@hadooppei/hwcode 0.2.0 → 0.2.1

package/.env.example

@@ -1,10 +1,5 @@
-# Keep real credentials outside version control.
-# Local provider credentials. Model addresses and capabilities live in
-# .pi/model-providers.json.
-PI_LOCAL_MODEL_API_KEY=local
-
-# Optional credential used as the default when logging in to the configurable
-# "hw" provider. Leave unset for a keyless local endpoint.
+# Keep real credentials outside version control. Set this value to provide the
+# required "hw" credential through the environment, or enter it through /login.
 # HW_API_KEY=
 
 # OPENAI_API_KEY=

package/.pi/lib/models/provider-config.ts

@@ -1,7 +1,7 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { loadReplacingResource } from "../runtime/config.ts";
+import { readJsonObject } from "../runtime/config.ts";
 
 export type ModelInput = "text" | "image";
 export interface ConfiguredModel { id: string; name?: string; reasoning?: boolean; input?: ModelInput[]; contextWindow?: number; maxTokens?: number; }
@@ -42,9 +42,9 @@ function validateModel(providerId: string, model: ConfiguredModel): void {
   if (model.maxTokens !== undefined && !isPositiveNumber(model.maxTokens)) throw new Error(`Model "${model.id}" has an invalid maxTokens`);
 }
 
-export function loadModelProvidersConfig(cwd = process.cwd()): ModelProvidersConfig {
+export function loadModelProvidersConfig(): ModelProvidersConfig {
   const source = "model-providers.json";
-  const config = loadReplacingResource<ModelProvidersConfig & Record<string, unknown>>(cwd, source, BUNDLED_CONFIG_PATH);
+  const config = readJsonObject(BUNDLED_CONFIG_PATH) as ModelProvidersConfig & Record<string, unknown>;
   if (!Array.isArray(config.providers) || config.providers.length === 0) throw new Error(`${source} must contain a non-empty providers array`);
   const providerIds = new Set<string>();
   for (const provider of config.providers) {

package/.pi/model-providers.json

@@ -1,53 +1,14 @@
 {
   "providers": [
-    {
-      "id": "local",
-      "name": "Qwen3 VL (8081)",
-      "baseUrl": "http://127.0.0.1:8081",
-      "apiKeyEnv": "PI_LOCAL_MODEL_API_KEY",
-      "modelDefaults": {
-        "contextWindow": 1000000,
-        "maxTokens": 8192
-      },
-      "models": [
-        {
-          "id": "qwen3-VL:2b",
-          "name": "Qwen3 VL 2B",
-          "input": ["text", "image"],
-          "contextWindow": 1000000,
-          "maxTokens": 8192
-        }
-      ]
-    },
-    {
-      "id": "local-8080",
-      "name": "Qwen3.5 9B (8080)",
-      "baseUrl": "http://127.0.0.1:8080",
-      "apiKeyEnv": "PI_LOCAL_MODEL_API_KEY",
-      "modelDefaults": {
-        "contextWindow": 1000000,
-        "maxTokens": 8192
-      },
-      "models": [
-        {
-          "id": "Qwen3.5-9B-Q4_K_M",
-          "name": "Qwen3.5 9B Q4_K_M",
-          "input": ["text"],
-          "contextWindow": 1000000,
-          "maxTokens": 8192
-        }
-      ]
-    },
     {
       "id": "hw",
       "name": "Huawei MaaS",
-      "baseUrl": "http://127.0.0.1:8080/v1",
       "apiKeyEnv": "HW_API_KEY",
       "login": {
         "enabled": true,
         "promptBaseUrl": true,
         "promptApiKey": true,
-        "apiKeyRequired": false,
+        "apiKeyRequired": true,
         "catalogPath": "models",
         "timeoutMs": 15000
       },
@@ -55,16 +16,7 @@
         "input": ["text"],
         "contextWindow": 1000000,
         "maxTokens": 8192
-      },
-      "models": [
-        {
-          "id": "Qwen3.5-9B-Q4_K_M",
-          "name": "Qwen3.5 9B Q4_K_M",
-          "input": ["text"],
-          "contextWindow": 1000000,
-          "maxTokens": 8192
-        }
-      ]
+      }
     }
   ]
 }

package/README.md

@@ -21,10 +21,11 @@ hwcode
 Run `hwcode --help` for the HWCode command reference, including model,
 session, tool, and workflow options.
 
-`npx @hadooppei/hwcode` is also supported without a global installation. HWCode loads a
-project's `.env` file when present and keeps Pi's normal user-level auth and
-session storage. Project-local `.pi` resources continue to load alongside the
-built-in HWCode profile.
+`npx @hadooppei/hwcode` is also supported without a global installation. HWCode
+loads a project's `.env` file when present and keeps Pi's normal user-level auth
+and session storage. Project-local Pi resources continue to load alongside the
+built-in HWCode profile, except for HWCode's package-scoped model-provider
+definition described below.
 
 ## Repository setup
 
@@ -38,45 +39,31 @@ On first launch, review and accept Pi's project-trust prompt so it can load the
 
 ## Model providers
 
-OpenAI-compatible providers are declared in `.pi/model-providers.json`.
-Static providers list their models directly:
+The published `.pi/model-providers.json` is package-scoped and is not replaced
+by a file in the current project. It registers the configurable `hw` provider
+without shipping a machine-specific endpoint or a pre-populated model catalog.
+Use Pi's native `/login` flow, select `Huawei MaaS`, and enter the endpoint and
+API key. The key can instead come from `HW_API_KEY`. HWCode then discovers every model exposed by the
+OpenAI-compatible endpoint and Pi stores the selected endpoint, credential, and
+dynamic catalog in its user-level stores.
 
-```json
-{
-  "id": "local-example",
-  "name": "Local example",
-  "baseUrl": "http://127.0.0.1:8082",
-  "apiKeyEnv": "PI_LOCAL_MODEL_API_KEY",
-  "models": [
-    {
-      "id": "model-id",
-      "input": ["text", "image"],
-      "contextWindow": 32768,
-      "maxTokens": 8192
-    }
-  ]
-}
-```
-
-Login providers use Pi's native `/login` flow and discover every model exposed
-by an OpenAI-compatible model endpoint:
+The published provider is equivalent to:
 
 ```json
 {
   "id": "hw",
-  "name": "hw",
-  "baseUrl": "http://127.0.0.1:8080/v1",
+  "name": "Huawei MaaS",
   "apiKeyEnv": "HW_API_KEY",
   "login": {
     "enabled": true,
     "promptBaseUrl": true,
     "promptApiKey": true,
-    "apiKeyRequired": false,
+    "apiKeyRequired": true,
     "catalogPath": "models"
   },
   "modelDefaults": {
     "input": ["text"],
-    "contextWindow": 32768,
+    "contextWindow": 1000000,
     "maxTokens": 8192
   }
 }
@@ -84,12 +71,14 @@ by an OpenAI-compatible model endpoint:
 
 `id` is the stable credential and cache key; `name` is the configurable label
 shown alongside other providers in `/login`. A login authenticates the whole
-provider and publishes its complete model catalog to `/model`. Entries in a
-login provider's `models` array are optional metadata overrides for discovered
-IDs, which is where vision support should be declared with
-`"input": ["text", "image"]`. Unknown models default to text-only. Keep real
-API keys in `.env` or enter them through `/login`; Pi stores entered credentials
-in its own auth store rather than the project configuration.
+provider and publishes its complete model catalog to `/model`. Unknown models
+default to text-only. Keep real API keys in `.env` or enter them through
+`/login`; Pi stores entered credentials in its own auth store rather than the
+package configuration.
+
+Repository maintainers can refer to `.pi/model-providers.json.template` for the
+previous local static-provider examples, including multimodal metadata. The
+template is not loaded at runtime and is explicitly excluded from npm packages.
 
 ## Welcome screen
 
@@ -174,9 +163,9 @@ commands, tools, and UI. Reusable behavior lives under `.pi/lib/`:
 - `context/` and `models/` own compaction and provider-configuration policy.
 
 `settings.json` is layered as defaults → profile → project for settings such as
-context and hidden commands. `welcome.json` and `model-providers.json` use a
-single replacing resource, preferring project, then profile, then the bundled
-default. This keeps configuration precedence consistent across extensions.
+context and hidden commands. `welcome.json` uses a single replacing resource.
+`model-providers.json` is deliberately package-scoped so a project cannot
+silently replace login providers or reintroduce machine-local defaults.
 
 ## Working directory
 
@@ -204,8 +193,9 @@ HWCode defaults locally configured and dynamically discovered models to a
 1,000,000-token context window and caps configured or provider-reported values
 at that limit. If an OpenAI-compatible model catalog reports a smaller
 `context_window`, `context_length`, `max_context_length`, `max_model_len`, or
-`n_ctx`, the smaller server value wins. Per-model `contextWindow` values in
-`.pi/model-providers.json` can also select a smaller limit.
+`n_ctx`, the smaller server value wins. The package-scoped provider's
+`modelDefaults.contextWindow` can also select a smaller limit for dynamically
+discovered models.
 
 The default context policy is configured under `hwcode.context` in
 `.pi/settings.json`:

package/bin/hwcode.js

@@ -82,7 +82,7 @@ HWCode 交互命令:
   hwcode -p "总结当前代码库"
   hwcode @README.md "检查文档是否完整"
 
-项目中的 .env 会自动加载；项目本地 .pi 资源会与 HWCode 内置配置共同生效。`;
+项目中的 .env 会自动加载；模型 Provider 使用 HWCode 发布配置，其余项目本地 .pi 资源照常生效。`;
 }
 
 if (userArgs[0] === "--help" || userArgs[0] === "-h") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadooppei/hwcode",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "A customizable terminal coding agent with local-model support and HWCode workflows.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
     "pi": "node --env-file-if-exists=.env ./bin/hwcode.js",
     "test": "node --test .pi/lib/*.test.ts",
     "test:workflows": "npm test",
-    "prepack": "npm test"
+    "prepack": "npm test && node scripts/audit-package.mjs"
   },
   "engines": {
     "node": ">=22.19.0"