule into a
- * one-way door.
- *
- * Always includes `detected` itself: coming back to what we detected is not moving inward, it
- * is dropping the override. Anything closer in than the detection is never offered, because
- * applyOverride would refuse it and a control that silently discards half its own values is
- * worse than no control.
- */
-export function reachChoicesFor(detected) {
-  const i = REACH_STEPS.indexOf(detected);
-  return i < 0 ? [...REACH_STEPS] : REACH_STEPS.slice(i);
-}
-
-
-/**
- * One router model from one configured target. The core of every client's candidate list.
- *
- * `kind` is 'bridge' for a CLI agent on this machine and 'api' for an HTTP endpoint;
- * `override` is what the user said about this model (see applyOverride); `health` is
- * `{ available, rateLimited }` as the host measured it, or null for "nothing observed".
- * Returns null for a target that names no model and is not an agent — nothing to route to.
- */
-export function inferCandidate(t, kind, { override = null, health = null } = {}) {
-  if (!t || (!t.model && kind !== 'bridge' && t.kind !== 'bridge')) return null;
-  const id = t.id || t.name || t.model;
-  if (!id) return null;
-  // NEVER A GENERATED ID. 'mqr0ifmw7sqxr7' appeared as the answer to "which model did this"
-  // in a real log — falling back to the id was the same as having no label at all. A bridge
-  // agent the user never renamed still knows which CLI it runs, and that is readable.
-  const label = [t.name, t.model && t.model !== t.name ? t.model : null]
-    .filter(Boolean).join(' · ')
-    || [t.bridgeAgent, t.model].filter(Boolean).join(' · ')
-    || kind || t.kind
-    || String(id);
-  const k = kind || t.kind;
-  const reach = reachOf({ ...t, kind: k });
-  const inferred = {
-    id,
-    label,
-    // Kept so failover can recognise the SAME model at another provider — the closest
-    // possible replacement, and invisible if only the display label survived.
-    model: t.model || '',
-    reach,
-    classUsed: reach === 'device' ? 'L' : (k === 'bridge' ? 'A' : 'C'),
-    capabilities: capabilitiesOf({ ...t, kind: k }),
-    costPer1k: costOf(t, reach),
-    latencyMs: latencyOf(reach, qualityOf({ ...t, kind: k })),
-    quality: qualityOf({ ...t, kind: k }),
-    providerRank: providerRankOf(t, k),
-    available: t.enabled !== false,
-  };
-  const configured = applyOverride(inferred, override || {});
-  // AN EXPLICIT DISABLE OUTRANKS A TUNING OVERRIDE. `enabled: false` is the user saying,
-  // right now, "don't use this"; a routing override is a hint saved earlier.
-  if (t.enabled === false) configured.available = false;
-  // A CORRECTED QUALITY CORRECTS THE SPEED DERIVED FROM IT — unless the user set the speed.
-  if (numericOverride(override?.latencyMs) === null) configured.latencyMs = latencyOf(reach, configured.quality);
-  return defineModel({
-    ...configured,
-    available: configured.available && (health ? health.available !== false : true),
-    rateLimited: !!health?.rateLimited,
-  });
-}
+import{classifySource as y}from"./sources.js";import{defineModel as x}from"./router.js";function w(e){if(e.kind==="bridge")return"trusted";const n=String(e.baseUrl||e.url||"");if(/^https?:\/\/(localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0)(:|\/|$)/i.test(n))return"device";const i=y(n);return i.internal&&i.matched!=="unparseable"?"trusted":"any"}const L=Object.freeze([{id:"tools",label:"Tools",hint:"Can call functions — needed for page actions, search and MCP."},{id:"vision",label:"Vision",hint:"Can read images and screenshots."},{id:"reasoning",label:"Reasoning",hint:"Thinks before answering — worth the wait on hard tasks."},{id:"long-context",label:"Long context",hint:"Handles large documents and long meetings."},{id:"coding",label:"Coding",hint:"Strong at writing and refactoring code."},{id:"json",label:"Structured output",hint:"Reliably returns valid JSON."},{id:"speech-in",label:"Speech in",hint:"Takes audio as input — a meeting, a voice note."},{id:"speech-out",label:"Speech out",hint:"Speaks its answer."},{id:"audio",label:"Audio",hint:"Understands audio content beyond speech — music, sounds."},{id:"image-out",label:"Image out",hint:"Generates images."}]);function O(e){const n=String(e.model||"").toLowerCase(),i=new Set(["json"]);return(e.kind==="bridge"||e.model)&&i.add("tools"),/gpt-4|gpt-5|claude|gemini|vision|vl\b|llava|pixtral/.test(n)&&i.add("vision"),/o1|o3|r1|reason|think|opus|sonnet|deepseek-r/.test(n)&&i.add("reasoning"),/200k|1m\b|long|gemini|claude|gpt-4\.1|gpt-5/.test(n)&&i.add("long-context"),/code|coder|codex|deepseek|qwen|opus|sonnet/.test(n)&&i.add("coding"),e.kind==="bridge"&&(i.add("coding"),i.add("reasoning")),[...i]}const p=[/localhost|127\.0\.0\.1|ollama|lm.?studio/i,/anthropic|openai\.com|api\.deepseek|googleapis|x\.ai/i,/(^|\W)bridge(\W|$)/i,/openrouter|huggingface|together|groq|fireworks|nvidia|replicate/i],b=1e3;function R(e,n){const i=`${e.baseUrl||e.url||""} ${e.name||""} ${n||e.kind||""}`;for(let t=0;t<p.length;t++)if(p[t].test(i))return b+t*10;return b+50}function m(e){const n=`${e.model||""} ${e.name||""}`.toLowerCase(),i=Number(/(\d+(?:\.\d+)?)\s*b\b/.exec(n)?.[1]);return Number.isFinite(i)?i>=60?.85:i>=20?.6:.3:/instant|mini|nano|tiny|lite|-small\b|haiku/.test(n)?.3:/opus|gpt-5|o1|o3|\bpro\b|ultra|deepseek-r|thinking/.test(n)?.9:/sonnet|gpt-4|flash|gemini|deepseek|qwen|mistral|codestral/.test(n)?.6:e.kind==="bridge"?.8:.5}function g(e,n){const i=e==="device"?1500:700,t=Number.isFinite(n)?n:.5;return Math.round(i*(.6+t))}function S(e,n){if(n==="device")return 0;const i=String(e.model||"").toLowerCase();return/opus|gpt-4|pro\b/.test(i)?5:/sonnet|mini|flash|haiku/.test(i)?1:2}function c(e){if(e==null||e===""||typeof e=="boolean")return null;const n=Number(e);return Number.isFinite(n)?n:null}function u(e,n={}){if(!n||typeof n!="object")return e;const i={...e},t=c(n.providerRank);t!==null&&(i.providerRank=t,i.orderPinned=!0),Array.isArray(n.capabilities)&&(i.capabilities=[...n.capabilities]);for(const a of["costPer1k","latencyMs","quality"]){const l=c(n[a]);l!==null&&(i[a]=l)}return typeof n.available=="boolean"&&(i.available=n.available),n.reach&&k[n.reach]>k[e.reach]&&(i.reach=n.reach),i}import{DEFAULT_MIN_CALLS as h,cardOverride as v}from"./model-ledger.js";import{cardOverride as I}from"./model-ledger.js";function E(e,n,{minCalls:i=h,jobKind:t=null,userOverride:a=null}={}){const{override:l,observed:r}=v(n,{minCalls:i,jobKind:t});let o=u(e,l);const d=new Set(n?.capabilities?.withdrawn||[]);return d.size&&Array.isArray(o.capabilities)&&(o={...o,capabilities:o.capabilities.filter(s=>!d.has(s))},r.push("capabilities")),a&&(o=u(o,a)),{...o,observed:r}}const k={device:0,trusted:1,any:2},f=["device","trusted","any"];function M(e){const n=f.indexOf(e);return n<0?[...f]:f.slice(n)}function _(e,n,{override:i=null,health:t=null}={}){if(!e||!e.model&&n!=="bridge"&&e.kind!=="bridge")return null;const a=e.id||e.name||e.model;if(!a)return null;const l=[e.name,e.model&&e.model!==e.name?e.model:null].filter(Boolean).join(" · ")||[e.bridgeAgent,e.model].filter(Boolean).join(" · ")||n||e.kind||String(a),r=n||e.kind,o=w({...e,kind:r}),d={id:a,label:l,model:e.model||"",reach:o,classUsed:o==="device"?"L":r==="bridge"?"A":"C",capabilities:O({...e,kind:r}),costPer1k:S(e,o),latencyMs:g(o,m({...e,kind:r})),quality:m({...e,kind:r}),providerRank:R(e,r),available:e.enabled!==!1},s=u(d,i||{});return e.enabled===!1&&(s.available=!1),c(i?.latencyMs)===null&&(s.latencyMs=g(o,s.quality)),x({...s,available:s.available&&(t?t.available!==!1:!0),rateLimited:!!t?.rateLimited})}export{h as DEFAULT_MIN_CALLS,L as KNOWN_CAPABILITIES,k as REACH_RANK,E as applyCard,u as applyOverride,O as capabilitiesOf,I as cardOverride,S as costOf,_ as inferCandidate,g as latencyOf,c as numericOverride,R as providerRankOf,m as qualityOf,M as reachChoicesFor,w as reachOf};

package/model-health.js

@@ -1,182 +1 @@
-// What a provider failure MEANS, and how long to stand the model down for it.
-//
-// Lived in the extension as `js/model-health.js`, wrapped around chrome.storage.session.
-// The desktop could not read it and so could not fail over at all: a model that returned
-// "you have depleted your monthly credits" ended the turn there, while the extension would
-// have moved to the next one. The classifier and the ledger are pure; only the persistence
-// was the extension's, and that is injected now.
-//
-// Only the categories that change what to DO are distinguished. A 402 and a 429 are both
-// "not now", but one is "not for a while" and the other is "in a moment", and routing that
-// treats them the same either hammers a dead endpoint or abandons a live one.
-//
-// Class R: strings in, a category and a deadline out. The clock is injected.
-
-const MODEL_STANDDOWN_MS = 30 * 60_000;
-
-/** How long to stand a model down, by what went wrong. */
-export const COOLDOWN_MS = Object.freeze({
-  quota: 30 * 60_000,
-  rate: 60_000,
-  server: 2 * 60_000,
-  // The model is gone — retired, removed, renamed. It is not coming back, so standing it
-  // down for the rest of the session is the honest answer; anything shorter just repeats the
-  // same failure on a timer.
-  gone: 24 * 60 * 60_000,
-  // The account needs reconnecting — a human action, on no timetable. Retrying on a short
-  // timer just walks the chain back into the same wall every turn.
-  auth: 6 * 60 * 60_000,
-  // A request this provider would not take. Another may; this one probably still will not,
-  // but it is worth re-checking well before an auth problem.
-  request: 10 * 60_000,
-  // Nobody is listening. A local model that is not running, a hostname that does not
-  // resolve, a server that refuses the connection. It is not coming back on a 30-second
-  // timer — someone has to start the thing — and re-dialling it every turn was the exact
-  // failure a user watched as ERR_CONNECTION_REFUSED, twice, on two different pages.
-  unreachable: 5 * 60_000,
-  // Anything else — treat as transient and barely stand it down at all.
-  unknown: 30_000,
-});
-
-/** The reasons that mean "not available" rather than "not right now". */
-export const UNAVAILABLE_REASONS = Object.freeze(['quota', 'server', 'gone', 'auth', 'request', 'unreachable']);
-
-export const normModelName = (m) => String(m || '').toLowerCase().replace(/^[^/]+\//, '').replace(/[:@].*$/, '').replace(/[^a-z0-9.]+/g, '');
-
-/**
- * Classify a provider failure — an Error, or a `{ status, message }` the host built from a
- * response it did not throw on.
- */
-export function classifyFailure(err) {
-  const text = String(err?.message || err?.error || err || '');
-  const status = Number(err?.status) || Number(/\b(4\d\d|5\d\d)\b/.exec(text)?.[1]) || 0;
-  if (status === 402 || /credit|quota|billing|payment required|depleted/i.test(text)) return 'quota';
-  if (status === 429 || /rate.?limit|too many requests/i.test(text)) return 'rate';
-  // THE MODEL IS GONE, not our request. A 410 saying "reached its end of life", a 404 on the
-  // model name, a deprecation notice — every other model would handle this request fine, so
-  // failing the turn is the one response that helps nobody. Checked BEFORE the generic 4xx
-  // rule, which would otherwise read this as our mistake and refuse to fail over.
-  if (status === 410
-    || /end of life|no longer available|has been (retired|deprecated|removed)|decommissioned/i.test(text)
-    // "The model X does not exist or you do not have access to it" — a 404 naming a model is
-    // the provider saying THIS model is unusable, not that our request was malformed.
-    || /model.*(does not exist|not found|no access|do not have access)|unknown model|no such model/i.test(text)
-    // An agent configured for a model it does not have. Nothing about that changes in thirty
-    // seconds, and retrying it costs a process spawn to be told the same thing.
-    || /invalid model selection|not recognized as a (known|custom) model|unsupported model/i.test(text)) return 'gone';
-  if (status >= 500 || /overloaded|unavailable|timeout|ECONNRESET/i.test(text)) return 'server';
-  // NOBODY IS LISTENING. A browser fetch to a dead endpoint throws TypeError: Failed to fetch
-  // (Safari: "Load failed"); Node says ECONNREFUSED. None carry a status.
-  if (/failed to fetch|load failed|networkerror|network error|connection refused|ECONNREFUSED|ERR_CONNECTION|ENOTFOUND|EHOSTUNREACH|ECONNABORTED|couldn't reach the gateway|gateway is not answering/i.test(text)) return 'unreachable';
-  // A BROKEN CONNECTION IS THIS PROVIDER'S, NOT THE REQUEST'S. An expired refresh token —
-  // "OAuth token exchange failed: HTTP 400 — invalid_grant" — says this provider's
-  // credentials went stale, and every other model would have answered the question fine.
-  if (status === 401 || status === 403
-    || /oauth|invalid[_ ]?grant|refresh[_ ]?token|token exchange|api[_ ]?key|unauthorized|not authenticated|authentication|credential|expired token|sign in|log ?in again/i.test(text)) {
-    return 'auth';
-  }
-  // A plain 400 usually IS a malformed request — but providers reject each other's
-  // parameters, tool schemas and sampling settings all the time. Failing over costs one
-  // extra attempt; dead-ending costs the user their turn.
-  if (status === 400) return 'request';
-  // Everything else gets tried elsewhere. A router that gives up on an unrecognised failure
-  // is a router that gives up.
-  return 'unknown';
-}
-
-/**
- * The health ledger: which models are standing down, and why.
- *
- * @param now       clock
- * @param onChange  `(snapshot) => void` — the host persists it (the extension: the session
- *                  area; the desktop: memory). Called after every change.
- */
-export function createModelHealth({ now = () => Date.now(), onChange = null } = {}) {
-  const health = new Map();   // id -> { until, reason, failures }
-  const byModel = new Map();  // normalised model name -> { providers:Set, until, reason }
-
-  const snapshot = () => ({
-    health: [...health].map(([id, h]) => [id, h]),
-    byModel: [...byModel].map(([k, m]) => [k, { providers: [...m.providers], until: m.until, reason: m.reason }]),
-  });
-  const changed = () => { try { onChange?.(snapshot()); } catch { /* persistence is best effort */ } };
-
-  return {
-    snapshot,
-
-    /** Load what another context already learned. Never overwrites what this one knows. */
-    hydrate(snap) {
-      if (!snap) return false;
-      const t = now();
-      for (const [id, h] of snap.health || []) if (h?.until > t && !health.has(id)) health.set(id, h);
-      for (const [k, m] of snap.byModel || []) {
-        if (!m || byModel.has(k)) continue;
-        byModel.set(k, { providers: new Set(m.providers || []), until: m.until || 0, reason: m.reason || null });
-      }
-      return true;
-    },
-
-    /** Record that a model failed, and stand it down for as long as that failure warrants. */
-    markUnhealthy(id, err, modelName = '') {
-      const reason = classifyFailure(err);
-      if (!id || !reason) return null;
-      // Learn about the MODEL, not only the endpoint. A model that is gone is gone everywhere,
-      // so one report is enough; anything else needs two providers to agree before we believe
-      // it is the model rather than the provider.
-      const key = normModelName(modelName);
-      if (key) {
-        const seen = byModel.get(key) || { providers: new Set(), until: 0, reason: null };
-        seen.providers.add(id);
-        if (reason === 'gone' || seen.providers.size >= 2) {
-          seen.until = now() + MODEL_STANDDOWN_MS;
-          seen.reason = reason;
-        }
-        byModel.set(key, seen);
-      }
-      const prev = health.get(id);
-      const failures = (prev?.failures || 0) + 1;
-      // Repeated failures extend the wait, capped — a model failing every time should be
-      // tried rarely, not never. The cap never shortens the base: capping a 24-hour
-      // stand-down at an hour would retry a model that no longer exists, 23 times a day.
-      const base = COOLDOWN_MS[reason] || COOLDOWN_MS.unknown;
-      const ceiling = Math.max(base, 60 * 60_000);
-      const until = now() + Math.min(base * failures, ceiling);
-      health.set(id, { until, reason, failures });
-      changed();
-      return { reason, until };
-    },
-
-    /** A model answered, so whatever was wrong is over. */
-    markHealthy(id) {
-      if (id && health.has(id)) { health.delete(id); changed(); }
-    },
-
-    /** `{ available, rateLimited, reason, until? }` for the router. Unknown models are healthy. */
-    healthOf(id, modelName = '') {
-      const key = normModelName(modelName);
-      if (key) {
-        const m = byModel.get(key);
-        if (m && m.until && now() < m.until) return { available: false, rateLimited: false, reason: m.reason, until: m.until, model: true };
-      }
-      const h = health.get(id);
-      if (!h || now() >= h.until) {
-        if (h) health.delete(id);   // expired; forget it rather than carrying dead state
-        return { available: true, rateLimited: false, reason: null };
-      }
-      // A rate limit is "not right now"; everything else on the list is "not available". The
-      // router rejects both; the reason it shows the user differs.
-      return { available: !UNAVAILABLE_REASONS.includes(h.reason), rateLimited: h.reason === 'rate', reason: h.reason, until: h.until };
-    },
-
-    /** What is currently stood down, for a settings page. */
-    unhealthyModels() {
-      const out = [];
-      const t = now();
-      for (const [id, h] of health) if (t < h.until) out.push({ id, ...h });
-      return out;
-    },
-
-    /** Forget everything. */
-    reset() { health.clear(); byModel.clear(); changed(); },
-  };
-}
+const _=18e5,p=Object.freeze({quota:18e5,rate:6e4,server:12e4,gone:864e5,auth:216e5,request:6e5,unreachable:3e5,unknown:3e4}),N=Object.freeze(["quota","server","gone","auth","request","unreachable"]),g=r=>String(r||"").toLowerCase().replace(/^[^/]+\//,"").replace(/[:@].*$/,"").replace(/[^a-z0-9.]+/g,"");function b(r){const s=String(r?.message||r?.error||r||""),n=Number(r?.status)||Number(/\b(4\d\d|5\d\d)\b/.exec(s)?.[1])||0;return n===402||/credit|quota|billing|payment required|depleted/i.test(s)?"quota":n===429||/rate.?limit|too many requests/i.test(s)?"rate":n===410||/end of life|no longer available|has been (retired|deprecated|removed)|decommissioned/i.test(s)||/model.*(does not exist|not found|no access|do not have access)|unknown model|no such model/i.test(s)||/invalid model selection|not recognized as a (known|custom) model|unsupported model/i.test(s)?"gone":n>=500||/overloaded|unavailable|timeout|ECONNRESET/i.test(s)?"server":/failed to fetch|load failed|networkerror|network error|connection refused|ECONNREFUSED|ERR_CONNECTION|ENOTFOUND|EHOSTUNREACH|ECONNABORTED|couldn't reach the gateway|gateway is not answering/i.test(s)?"unreachable":n===401||n===403||/oauth|invalid[_ ]?grant|refresh[_ ]?token|token exchange|api[_ ]?key|unauthorized|not authenticated|authentication|credential|expired token|sign in|log ?in again/i.test(s)?"auth":n===400?"request":"unknown"}function E({now:r=()=>Date.now(),onChange:s=null}={}){const n=new Map,l=new Map,d=()=>({health:[...n].map(([t,o])=>[t,o]),byModel:[...l].map(([t,o])=>[t,{providers:[...o.providers],until:o.until,reason:o.reason}])}),c=()=>{try{s?.(d())}catch{}};return{snapshot:d,hydrate(t){if(!t)return!1;const o=r();for(const[a,e]of t.health||[])e?.until>o&&!n.has(a)&&n.set(a,e);for(const[a,e]of t.byModel||[])!e||l.has(a)||l.set(a,{providers:new Set(e.providers||[]),until:e.until||0,reason:e.reason||null});return!0},markUnhealthy(t,o,a=""){const e=b(o);if(!t||!e)return null;const i=g(a);if(i){const u=l.get(i)||{providers:new Set,until:0,reason:null};u.providers.add(t),(e==="gone"||u.providers.size>=2)&&(u.until=r()+18e5,u.reason=e),l.set(i,u)}const f=(n.get(t)?.failures||0)+1,h=p[e]||p.unknown,v=Math.max(h,60*6e4),m=r()+Math.min(h*f,v);return n.set(t,{until:m,reason:e,failures:f}),c(),{reason:e,until:m}},markHealthy(t){t&&n.has(t)&&(n.delete(t),c())},healthOf(t,o=""){const a=g(o);if(a){const i=l.get(a);if(i&&i.until&&r()<i.until)return{available:!1,rateLimited:!1,reason:i.reason,until:i.until,model:!0}}const e=n.get(t);return!e||r()>=e.until?(e&&n.delete(t),{available:!0,rateLimited:!1,reason:null}):{available:!N.includes(e.reason),rateLimited:e.reason==="rate",reason:e.reason,until:e.until}},unhealthyModels(){const t=[],o=r();for(const[a,e]of n)o<e.until&&t.push({id:a,...e});return t},reset(){n.clear(),l.clear(),c()}}}export{p as COOLDOWN_MS,N as UNAVAILABLE_REASONS,b as classifyFailure,E as createModelHealth,g as normModelName};