@inhuman.tools/harness 0.0.0-stage → 0.1.0

package/dist/providers/openai-compat/connection.js

@@ -0,0 +1,837 @@
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __setFunctionName = (this && this.__setFunctionName) || function (f, name, prefix) {
+    if (typeof name === "symbol") name = name.description ? "[".concat(name.description, "]") : "";
+    return Object.defineProperty(f, "name", { configurable: true, value: prefix ? "".concat(prefix, " ", name) : name });
+};
+/**
+ * The class is the driver; an instance is one live openai-compat connection.
+ * Bootstrap handshakes GET {baseUrl}/models. The actor owns the chat turn.
+ *
+ * Wire history is viewWire over the PEW spine, not a connection bag.
+ *
+ * Adopt parks an optional API key via `callback("UI", …)`; bootstrap reads
+ * `apiKey` from `this.secrets`.
+ *
+ * TFRP FRESHNESS: `nowMs` / `lastChallenge` / `refreshFailedAtMs` are own
+ * handle fields — never keys of `state`, never `spec.live`. The published face
+ * is `state.auth` (`"needs-auth"` while `needsAuth`). The kernel mirror copies
+ * that onto `spec.live`. Clock is `@action tick` (no `Date.now()` in a
+ * computed). `fresh` is per class: empty-key compat is fresh without a token.
+ *
+ * Two fetch doors — not a public `send()`, no 401 retry, no `refreshSession()`
+ * from a fetch site:
+ * - handshake (`#probe`, hydrate, probeAccount, anything awaited inside
+ *   `bootstrap()`): always hits the wire; never waits send-ready.
+ * - send (actor, Grok webSearch, `#accountLoop` after `bootstrapDone`):
+ *   `when ((ready && fresh) || needsAuth || failed)` then stamp (stamp wins
+ *   `init.headers`) then fetch once.
+ */
+import { step, trace } from "@inhuman.tools/harness-diagnostics";
+import { ConnectionMiss, PEWDriver, } from "@inhuman.tools/plexus-expectations/driver";
+import { action, autorun, computed, observable, runInAction, when } from "mobx";
+import invariant from "tiny-invariant";
+import { accountGetterFor, paintAccountHint } from "./account-look.js";
+import { OpenAiCompatChatActor, OpenAiCompatResponsesActor } from "./actor.js";
+import { asAdoptString } from "./adopt.js";
+import { maskSecret } from "./api-extensions/index.js";
+import { cacheAffinityFor, cacheFlavorFromBaseUrl, probeCachePolicy, } from "./cache-affinity.js";
+import { describeFetchLine, describeHttpFailure, REQUEST_TIMEOUT_MS, wrapFetchFailure } from "./fetch-failure.js";
+import { headersRecord } from "./fetch-types.js";
+import { detectedLocalOffers } from "./local-offers.js";
+import { CUSTOM_OFFER, isLoopbackBaseUrl, nameFromBaseUrl, REMOTE_OFFERS } from "./presence.js";
+import { reasoningFlavorFromBaseUrl } from "./reasoning-flavor.js";
+import { openaiCompatConfigurationSchema, openaiCompatSecretsSchema, } from "./schema.js";
+const HEALTH_MS = 30_000;
+/** Looking (focused / ambient occupancy) quota poll. */
+export const ACCOUNT_STALE_MS = 45_000;
+/** Interned but nobody looking — slow heartbeat so Ctrl overlay is not empty. */
+export const ACCOUNT_IDLE_MS = 5 * 60_000;
+/** Same period as `OIDC_REFRESH_MS` — tick is the event source, not a refresh call. */
+const CLOCK_TICK_MS = 60_000;
+/** Local OpenAI-compat (LM Studio / Ollama) answers in milliseconds. */
+export const LOCAL_HANDSHAKE_MS = 2500;
+/** Remote catalogs (OpenRouter, Grok proxy, ChatGPT) need a real RTT. */
+export const REMOTE_HANDSHAKE_MS = REQUEST_TIMEOUT_MS;
+/** Detected-offers state per driver class — each class reads its own demand. */
+const detectedByClass = new WeakMap();
+function detectedFor(cls) {
+    let box = detectedByClass.get(cls);
+    if (box === undefined) {
+        box = detectedLocalOffers({
+            looking: () => cls.revalidationDemand !== "none",
+            fetch: () => cls.probeFetch,
+        });
+        detectedByClass.set(cls, box);
+    }
+    return box;
+}
+export function handshakeTimeoutMs(url) {
+    try {
+        const host = new URL(url).hostname;
+        if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+            return LOCAL_HANDSHAKE_MS;
+    }
+    catch {
+        /* keep remote */
+    }
+    return REMOTE_HANDSHAKE_MS;
+}
+/** OpenAI-compat extras: invocation catalog plus the account/key face. */
+export function openaiCompatLiveState() {
+    return {
+        catalogName: "",
+        account: undefined,
+        keyMask: "",
+        auth: undefined,
+        models: [],
+        windows: {},
+    };
+}
+let OpenAiCompatDriverConnection = (() => {
+    var _a;
+    let _classSuper = PEWDriver;
+    let _instanceExtraInitializers = [];
+    let _private_secretRev_decorators;
+    let _private_secretRev_initializers = [];
+    let _private_secretRev_extraInitializers = [];
+    let _private_secretRev_descriptor;
+    let _nowMs_decorators;
+    let _nowMs_initializers = [];
+    let _nowMs_extraInitializers = [];
+    let _lastChallenge_decorators;
+    let _lastChallenge_initializers = [];
+    let _lastChallenge_extraInitializers = [];
+    let _refreshFailedAtMs_decorators;
+    let _refreshFailedAtMs_initializers = [];
+    let _refreshFailedAtMs_extraInitializers = [];
+    let _state_decorators;
+    let _state_initializers = [];
+    let _state_extraInitializers = [];
+    let _get_expiring_decorators;
+    let _get_needsAuth_decorators;
+    let _get_fresh_decorators;
+    let _tick_decorators;
+    let _noteChallenge_decorators;
+    let _publishAuth_decorators;
+    let _noteRefreshFailed_decorators;
+    let _mergeSecrets_decorators;
+    let _depositSecrets_decorators;
+    let _reportLive_decorators;
+    let _private_noteOk_decorators;
+    let _private_noteOk_descriptor;
+    let _noteFail_decorators;
+    let _private_noteProbeFail_decorators;
+    let _private_noteProbeFail_descriptor;
+    return class OpenAiCompatDriverConnection extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(this, _private_secretRev_descriptor = { get: __setFunctionName(function () { return this.#secretRev_accessor_storage; }, "#secretRev", "get"), set: __setFunctionName(function (value) { this.#secretRev_accessor_storage = value; }, "#secretRev", "set") }, _private_secretRev_decorators, { kind: "accessor", name: "#secretRev", static: false, private: true, access: { has: obj => #secretRev in obj, get: obj => obj.#secretRev, set: (obj, value) => { obj.#secretRev = value; } }, metadata: _metadata }, _private_secretRev_initializers, _private_secretRev_extraInitializers);
+            __esDecorate(this, null, _nowMs_decorators, { kind: "accessor", name: "nowMs", static: false, private: false, access: { has: obj => "nowMs" in obj, get: obj => obj.nowMs, set: (obj, value) => { obj.nowMs = value; } }, metadata: _metadata }, _nowMs_initializers, _nowMs_extraInitializers);
+            __esDecorate(this, null, _lastChallenge_decorators, { kind: "accessor", name: "lastChallenge", static: false, private: false, access: { has: obj => "lastChallenge" in obj, get: obj => obj.lastChallenge, set: (obj, value) => { obj.lastChallenge = value; } }, metadata: _metadata }, _lastChallenge_initializers, _lastChallenge_extraInitializers);
+            __esDecorate(this, null, _refreshFailedAtMs_decorators, { kind: "accessor", name: "refreshFailedAtMs", static: false, private: false, access: { has: obj => "refreshFailedAtMs" in obj, get: obj => obj.refreshFailedAtMs, set: (obj, value) => { obj.refreshFailedAtMs = value; } }, metadata: _metadata }, _refreshFailedAtMs_initializers, _refreshFailedAtMs_extraInitializers);
+            __esDecorate(this, null, _state_decorators, { kind: "accessor", name: "state", static: false, private: false, access: { has: obj => "state" in obj, get: obj => obj.state, set: (obj, value) => { obj.state = value; } }, metadata: _metadata }, _state_initializers, _state_extraInitializers);
+            __esDecorate(this, null, _get_expiring_decorators, { kind: "getter", name: "expiring", static: false, private: false, access: { has: obj => "expiring" in obj, get: obj => obj.expiring }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_needsAuth_decorators, { kind: "getter", name: "needsAuth", static: false, private: false, access: { has: obj => "needsAuth" in obj, get: obj => obj.needsAuth }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_fresh_decorators, { kind: "getter", name: "fresh", static: false, private: false, access: { has: obj => "fresh" in obj, get: obj => obj.fresh }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _tick_decorators, { kind: "method", name: "tick", static: false, private: false, access: { has: obj => "tick" in obj, get: obj => obj.tick }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _noteChallenge_decorators, { kind: "method", name: "noteChallenge", static: false, private: false, access: { has: obj => "noteChallenge" in obj, get: obj => obj.noteChallenge }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _publishAuth_decorators, { kind: "method", name: "publishAuth", static: false, private: false, access: { has: obj => "publishAuth" in obj, get: obj => obj.publishAuth }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _noteRefreshFailed_decorators, { kind: "method", name: "noteRefreshFailed", static: false, private: false, access: { has: obj => "noteRefreshFailed" in obj, get: obj => obj.noteRefreshFailed }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _mergeSecrets_decorators, { kind: "method", name: "mergeSecrets", static: false, private: false, access: { has: obj => "mergeSecrets" in obj, get: obj => obj.mergeSecrets }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _depositSecrets_decorators, { kind: "method", name: "depositSecrets", static: false, private: false, access: { has: obj => "depositSecrets" in obj, get: obj => obj.depositSecrets }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _reportLive_decorators, { kind: "method", name: "reportLive", static: false, private: false, access: { has: obj => "reportLive" in obj, get: obj => obj.reportLive }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, _private_noteOk_descriptor = { value: __setFunctionName(function () {
+                    this.readyState = "ready";
+                    this.error = "";
+                }, "#noteOk") }, _private_noteOk_decorators, { kind: "method", name: "#noteOk", static: false, private: true, access: { has: obj => #noteOk in obj, get: obj => obj.#noteOk }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _noteFail_decorators, { kind: "method", name: "noteFail", static: false, private: false, access: { has: obj => "noteFail" in obj, get: obj => obj.noteFail }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, _private_noteProbeFail_descriptor = { value: __setFunctionName(function (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    step(`probe failed: connection=${this.connectionId} healthy=${this.#healthy} models=${this.state.models.length} error=${message}`);
+                    if (this.state.models.length > 0)
+                        return;
+                    this.readyState = "failed";
+                    this.error = message;
+                }, "#noteProbeFail") }, _private_noteProbeFail_decorators, { kind: "method", name: "#noteProbeFail", static: false, private: true, access: { has: obj => #noteProbeFail in obj, get: obj => obj.#noteProbeFail }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        static configurationSchema = openaiCompatConfigurationSchema;
+        static secretsSchema = openaiCompatSecretsSchema;
+        static configurationLabel = "openai-compat";
+        /** Probe transport for local detection. Tests swap it. */
+        static probeFetch = (input, init) => fetch(input, init);
+        /**
+         * Detected local servers, then the custom door, then key-only catalogs. The
+         * detected part is observable and wakes under an observer (the catalog
+         * mirror); a plain read sees whatever was last probed.
+         */
+        static get offers() {
+            return [...detectedFor(this).get(), CUSTOM_OFFER, ...REMOTE_OFFERS];
+        }
+        /**
+         * Loopback baseUrl: no questions. Remote baseUrl (a catalog offer): one
+         * required key. No baseUrl (custom): ask for it, key optional.
+         */
+        static async adopt(args, callback) {
+            const settings = { ...(args.settings ?? {}) };
+            const custom = asAdoptString(settings.baseUrl) === "";
+            let baseUrl = asAdoptString(settings.baseUrl);
+            if (custom) {
+                const { input } = await callback("UI", '(harness/input :name "Base URL" :description "OpenAI-compatible endpoint")');
+                baseUrl = asAdoptString(input);
+            }
+            settings.baseUrl = baseUrl;
+            const fallback = (args.name ?? "").trim();
+            const name = fallback === "" || fallback === "openai-compat" || fallback === "OpenAI-compatible"
+                ? (nameFromBaseUrl(baseUrl) ?? (fallback || "openai-compat"))
+                : fallback;
+            const secrets = {};
+            if (custom) {
+                const { input: apiKey } = await callback("UI", '(harness/input :name "API key" :description "Optional. Empty to skip." :secret #t)');
+                const key = asAdoptString(apiKey);
+                if (key !== "")
+                    secrets.apiKey = key;
+            }
+            else if (!isLoopbackBaseUrl(baseUrl) && asAdoptString(args.secrets?.apiKey) === "") {
+                const quotedHint = `"${`${name} API key`.replaceAll("\\", "\\\\").replaceAll('"', String.raw `\"`)}"`;
+                const { input: apiKey } = await callback("UI", `(harness/input :name "API key" :description ${quotedHint} :secret #t)`);
+                const key = asAdoptString(apiKey);
+                if (key === "")
+                    throw new Error(`${name} needs an API key`);
+                secrets.apiKey = key;
+            }
+            return { name, settings, secrets };
+        }
+        #baseUrl = (__runInitializers(this, _instanceExtraInitializers), "");
+        #headers = {};
+        /** Flavor learned from a live probe; wins over the hostname guess. */
+        #detectedFlavor = null;
+        #healthy = false;
+        #inflight = new Set();
+        #healthTimer = null;
+        #tickTimer = null;
+        #accountLoop = null;
+        #accountPeriod = 0;
+        #accountInflight = null;
+        #accountStop = null;
+        #account;
+        #refreshing = null;
+        #secretRev_accessor_storage = __runInitializers(this, _private_secretRev_initializers, 0);
+        get #secretRev() { return _private_secretRev_descriptor.get.call(this); }
+        set #secretRev(value) { return _private_secretRev_descriptor.set.call(this, value); }
+        #nowMs_accessor_storage = (__runInitializers(this, _private_secretRev_extraInitializers), __runInitializers(this, _nowMs_initializers, Date.now()));
+        get nowMs() { return this.#nowMs_accessor_storage; }
+        set nowMs(value) { this.#nowMs_accessor_storage = value; }
+        #lastChallenge_accessor_storage = (__runInitializers(this, _nowMs_extraInitializers), __runInitializers(this, _lastChallenge_initializers, "none"));
+        get lastChallenge() { return this.#lastChallenge_accessor_storage; }
+        set lastChallenge(value) { this.#lastChallenge_accessor_storage = value; }
+        #refreshFailedAtMs_accessor_storage = (__runInitializers(this, _lastChallenge_extraInitializers), __runInitializers(this, _refreshFailedAtMs_initializers, null));
+        get refreshFailedAtMs() { return this.#refreshFailedAtMs_accessor_storage; }
+        set refreshFailedAtMs(value) { this.#refreshFailedAtMs_accessor_storage = value; }
+        #state_accessor_storage = (__runInitializers(this, _refreshFailedAtMs_extraInitializers), __runInitializers(this, _state_initializers, openaiCompatLiveState()));
+        get state() { return this.#state_accessor_storage; }
+        set state(value) { this.#state_accessor_storage = value; }
+        get alive() {
+            return this.#healthy;
+        }
+        /** Secret bag changed — computeds read this, not `Date.now()`, then `secrets.get`. */
+        readSecrets() {
+            void this.#secretRev;
+        }
+        get expiring() {
+            return false;
+        }
+        /**
+         * Static key: lastChallenge with a configured key. Empty key is not ceremony.
+         * PR4: a send 401 is `noteChallenge`, not catalog `noteFail`.
+         */
+        get needsAuth() {
+            this.readSecrets();
+            return this.secretField("apiKey") !== undefined && this.lastChallenge !== "none";
+        }
+        get fresh() {
+            return !this.expiring && !this.needsAuth;
+        }
+        tick(now = Date.now()) {
+            this.nowMs = now;
+        }
+        noteChallenge(status) {
+            this.lastChallenge = status === 403 ? 403 : 401;
+            this.publishAuth();
+            step(`challenge ${status}: connection=${this.connectionId} refreshToken=${this.secretField("refreshToken") === undefined ? "no" : "yes"}`);
+        }
+        publishAuth() {
+            this.state.auth = this.needsAuth ? "needs-auth" : undefined;
+        }
+        noteRefreshFailed() {
+            this.refreshFailedAtMs = this.nowMs;
+            this.publishAuth();
+        }
+        /** Persist a bag. Identity hydrate uses this; a token grant uses {@link depositSecrets}. */
+        mergeSecrets(next) {
+            const bag = {};
+            const current = this.secrets.all?.() ?? {};
+            for (const [key, value] of Object.entries(current)) {
+                if (typeof value === "string" && value.length > 0)
+                    bag[key] = value;
+            }
+            Object.assign(bag, next);
+            this.#secretRev += 1;
+            if (this.secrets.replace === undefined) {
+                this.secrets = {
+                    get: (field) => bag[field],
+                    all: () => bag,
+                };
+            }
+            else {
+                this.secrets.replace(bag);
+            }
+            this.reportLive();
+        }
+        /**
+         * Token grant. Clears `lastChallenge` and `refreshFailedAtMs` so a grant
+         * does not keep the standing reaction eligible forever.
+         */
+        depositSecrets(next) {
+            this.lastChallenge = "none";
+            this.refreshFailedAtMs = null;
+            this.mergeSecrets(next);
+        }
+        /** Coalesced grant. Fetch sites do not call this. */
+        async refreshSession() {
+            if (this.#refreshing !== null)
+                return this.#refreshing;
+            const pending = this.refreshGrant().finally(() => {
+                if (this.#refreshing === pending)
+                    this.#refreshing = null;
+            });
+            this.#refreshing = pending;
+            return pending;
+        }
+        async refreshGrant() { }
+        async bootstrap() {
+            this.#baseUrl = this.settings.baseUrl;
+            this.#headers = this.settings.headers ?? {};
+            this.#healthy = false;
+            this.reportLive();
+            this.#startClock();
+            await this.#probe();
+            void this.#probeCacheFlavor(this.state.models).catch(() => { });
+            this.#healthTimer = setInterval(() => {
+                void this.#probe().catch(() => { });
+            }, HEALTH_MS);
+            this.#healthTimer.unref?.();
+            this.#accountStop = autorun(() => {
+                if (!this.accountPolls()) {
+                    this.#stopAccountLoop();
+                    return;
+                }
+                const looking = this.revalidationDemand !== "none";
+                if (looking)
+                    void this.#refreshAccount();
+                this.#restartAccountLoop(looking ? ACCOUNT_STALE_MS : ACCOUNT_IDLE_MS);
+            });
+            if (this.accountPolls())
+                void this.#refreshAccount();
+        }
+        #startClock() {
+            if (this.#tickTimer !== null)
+                return;
+            this.#tickTimer = setInterval(() => {
+                this.tick();
+            }, CLOCK_TICK_MS);
+            this.#tickTimer.unref?.();
+        }
+        modelsRequestUrl() {
+            return `${this.#baseUrl}/models`;
+        }
+        completionRequestUrl() {
+            return `${this.#baseUrl}/chat/completions`;
+        }
+        responsesRequestUrl() {
+            return `${this.#baseUrl || this.settings.baseUrl}/responses`;
+        }
+        completionApi() {
+            return "chat";
+        }
+        async #probe() {
+            const url = this.modelsRequestUrl();
+            let response;
+            try {
+                response = await this.#fetchWithTimeout(url, undefined, handshakeTimeoutMs(url));
+            }
+            catch (error) {
+                this.#noteProbeFail(error);
+                throw error instanceof Error ? error : new Error(String(error));
+            }
+            if (!response.ok) {
+                const body = await response.text();
+                const detail = body.trim().slice(0, 240);
+                const error = new Error(describeHttpFailure({
+                    why: "models probe",
+                    method: "GET",
+                    url,
+                    status: response.status,
+                    detail,
+                }));
+                this.#noteProbeFail(error);
+                throw error;
+            }
+            const ids = [];
+            const windows = {};
+            for (const row of modelRows(await response.json())) {
+                const id = modelId(row);
+                if (id === null)
+                    continue;
+                ids.push(id);
+                const window = contextWindowOf(row);
+                if (window != null)
+                    windows[id] = window;
+            }
+            const manual = this.settings.contextWindow;
+            for (const id of ids) {
+                const key = `${this.connectionId}:${id}`;
+                const override = manual?.[key];
+                if (typeof override === "number" && Number.isFinite(override) && override > 0) {
+                    windows[id] = Math.trunc(override);
+                }
+            }
+            runInAction(() => {
+                this.state.models = ids;
+                this.state.windows = windows;
+                this.#healthy = true;
+            });
+            this.#noteOk();
+            step(`probe completed: connection=${this.connectionId} healthy=true models=${ids.length} ${ids.length === 0 ? "(none)" : ids.slice(0, 8).join(",") + (ids.length > 8 ? ",…" : "")}`);
+        }
+        /**
+         * Learn the cache flavor by probing when the hostname does not pin one.
+         * Known hosts (grok/openai/chatgpt/openrouter) keep their hardcoded flavor.
+         * Unknown hosts get two warm/repeat calls once per bootstrap; the probe
+         * sends no affinity keys, so it is safe against servers that 400 on them.
+         *
+         * Set `settings.cacheProbe: true` to enable — off by default, since it costs
+         * two extra completion calls at bootstrap and writes a POST the operator did
+         * not ask for. Enable per connection for an unknown provider.
+         */
+        async #probeCacheFlavor(models) {
+            if (this.settings.cacheProbe !== true)
+                return;
+            // Honor a subclass that pins a flavor: nothing to learn, and probing would
+            // overwrite the pin.
+            if (this.cacheFlavor() !== "none") {
+                this.#detectedFlavor = null;
+                return;
+            }
+            if (models.length === 0)
+                return;
+            const model = models[0];
+            if (model === "")
+                return;
+            const flavor = await probeCachePolicy({
+                url: this.completionRequestUrl(),
+                headers: this.#headers,
+                model,
+                fetch: (reqUrl, init) => this.handshakeFetch(reqUrl, init),
+            });
+            runInAction(() => {
+                this.#detectedFlavor = flavor;
+            });
+            step(`cache flavor probed: connection=${this.connectionId} flavor=${flavor} model=${model}`);
+        }
+        reportLive() {
+            this.state.catalogName = this.connectionCatalogName();
+            this.state.account = this.#account;
+            this.state.keyMask = this.connectionKeyMask();
+            this.publishAuth();
+        }
+        connectionCatalogName() {
+            const configured = this.settings.name;
+            if (typeof configured === "string" && configured.trim() !== "")
+                return configured;
+            const detected = nameFromBaseUrl(this.settings.baseUrl);
+            if (detected !== undefined)
+                return detected;
+            return this.connectionId;
+        }
+        connectionKeyMask() {
+            const apiKey = this.secretField("apiKey");
+            if (this.#account !== undefined)
+                return paintAccountHint(this.#account, apiKey);
+            if (apiKey === undefined)
+                return "";
+            return maskSecret(apiKey);
+        }
+        #stopAccountLoop() {
+            if (this.#accountLoop !== null) {
+                clearInterval(this.#accountLoop);
+                this.#accountLoop = null;
+            }
+            this.#accountPeriod = 0;
+        }
+        #restartAccountLoop(period) {
+            if (this.#accountLoop !== null && this.#accountPeriod === period)
+                return;
+            this.#stopAccountLoop();
+            this.#accountPeriod = period;
+            this.#accountLoop = setInterval(() => {
+                void this.#refreshAccount();
+            }, period);
+            this.#accountLoop.unref?.();
+        }
+        #refreshAccount() {
+            if (this.#accountInflight !== null)
+                return this.#accountInflight;
+            const pending = this.#accountOnce().finally(() => {
+                if (this.#accountInflight === pending)
+                    this.#accountInflight = null;
+            });
+            this.#accountInflight = pending;
+            return pending;
+        }
+        async #accountOnce() {
+            try {
+                const snap = await this.loadAccount();
+                if (snap === undefined)
+                    return;
+                this.#account = {
+                    ...snap,
+                    balanceDetail: {
+                        ...snap.balanceDetail,
+                        asOf: new Date().toISOString(),
+                    },
+                };
+                this.reportLive();
+            }
+            catch (error) {
+                // Usage/limits metadata is not handshake. Last snapshot stays on live.account.
+                step(`account poll failed: connection=${this.connectionId} error=${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        /** True when this connection has a funds/quota probe. Local hosts stay off. */
+        accountPolls() {
+            return accountGetterFor(this.#baseUrl) !== undefined;
+        }
+        /** Handshake until `bootstrapDone`; send after. */
+        accountDoor(input, init) {
+            const signal = init?.signal ?? undefined;
+            return this.bootstrapDone ? this.authorizedFetch(input, init, signal) : this.handshakeFetch(input, init, signal);
+        }
+        async loadAccount() {
+            const getter = accountGetterFor(this.#baseUrl);
+            if (getter === undefined)
+                return undefined;
+            return getter({
+                baseUrl: this.#baseUrl,
+                apiKey: this.secretField("apiKey"),
+                fetch: (input, init) => this.accountDoor(input, init),
+            });
+        }
+        refreshAccount() {
+            return this.#refreshAccount();
+        }
+        get #noteOk() { return _private_noteOk_descriptor.value; }
+        noteFail(error) {
+            this.readyState = "failed";
+            this.error = error instanceof Error ? error.message : String(error);
+            step(`probe failed: connection=${this.connectionId} healthy=${this.#healthy} models=${this.state.models.length} error=${this.error}`);
+        }
+        /** Handshake miss is a failure. Refresh miss with a catalog is not. */
+        get #noteProbeFail() { return _private_noteProbeFail_descriptor.value; }
+        trackInflight(abort) {
+            this.#inflight.add(abort);
+        }
+        untrackInflight(abort) {
+            this.#inflight.delete(abort);
+        }
+        abortOnDrop(reason) {
+            super.abortOnDrop(reason);
+            for (const abort of this.#inflight)
+                abort.abort(reason);
+        }
+        async [(_private_secretRev_decorators = [observable], _nowMs_decorators = [observable], _lastChallenge_decorators = [observable], _refreshFailedAtMs_decorators = [observable], _state_decorators = [(_a = observable).shallow.bind(_a)], _get_expiring_decorators = [computed], _get_needsAuth_decorators = [computed], _get_fresh_decorators = [computed], _tick_decorators = [action], _noteChallenge_decorators = [action], _publishAuth_decorators = [action], _noteRefreshFailed_decorators = [action], _mergeSecrets_decorators = [action], _depositSecrets_decorators = [action], _reportLive_decorators = [action], _private_noteOk_decorators = [action], _noteFail_decorators = [action], _private_noteProbeFail_decorators = [action], Symbol.asyncDispose)]() {
+            this.#accountStop?.();
+            this.#accountStop = null;
+            this.#stopAccountLoop();
+            if (this.#healthTimer !== null) {
+                clearInterval(this.#healthTimer);
+                this.#healthTimer = null;
+            }
+            if (this.#tickTimer !== null) {
+                clearInterval(this.#tickTimer);
+                this.#tickTimer = null;
+            }
+            for (const abort of this.#inflight)
+                abort.abort();
+            this.#inflight.clear();
+            this.#healthy = false;
+        }
+        /**
+         * Wait send-ready, then `handle(round)`. Idempotent under live honor.
+         * On abort, abort the interned actor.
+         */
+        async complete(req) {
+            invariant(req.round.plexus != null, "complete: round must be homed");
+            const waitSignal = req.signal;
+            const sendReady = () => (this.readyState === "ready" && this.fresh) || this.needsAuth || this.readyState === "failed";
+            try {
+                await (waitSignal === undefined ? when(sendReady) : when(sendReady, { signal: waitSignal }));
+            }
+            catch (error) {
+                if (waitSignal?.reason instanceof ConnectionMiss)
+                    throw waitSignal.reason;
+                throw error;
+            }
+            if (this.needsAuth) {
+                throw new ConnectionMiss("needs-auth", `connection ${this.connectionId} needs auth — reconnect`);
+            }
+            if (this.readyState === "failed" || !this.fresh) {
+                throw new ConnectionMiss("not-ready", `connection ${this.connectionId} is not send-ready`);
+            }
+            trace("harness:complete", `handle ${req.round.uuid} connection=${this.connectionId} api=${this.completionApi()}`);
+            this.handle(req.round);
+            const onAbort = () => {
+                if (!this.has(req.round))
+                    return;
+                const actor = this.resolveExpectation(req.round);
+                const reason = waitSignal?.reason;
+                // A park pauses the round: stop the actor, write no ending. The next wrap
+                // appends a fresh round (a new CompletionJob is a new attempt).
+                if (reason === "park") {
+                    actor.abort(reason);
+                    return;
+                }
+                if (req.round.failReason == null && reason instanceof Error && reason.message !== "") {
+                    req.round.failReason = reason.message;
+                }
+                actor.abort(reason);
+                if (!req.round.isDone)
+                    actor.admitTermination();
+            };
+            if (waitSignal !== undefined) {
+                if (waitSignal.aborted)
+                    onAbort();
+                else
+                    waitSignal.addEventListener("abort", onAbort, { once: true });
+            }
+            try {
+                await (waitSignal === undefined
+                    ? when(() => req.round.isDone)
+                    : when(() => req.round.isDone, { signal: waitSignal }));
+            }
+            catch (error) {
+                if (waitSignal?.aborted === true && !req.round.isDone)
+                    onAbort();
+                if (!req.round.isDone)
+                    throw error;
+            }
+            finally {
+                waitSignal?.removeEventListener("abort", onAbort);
+            }
+            if (this.accountPolls() && waitSignal?.aborted !== true)
+                void this.#refreshAccount();
+            if (req.round.outcome !== "successful") {
+                const reason = req.round.failReason;
+                throw new Error(reason == null ? "completion failed" : reason);
+            }
+            return {
+                text: req.round.responseText,
+                ...(req.round.responseThought === "" ? {} : { thought: req.round.responseThought }),
+                ...(req.round.responseThoughtKind == null ? {} : { thoughtKind: req.round.responseThoughtKind }),
+            };
+        }
+        resolve(expectation) {
+            invariant(this.#healthy, "OpenAiCompatDriverConnection.resolve: connection not warmed");
+            return this.completionApi() === "responses"
+                ? new OpenAiCompatResponsesActor(expectation, this)
+                : new OpenAiCompatChatActor(expectation, this);
+        }
+        /** Pure stamp: current secret + `authHeaders()`. Tests and dumps only. */
+        requestHeaders() {
+            const apiKey = this.secretField("apiKey");
+            return {
+                "content-type": "application/json",
+                ...this.#headers,
+                ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
+                ...this.authHeaders(),
+            };
+        }
+        /** Stamp wins colliding keys (case-insensitive). Never another connection's secrets. */
+        stamp(init) {
+            const out = headersRecord(init);
+            for (const [key, value] of Object.entries(this.requestHeaders())) {
+                for (const existing of Object.keys(out)) {
+                    if (existing.toLowerCase() === key.toLowerCase())
+                        delete out[existing];
+                }
+                out[key] = value;
+            }
+            return out;
+        }
+        /**
+         * Send door. Wait on the graph; stamp; fetch once. No retry. No `refreshSession()`.
+         */
+        async authorizedFetch(input, init, signal) {
+            const waitSignal = signal ?? init?.signal ?? undefined;
+            const started = Date.now();
+            const sendReady = () => (this.readyState === "ready" && this.fresh) || this.needsAuth || this.readyState === "failed";
+            try {
+                await (waitSignal === undefined ? when(sendReady) : when(sendReady, { signal: waitSignal }));
+            }
+            catch (error) {
+                if (waitSignal?.reason instanceof ConnectionMiss)
+                    throw waitSignal.reason;
+                throw error;
+            }
+            step(`wait-fresh: connection=${this.connectionId} ms=${Date.now() - started}`);
+            if (this.needsAuth) {
+                throw new ConnectionMiss("needs-auth", `connection ${this.connectionId} needs auth — reconnect`);
+            }
+            if (this.readyState === "failed" || !this.fresh) {
+                throw new ConnectionMiss("not-ready", `connection ${this.connectionId} is not send-ready`);
+            }
+            const res = await fetch(input, {
+                ...init,
+                headers: this.stamp(init?.headers),
+                signal: waitSignal,
+            });
+            if (res.status === 401 || res.status === 403) {
+                runInAction(() => {
+                    this.noteChallenge(res.status);
+                });
+            }
+            return res;
+        }
+        /** Handshake door. Always hits the wire. Never throws on !fresh. Never waits send-ready. */
+        async handshakeFetch(input, init, signal) {
+            return fetch(input, {
+                ...init,
+                headers: this.stamp(init?.headers),
+                signal: signal ?? init?.signal,
+            });
+        }
+        /** Extra auth headers for a subscription profile (account id, grok-cli token). */
+        authHeaders() {
+            return {};
+        }
+        secretField(field) {
+            this.readSecrets();
+            const value = this.secrets.get(field);
+            return typeof value === "string" && value.length > 0 ? value : undefined;
+        }
+        /**
+         * Prompt-cache flavor. Subscription drivers override. Hostname tables are
+         * the fallback; `#detectedFlavor` wins after a live {@link probeCachePolicy}.
+         */
+        cacheFlavor() {
+            return this.#detectedFlavor ?? cacheFlavorFromBaseUrl(this.#baseUrl || this.settings.baseUrl);
+        }
+        /** Completion-only. Handshake must not send these. */
+        cacheAffinity(sessionId, model, request) {
+            return cacheAffinityFor(this.cacheFlavor(), sessionId, model, request);
+        }
+        /**
+         * Reasoning dialect from host. Cache flavor pins grok/openai/chatgpt/openrouter
+         * when a driver stubs it (tests, subscription). Else {@link reasoningFlavorFromBaseUrl}.
+         */
+        reasoningFlavor() {
+            const cache = this.cacheFlavor();
+            if (cache === "grok" || cache === "openai" || cache === "chatgpt" || cache === "openrouter")
+                return cache;
+            return reasoningFlavorFromBaseUrl(this.#baseUrl || this.settings.baseUrl);
+        }
+        async #fetchWithTimeout(url, init, ms = LOCAL_HANDSHAKE_MS) {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), ms);
+            const method = typeof init?.method === "string" && init.method.trim() !== "" ? init.method : "GET";
+            const where = { why: "models probe", method, url };
+            try {
+                return await this.handshakeFetch(url, init, ctrl.signal);
+            }
+            catch (error) {
+                throw ctrl.signal.aborted
+                    ? new Error(describeFetchLine(where, `timeout after ${ms}ms`))
+                    : wrapFetchFailure(error, where);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _state_extraInitializers);
+        }
+    };
+})();
+export { OpenAiCompatDriverConnection };
+function modelRows(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return [];
+    const rec = raw;
+    const rows = Array.isArray(rec.data) ? rec.data : Array.isArray(rec.models) ? rec.models : [];
+    return rows.filter((row) => typeof row === "object" && row !== null);
+}
+function modelId(row) {
+    const item = row;
+    const id = typeof item.slug === "string" && item.slug.length > 0 ? item.slug : item.id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
+function contextWindowOf(row) {
+    const rec = row;
+    const provider = rec.top_provider;
+    if (typeof provider === "object" && provider !== null) {
+        const routed = positiveInt(provider.context_length);
+        if (routed != null)
+            return routed;
+    }
+    const loaded = rec.loaded_instances;
+    const loadedWindow = Array.isArray(loaded) && typeof loaded[0] === "object" && loaded[0] !== null
+        ? positiveInt(loaded[0].config?.context_length)
+        : null;
+    return (positiveInt(rec.context_length) ??
+        positiveInt(rec.context_window) ??
+        positiveInt(rec.max_model_len) ??
+        positiveInt(rec.max_context_length) ??
+        positiveInt(rec.max_context_window) ??
+        loadedWindow);
+}
+function positiveInt(value) {
+    const n = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
+    if (!Number.isFinite(n) || n <= 0)
+        return null;
+    return Math.trunc(n);
+}
+//# sourceMappingURL=connection.js.map