@flame0510/project-aether 1.1.15 → 1.3.0

package/lib/docker-exec.ts

@@ -6,7 +6,8 @@
  * thread does nothing else — no other request is served, no agent's stream
  * advances. Node's own guidance names `execSync` in a server as a
  * denial-of-service vector, and the numbers here bear that out: a bare
- * `docker exec … echo` costs ~260ms, and the OpenClaw CLI inside a container
+ * `docker exec … echo` costs ~90ms warm and ~225ms on the first call after an
+ * idle period, and the OpenClaw CLI inside a container
  * takes 2.5–6s per invocation because it boots a whole Node process.
  *
  * Routes that walk every agent multiplied that: `/api/crons` measured 19.2s on a
@@ -30,7 +31,12 @@ const DEFAULT_MAX_BUFFER = 1024 * 1024;
 
 export interface DockerExecOptions {
   timeoutMs?: number;
-  /** Extra environment for the command, passed as `-e KEY=VALUE`. */
+  /**
+   * Extra environment for the command. Only the *names* reach argv, as `-e KEY`;
+   * docker then forwards each value from its own environment. A value passed as
+   * `-e KEY=VALUE` would sit in the process table for anyone on the host to read
+   * with `ps`, and in the text of any rejection Node builds from that argv.
+   */
   env?: Record<string, string>;
   maxBuffer?: number;
   signal?: AbortSignal;
@@ -38,11 +44,32 @@ export interface DockerExecOptions {
 
 function baseArgs(container: string, opts?: DockerExecOptions): string[] {
   const args = ['exec'];
-  for (const [k, v] of Object.entries(opts?.env ?? {})) args.push('-e', `${k}=${v}`);
+  for (const k of Object.keys(opts?.env ?? {})) args.push('-e', k);
   args.push(container);
   return args;
 }
 
+/**
+ * Rebuild a failure without the command that produced it.
+ *
+ * Node composes its own message as `Command failed: <argv…>\n<stderr>`, and the
+ * argv holds whatever the caller put in the script. For credential delivery that
+ * is the secret — base64 is encoding, not protection — and the message travels:
+ * `syncProfileToAgents` puts it in `SyncResult.error`, which the sync route
+ * returns to the browser. The most common failure of all, a revoked or expired
+ * token, is exactly the one that triggers it.
+ *
+ * `stderr` is kept because that is the part that actually explains the failure.
+ */
+function execFailure(e: unknown, container: string): Error {
+  const err = e as { stderr?: string; code?: number; killed?: boolean; name?: string };
+  // An abort is the caller's own doing and is matched on elsewhere by name.
+  if (err.name === 'AbortError') return e as Error;
+  const cause = err.killed ? 'timed out' : err.code !== undefined ? `exit ${err.code}` : 'failed';
+  const detail = (err.stderr ?? '').trim();
+  return new Error(`docker exec ${container}: ${cause}${detail ? ` — ${detail}` : ''}`);
+}
+
 /**
  * Run a command inside a container, passing argv directly.
  *
@@ -59,17 +86,22 @@ export async function dockerExec(
 ): Promise<string> {
   if (!resolveDockerSocket()) throw new Error('Docker is not available');
 
-  const { stdout } = await execFileAsync(
-    'docker',
-    [...baseArgs(container, opts), ...argv],
-    {
-      encoding: 'utf-8',
-      timeout: opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-      maxBuffer: opts?.maxBuffer ?? DEFAULT_MAX_BUFFER,
-      signal: opts?.signal,
-    },
-  );
-  return stdout;
+  try {
+    const { stdout } = await execFileAsync(
+      'docker',
+      [...baseArgs(container, opts), ...argv],
+      {
+        encoding: 'utf-8',
+        timeout: opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: opts?.maxBuffer ?? DEFAULT_MAX_BUFFER,
+        signal: opts?.signal,
+        ...(opts?.env ? { env: { ...process.env, ...opts.env } } : {}),
+      },
+    );
+    return stdout;
+  } catch (e) {
+    throw execFailure(e, container);
+  }
 }
 
 /**
@@ -132,6 +164,10 @@ export function dockerExecWithInput(
   return new Promise((resolve, reject) => {
     const child = spawn('docker', ['exec', '-i', ...baseArgs(container, opts).slice(1), ...argv], {
       stdio: ['pipe', 'pipe', 'pipe'],
+      // `baseArgs` names the variables but carries no values, so they have to
+      // reach docker through its own environment — without this the container
+      // would be handed empty variables and never say why.
+      ...(opts?.env ? { env: { ...process.env, ...opts.env } } : {}),
     });
 
     let stdout = '';

package/lib/model-catalogue.ts

@@ -2,14 +2,13 @@
  * Model catalogue — bundle-first + user-overrides.
  *
  * Reads the bundled models.config.json from the npm package and applies
- * user toggles from REV4A_DATA/model-overrides.json.
- *
- * Imported by both provider/route.ts and gateway/sync.ts — shared logic,
- * avoids circular dependencies.
+ * user toggles from REV4A_DATA/model-overrides.json. The only module that reads
+ * either file: routes, pages and the sync all go through it.
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import { REV4A_DATA } from '@/lib/rev4a-paths';
+import { readProviderKeys } from '@/app/api/gateway/provider/keys';
 
 /* ------------------------------------------------------------------ */
 /*  Types                                                              */
@@ -21,6 +20,8 @@ export interface ModelConfigEntry {
   provider: string;
   enabled: boolean;
   modality?: string;
+  /** Upstream has retired this id. It still answers, but is redirected. */
+  deprecated?: boolean;
 }
 
 /* ------------------------------------------------------------------ */
@@ -45,21 +46,61 @@ function resolveBundledPath(): string {
 /*  Loaders                                                             */
 /* ------------------------------------------------------------------ */
 
+/** Last catalogue read successfully by this process. */
+let lastGoodBundle: ModelConfigEntry[] | null = null;
+
+/** How the most recent read of models.config.json went. */
+let bundleStatus: 'ok' | 'stale' | 'unavailable' = 'ok';
+
+/**
+ * Where the last catalogue read left us:
+ * - `ok`          the file was read and parsed
+ * - `stale`       the read failed; this process's last good copy was used
+ * - `unavailable` the read failed with no earlier copy, so the catalogue is empty
+ */
+export function bundledCatalogueStatus(): 'ok' | 'stale' | 'unavailable' {
+  return bundleStatus;
+}
+
+/**
+ * The bundled catalogue.
+ *
+ * A failed read must not look like an empty catalogue. It used to: this returned
+ * `[]`, the loader then treated every user override as an orphan and deleted them
+ * all from disk, the sync pushed an empty model list into every agent, and the
+ * proxy refused every request. One unlucky read — the pricing script rewriting the
+ * file in place, a malformed release — was enough. A failed read now falls back to
+ * the last good copy and reports it through `bundledCatalogueStatus()`.
+ */
 function loadBundledModels(): ModelConfigEntry[] {
   try {
     const raw = fs.readFileSync(resolveBundledPath(), 'utf-8');
     const parsed = JSON.parse(raw);
-    if (Array.isArray(parsed.models)) {
-      return parsed.models.map((m: Record<string, unknown>) => ({
-        id: String(m.id ?? ''),
-        name: String(m.name ?? ''),
-        provider: String(m.provider ?? ''),
-        enabled: Boolean(m.enabled),
-        modality: typeof m.modality === 'string' ? m.modality : undefined,
-      }));
+    if (!Array.isArray(parsed.models) || parsed.models.length === 0) {
+      throw new Error('no models array');
     }
-  } catch { /* fall through */ }
-  return [];
+    const models: ModelConfigEntry[] = parsed.models.map((m: Record<string, unknown>) => ({
+      id: String(m.id ?? ''),
+      name: String(m.name ?? ''),
+      provider: String(m.provider ?? ''),
+      enabled: Boolean(m.enabled),
+      modality: typeof m.modality === 'string' ? m.modality : undefined,
+      deprecated: m.deprecated === true ? true : undefined,
+    }));
+    lastGoodBundle = models;
+    bundleStatus = 'ok';
+    return models;
+  } catch (e) {
+    const why = (e as Error).message;
+    if (lastGoodBundle) {
+      if (bundleStatus !== 'stale') console.warn(`[model-catalogue] models.config.json unreadable, using the last good copy: ${why}`);
+      bundleStatus = 'stale';
+      return lastGoodBundle;
+    }
+    if (bundleStatus !== 'unavailable') console.error(`[model-catalogue] models.config.json unreadable and no earlier copy: ${why}`);
+    bundleStatus = 'unavailable';
+    return [];
+  }
 }
 
 export function loadOverrides(): Record<string, boolean> {
@@ -90,23 +131,14 @@ export function writeOverrides(overrides: Record<string, boolean>): void {
  * 1. Read models.config.json from the npm package (bundle).
  * 2. Apply user overrides (enabled/disabled toggles).
  *
- * The bundle is read-only at runtime. User choices live in model-overrides.json.
+ * Read-only. Overrides for ids the bundle no longer has are ignored here and
+ * pruned only by `toggleModelOverride`, against a fresh read: this runs on every
+ * proxy request, and a read path that deletes user settings is one failed read
+ * away from deleting all of them.
  */
 export function loadModelsConfig(): ModelConfigEntry[] {
   const bundled = loadBundledModels();
   const overrides = loadOverrides();
-
-  // Clean up orphan overrides (models removed from bundle)
-  const bundledIds = new Set(bundled.map((m) => m.id));
-  let dirty = false;
-  for (const id of Object.keys(overrides)) {
-    if (!bundledIds.has(id)) {
-      delete overrides[id];
-      dirty = true;
-    }
-  }
-  if (dirty) writeOverrides(overrides);
-
   return bundled.map((m) => ({
     ...m,
     enabled: Object.prototype.hasOwnProperty.call(overrides, m.id) ? overrides[m.id] : m.enabled,
@@ -126,6 +158,87 @@ export function toggleModelOverride(modelId: string, enabled: boolean): boolean
   } else {
     overrides[modelId] = enabled;
   }
+
+  // Drop overrides for models the catalogue no longer has — but only against a
+  // catalogue read just now. Against a stale or missing copy every override
+  // would look orphaned.
+  if (bundledCatalogueStatus() === 'ok') {
+    const ids = new Set(bundled.map((m) => m.id));
+    for (const id of Object.keys(overrides)) if (!ids.has(id)) delete overrides[id];
+  }
+
   writeOverrides(overrides);
   return true;
 }
+
+/**
+ * The models this deployment actually offers.
+ *
+ * Two conditions, and they are separate questions:
+ *
+ *  - **enabled** — policy. What the operator wants offered, `models.config.json`
+ *    as the default and `model-overrides.json` as their decision on top.
+ *  - **provider has a key** — availability. Offering a model nobody can be billed
+ *    for produces a runtime failure at the worst moment.
+ *
+ * This exists because four readers each answered it differently, and the answers
+ * mattered. Measured on the production host, which has keys for four providers
+ * and eight overrides that all diverge from the bundled default: the create
+ * wizard listed 58 models where the correct answer was 62, offering two the
+ * operator had switched off and hiding six they had switched on. It read the
+ * bundle directly and never opened the overrides file. Meanwhile
+ * `/api/provider/v1/models` applied the overrides but not the key filter, so it
+ * advertised models for providers with no credentials.
+ *
+ * Callers still shape the result themselves — the sync adds `input` modalities,
+ * the pickers add prices — but the *set* is decided here, once.
+ */
+export function loadOfferedModels(): ModelConfigEntry[] {
+  const configured = new Set(Object.keys(readProviderKeys()));
+  return loadModelsConfig().filter((m) => {
+    if (!m.enabled) return false;
+    if (configured.has(m.provider)) return true;
+    // A `rev4a/*` alias bills through DeepSeek upstream, so a DeepSeek key is
+    // enough to offer one. The catalogue currently defines none.
+    if (m.provider === 'rev4a' && configured.has('deepseek')) return true;
+    return false;
+  });
+}
+
+/**
+ * May this deployment serve a request for this model?
+ *
+ * `loadOfferedModels` answers what to *show*; this answers what to *honour*. They
+ * were the same question asked in two places and only the first was ever asked:
+ * the proxy and the assistant took whatever model the caller named and billed it.
+ * Unchecking a model on the Gateway page removed it from every picker and stopped
+ * nothing, because a client that already held the id — a stale in-memory list, a
+ * saved preference, an agent configured before the change — kept working.
+ *
+ * Takes the *resolved* pair, not the raw string. Callers reach it through
+ * `extractProviderAndModel`, which collapses `rev4a/deepseek/deepseek-flash`,
+ * `deepseek/deepseek-flash` and the two-segment alias `rev4a/deepseek-flash` onto
+ * one provider and model, so all three are tested as the same catalogue id.
+ */
+export function isModelOffered(provider: string, model: string): boolean {
+  const id = `${provider}/${model}`;
+  return loadOfferedModels().some((m) => m.id === id);
+}
+
+/**
+ * Where a model id stands against the catalogue, for explaining a failure.
+ *
+ * - `offered`  — enabled and its provider has a key; the proxy serves it
+ * - `disabled` — in the catalogue but not offered: unchecked, or no key
+ * - `missing`  — not in the catalogue at all, e.g. removed in a release
+ *
+ * Takes a bare id, without the `rev4a/` prefix. The Model panel used to infer the
+ * cause from the offered list alone, so a model removed from the catalogue was
+ * explained as "unchecked, or its provider has no key" while the card said
+ * `NOT IN CATALOGUE`. `models-summary` computes the same two sets once for the
+ * whole fleet instead of calling this per agent.
+ */
+export function catalogueStatus(id: string): 'offered' | 'disabled' | 'missing' {
+  if (!loadModelsConfig().some((m) => m.id === id)) return 'missing';
+  return loadOfferedModels().some((m) => m.id === id) ? 'offered' : 'disabled';
+}

package/lib/rev4a-paths.ts

@@ -58,27 +58,6 @@ export const SHARED_SKILLS_DIR = path.join(REV4A_DATA, 'shared', 'shared-skills'
 /** Rev4a system rules injected into every agent workspace, mounted read-only. */
 export const REV4A_RULES_DIR = path.join(REV4A_DATA, 'shared', 'rev4a-rules');
 
-/**
- * Model catalogue — read-only, shipped with the package.
- * Resolved at module load from the package root (alongside bin/rev4a.js).
- */
-function resolvePackageFile(filename: string): string {
-  // cwd in dev (workspace checkout)
-  const cwdPath = path.join(process.cwd(), filename);
-  if (fs.existsSync(cwdPath)) return cwdPath;
-
-  // Installed package: this file is at <pkgRoot>/lib/rev4a-paths.js
-  const pkgRoot = path.resolve(__dirname, '..');
-  const pkgPath = path.join(pkgRoot, filename);
-  if (fs.existsSync(pkgPath)) return pkgPath;
-
-  // Last resort: accept that it may not exist (will throw at read time)
-  return cwdPath;
-}
-
-/** Static model catalogue — read-only, inside the package repo */
-export const MODELS_CONFIG_FILE = resolvePackageFile('models.config.json');
-
 /** Top-level .next build directory (kept inside npm package for now — built by rev4a serve) */
 export function nextDir(pkgRoot: string): string {
   return path.join(pkgRoot, '.next');