@garuda-agent/garuda 0.15.0 → 0.16.0

package/dist/chunk-NP6RIC25.js

@@ -0,0 +1,331 @@
+#!/usr/bin/env node
+import {
+  keepSecretForRedaction,
+  writeFileAtomic
+} from "./chunk-EIXUSVFX.js";
+import {
+  lookupModel
+} from "./chunk-R7I2NBPX.js";
+import {
+  isLoopbackHost
+} from "./chunk-ATW7BNIG.js";
+
+// src/model/credentials.ts
+import { randomBytes } from "crypto";
+import { constants } from "fs";
+import { chmod, mkdir, open, rename, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z } from "zod";
+var CREDENTIALS_FILE = join(".garuda", "credentials");
+var CREDENTIALS_MAX_BYTES = 64 * 1024;
+var KEY_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var fileSchema = z.record(z.string().regex(KEY_NAME), z.string().min(1).max(4096));
+function credentialsPath(home = homedir()) {
+  return join(home, CREDENTIALS_FILE);
+}
+async function readCredentials(home = homedir()) {
+  const file = credentialsPath(home);
+  const ignored = (why) => ({
+    keys: {},
+    warning: `${file} ${why} Garuda ignores it.`
+  });
+  let handle;
+  try {
+    handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return { keys: {} };
+    if (code === "ELOOP") return ignored("is a symbolic link.");
+    return ignored(`cannot be read (${code ?? "error"}).`);
+  }
+  try {
+    const info = await handle.stat();
+    if (!info.isFile()) return ignored("is not a regular file.");
+    const uid = process.getuid?.();
+    if (uid !== void 0 && info.uid !== uid) return ignored("is not owned by you.");
+    if ((info.mode & 63) !== 0) {
+      return ignored(`can be read by other users. Run: chmod 600 ${file}.`);
+    }
+    if (info.size > CREDENTIALS_MAX_BYTES) return ignored("is too large.");
+    const text = await handle.readFile("utf8");
+    let data;
+    try {
+      data = JSON.parse(text);
+    } catch {
+      return ignored("is not valid JSON.");
+    }
+    const parsed = fileSchema.safeParse(data);
+    if (!parsed.success) {
+      return ignored(
+        'is not valid: it must be a JSON object of key names to keys, for example { "ANTHROPIC_API_KEY": "\u2026" }.'
+      );
+    }
+    return { keys: parsed.data };
+  } finally {
+    await handle.close();
+  }
+}
+async function writeCredentials(keys, home = homedir()) {
+  const file = credentialsPath(home);
+  if (Object.keys(keys).length === 0) {
+    await rm(file, { force: true });
+    return;
+  }
+  await mkdir(dirname(file), { recursive: true, mode: 448 });
+  const temp = join(dirname(file), `.credentials.garuda-${randomBytes(4).toString("hex")}.tmp`);
+  await writeFile(temp, `${JSON.stringify(keys, null, 2)}
+`, { flag: "wx", mode: 384 });
+  try {
+    await chmod(temp, 384);
+    await rename(temp, file);
+  } catch (error) {
+    await rm(temp, { force: true });
+    throw error;
+  }
+}
+function maskKey(key) {
+  if (key.length < 16) return "\u2026";
+  if (key.length < 32) return `\u2026${key.slice(-4)}`;
+  const start = key.match(/^[A-Za-z]+-(?:[A-Za-z]+-)?/)?.[0] ?? key.slice(0, 3);
+  return `${start.slice(0, 8)}\u2026${key.slice(-4)}`;
+}
+
+// src/model/providers.ts
+import { mkdir as mkdir2, readFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+import { z as z2 } from "zod";
+var MODELS_FILE = join2(".garuda", "models.json");
+var NO_MODEL = "Set a model with --model <id> or the GARUDA_MODEL variable, or run `garuda setup`.";
+var priceSchema = z2.strictObject({
+  input: z2.number().min(0),
+  output: z2.number().min(0),
+  cacheRead: z2.number().min(0),
+  cacheWrite: z2.number().min(0)
+});
+var providerSchema = z2.strictObject({
+  type: z2.enum(["anthropic", "openai-compatible"]),
+  /** For openai-compatible: the URL that ends before /chat/completions. */
+  baseUrl: z2.url().optional(),
+  /** The environment variable that holds the API key. */
+  apiKeyEnv: z2.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional(),
+  /** A server on this machine: price 0 unless a model entry says otherwise. */
+  local: z2.boolean().optional(),
+  /** Allow plain http to a host that is not this machine. Off: an API key could travel in clear text. */
+  allowInsecureHttp: z2.boolean().optional()
+});
+var modelSchema = z2.strictObject({
+  contextWindow: z2.number().int().min(4096).optional(),
+  price: priceSchema.optional(),
+  maxTokens: z2.number().int().min(256).optional(),
+  /**
+   * Tool calls that the model writes as JSON text (openai-compatible only): "whole" (default) when
+   * the whole reply is calls, "lines" when calls stand on their own lines between prose, "off".
+   */
+  textToolCalls: z2.enum(["off", "whole", "lines"]).optional()
+});
+var fileSchema2 = z2.strictObject({
+  providers: z2.record(z2.string().regex(/^[a-z][a-z0-9-]{0,31}$/), providerSchema).default({}),
+  /** Keyed by the full spec, for example "ollama/qwen3-coder:30b". */
+  models: z2.record(z2.string(), modelSchema).default({}),
+  /** The model when neither --model nor GARUDA_MODEL names one (0.16; `garuda setup` writes it). */
+  default: z2.string().min(1).optional()
+});
+var BUILTIN_PROVIDERS = {
+  anthropic: { type: "anthropic" },
+  ollama: { type: "openai-compatible", baseUrl: "http://localhost:11434/v1", local: true },
+  lmstudio: { type: "openai-compatible", baseUrl: "http://localhost:1234/v1", local: true },
+  llamacpp: { type: "openai-compatible", baseUrl: "http://localhost:8080/v1", local: true },
+  vllm: { type: "openai-compatible", baseUrl: "http://localhost:8000/v1", local: true },
+  openrouter: {
+    type: "openai-compatible",
+    baseUrl: "https://openrouter.ai/api/v1",
+    apiKeyEnv: "OPENROUTER_API_KEY"
+  }
+};
+var OPEN_MODEL_DEFAULT_WINDOW = 32768;
+var ZERO_PRICE = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+function chooseModel(config, ...given) {
+  for (const spec of given) if (spec !== void 0 && spec !== "") return spec;
+  return config.default;
+}
+async function loadModelsConfig(home = homedir2()) {
+  const file = join2(home, MODELS_FILE);
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { config: { providers: {}, models: {} } };
+    return {
+      config: { providers: {}, models: {} },
+      problem: `${file}: ${error.message}`
+    };
+  }
+  try {
+    const parsed = fileSchema2.safeParse(JSON.parse(text));
+    if (!parsed.success) {
+      return {
+        config: { providers: {}, models: {} },
+        problem: `${file}: ${z2.prettifyError(parsed.error)}`
+      };
+    }
+    return { config: parsed.data };
+  } catch (error) {
+    return {
+      config: { providers: {}, models: {} },
+      problem: `${file}: invalid JSON: ${error.message}`
+    };
+  }
+}
+async function setDefaultModel(spec, home = homedir2()) {
+  const file = join2(home, MODELS_FILE);
+  let data = {};
+  let exists = true;
+  try {
+    const parsed = JSON.parse(await readFile(file, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error(`${file} is not a JSON object.`);
+    }
+    data = parsed;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    exists = false;
+  }
+  data.default = spec;
+  await mkdir2(dirname2(file), { recursive: true, mode: 448 });
+  await writeFileAtomic(file, `${JSON.stringify(data, null, 2)}
+`, { createOnly: !exists });
+}
+var keptKeys = /* @__PURE__ */ new Map();
+function keepProviderKey(name) {
+  const value = process.env[name];
+  if (value !== void 0 && value !== "") {
+    keptKeys.set(name, { value, from: "environment" });
+    keepSecretForRedaction(name, value);
+    delete process.env[name];
+  }
+}
+function keepStoredKey(name, value) {
+  if ((process.env[name] ?? "") !== "") return false;
+  if (keptKeys.get(name)?.from === "environment") return false;
+  keptKeys.set(name, { value, from: "file" });
+  keepSecretForRedaction(name, value);
+  return true;
+}
+function providerKeySource(name) {
+  if ((process.env[name] ?? "") !== "") return "environment";
+  return keptKeys.get(name)?.from;
+}
+async function keepProviderKeys(names, home) {
+  const wanted = names.filter((name) => name !== void 0);
+  for (const name of wanted) keepProviderKey(name);
+  const stored = await readCredentials(home);
+  for (const [name, kept] of keptKeys) if (kept.from === "file") keptKeys.delete(name);
+  for (const [name, value] of Object.entries(stored.keys)) {
+    if (!keepStoredKey(name, value)) keepSecretForRedaction(name, value);
+  }
+  return stored.warning;
+}
+function providerKey(env, name) {
+  if (name === void 0) return void 0;
+  return keptKeys.get(name)?.value ?? env[name];
+}
+function resolveModel(spec, config = { providers: {}, models: {} }) {
+  const providers = { ...BUILTIN_PROVIDERS, ...config.providers };
+  const slash = spec.indexOf("/");
+  const [provider, model] = slash === -1 ? ["anthropic", spec] : [spec.slice(0, slash), spec.slice(slash + 1)];
+  const def = providers[provider];
+  if (def === void 0) {
+    throw new Error(
+      `Unknown model provider "${provider}" in "${spec}". Known providers: ${Object.keys(providers).join(", ")}. Add others in ~/${MODELS_FILE}.`
+    );
+  }
+  if (model === "") throw new Error(`"${spec}" names no model. Use <provider>/<model>.`);
+  if (def.type === "openai-compatible") checkBaseUrl(provider, def);
+  const entry = config.models[spec] ?? (provider === "anthropic" ? config.models[model] : void 0);
+  const base = def.type === "anthropic" ? lookupModel(model) : { contextWindow: OPEN_MODEL_DEFAULT_WINDOW, ...def.local ? { price: ZERO_PRICE } : {} };
+  const info = {
+    contextWindow: entry?.contextWindow ?? base.contextWindow,
+    ...entry?.price !== void 0 ? { price: entry.price } : base.price !== void 0 ? { price: base.price } : {},
+    // Thinking by model (0.9): only Claude models on the Anthropic provider have it.
+    ...base.thinking === void 0 ? {} : { thinking: base.thinking }
+  };
+  const notes = [];
+  if (def.type === "openai-compatible" && entry?.contextWindow === void 0) {
+    notes.push(
+      `Garuda assumes a ${OPEN_MODEL_DEFAULT_WINDOW}-token context window for ${spec}. Set the real value ("contextWindow") for "${spec}" in ~/${MODELS_FILE}; the server must allow it too (for Ollama: OLLAMA_CONTEXT_LENGTH).`
+    );
+  }
+  return {
+    spec,
+    provider,
+    model,
+    def,
+    info,
+    notes,
+    ...entry?.maxTokens === void 0 ? {} : { maxTokens: entry.maxTokens },
+    ...def.type === "anthropic" ? {
+      async createBatch(env = process.env, options = {}) {
+        const apiKey = providerKey(env, def.apiKeyEnv ?? "ANTHROPIC_API_KEY");
+        const { AnthropicBatchClient } = await import("./anthropic-NQDBCHJU.js");
+        return new AnthropicBatchClient({ model, ...apiKey ? { apiKey } : {}, ...options });
+      }
+    } : {},
+    async create(env = process.env) {
+      const apiKey = providerKey(env, def.apiKeyEnv);
+      if (def.apiKeyEnv !== void 0 && (apiKey === void 0 || apiKey === "")) {
+        throw new Error(
+          `Set ${def.apiKeyEnv} to use the ${provider} provider, or run \`garuda setup\`.`
+        );
+      }
+      if (def.type === "anthropic") {
+        const key = providerKey(env, def.apiKeyEnv ?? "ANTHROPIC_API_KEY");
+        const { AnthropicClient } = await import("./anthropic-NQDBCHJU.js");
+        return new AnthropicClient({ model, ...key ? { apiKey: key } : {} });
+      }
+      const { OpenAICompatibleClient } = await import("./openaiCompatible-CJWVJP5M.js");
+      return new OpenAICompatibleClient({
+        provider,
+        baseUrl: def.baseUrl,
+        model,
+        ...apiKey === void 0 ? {} : { apiKey },
+        ...entry?.textToolCalls === void 0 ? {} : { textToolCalls: entry.textToolCalls }
+      });
+    }
+  };
+}
+function checkBaseUrl(provider, def) {
+  if (def.baseUrl === void 0) throw new Error(`Provider "${provider}" needs a baseUrl.`);
+  const url = new URL(def.baseUrl);
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error(`Provider "${provider}": the baseUrl must use http or https.`);
+  }
+  if (url.username !== "" || url.password !== "") {
+    throw new Error(`Provider "${provider}": put credentials in apiKeyEnv, not in the baseUrl.`);
+  }
+  if (url.protocol === "http:" && !isLoopbackHost(url.hostname) && def.allowInsecureHttp !== true) {
+    throw new Error(
+      `Provider "${provider}" uses plain http to ${url.hostname}. Use https, or set "allowInsecureHttp": true for a trusted network.`
+    );
+  }
+}
+
+export {
+  KEY_NAME,
+  credentialsPath,
+  readCredentials,
+  writeCredentials,
+  maskKey,
+  MODELS_FILE,
+  NO_MODEL,
+  BUILTIN_PROVIDERS,
+  chooseModel,
+  loadModelsConfig,
+  setDefaultModel,
+  providerKeySource,
+  keepProviderKeys,
+  resolveModel
+};
+//# sourceMappingURL=chunk-NP6RIC25.js.map

package/dist/chunk-R7I2NBPX.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import {
+  EFFORTS
+} from "./chunk-3EQU2GUX.js";
+
+// src/model/pricing.ts
+var DEFAULT_CONTEXT_WINDOW = 2e5;
+var M = 1e6;
+var ALWAYS = { mode: "always", efforts: EFFORTS };
+var OPTIONAL = { mode: "optional", efforts: EFFORTS };
+var OPTIONAL_46 = {
+  mode: "optional",
+  efforts: EFFORTS.filter((e) => e !== "xhigh")
+};
+var KNOWN = [
+  ["claude-fable-5-1", { price: p(10, 50, 0.25, 12.5), contextWindow: M, thinking: ALWAYS }],
+  ["claude-fable-5", { price: p(10, 50, 1, 12.5), contextWindow: M, thinking: ALWAYS }],
+  ["claude-opus-5-5", { price: p(4, 20, 0.2, 5), contextWindow: M, thinking: ALWAYS }],
+  ["claude-opus-5", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: ALWAYS }],
+  ["claude-opus-4-8", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL }],
+  ["claude-opus-4-7", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL }],
+  ["claude-opus-4-6", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL_46 }],
+  ["claude-opus-4-5", { price: p(5, 25, 0.5, 6.25), contextWindow: 2e5 }],
+  ["claude-sonnet-5", { price: p(2, 10, 0.2, 2.5), contextWindow: M, thinking: ALWAYS }],
+  ["claude-sonnet-4-6", { price: p(3, 15, 0.3, 3.75), contextWindow: M, thinking: OPTIONAL_46 }],
+  ["claude-sonnet-4-5", { price: p(3, 15, 0.3, 3.75), contextWindow: 2e5 }],
+  ["claude-haiku-4-5", { price: p(1, 5, 0.1, 1.25), contextWindow: 2e5 }]
+];
+function p(input, output, cacheRead, cacheWrite) {
+  return { input, output, cacheRead, cacheWrite };
+}
+function aliasModel(alias) {
+  if (!/^(haiku|sonnet|opus|fable)$/.test(alias)) return void 0;
+  return KNOWN.find(([prefix]) => prefix.startsWith(`claude-${alias}-`))?.[0];
+}
+function knownModels() {
+  return KNOWN.map(([id, info]) => ({ id, info }));
+}
+function lookupModel(modelId) {
+  let best;
+  for (const [prefix, info] of KNOWN) {
+    if (modelId.startsWith(prefix) && prefix.length > (best?.prefix.length ?? 0)) {
+      best = { prefix, info };
+    }
+  }
+  return best?.info ?? { contextWindow: DEFAULT_CONTEXT_WINDOW };
+}
+var WEB_SEARCH_USD = 0.01;
+function costOf(usage, price, factor = 1) {
+  return (usage.inputTokens * price.input + usage.outputTokens * price.output + usage.cacheReadTokens * price.cacheRead + usage.cacheWriteTokens * price.cacheWrite) / M * factor + (usage.webSearches ?? 0) * WEB_SEARCH_USD;
+}
+function responseCost(response, price) {
+  return costOf(response.usage, price, response.priceFactor ?? 1);
+}
+function totalTokens(usage) {
+  return usage.inputTokens + usage.outputTokens + usage.cacheReadTokens + usage.cacheWriteTokens;
+}
+function contextSize(usage) {
+  return totalTokens(usage);
+}
+
+export {
+  aliasModel,
+  knownModels,
+  lookupModel,
+  WEB_SEARCH_USD,
+  responseCost,
+  totalTokens,
+  contextSize
+};
+//# sourceMappingURL=chunk-R7I2NBPX.js.map

package/dist/{chunk-2TAXSFWN.js → chunk-TUUEBHG2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   DEFAULT_ENV_ALLOWLIST
-} from "./chunk-SI2QJYCR.js";
+} from "./chunk-GXZACJUI.js";
 
 // src/jobs/git.ts
 var GIT_TIMEOUT_MS = 12e4;
@@ -46,4 +46,4 @@ export {
   git,
   hostCommand
 };
-//# sourceMappingURL=chunk-2TAXSFWN.js.map
+//# sourceMappingURL=chunk-TUUEBHG2.js.map

package/dist/{chunk-HRGX53VC.js → chunk-ULAJPMY7.js}

@@ -2,69 +2,10 @@
 import {
   cleanLine
 } from "./chunk-PZS3V6P3.js";
-import {
-  EFFORTS
-} from "./chunk-SI2QJYCR.js";
 import {
   formatRule
 } from "./chunk-3NJNVZTK.js";
 
-// src/model/pricing.ts
-var DEFAULT_CONTEXT_WINDOW = 2e5;
-var M = 1e6;
-var ALWAYS = { mode: "always", efforts: EFFORTS };
-var OPTIONAL = { mode: "optional", efforts: EFFORTS };
-var OPTIONAL_46 = {
-  mode: "optional",
-  efforts: EFFORTS.filter((e) => e !== "xhigh")
-};
-var KNOWN = [
-  ["claude-fable-5-1", { price: p(10, 50, 0.25, 12.5), contextWindow: M, thinking: ALWAYS }],
-  ["claude-fable-5", { price: p(10, 50, 1, 12.5), contextWindow: M, thinking: ALWAYS }],
-  ["claude-opus-5-5", { price: p(4, 20, 0.2, 5), contextWindow: M, thinking: ALWAYS }],
-  ["claude-opus-5", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: ALWAYS }],
-  ["claude-opus-4-8", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL }],
-  ["claude-opus-4-7", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL }],
-  ["claude-opus-4-6", { price: p(5, 25, 0.5, 6.25), contextWindow: M, thinking: OPTIONAL_46 }],
-  ["claude-opus-4-5", { price: p(5, 25, 0.5, 6.25), contextWindow: 2e5 }],
-  ["claude-sonnet-5", { price: p(2, 10, 0.2, 2.5), contextWindow: M, thinking: ALWAYS }],
-  ["claude-sonnet-4-6", { price: p(3, 15, 0.3, 3.75), contextWindow: M, thinking: OPTIONAL_46 }],
-  ["claude-sonnet-4-5", { price: p(3, 15, 0.3, 3.75), contextWindow: 2e5 }],
-  ["claude-haiku-4-5", { price: p(1, 5, 0.1, 1.25), contextWindow: 2e5 }]
-];
-function p(input, output, cacheRead, cacheWrite) {
-  return { input, output, cacheRead, cacheWrite };
-}
-function aliasModel(alias) {
-  if (!/^(haiku|sonnet|opus|fable)$/.test(alias)) return void 0;
-  return KNOWN.find(([prefix]) => prefix.startsWith(`claude-${alias}-`))?.[0];
-}
-function knownModels() {
-  return KNOWN.map(([id, info]) => ({ id, info }));
-}
-function lookupModel(modelId) {
-  let best;
-  for (const [prefix, info] of KNOWN) {
-    if (modelId.startsWith(prefix) && prefix.length > (best?.prefix.length ?? 0)) {
-      best = { prefix, info };
-    }
-  }
-  return best?.info ?? { contextWindow: DEFAULT_CONTEXT_WINDOW };
-}
-var WEB_SEARCH_USD = 0.01;
-function costOf(usage, price, factor = 1) {
-  return (usage.inputTokens * price.input + usage.outputTokens * price.output + usage.cacheReadTokens * price.cacheRead + usage.cacheWriteTokens * price.cacheWrite) / M * factor + (usage.webSearches ?? 0) * WEB_SEARCH_USD;
-}
-function responseCost(response, price) {
-  return costOf(response.usage, price, response.priceFactor ?? 1);
-}
-function totalTokens(usage) {
-  return usage.inputTokens + usage.outputTokens + usage.cacheReadTokens + usage.cacheWriteTokens;
-}
-function contextSize(usage) {
-  return totalTokens(usage);
-}
-
 // src/permissions/projectSettings.ts
 import { createHash } from "crypto";
 function settingsRisk(settings) {
@@ -161,13 +102,6 @@ async function gateProjectSettings(options) {
 }
 
 export {
-  aliasModel,
-  knownModels,
-  lookupModel,
-  WEB_SEARCH_USD,
-  responseCost,
-  totalTokens,
-  contextSize,
   gateProjectSettings
 };
-//# sourceMappingURL=chunk-HRGX53VC.js.map
+//# sourceMappingURL=chunk-ULAJPMY7.js.map

package/dist/{chunk-S77XDSD4.js → chunk-USCUXCAU.js}

@@ -2,7 +2,7 @@
 import {
   hostCommand,
   shellWord
-} from "./chunk-2TAXSFWN.js";
+} from "./chunk-TUUEBHG2.js";
 import {
   JOBS_DIR
 } from "./chunk-KKB5W47S.js";
@@ -154,4 +154,4 @@ export {
   nightAgentTime,
   removeAgent
 };
-//# sourceMappingURL=chunk-S77XDSD4.js.map
+//# sourceMappingURL=chunk-USCUXCAU.js.map