@ebony-vinyl/dsh-our-free-model 2.7.4 → 2.8.2

package/src/feed.js

@@ -109,6 +109,11 @@ function parseItem(row, now) {
     && /^https?:\/\//i.test(row.link.url)) {
     link = { url: row.link.url, label: typeof row.link.label === 'string' ? row.link.label.slice(0, 100) : '' }
   }
+  // `holdSeconds` asks the client to keep the modal's close control locked for
+  // a few seconds so the body is actually read (0/absent closes immediately).
+  // The ceiling keeps an owner from writing "hold for a week".
+  const holdSeconds = row.holdSeconds
+  const hold = Number.isInteger(holdSeconds) && holdSeconds >= 0 && holdSeconds <= 30 ? holdSeconds : 0
   return {
     id,
     title,
@@ -118,6 +123,7 @@ function parseItem(row, now) {
     ...expiresAt === undefined ? {} : { expiresAt },
     ...row.pinned === true ? { pinned: true } : {},
     ...link === undefined ? {} : { link },
+    ...(hold > 0 ? { holdSeconds: hold } : {}),
   }
 }
 

package/src/http.js

@@ -419,7 +419,12 @@ function emptyBodyFailure(status, retryAfterMs, imageContent) {
 }
 
 export async function postStreamed({ path, body, session, attributionUserAgent, signal, onData, timeoutMs = 300000 }) {
-  const headers = gatewayHeaders({ session: truncateSession(session), stream: true })
+  // The Messages wire carries the 2.x client's beta header (o2a/headers.js);
+  // the path is the only wire signal this layer sees. The project id derives
+  // from the same canonical session, so one conversation's retries,
+  // continuations and refreshes share one upstream quota bucket (PR #757).
+  const canonical = truncateSession(session)
+  const headers = gatewayHeaders({ session: canonical, project: canonical, stream: true, anthropic: path.includes('/messages') })
   headers['user-agent'] = userAgentWith(attributionUserAgent)
   let response
   try {
@@ -429,6 +434,13 @@ export async function postStreamed({ path, body, session, attributionUserAgent,
     // `TimeoutError`/user Error rather than `AbortError` — testing the name alone
     // reported a cancelled turn as `TRANSPORT`, which is retryable.
     if (signal?.aborted === true || error?.name === 'AbortError') throw new UpstreamError('request aborted', CODE.aborted)
+    // A lane-configuration refusal (a missing Bun, an unusable proxy) is not an
+    // "upstream request failed": the sentence the lane wrote is already the
+    // actionable answer, so it ships unwrapped, with its flag intact for the
+    // surfaces that distinguish "fix your environment" from "upstream broke".
+    if (error?.laneConfig === true) {
+      throw new UpstreamError(String(error?.message ?? error), CODE.transport, { laneConfig: true })
+    }
     throw new UpstreamError(`our-free-model: upstream request failed: ${error?.message ?? error}${transportCause(error)}`, CODE.transport)
   }
 
@@ -623,7 +635,8 @@ export async function readSse(source, onData, signal, timeoutMs = 300000) {
 
 /** Fetch a small JSON document from the gateway with the fingerprint headers. */
 export async function getJson(path, { session, attributionUserAgent, signal, timeoutMs = 15000 } = {}) {
-  const headers = gatewayHeaders({ session: truncateSession(session ?? ''), stream: false, accept: 'application/json' })
+  const canonical = truncateSession(session ?? '')
+  const headers = gatewayHeaders({ session: canonical, project: canonical, stream: false, accept: 'application/json' })
   headers['user-agent'] = userAgentWith(attributionUserAgent)
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)

package/src/kilo.js

@@ -25,8 +25,20 @@ import { egressFetch } from './egress.js'
 const LISTING_TIMEOUT_MS = 15000
 const TURN_TIMEOUT_MS = 300000
 
-/** Overridable for the offline suite and the live probes, like the free lane's base. */
-export const KILO_BASE = (process.env.OUR_FREE_MODEL_KILO_BASE ?? 'https://api.kilo.ai/api/gateway').replace(/\/+$/, '')
+/**
+ * The gateway base, newest first (`ai-gateway.kilo.ai` is what the official
+ * docs publish; the older `api.kilo.ai/api/gateway` path answers the same
+ * catalog and stays as the override/fallback). Overridable for the offline
+ * suite and the live probes, like the free lane's base.
+ */
+export const KILO_BASE = (process.env.OUR_FREE_MODEL_KILO_BASE ?? 'https://ai-gateway.kilo.ai/api/v1').replace(/\/+$/, '')
+
+/** The attribution headers Kilo's own clients send; documented optional, and a
+ *  gateway that ranks by referrer sees the plugin, not a spoofed editor. */
+const KILO_ATTRIBUTION = {
+  'http-referer': 'https://kilo.ai/',
+  'x-title': 'Our Free Model',
+}
 
 /**
  * The lane's transport is `egressFetch`, exactly like the free lane's: an
@@ -37,7 +49,13 @@ function kiloFetch(url, init) {
   return egressFetch(url, init)
 }
 
-/** One listing round: `GET {base}/models`. Returns the parsed JSON document. */
+/** The cached listing document and its validator, for conditional rounds. */
+let listingCache = null
+let listingETag = null
+
+/** One listing round: `GET {base}/models`, conditionally when the gateway
+ *  named a validator last time. Returns the parsed JSON document; a `304`
+ *  answers with the cached one. */
 export async function fetchKiloListing({ signal, timeoutMs = LISTING_TIMEOUT_MS } = {}) {
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), timeoutMs)
@@ -46,15 +64,27 @@ export async function fetchKiloListing({ signal, timeoutMs = LISTING_TIMEOUT_MS
   const onCallerAbort = () => { callerAborted = true; controller.abort() }
   signal?.addEventListener('abort', onCallerAbort, { once: true })
   try {
+    const headers = {
+      accept: 'application/json',
+      'user-agent': 'dsh-our-free-model',
+      ...KILO_ATTRIBUTION,
+      ...(listingETag !== null ? { 'if-none-match': listingETag } : {}),
+    }
     const response = await kiloFetch(`${KILO_BASE}/models`, {
-      headers: { accept: 'application/json', 'user-agent': 'dsh-our-free-model' },
+      headers,
       redirect: 'error',
       signal: controller.signal,
     })
+    if (response.status === 304 && listingCache !== null) return listingCache
     const text = await response.text()
     let payload
     try { payload = JSON.parse(text) } catch { payload = { error: { message: text.slice(0, 300) || `HTTP ${response.status}` } } }
     if (!response.ok) throw classifyFailure(response.status, payload)
+    const etag = response.headers.get('etag')
+    if (typeof etag === 'string' && etag !== '') {
+      listingETag = etag
+      listingCache = payload
+    }
     return payload
   } catch (error) {
     if (error instanceof UpstreamError) throw error
@@ -83,7 +113,7 @@ export async function postKiloStreamed({ body, signal, onData, timeoutMs = TURN_
   try {
     response = await kiloFetch(`${KILO_BASE}/chat/completions`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json', accept: 'text/event-stream', 'user-agent': 'dsh-our-free-model' },
+      headers: { 'content-type': 'application/json', accept: 'text/event-stream', 'user-agent': 'dsh-our-free-model', ...KILO_ATTRIBUTION },
       body: bodyText,
       redirect: 'error',
       signal,
@@ -151,9 +181,29 @@ function classifyKilo(status, text, retryAfterMs) {
   let payload
   try { payload = JSON.parse(text) } catch { payload = { error: { message: text.slice(0, 300) || `HTTP ${status}` } } }
   const type = payload?.error_type ?? payload?.error?.code ?? payload?.error?.type
+  const rawMeta = payload?.error?.metadata?.raw ?? payload?.metadata?.raw
+  let message = payload?.error?.message ?? (typeof payload?.message === 'string' ? payload.message : undefined)
+  if (typeof rawMeta === 'string' && rawMeta.trim() !== '') {
+    let rawDetail = ''
+    try {
+      const parsed = JSON.parse(rawMeta)
+      rawDetail = typeof parsed?.error === 'string' ? parsed.error
+        : typeof parsed?.message === 'string' ? parsed.message
+        : typeof parsed?.error?.message === 'string' ? parsed.error.message
+        : ''
+    } catch {
+      rawDetail = rawMeta.slice(0, 200).trim()
+    }
+    const providerName = payload?.error?.metadata?.provider_name ?? payload?.metadata?.provider_name
+    const providerSuffix = typeof providerName === 'string' && providerName !== '' ? ` (${providerName})` : ''
+    if (rawDetail !== '') {
+      message = message ? `${message}: ${rawDetail}${providerSuffix}` : `${rawDetail}${providerSuffix}`
+    }
+  }
   const shaped = {
     error: {
       ...payload?.error,
+      ...(message !== undefined ? { message } : {}),
       ...(type === undefined ? {} : { type: String(type) }),
     },
   }

package/src/magpie-engine.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process'
 import { randomBytes, createHash } from 'node:crypto'
-import { existsSync, readFileSync, createReadStream } from 'node:fs'
+import { existsSync, readFileSync, createReadStream, statSync } from 'node:fs'
 import { mkdir, readFile, writeFile, rename, link, unlink, realpath } from 'node:fs/promises'
 import http from 'node:http'
 import net from 'node:net'
@@ -400,6 +400,11 @@ const engineAppearanceCSS = `
 :root[data-ofm-engine] #addSheet > .row-head { height:auto; min-height:32px; gap:8px; }
 :root[data-ofm-engine] #addSheet .find { height:32px; }
 :root[data-ofm-engine] #addSheet .kind { padding-top:16px; }
+/* Upstream's "Compact at" row (#876) shrinks and wraps inside the agent prefs,
+   but the settings lists kept it flex:none: at a narrow panel width the fixed
+   76px number input sticks past the clipped list and loses half its width.
+   The same shrink-and-wrap answer, for the rows upstream missed. */
+:root[data-ofm-engine] .row.pref .compact-at { flex:0 1 auto; min-width:0; flex-wrap:wrap; row-gap:6px; }
 :root[data-ofm-engine-theme] {
   --ofm-bg:#f4f4f6; --ofm-card:#fff; --ofm-fg:#1c1c21; --ofm-quiet:#63636b;
   --ofm-muted:#85858d; --ofm-line:#e3e3e8; --ofm-accent:#4f46e5;
@@ -762,7 +767,31 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
       const env = { ...process.env }
       // An inherited Magpie override must never redirect this owned instance.
       for (const key of Object.keys(env)) if (key.toUpperCase().startsWith('MAGPIE_')) delete env[key]
+      // The engine wires every agent it finds under the user's home (ZCode's
+      // provider_config.json, Codex's config.toml, …) to itself when it starts.
+      // This engine's catalog is its own and may be empty, so that startup sync
+      // would rewrite those agents with no models. Give it a home of its own:
+      // it still serves its page, and no file of a real agent is touched. The
+      // Windows folders os.UserConfigDir reads are moved too, for the agents
+      // that keep their settings there (VS Code, Cline, …).
+      const agentHome = path.join(home, 'agent-home')
+      const agentRoaming = path.join(agentHome, 'AppData', 'Roaming')
+      const agentLocal = path.join(agentHome, 'AppData', 'Local')
+      for (const dir of [agentHome, agentRoaming, agentLocal]) {
+        await mkdir(dir, { recursive: true, mode: 0o700 })
+      }
+      // Windows folds every ancestor of a session folder into a 260-character
+      // budget; this redirection adds ~40, and claude appends a slug of the
+      // whole project path on top. A long or non-ASCII data home is the class
+      // of failure behind "rename the folder to something short and it works"
+      // — say so up front, with the escape hatch, instead of leaving a bare
+      // mkdir error nobody can act on.
+      if (agentHome.length > 200 || /[^\x20-\x7E]/.test(agentHome)) {
+        logger?.warn?.(`our-free-model: 引擎数据目录较长或含非 ASCII 字符（${agentHome.length} 字符）——Claude 等客户端可能无法新建会话文件夹；如遇到，请把 DSH_HOME 指向一个短的纯英文路径后重启。(engine data home is long or contains non-ASCII characters; if agents cannot create session folders, point DSH_HOME at a short ASCII path and restart)`)
+      }
       Object.assign(env, {
+        HOME: agentHome, USERPROFILE: agentHome,
+        APPDATA: agentRoaming, LOCALAPPDATA: agentLocal,
         XDG_CONFIG_HOME: dirs.config, XDG_CACHE_HOME: dirs.cache,
         XDG_DATA_HOME: dirs.data, XDG_STATE_HOME: dirs.state,
         MAGPIE_ADDR: `127.0.0.1:${gatewayPort}`, MAGPIE_WEB_KEY: webKey,
@@ -924,7 +953,13 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
       if (failure.statusCode === 400) throw engineError('Invalid gateway key request', 400)
       if (failure.statusCode === 413) throw engineError('Gateway key request exceeds limit', 413)
       if (options.signal?.aborted) throw new DOMException('Engine request aborted', 'AbortError')
-      throw engineError('Engine request failed')
+      // The engine's own transport refusals carry the actionable fact (the
+      // refused path, the socket error); a bare "Engine request failed" turns a
+      // diagnosable boot into a support thread. Keep the detail, bounded, and
+      // never from response bodies — those can quote user content.
+      const detail = typeof failure?.message === 'string' && failure.message !== ''
+        ? `: ${failure.message.slice(0, 160)}` : ''
+      throw engineError(`Engine request failed${detail}`)
     }
   }
   const proxy = async (req, res, subpath = '/', options = {}) => {
@@ -1101,3 +1136,27 @@ export function createMagpieEngine({ dataDir, logger, binary } = {}) {
   }
   return { start, status, close, request, proxy, gateway }
 }
+
+/**
+ * A lightweight PATH probe for the agent CLIs the engine connects to (claude
+ * first among them). The engine manages agent installs itself, but its
+ * downloader cannot reach the release host from every network, so the practical
+ * requirement is a pre-installed CLI — warn at boot instead of at the user's
+ * first failed connect. Never resolves shell shims deeper than a PATH entry.
+ */
+export function findAgentCli(command) {
+  const name = String(command ?? '').trim()
+  if (name === '' || name.includes('/') || name.includes('\\')) return undefined
+  const spellings = process.platform === 'win32' ? ['.cmd', '.bat', '.exe', ''] : ['']
+  const dirs = [
+    ...(process.env.PATH ?? '').split(path.delimiter).filter(Boolean),
+    ...(process.platform === 'win32' && process.env.APPDATA ? [path.join(process.env.APPDATA, 'npm')] : []),
+  ]
+  for (const dir of dirs) {
+    for (const spelling of spellings) {
+      const candidate = path.join(dir, `${name}${spelling}`)
+      try { if (statSync(candidate).isFile()) return candidate } catch { /* try the next spelling */ }
+    }
+  }
+  return undefined
+}

package/src/magpie-models.js

@@ -4,14 +4,42 @@ import { deniedModel } from './magpie-policy.js'
 
 const PREFIX = 'subscription:magpie/'
 
+/**
+ * Engine inference rides the host's replaceable `globalThis.fetch` — the same
+ * transport the imported sidecar subscriptions already use — so local proxy
+ * plugins that swap `globalThis.fetch` to re-serialize outgoing bodies can see
+ * engine turns again, as they could before the 2026-10-24 private-transport
+ * quarantine. Startup, health, management and catalog reads keep the private
+ * loopback transport: a broken fetch replacement must never keep the workspace
+ * from becoming ready. An explicit `fetchImpl` (tests, embedded hosts) still
+ * governs both paths, and OFM_ENGINE_PRIVATE_FETCH=1 forces inference back
+ * onto the private transport.
+ */
+function defaultInferenceTransport() {
+  return process.env.OFM_ENGINE_PRIVATE_FETCH === '1' ? loopbackFetch : globalThis.fetch
+}
+
 /** Expose the engine's live catalog through the existing DSH stream adapter. */
-export function createMagpieModels({ engine, stats, logger, onChanged = () => {}, fetchImpl = loopbackFetch }) {
+export function createMagpieModels({ engine, stats, logger, onChanged = () => {}, fetchImpl = loopbackFetch, inferenceFetch, extensionRuntime } = {}) {
   let models = []
   let pending
   let closed = false
   let owner
+  // An explicit fetchImpl governs inference and catalog alike (the historical
+  // contract); otherwise inference is the replaceable transport and only the
+  // catalog read stays private.
+  const catalogFetch = fetchImpl
+  const inferenceTransport = inferenceFetch ?? (fetchImpl !== loopbackFetch ? fetchImpl : defaultInferenceTransport())
   const runtime = createSubscriptionRuntime({
-    stats, logger, fetchImpl,
+    stats, logger,
+    fetchImpl: inferenceTransport,
+    // Enhancement extensions get the same fail-open body seam the harness lane
+    // gives them: one plain-object pass, microseconds, no gateway hop.
+    onPayload: async (payload, meta) => {
+      const source = typeof extensionRuntime === 'function' ? extensionRuntime() : extensionRuntime
+      if (source?.applyRequestHooks === undefined) return payload
+      return source.applyRequestHooks(payload, { ...meta, lane: 'magpie' })
+    },
     subscriptions: {
       list: () => [{
         id: 'magpie', provider: 'magpie', enabled: engine.status().state === 'ready',
@@ -65,7 +93,7 @@ export function createMagpieModels({ engine, stats, logger, onChanged = () => {}
       if (pending) return pending
       pending = (async () => {
         const gateway = engine.gateway()
-        const response = await fetchImpl(`${gateway.url.replace(/\/$/, '')}/v1/models`, {
+        const response = await catalogFetch(`${gateway.url.replace(/\/$/, '')}/v1/models`, {
           headers: { authorization: `Bearer ${gateway.key}` },
           signal: AbortSignal.timeout(15000), redirect: 'error',
         })

package/src/model-test.js

@@ -84,7 +84,9 @@ export function modelAvailability(id, snapshot, listed = false) {
   // Older saved snapshots have only `at`, which retains their previous order.
   const measured = manual && (!probe || manual.at >= (probe.startedAt ?? probe.at)) ? manual : probe
   return {
-    availabilitySource: measured === manual && manual ? 'manual' : listed ? 'listing' : 'probe',
+    availabilitySource: measured === manual && manual ? 'manual'
+      : measured?.source === 'passive' ? 'passive'
+        : listed ? 'listing' : 'probe',
     availability: measured?.state ?? 'unknown',
     detail: measured?.detail ?? '', probedAt: measured?.at ?? 0,
     ttftMs: measured?.ttftMs, latencyMs: measured?.latencyMs,