@galaxyproject/orbit 0.0.0 → 0.9.0

package/shared/provider-auth-caps.d.ts

@@ -0,0 +1,22 @@
+export interface ProviderAuthCaps {
+  /** pi's finished button text, e.g. "Sign in with OpenRouter". "" when pi gives none. */
+  signInLabel: string;
+  /** The account behind it, e.g. "Anthropic (Claude Pro/Max)". "" when pi gives none. */
+  providerLabel: string;
+  /** pi defines an API-key auth path for this provider (dual-auth when it also signs in). */
+  acceptsApiKey: boolean;
+}
+
+/** Shape of the bits of a pi registry provider entry this module reads. */
+export interface PiProviderAuthEntry {
+  id?: string;
+  auth?: {
+    apiKey?: unknown;
+    oauth?: { login?: unknown; name?: string; loginLabel?: string };
+  };
+}
+
+export function classifyProviderAuth(provider: PiProviderAuthEntry): ProviderAuthCaps | null;
+export function isOAuthOnly(caps: ProviderAuthCaps | undefined): boolean;
+export const SEED_PROVIDER_AUTH_CAPS: Record<string, ProviderAuthCaps>;
+export const SEED_OAUTH_ONLY_PROVIDERS: string[];

package/shared/provider-auth-caps.js

@@ -0,0 +1,57 @@
+/**
+ * What a provider's auth surface looks like, and the one predicate every layer
+ * has to agree on: does this provider authenticate ONLY by sign-in?
+ *
+ * pi models `auth.apiKey` and `auth.oauth` independently. `openai-codex` carries
+ * oauth alone; anthropic, xai, openrouter, kimi-coding, github-copilot and radius
+ * carry both. Reading "can sign in" as "has no API key" is what broke #429 --
+ * Orbit stopped showing, storing, reporting and injecting the Anthropic key the
+ * moment pi taught Anthropic to sign in. That rule now lives here once, instead
+ * of in the main process, the renderer and the CLI separately.
+ */
+
+/**
+ * Classify one provider's auth surface from pi's registry entry. Returns null
+ * when the provider offers no sign-in at all. Pure, so the predicate #429 got
+ * wrong is testable without an Electron or pi runtime.
+ */
+export function classifyProviderAuth(provider) {
+  const oauth = provider && provider.auth && provider.auth.oauth;
+  if (!oauth || !oauth.login) return null;
+  return {
+    // Two distinct things, deliberately not collapsed: pi's loginLabel is a
+    // finished button ("Sign in with OpenRouter"), while name is the account
+    // behind it ("Anthropic (Claude Pro/Max)"). Folding them into one field
+    // renders "Sign in with Sign in with OpenRouter".
+    signInLabel: oauth.loginLabel || "",
+    providerLabel: oauth.name || "",
+    acceptsApiKey: Boolean(provider.auth.apiKey),
+  };
+}
+
+/**
+ * Sign-in is the only way in, so there is no API key to ask for. Gates every
+ * "there is no key here" behavior: hiding the key field, masking `hasApiKey`,
+ * and skipping key injection into the brain. Dual-auth providers answer false.
+ *
+ * An unknown provider (no caps) answers false too -- offering a key field for a
+ * provider we haven't classified yet is the safe direction.
+ */
+export function isOAuthOnly(caps) {
+  return Boolean(caps && !caps.acceptsApiKey);
+}
+
+/**
+ * Known-good caps for the provider that ships sign-in enabled, used before the
+ * registry read lands (main, renderer) and as the CLI's static answer, which has
+ * no registry to read at all. Everything absent from it reads as "takes an API
+ * key" -- the safe default, since it offers a key field rather than hiding one.
+ */
+export const SEED_PROVIDER_AUTH_CAPS = {
+  "openai-codex": { signInLabel: "", providerLabel: "", acceptsApiKey: false },
+};
+
+/** The seed's sign-in-only ids. Deliberately NOT "everything that can sign in". */
+export const SEED_OAUTH_ONLY_PROVIDERS = Object.keys(SEED_PROVIDER_AUTH_CAPS).filter((id) =>
+  isOAuthOnly(SEED_PROVIDER_AUTH_CAPS[id]),
+);

package/shared/random.d.ts

@@ -0,0 +1,2 @@
+export function randomBytes(n: number): Uint8Array;
+export function randomHex(n: number): string;

package/shared/random.js

@@ -0,0 +1,15 @@
+/**
+ * Random bytes from the platform CSPRNG. Node 22+ (engines >=22.19) and workers
+ * both have globalThis.crypto, so nothing here imports `crypto`, and the brain's
+ * random ids need no Node edge.
+ */
+
+/** @param {number} n @returns {Uint8Array} */
+export function randomBytes(n) {
+  return globalThis.crypto.getRandomValues(new Uint8Array(n));
+}
+
+/** @param {number} n bytes @returns {string} 2n lowercase hex characters */
+export function randomHex(n) {
+  return Array.from(randomBytes(n), (b) => b.toString(16).padStart(2, "0")).join("");
+}

package/shared/record-excerpt.d.ts

@@ -0,0 +1,4 @@
+export const HEAD_MAX_CHARS: number;
+export const TAIL_MAX_CHARS: number;
+export const ELISION_MARKER: string;
+export function excerptHeadTail(content: string): { text: string; elided: boolean };

package/shared/record-excerpt.js

@@ -0,0 +1,16 @@
+// Shared head + tail excerpt of a record (Orbit's notebook.md, the browser's Galaxy Page) for
+// per-turn context. Head gives project intent and early plans; tail gives the latest activity.
+
+export const HEAD_MAX_CHARS = 2000;
+export const TAIL_MAX_CHARS = 4000;
+export const ELISION_MARKER = "_(... middle elided ...)_";
+
+/** @param {string} content @returns {{ text: string, elided: boolean }} */
+export function excerptHeadTail(content) {
+  if (content.length <= HEAD_MAX_CHARS + TAIL_MAX_CHARS + 100) {
+    return { text: content, elided: false };
+  }
+  const head = content.slice(0, HEAD_MAX_CHARS);
+  const tail = content.slice(-TAIL_MAX_CHARS);
+  return { text: `${head}\n\n${ELISION_MARKER}\n\n${tail}`, elided: true };
+}

package/shared/redirect-guard.d.ts

@@ -0,0 +1,36 @@
+export type RedirectRefusalKind = "cross-origin" | "unreadable" | "unparsable" | "too-many-hops";
+
+export declare class RedirectRefusedError extends Error {
+  readonly kind: RedirectRefusalKind;
+  readonly status: number;
+  readonly fromOrigin: string;
+  readonly toOrigin: string | null;
+  constructor(
+    message: string,
+    detail: {
+      kind: RedirectRefusalKind;
+      status: number;
+      fromOrigin: string;
+      toOrigin?: string | null;
+    },
+  );
+}
+
+export declare function originOf(url: string): string | null;
+
+export interface SameOriginFetchOptions {
+  /** Defaults to `globalThis.fetch`, resolved per call. */
+  fetchImpl?: typeof fetch;
+  /** Same-origin hops to allow before giving up. Default 3. */
+  maxHops?: number;
+  /** How the server is named in error messages. Default "The server". */
+  serverLabel?: string;
+  /** How the URL setting is named in error messages. Default "the configured URL". */
+  urlSettingLabel?: string;
+}
+
+export declare function fetchSameOriginOnly(
+  url: string,
+  init?: RequestInit,
+  options?: SameOriginFetchOptions,
+): Promise<Response>;

package/shared/redirect-guard.js

@@ -0,0 +1,235 @@
+// A fetch wrapper for requests that carry a credential header.
+//
+// Node's fetch defaults to `redirect: "follow"`, and undici strips only
+// `authorization`, `proxy-authorization`, `cookie` and `host` when a redirect
+// crosses origins. A custom credential header -- Galaxy's `x-api-key` -- is forwarded
+// intact, so a server that answers 3xx pointing at another host receives the
+// caller's key while the caller sees an ordinary result. This takes redirects
+// manually instead: only an exact same-origin hop is followed, everything else
+// throws.
+//
+// A scheme change counts as an origin change, so http://host -> https://host is
+// refused rather than followed. The key already went out in cleartext on the
+// first hop; quietly following the upgrade would hide that for good, and what
+// the user needs is to change the configured URL -- which the error says.
+//
+// Errors name the status and the target's ORIGIN. Never the full URL: a
+// redirect target's path or query can carry a token, and that would end up in
+// logs, notebooks and bug reports.
+
+/** Statuses that carry a Location and mean "go here instead". */
+const REDIRECT_STATUS_SET = new Set([301, 302, 303, 307, 308]);
+
+/** Request-body headers, dropped when a redirect turns the request into a GET. */
+const BODY_HEADERS = new Set([
+  "content-encoding",
+  "content-language",
+  "content-length",
+  "content-location",
+  "content-type",
+]);
+
+const DEFAULT_MAX_HOPS = 3;
+
+/**
+ * A redirect we would not follow, or could not follow safely.
+ *
+ * `kind` is what went wrong: `cross-origin` (the common one), `unreadable`
+ * (a redirect whose headers we cannot read at all), `unparsable` (a Location
+ * we can read but cannot resolve, so we cannot prove where it points) and
+ * `too-many-hops` (same-origin redirects that never settle).
+ */
+export class RedirectRefusedError extends Error {
+  /**
+   * @param {string} message
+   * @param {{ kind: "cross-origin" | "unreadable" | "unparsable" | "too-many-hops", status: number,
+   *           fromOrigin: string, toOrigin?: string | null }} detail
+   */
+  constructor(message, detail) {
+    super(message);
+    this.name = "RedirectRefusedError";
+    this.kind = detail.kind;
+    this.status = detail.status;
+    this.fromOrigin = detail.fromOrigin;
+    this.toOrigin = detail.toOrigin ?? null;
+  }
+}
+
+/** Scheme + host + port, or null when the URL will not parse. */
+export function originOf(url) {
+  try {
+    return new URL(String(url)).origin;
+  } catch {
+    return null;
+  }
+}
+
+/** Headers minus the request-body ones, in whatever shape they arrived. */
+function withoutBodyHeaders(headers) {
+  if (!headers) return headers;
+  if (typeof Headers !== "undefined" && headers instanceof Headers) {
+    const next = new Headers(headers);
+    for (const name of BODY_HEADERS) next.delete(name);
+    return next;
+  }
+  if (Array.isArray(headers)) {
+    return headers.filter(([name]) => !BODY_HEADERS.has(String(name).toLowerCase()));
+  }
+  return Object.fromEntries(
+    Object.entries(headers).filter(([name]) => !BODY_HEADERS.has(name.toLowerCase())),
+  );
+}
+
+/**
+ * The init for the next hop, applying the method rewrite fetch itself would:
+ * 301/302 turn a POST into a GET, 303 turns anything but GET/HEAD into a GET,
+ * and 307/308 preserve both method and body.
+ */
+function initForNextHop(init, status) {
+  const method = String(init.method ?? "GET").toUpperCase();
+  const rewrite =
+    ((status === 301 || status === 302) && method === "POST") ||
+    (status === 303 && method !== "GET" && method !== "HEAD");
+  if (!rewrite) return init;
+  const next = { ...init, method: "GET", headers: withoutBodyHeaders(init.headers) };
+  delete next.body;
+  return next;
+}
+
+/**
+ * `undefined` when the response's headers cannot be read at all, `null` when
+ * they can and carry no Location, otherwise the Location value. The first two
+ * are not the same thing: one means we do not know where the server is
+ * pointing, the other means it is not pointing anywhere.
+ */
+function readLocation(response) {
+  const get = response.headers?.get;
+  if (typeof get !== "function") return undefined;
+  return response.headers.get("location") || null;
+}
+
+/**
+ * Release an intermediate response we are not returning. Without this the
+ * body of every hop -- and of the redirect we refuse -- sits on its socket
+ * until the GC gets to it, which on a server that pads its 3xx bodies costs a
+ * connection and a buffer per call.
+ */
+function discard(response) {
+  try {
+    const cancelled = response?.body?.cancel?.();
+    if (cancelled && typeof cancelled.catch === "function") cancelled.catch(() => {});
+  } catch {
+    // Already consumed, already errored, or not a real Response: nothing to do.
+  }
+}
+
+/**
+ * Fetch `url`, following redirects only while they stay on the same origin.
+ *
+ * @param {string} url
+ * @param {RequestInit} [init]
+ * @param {{ fetchImpl?: typeof fetch, maxHops?: number, serverLabel?: string,
+ *           urlSettingLabel?: string }} [options]
+ * @returns {Promise<Response>}
+ */
+export async function fetchSameOriginOnly(url, init = {}, options = {}) {
+  // Resolved per call, not per module load, so a test (or a caller that
+  // injects one) can swap the implementation.
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  // NaN or Infinity here would quietly turn the hop limit off.
+  const maxHops =
+    Number.isInteger(options.maxHops) && options.maxHops >= 0 ? options.maxHops : DEFAULT_MAX_HOPS;
+  const serverLabel = options.serverLabel ?? "The server";
+  const urlSettingLabel = options.urlSettingLabel ?? "the configured URL";
+  const startOrigin = originOf(url) ?? String(url);
+
+  let currentUrl = String(url);
+  let currentInit = { ...init, redirect: "manual" };
+
+  for (let hop = 0; ; hop++) {
+    const response = await fetchImpl(currentUrl, currentInit);
+    const status = response?.status;
+    // Not a redirect at all: the caller's normal status handling owns it.
+    if (!REDIRECT_STATUS_SET.has(status)) return response;
+
+    const location = readLocation(response);
+    if (location === undefined) {
+      discard(response);
+      throw new RedirectRefusedError(
+        `${serverLabel} answered HTTP ${status} but where it was pointing could not be read, so the request was refused and no credentials were sent onward.`,
+        { kind: "unreadable", status, fromOrigin: startOrigin },
+      );
+    }
+    // A 3xx with no Location points nowhere, so there is nothing to refuse --
+    // the caller's `!response.ok` branch reports it the way it always has.
+    if (location === null) return response;
+
+    let target;
+    try {
+      target = new URL(location, currentUrl);
+    } catch {
+      discard(response);
+      throw new RedirectRefusedError(
+        `${serverLabel} answered HTTP ${status} with a redirect target that could not be read, so the request was refused and no credentials were sent to it.`,
+        { kind: "unparsable", status, fromOrigin: startOrigin },
+      );
+    }
+
+    if (target.origin !== startOrigin) {
+      discard(response);
+      throw new RedirectRefusedError(
+        crossOriginMessage(serverLabel, urlSettingLabel, status, startOrigin, target.origin),
+        {
+          kind: "cross-origin",
+          status,
+          fromOrigin: startOrigin,
+          toOrigin: target.origin,
+        },
+      );
+    }
+
+    if (hop >= maxHops) {
+      discard(response);
+      throw new RedirectRefusedError(
+        `${serverLabel} redirected the request more than ${maxHops} times within ${startOrigin} without ever settling, so the request was given up on.`,
+        { kind: "too-many-hops", status, fromOrigin: startOrigin, toOrigin: target.origin },
+      );
+    }
+
+    // Userinfo is dropped before re-issuing. It does not change the origin, so
+    // a Location carrying it would pass the check above and then die inside
+    // fetch with a TypeError that quotes the whole URL back -- path, query and
+    // all -- which is the one thing these errors must never do.
+    target.username = "";
+    target.password = "";
+
+    discard(response);
+    currentInit = initForNextHop(currentInit, status);
+    currentUrl = target.toString();
+  }
+}
+
+/**
+ * Two different sentences, because the two cases need opposite fixes: a bare
+ * scheme change is the user's own URL one edit away from correct, while a
+ * different host usually means the URL points at a proxy or a sign-in page.
+ */
+function crossOriginMessage(serverLabel, urlSettingLabel, status, fromOrigin, toOrigin) {
+  const prefix =
+    `${serverLabel} redirected the request (HTTP ${status}) to ${toOrigin}, which is a different ` +
+    `origin than the configured ${fromOrigin}. The request was refused and no credentials were ` +
+    `sent to it.`;
+  const sameHost = hostAndPort(fromOrigin) === hostAndPort(toOrigin);
+  return sameHost
+    ? `${prefix} Set ${urlSettingLabel} to ${toOrigin}.`
+    : `${prefix} Check that ${urlSettingLabel} points at the server itself rather than a proxy or a sign-in page.`;
+}
+
+function hostAndPort(origin) {
+  try {
+    const parsed = new URL(origin);
+    return `${parsed.hostname}:${parsed.port}`;
+  } catch {
+    return origin;
+  }
+}

package/shared/skills-pin.d.ts

@@ -0,0 +1,8 @@
+// Generated by scripts/sync-skills.mjs. Do not hand-edit; run `npm run sync:skills`.
+export const SKILLS_PIN: {
+  repo: string;
+  /** Commit the bundled content was vendored from. Tags move; this does not. */
+  commit: string;
+  commitDate: string | null;
+  tag: string | null;
+};

package/shared/skills-pin.js

@@ -0,0 +1,9 @@
+// Generated by scripts/sync-skills.mjs. Do not hand-edit; run `npm run sync:skills`.
+// The commit the bundled skill content was vendored from, for a shell to show
+// beside a bundled repo. `tag` is a label only; the commit is the pin.
+export const SKILLS_PIN = {
+  repo: "galaxyproject/agentic-plugins",
+  commit: "aa4da4bd68eb00e360dfd5aa6e998feb5de0ac49",
+  commitDate: "2026-09-17",
+  tag: null,
+};

package/shared/skills-router.d.ts

@@ -0,0 +1,17 @@
+export const SKILLS_SURFACE_ID: "loom";
+export function selectSkills<T extends { surfaces: string[] }>(entries: T[], surface?: string): T[];
+export interface SkillsRouterRepo {
+  name: string;
+  label?: string;
+}
+export interface SkillsRouterEntry {
+  path: string;
+  name: string;
+  description: string;
+  whenToUse?: string;
+}
+export function renderSkillsRouter(
+  repos: readonly SkillsRouterRepo[],
+  entriesByRepo: ReadonlyMap<string, readonly SkillsRouterEntry[]>,
+  options: { freshness?: string; defaultRepoPhrase: string; defaultRepo?: string | null },
+): string;

package/shared/skills-router.js

@@ -0,0 +1,63 @@
+// The skills router both shells put in the system prompt: which repos exist, what each offers this
+// surface, and the exact skills_fetch call for it. The em dashes are model-visible bytes the
+// browser's prompt snapshots pin, so they stay.
+
+/** The surface tag Orbit and the browser claim. A skill opts in with `surfaces: [loom]`. */
+export const SKILLS_SURFACE_ID = "loom";
+
+/**
+ * Tag-or-all: if any entry is tagged for this surface, keep only those; else keep all.
+ * @template {{ surfaces: string[] }} T
+ * @param {T[]} entries
+ * @param {string} [surface]
+ * @returns {T[]}
+ */
+export function selectSkills(entries, surface = SKILLS_SURFACE_ID) {
+  const tagged = entries.filter((e) => e.surfaces.includes(surface));
+  return tagged.length ? tagged : entries;
+}
+
+/**
+ * @param {{ name: string, label?: string }[]} repos
+ * @param {Map<string, { path: string, name: string, description: string, whenToUse?: string }[]>} entriesByRepo
+ * @param {{ freshness?: string, defaultRepoPhrase: string, defaultRepo?: string | null }} options
+ *   `defaultRepo` is the repo a `repo`-less fetch reaches, when that is not simply the first one
+ *   listed; null means none does, so every fetch line names its repo.
+ * @returns {string}
+ */
+export function renderSkillsRouter(
+  repos,
+  entriesByRepo,
+  { freshness, defaultRepoPhrase, defaultRepo: defaultRepoOption },
+) {
+  if (repos.length === 0) return "";
+  const lines = [
+    "## Skills repositories (operational know-how)",
+    "",
+    "Use the `skills_fetch({ repo, path })` tool to load a skill on demand. " +
+      "**Don't guess operational patterns from training data — fetch the relevant " +
+      `skill first.** ${freshness ? `${freshness} ` : ""}When \`repo\` is omitted, ` +
+      `${defaultRepoPhrase} is used.`,
+    "",
+    "### Configured repos",
+    "",
+    ...repos.map((r) => `- **${r.name}**${r.label ? ` — ${r.label}` : ""}`),
+    "",
+  ];
+  const defaultRepo = defaultRepoOption === undefined ? repos[0].name : defaultRepoOption;
+  for (const r of repos) {
+    const entries = entriesByRepo.get(r.name) ?? [];
+    if (entries.length === 0) continue;
+    lines.push(`### ${r.name} skills`, "");
+    for (const e of entries) {
+      const repoArg = r.name === defaultRepo ? "" : `repo: "${r.name}", `;
+      lines.push(
+        `- **${e.name}** — ${e.description} → \`skills_fetch({ ${repoArg}path: "${e.path}" })\``,
+      );
+      if (e.whenToUse) lines.push(`  When to use: ${e.whenToUse}`);
+    }
+    lines.push("");
+  }
+  lines.push("Read the SKILL.md fully before acting on what it teaches.", "");
+  return lines.join("\n");
+}

package/shared/sra-import.d.ts

@@ -0,0 +1,34 @@
+export type NormalizeName = (
+  name: string,
+  args: Record<string, unknown>,
+) => { name: string; args: Record<string, unknown> } | null;
+export interface SraCall {
+  key: string;
+  historyId: string;
+  toolId: string;
+  runs: string[] | undefined;
+  mapped: boolean;
+  fileList: boolean;
+}
+export interface SraBlock {
+  reason: string;
+  call: SraCall;
+  runs: string[];
+  cause: "mapped-import" | "duplicate-accession" | "split-batch";
+}
+export function parseObject(value: unknown): Record<string, unknown> | null;
+export function stable(value: unknown): string;
+export function flatten(inputs: Record<string, unknown>): Record<string, unknown>;
+export function accessions(value: unknown): string[] | undefined;
+export function sraCall(
+  name: unknown,
+  input: unknown,
+  options?: { normalizeName?: NormalizeName },
+): SraCall | null;
+export class SraImportGate {
+  constructor(options: { remediation: (runs: string[]) => string; normalizeName?: NormalizeName });
+  clear(): void;
+  observe(calls: Iterable<{ id: string; name: string; arguments: unknown }>): void;
+  block(id: string, name: string, args: unknown): SraBlock | undefined;
+  check(id: string, name: string, args: unknown): string | undefined;
+}