@iola_adm/iola-cli 0.1.104 → 0.1.106

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iola_adm/iola-cli",
-  "version": "0.1.104",
+  "version": "0.1.106",
   "description": "CLI и AI-агент городского округа Йошкар-Ола.",
   "license": "MIT",
   "homepage": "https://github.com/adm-iola/iola-cli#readme",

package/src/cli.js

@@ -15,6 +15,8 @@ import { inflateRawSync, inflateSync } from "node:zlib";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE_URL = process.env.IOLA_API_BASE_URL || "https://apiiola.yasg.ru/api/v1";
 const MCP_BASE_URL = process.env.IOLA_MCP_BASE_URL || "https://apiiola.yasg.ru";
+const AI_RELAY_BASE_URL = process.env.IOLA_AI_RELAY_BASE_URL || `${API_BASE_URL}/ai/relay`;
+const AI_NETWORK_MODE = process.env.IOLA_AI_NETWORK_MODE || "";
 const MIN_NODE_VERSION = "22.5.0";
 const CONFIG_DIR = path.join(os.homedir(), ".iola");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
@@ -121,6 +123,7 @@ const DEFAULT_AI_CONFIG = {
   api: {
     baseUrl: "https://apiiola.yasg.ru/api/v1",
     mcpBaseUrl: "https://apiiola.yasg.ru",
+    aiRelayBaseUrl: "https://apiiola.yasg.ru/api/v1/ai/relay",
   },
   ai: {
     activeProfile: "local",
@@ -140,11 +143,13 @@ const DEFAULT_AI_CONFIG = {
         provider: "openai",
         model: "gpt-4.1-mini",
         baseUrl: "https://api.openai.com/v1",
+        networkMode: "gateway",
       },
       openrouter: {
         provider: "openrouter",
         model: "openai/gpt-4.1-mini",
         baseUrl: "https://openrouter.ai/api/v1",
+        networkMode: "gateway",
       },
       codex: {
         provider: "codex",
@@ -625,6 +630,8 @@ Usage:
 Environment:
   IOLA_API_BASE_URL   default: ${API_BASE_URL}
   IOLA_MCP_BASE_URL   default: ${MCP_BASE_URL}
+  IOLA_AI_RELAY_BASE_URL default: ${AI_RELAY_BASE_URL}
+  IOLA_AI_NETWORK_MODE direct|gateway|auto
 
 Requirements:
   Node.js >= ${MIN_NODE_VERSION}
@@ -4327,6 +4334,13 @@ async function listAiModels(provider) {
     if (!apiKey) {
       throw new Error("OpenAI API key не найден. Выполните iola ai key set openai.");
     }
+    const relayConfig = await getApiProviderNetworkConfig("openai");
+    if (getAiNetworkMode(relayConfig) === "gateway") {
+      const payload = await callAiRelayModels(relayConfig, apiKey, "OpenAI");
+      return (payload.data || [])
+        .map((model) => ({ id: model.id, provider: "openai", note: model.owned_by || "" }))
+        .sort((left, right) => left.id.localeCompare(right.id));
+    }
     const response = await fetch("https://api.openai.com/v1/models", {
       headers: { authorization: `Bearer ${apiKey}` },
     });
@@ -4342,6 +4356,18 @@ async function listAiModels(provider) {
   }
 
   if (provider === "openrouter") {
+    const apiKey = await getApiKey("openrouter");
+    const relayConfig = await getApiProviderNetworkConfig("openrouter");
+    if (apiKey && getAiNetworkMode(relayConfig) === "gateway") {
+      const payload = await callAiRelayModels(relayConfig, apiKey, "OpenRouter");
+      return (payload.data || [])
+        .map((model) => ({
+          id: model.id,
+          provider: "openrouter",
+          note: model.name || "",
+        }))
+        .sort((left, right) => left.id.localeCompare(right.id));
+    }
     const response = await fetch("https://openrouter.ai/api/v1/models", {
       headers: { accept: "application/json" },
     });
@@ -4369,6 +4395,16 @@ async function listAiModels(provider) {
   ];
 }
 
+async function getApiProviderNetworkConfig(provider) {
+  const config = await loadConfig();
+  const profile = config.ai.profiles?.[provider] || DEFAULT_AI_CONFIG.ai.profiles[provider] || {};
+  return {
+    provider,
+    ...profile,
+    aiRelayBaseUrl: profile.aiRelayBaseUrl || config.api?.aiRelayBaseUrl || AI_RELAY_BASE_URL,
+  };
+}
+
 function getRecommendedOllamaModels(notePrefix = "recommended") {
   return [
     { id: IOLA_LOCAL_OLLAMA_MODEL, provider: "ollama", note: `${notePrefix} IOLA default low RAM` },
@@ -4389,7 +4425,9 @@ async function printAiProfiles() {
     provider: profile.provider,
     model: profile.model || "-",
     baseUrl: profile.baseUrl || "-",
-    mode: profile.provider === "codex" ? `sandbox=${profile.sandbox || "read-only"}, approval=${profile.approval || "never"}` : "-",
+    mode: profile.provider === "codex"
+      ? `sandbox=${profile.sandbox || "read-only"}, approval=${profile.approval || "never"}`
+      : (profile.provider === "openai" || profile.provider === "openrouter" ? `network=${getAiNetworkMode(profile)}` : "-"),
   }));
 
   printTable(rows, [
@@ -4512,6 +4550,12 @@ function buildProfileFromOptions(provider, options) {
   if (options["base-url"]) {
     profile.baseUrl = options["base-url"];
   }
+  if (options["network-mode"]) {
+    profile.networkMode = validateAiNetworkMode(options["network-mode"]);
+  }
+  if (options["relay-url"]) {
+    profile.aiRelayBaseUrl = options["relay-url"];
+  }
 
   if (provider === "iola") {
     profile.runtime = options.runtime || defaults.runtime || "ollama";
@@ -6473,6 +6517,8 @@ function resolveAiProfile(config, options = {}) {
     provider,
     model: options.model || activeProfile.model || config.ai.model,
     baseUrl: options["base-url"] || activeProfile.baseUrl || config.ai.baseUrl,
+    aiRelayBaseUrl: options["relay-url"] || activeProfile.aiRelayBaseUrl || config.api?.aiRelayBaseUrl || AI_RELAY_BASE_URL,
+    networkMode: options["network-mode"] || activeProfile.networkMode,
     repo: options.repo || activeProfile.repo,
     modelDir: options["model-dir"] || activeProfile.modelDir,
     temperature: options.temperature || activeProfile.temperature,
@@ -6551,12 +6597,33 @@ async function localToolAsk(question, providerConfig, options) {
 
 function guardNonPublicQuestion(question) {
   const normalized = String(question || "").toLocaleLowerCase("ru-RU");
+  if (isDangerousInstructionQuestion(normalized)) {
+    return "Не могу помогать с созданием оружия, взрывчатых веществ или инструкциями по причинению вреда.";
+  }
   if (/(зарплат|получа[ею]т|доход|домашн|паспорт|снилс|личн|персональн)/iu.test(normalized)) {
     return "Это поле не входит в открытые публичные данные.";
   }
+  if (isUnsupportedPublicEntityQuestion(normalized)) {
+    return "Сейчас в открытых слоях CLI подключены школы и детские сады. По музеям, маршрутам, больницам и другим организациям я пока не могу давать проверяемые ответы.";
+  }
   return "";
 }
 
+function isDangerousInstructionQuestion(normalized) {
+  const asksHow = /(как|сдела|собра|изготов|созда|надо|нужн|инструкц|рецепт|схем|компонент)/iu.test(normalized);
+  const weapon = /(бомб|взрывчат|взрывн|детонатор|термит|напалм|оруж|патрон|яд|отрав|боеприпас|мина|гранат)/iu.test(normalized);
+  const nuclear = /(атомн|ядерн|уран|плутони|обогащен)/iu.test(normalized) && /(бомб|оруж|собра|сдела|созда|надо|нужн)/iu.test(normalized);
+  return (asksHow && weapon) || nuclear;
+}
+
+function isUnsupportedPublicEntityQuestion(normalized) {
+  const unsupportedEntity = /(музе[йяею]|театр|больниц|поликлиник|аптек|магазин|кафе|ресторан|гостиниц|банк|мфц|библиотек|парк|маршрут|остановк)/iu.test(normalized);
+  if (!unsupportedEntity) return false;
+  const supportedEducation = /(школ|гимнази|лице|детск\w*\s+сад|детсад|садик)/iu.test(normalized);
+  if (supportedEducation) return false;
+  return /(адрес|где|как пройти|как добраться|директ|руководител|заведующ|телефон|сайт|почт|инн|кто|находится)/iu.test(normalized);
+}
+
 function buildCasualDirectAnswer(question) {
   const normalized = String(question || "").toLocaleLowerCase("ru-RU").trim();
   if (/^(кто ты|что ты|какая ты модель|что ты за модель|что за модель|какая модель|назови модель|ты какая модель|ты кто)([?.!\s]*)$/iu.test(normalized)) {
@@ -6767,8 +6834,10 @@ function validateToolPlan(plan, options = {}) {
 }
 
 async function searchPublicEntities(args = {}) {
+  const layer = normalizeEntityLayer(args.layer);
+  assertSupportedPublicEntityLayer(layer);
   const payload = await postJson(`${await getApiBaseUrl()}/search-entities`, {
-    layer: normalizeEntityLayer(args.layer),
+    layer,
     query: args.query || args.entity_name || args.name || "",
     limit: Number(args.limit || 10),
     filters: args.filters || undefined,
@@ -6784,6 +6853,7 @@ async function resolvePublicEntityField(args = {}) {
   const endpoint = `${await getApiBaseUrl()}/resolve-entity-field`;
   const requestedField = normalizeEntityField(args.field);
   const layer = normalizeEntityLayer(args.layer);
+  assertSupportedPublicEntityLayer(layer);
   const strictQuestionNumber = extractEntityNumberFromQuestion(args.source_question, layer);
   const payload = {
     layer,
@@ -6988,9 +7058,24 @@ function normalizeEntityLayer(layer) {
   const value = String(layer || "").toLocaleLowerCase("ru-RU");
   if (value === "school" || value === "schools" || value.includes("школ")) return "schools";
   if (value === "kindergarten" || value === "kindergartens" || value.includes("сад")) return "kindergartens";
+  if (value === "museum" || value === "museums" || value.includes("музе")) return "museums";
   return value || "schools";
 }
 
+function assertSupportedPublicEntityLayer(layer) {
+  if (layer === "schools" || layer === "kindergartens") return;
+  throw createUnsupportedPublicDatasetError(layer);
+}
+
+function createUnsupportedPublicDatasetError(layer) {
+  const detail = {
+    error: "unsupported_public_dataset",
+    message: "Unknown public dataset",
+    layer,
+  };
+  return new Error(`Request failed: 400 Bad Request (local-validation)\n${JSON.stringify({ detail })}`);
+}
+
 function normalizeEntityField(field) {
   const value = String(field || "").toLocaleLowerCase("ru-RU");
   if (value === "director" || value === "directors" || value === "directs" || value === "direct" || value === "head" || value === "head_name" || value.includes("директ") || value.includes("руковод")) return "director";
@@ -7037,6 +7122,9 @@ function isLocalEntityValidationError(error) {
 
 function formatToolExecutionError(error, plan) {
   const details = parseErrorJsonDetails(error);
+  if (details?.error === "unsupported_public_dataset" || details === "Unknown public dataset") {
+    return "Сейчас в открытых слоях CLI подключены школы и детские сады. По этому типу организаций я пока не могу давать проверяемые ответы.";
+  }
   if (details?.error !== "entity_not_found") return "";
   if (details.local_validation && details.entity_name) {
     return `В открытом слое не нашел организацию по названию "${details.entity_name}". Проверьте название.`;
@@ -8048,6 +8136,23 @@ async function callOpenAiCompatible(config, messages, apiKey, providerName) {
     throw new Error(`${providerName} API key не найден. Выполните iola ai key set ${providerName === "OpenAI" ? "openai" : "openrouter"} или задайте ${providerName === "OpenAI" ? "OPENAI_API_KEY" : "OPENROUTER_API_KEY"}.`);
   }
 
+  const networkMode = getAiNetworkMode(config);
+  if (networkMode === "gateway") {
+    return callAiRelay(config, messages, apiKey, providerName);
+  }
+  if (networkMode === "auto") {
+    try {
+      return await callOpenAiDirect(config, messages, apiKey, providerName);
+    } catch (error) {
+      if (!isNetworkFallbackError(error)) throw error;
+      return callAiRelay(config, messages, apiKey, providerName);
+    }
+  }
+
+  return callOpenAiDirect(config, messages, apiKey, providerName);
+}
+
+async function callOpenAiDirect(config, messages, apiKey, providerName) {
   const response = await fetch(`${config.baseUrl}/chat/completions`, {
     method: "POST",
     headers: {
@@ -8065,13 +8170,80 @@ async function callOpenAiCompatible(config, messages, apiKey, providerName) {
 
   if (!response.ok) {
     const text = await response.text();
-    throw new Error(`${providerName} request failed: ${response.status} ${response.statusText}\n${text}`);
+    throw new Error(`${providerName} request failed: ${response.status} ${response.statusText}\n${sanitizeSecretFromText(text, apiKey)}`);
+  }
+
+  const payload = await response.json();
+  return payload.choices?.[0]?.message?.content || "";
+}
+
+async function callAiRelay(config, messages, apiKey, providerName) {
+  const relayBaseUrl = String(config.aiRelayBaseUrl || AI_RELAY_BASE_URL).replace(/\/+$/, "");
+  const response = await fetch(`${relayBaseUrl}/chat`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      provider: providerName === "OpenAI" ? "openai" : "openrouter",
+      api_key: apiKey,
+      model: config.model,
+      messages,
+      temperature: Number(config.temperature ?? 0.2),
+    }),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${providerName} relay request failed: ${response.status} ${response.statusText}\n${sanitizeSecretFromText(text, apiKey)}`);
   }
 
   const payload = await response.json();
   return payload.choices?.[0]?.message?.content || "";
 }
 
+async function callAiRelayModels(config, apiKey, providerName) {
+  const relayBaseUrl = String(config.aiRelayBaseUrl || AI_RELAY_BASE_URL).replace(/\/+$/, "");
+  const response = await fetch(`${relayBaseUrl}/models`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      provider: providerName === "OpenAI" ? "openai" : "openrouter",
+      api_key: apiKey,
+    }),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${providerName} relay models request failed: ${response.status} ${response.statusText}\n${sanitizeSecretFromText(text, apiKey)}`);
+  }
+
+  return response.json();
+}
+
+function getAiNetworkMode(config = {}) {
+  return validateAiNetworkMode(AI_NETWORK_MODE || config.networkMode || "gateway");
+}
+
+function validateAiNetworkMode(value) {
+  const mode = String(value || "").trim().toLocaleLowerCase("en-US");
+  if (mode === "direct" || mode === "gateway" || mode === "auto") return mode;
+  throw new Error("AI network mode должен быть direct, gateway или auto.");
+}
+
+function isNetworkFallbackError(error) {
+  const message = String(error?.message || "");
+  return /fetch failed|ECONN|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|socket|TLS|proxy|network/i.test(message);
+}
+
+function sanitizeSecretFromText(text, secret) {
+  const source = String(text || "");
+  if (!secret) return source;
+  return source.split(secret).join("[redacted]");
+}
+
 async function getApiKey(provider) {
   if (provider === "openai" && process.env.OPENAI_API_KEY) {
     return process.env.OPENAI_API_KEY;
@@ -10391,6 +10563,8 @@ function mergeConfig(base, override) {
 
 function sanitizeConfig(config) {
   const next = JSON.parse(JSON.stringify(config || {}));
+  next.api = next.api || {};
+  next.api.aiRelayBaseUrl = next.api.aiRelayBaseUrl || AI_RELAY_BASE_URL;
   if (next.permissions?.localTools && typeof next.permissions.localTools === "object") {
     for (const tool of Object.keys(next.permissions.localTools)) {
       if (!ALL_TOOL_ALIASES.includes(tool)) {
@@ -10416,6 +10590,11 @@ function sanitizeConfig(config) {
     next.ai.model = IOLA_LOCAL_MODEL;
     next.ai.baseUrl = next.ai.baseUrl || "http://127.0.0.1:11434";
   }
+  for (const profile of Object.values(next.ai?.profiles || {})) {
+    if (profile?.provider === "openai" || profile?.provider === "openrouter") {
+      profile.networkMode = profile.networkMode || "gateway";
+    }
+  }
   return next;
 }
 
@@ -10429,6 +10608,7 @@ function validateConfig(config) {
   for (const [name, profile] of Object.entries(config.ai?.profiles || {})) {
     if (!["iola", "ollama", "openai", "openrouter", "codex"].includes(profile.provider)) errors.push(`ai.profiles.${name}.provider неизвестен`);
     if (profile.provider !== "codex" && profile.provider !== "iola" && !profile.baseUrl) errors.push(`ai.profiles.${name}.baseUrl обязателен`);
+    if (profile.networkMode && !["direct", "gateway", "auto"].includes(profile.networkMode)) errors.push(`ai.profiles.${name}.networkMode должен быть direct, gateway или auto`);
   }
   for (const tool of Object.keys(config.permissions?.localTools || {})) {
     if (!ALL_TOOL_ALIASES.includes(tool)) errors.push(`permissions.localTools.${tool} неизвестен`);