@kingsoftcloud/agentkit-harness-node 0.0.0-stage → 0.0.1

package/src/native/model-port.mjs

@@ -0,0 +1,361 @@
+// Native model protocol adapter: one host-resolved HTTP request per attempt.
+//
+// createNativeModelPort({ resolveProfile, fetchImpl, maxResponseBytes,
+//   idleTimeoutMs }) -> ModelPort. generate(request, emit) resolves a host-owned
+// binding, issues exactly ONE HTTP request, streams text/thinking/tool_delta
+// display deltas, and returns one sealed ModelResult. The adapter never retries
+// and never executes tools; kernel policy owns backoff, call budgets and tool
+// execution.
+//
+// The binding's apiKey is placed only in the Authorization/x-api-key header and
+// never persisted in request, messages or result. binding.parameters may add
+// generation fields but never override messages/tools/model/stream or
+// security-sensitive transport values. Caller signal, body size and idle
+// silence are all bounded.
+
+import {
+  emptyUsage, parseRetryAfterMs, sanitizeFailureKind, ProtocolError,
+} from './model-normalize.mjs';
+import {
+  readModelSse, SseFramingError, IdleTimeout,
+} from './model-sse.mjs';
+import {
+  parseOpenAIBuffered, createOpenAIStreamTurn,
+} from './model-openai-chat.mjs';
+import {
+  parseAnthropicBuffered, createAnthropicStreamState,
+} from './model-anthropic.mjs';
+import {
+  parseResponsesBuffered, createResponsesStreamState,
+} from './model-responses.mjs';
+import { MediaError } from './model-media.mjs';
+import { buildNativeModelRequest } from './model-request.mjs';
+// parseModelJson is the kernel's strict finite JSON parser; used here for the
+// 400 context-length error heuristic so a malformed error body is never parsed
+// as a lenient ambiguity.
+import { parseModelJson, MODEL_FAILURE_CODES } from '@kingsoftcloud/agentkit-harness-core';
+import { observeModelTransportPort } from './model-transport-observation.mjs';
+
+const DEFAULT_MAX_BYTES = 8 * 1024 * 1024;
+const DEFAULT_IDLE_MS = 180000;
+
+/** Only the adapter's plain inference request is admitted for cold replay.
+ * Profile extensions can enable provider behavior we cannot prove pure. Keep
+ * those manual until their semantics have an explicit Host admission contract.
+ * A replay remains a new billed attempt; the ledger retains uncertain usage. */
+export function nativeModelRecoveryPolicy({ protocol, parameters = {} } = {}) {
+  return ['openai-chat', 'openai-responses', 'anthropic-messages'].includes(protocol)
+    && parameters !== null && typeof parameters === 'object' && !Array.isArray(parameters)
+    && Object.keys(parameters).length === 0 ? 'pure-inference/v1' : 'manual';
+}
+
+// A response body exceeded maxResponseBytes: terminal, never a truncated final.
+class OverflowError extends Error {
+  constructor() { super('response body exceeded maxResponseBytes'); this.name = 'OverflowError'; }
+}
+
+export function createNativeModelPort({
+  resolveProfile,
+  fetchImpl = fetch,
+  maxResponseBytes = DEFAULT_MAX_BYTES,
+  idleTimeoutMs = DEFAULT_IDLE_MS,
+} = {}) {
+  if (typeof resolveProfile !== 'function') {
+    throw new TypeError('createNativeModelPort requires a resolveProfile function');
+  }
+  if (typeof fetchImpl !== 'function') {
+    throw new TypeError('createNativeModelPort requires a fetchImpl function');
+  }
+  if (!Number.isSafeInteger(maxResponseBytes) || maxResponseBytes <= 0) throw new RangeError('maxResponseBytes must be a positive safe integer');
+  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) throw new RangeError('idleTimeoutMs must be positive and finite');
+  const maxBytes = maxResponseBytes;
+  const idleTimeout = idleTimeoutMs;
+
+  return observeModelTransportPort(async (request, emitEvent, observation) => {
+      if (!request || typeof request !== 'object' || !request.profile) {
+        return withFailure(terminalResult('invalid_response'), null, 'request', 'request_invalid');
+      }
+
+      // 1. Resolve the host-owned binding. A host hook failure is terminal and
+      // sanitized: exception text may carry credentials, so only the kind leaks.
+      let binding;
+      try {
+        binding = await resolveProfile(request.profile, request);
+      } catch {
+        return withFailure(terminalResult('host_error'), null, 'binding', 'host_binding');
+      }
+
+      // 2. Build the wire request. Pre-flight validation of the binding, profile
+      // or media is terminal; the adapter never calls HTTP with a bad binding.
+      let built;
+      try {
+        built = buildNativeModelRequest(binding, request);
+      } catch (error) {
+        const failureKind = (error instanceof ProtocolError || error instanceof MediaError)
+          ? 'invalid_response' : 'client_error';
+        return withFailure(terminalResult(failureKind), binding, 'request', 'request_invalid');
+      }
+
+      // 3. One fetch with a combined signal: the caller's signal plus an internal
+      // controller that bounds overall wall time. Redirects are disabled so a 3xx
+      // is a terminal client error, never a silent second request.
+      const internal = new AbortController();
+      const signals = [internal.signal];
+      if (request.signal) signals.push(request.signal);
+      const combined = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+      let overallTimer = null;
+      const overallMs = Number(request.profile?.requestTimeoutMs);
+      if (Number.isFinite(overallMs) && overallMs > 0) {
+        overallTimer = setTimeout(() => internal.abort(new IdleTimeout()), overallMs);
+        overallTimer.unref?.();
+      }
+
+      let response;
+      try {
+        observation.phase('headers');
+        response = await fetchImpl(built.url, {
+          method: 'POST',
+          headers: built.headers,
+          body: built.body,
+          signal: combined,
+          redirect: 'manual',
+        });
+        observation.headers();
+      } catch (error) {
+        clearTimer(overallTimer);
+        // Honor a caller-initiated abort by propagating it.
+        if (request.signal?.aborted) throw error;
+        if (internal.signal.aborted) return withFailure(retryableResult('request_timeout'), binding, 'headers', 'stream_timeout');
+        return withFailure(retryableResult(sanitizeFailureKind(error, 'network_error')), binding, 'headers', 'transport_error');
+      }
+
+      // 4. Dispatch. The overall timer stays armed through body reads so a
+      // server that sends headers then hangs the body is bounded; the finally
+      // clears the timer and cancels any unconsumed body so no connection leaks
+      // (e.g. a 429 whose body was never read).
+      try {
+        if (!response.ok) {
+          observation.phase('http-error');
+          const result = await classifyHttpError(response, { maxBytes });
+          request.signal?.throwIfAborted();
+          const code = response.status === 401 ? 'http_authentication' : response.status === 403 ? 'http_permission'
+            : response.status === 429 ? 'http_rate_limit' : response.status === 408 ? 'http_timeout'
+              : response.status >= 500 ? 'http_server' : 'http_client';
+          return withFailure(result, binding, 'http-error', code, { httpStatus: response.status });
+        }
+        const contentType = response.headers.get('content-type') || '';
+        if (contentType.includes('text/event-stream')) {
+          observation.phase('stream');
+          const idlePolicy = request.profile.streaming !== false && request.profile.streamTimeoutPolicy === 'idle/v1';
+          if (idlePolicy) { clearTimer(overallTimer); overallTimer = null; }
+          return await streamResponse(response, request, binding, emitEvent, internal, maxBytes,
+            idlePolicy && overallMs > 0 ? Math.min(idleTimeout, overallMs) : idleTimeout, observation);
+        }
+        observation.phase('buffered');
+        return await bufferedResponse(response, request, binding, maxBytes, emitEvent, observation);
+      } catch (error) {
+        if (request.signal?.aborted) throw error;
+        if (error instanceof IdleTimeout || internal.signal.aborted) {
+          return withFailure(retryableResult('request_timeout'), binding, 'buffered', 'stream_timeout');
+        }
+        // Overflow, bad UTF-8, or a transport error mid-body: a partial body is
+        // never sealed as a final; the attempt is terminal invalid_response.
+        return withFailure(terminalResult('invalid_response'), binding, 'buffered', error instanceof OverflowError
+          ? 'body_limit' : error instanceof TypeError && error.code === 'ERR_ENCODING_INVALID_ENCODED_DATA'
+            ? 'body_encoding' : protocolCode(error));
+      } finally {
+        clearTimer(overallTimer);
+        cancelBody(response);
+      }
+  });
+}
+
+async function streamResponse(response, request, binding, emit, internal, maxBytes, idleTimeoutMs, observation) {
+  const profile = request.profile;
+  const idlePolicy = profile.streaming !== false && profile.streamTimeoutPolicy === 'idle/v1';
+  const state = binding.protocol === 'anthropic-messages'
+    ? createAnthropicStreamState(profile)
+    : binding.protocol === 'openai-responses'
+      ? createResponsesStreamState(profile)
+      : createOpenAIStreamTurn(profile, binding);
+  // Idle silence aborts the fetch via the internal controller so the pending
+  // body read rejects cleanly instead of leaving an orphaned read to cancel.
+  const abort = (reason) => internal.abort(reason);
+  let frameIndex = -1;
+  const failed = (result, code) => withFailure(result, binding, 'stream', code,
+    { ...(frameIndex < 0 ? {} : { frameIndex }),
+      ...(code === 'usage_conflict' && state.usageConflict ? { usageConflict: state.usageConflict } : {}) });
+  try {
+    for await (const frame of readModelSse(response.body, { maxBytes, idleTimeoutMs, abort, observeBytes: observation.bytes })) {
+      if (idlePolicy && !frame.data.trim()) continue;
+      frameIndex++;
+      observation.frame();
+      state.consume(frame, emit);
+      if (idlePolicy) emit({ kind: 'activity', text: '' });
+      if (state.done) break;
+    }
+  } catch (error) {
+    if (request.signal?.aborted) throw error; // caller cancel propagates
+    if (error instanceof IdleTimeout) {
+      return failed(state.finalize({ errorKind: 'provider_retryable_error', failureKind: 'request_timeout' }), 'stream_timeout');
+    }
+    if (error instanceof SseFramingError) {
+      return failed(state.finalize({ errorKind: 'provider_terminal_error', failureKind: 'invalid_response' }), protocolCode(error));
+    }
+    if (error instanceof ProtocolError) {
+      // An Anthropic in-stream `error` event carries its own classification.
+      if (error.streamError) {
+        return failed(state.finalize({ errorKind: error.streamError.kind, failureKind: error.streamError.failureKind }), 'provider_error');
+      }
+      return failed(state.finalize({ errorKind: 'provider_terminal_error', failureKind: 'invalid_response' }), protocolCode(error));
+    }
+    if (internal.signal.aborted) {
+      // An overall-timeout abort (and any idle abort that surfaced as a
+      // transport error) is a retryable request timeout, never a final.
+      return failed(state.finalize({ errorKind: 'provider_retryable_error', failureKind: 'request_timeout' }), 'stream_timeout');
+    }
+    return failed(state.finalize({ errorKind: 'provider_retryable_error', failureKind: sanitizeFailureKind(error, 'network_error') }), 'transport_error');
+  }
+  const result = state.finalize();
+  return failed(result, state.streamError ? 'provider_error' : result.kind === 'malformed_tool_call' ? 'tool_payload_invalid'
+    : result.failureKind === 'incomplete_response' ? 'stream_incomplete' : 'protocol_invalid');
+}
+
+async function bufferedResponse(response, request, binding, maxBytes, emit, observation) {
+  const bodyText = await readBoundedText(response, maxBytes, observation.bytes);
+  const captureReplay = request.profile?.providerReplayMode !== 'none';
+  // Keep legacy buffered admissions unchanged. New visibility admissions also
+  // retain explicitly provided display reasoning when a server returns JSON.
+  const onThinking = request.profile.providerThinkingDisplayPolicy === 'provider-visible/v1'
+    && request.profile.providerThinkingDisplay === true ? text => { if (text) emit({ kind: 'thinking', text }); } : undefined;
+  try {
+    if (binding.protocol === 'anthropic-messages') {
+      return withFailure(parseAnthropicBuffered(bodyText, request, { captureReplay, onThinking }), binding, 'buffered', 'protocol_invalid');
+    }
+    if (binding.protocol === 'openai-responses') {
+      return withFailure(parseResponsesBuffered(bodyText, request, { captureReplay, onThinking }), binding, 'buffered', 'protocol_invalid');
+    }
+    return withFailure(parseOpenAIBuffered(bodyText, request, { captureReplay, binding, onThinking }), binding, 'buffered', 'protocol_invalid');
+  } catch (error) {
+    return withFailure(terminalResult('invalid_response'), binding, 'buffered', protocolCode(error));
+  }
+}
+
+// Classify a non-2xx HTTP response into a sealed ModelResult. The body is read
+// only for a 400 to detect a context_length_exceeded code; otherwise the
+// status and Retry-After header are the only facts that leave the adapter. A
+// body that cannot be read (timeout/overflow/bad utf-8) cannot erase the HTTP
+// failure fact — the status-based classification still stands.
+async function classifyHttpError(response, { maxBytes }) {
+  const status = response.status;
+  const retryAfterMs = parseRetryAfterMs(response.headers.get('retry-after'));
+  if (status === 408) return retryableResult('request_timeout', retryAfterMs);
+  if (status === 429) return retryableResult('rate_limit', retryAfterMs);
+  if (status >= 500 && status <= 599) return retryableResult('server_error', retryAfterMs);
+  if (status === 403) return { kind: 'policy_abort', text: '', toolCalls: [], usage: emptyUsage(), usageReported: false };
+  if (status === 400) {
+    try {
+      const bodyText = await readBoundedText(response, maxBytes);
+      if (hasContextLengthExceeded(bodyText)) {
+        return { kind: 'context_overflow', text: '', toolCalls: [], usage: emptyUsage(), usageReported: false };
+      }
+    } catch { /* an unreadable 400 body cannot erase the 400 failure fact */ }
+    return terminalResult('client_error');
+  }
+  return terminalResult('client_error');
+}
+
+function hasContextLengthExceeded(bodyText) {
+  try {
+    const payload = parseModelJson(bodyText);
+    const error = payload && typeof payload === 'object' ? payload.error : null;
+    if (error && typeof error === 'object') {
+      const code = String(error.code || '');
+      const type = String(error.type || '');
+      if (code === 'context_length_exceeded' || type === 'context_length_exceeded') return true;
+    }
+  } catch { /* an unreadable error body cannot erase the HTTP failure fact */ }
+  return false;
+}
+
+function terminalResult(failureKind) {
+  return { kind: 'provider_terminal_error', text: '', toolCalls: [], usage: emptyUsage(), usageReported: false, failureKind };
+}
+
+// A closed enum, rather than exception messages, crosses the model boundary.
+// This is diagnostic evidence only; original classification/retry policy stays intact.
+function protocolCode(error) {
+  return (error instanceof ProtocolError || error instanceof SseFramingError) && MODEL_FAILURE_CODES.includes(error.code)
+    ? error.code : 'protocol_invalid';
+}
+function withFailure(result, binding, phase, code, fields = {}) {
+  if (!['provider_terminal_error', 'provider_retryable_error', 'policy_abort', 'malformed_tool_call'].includes(result.kind)) return result;
+  const protocol = ['openai-chat', 'openai-responses', 'anthropic-messages'].includes(binding?.protocol) ? binding.protocol : 'unknown';
+  return { ...result, failureDiagnostic: { contract: fields.usageConflict
+    ? 'model-failure-diagnostic/v2' : 'model-failure-diagnostic/v1', protocol, phase, code, ...fields } };
+}
+
+function retryableResult(failureKind, retryAfterMs = null) {
+  const result = { kind: 'provider_retryable_error', text: '', toolCalls: [], usage: emptyUsage(), usageReported: false, failureKind };
+  if (Number.isFinite(retryAfterMs) && retryAfterMs != null && retryAfterMs >= 0) {
+    result.retryAfterMs = retryAfterMs;
+  }
+  return result;
+}
+
+function clearTimer(timer) {
+  if (timer) clearTimeout(timer);
+}
+
+// Cancel an unconsumed response body so the underlying connection is released
+// (e.g. a 429 whose body was never read). Safe to call on a consumed/locked/
+// errored body: a cancel that cannot proceed, or rejects because the stream
+// was aborted, is swallowed so it never surfaces as an unhandled rejection.
+function cancelBody(response) {
+  try {
+    const result = response?.body?.cancel?.();
+    if (result && typeof result.then === 'function') result.catch(() => {});
+  } catch { /* already locked/consumed */ }
+}
+
+// Read a response body as strict UTF-8 text, failing on overflow rather than
+// truncating a prefix (a JSON prefix + overflow suffix must not masquerade as a
+// complete response). Reads to EOF before sealing. Throws OverflowError on
+// overflow; propagates abort and bad-UTF-8 errors for the caller to classify.
+async function readBoundedText(response, maxBytes, observeBytes) {
+  const body = response.body;
+  if (body == null) return '';
+  const reader = body.getReader ? body.getReader() : null;
+  const decoder = new TextDecoder('utf-8', { fatal: true });
+  let total = 0;
+  const chunks = [];
+  if (reader) {
+    try {
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        if (!value) continue;
+        if (!(value instanceof Uint8Array) && !(value instanceof ArrayBuffer)) throw new ProtocolError('body requires bytes');
+        total += value.byteLength;
+        observeBytes?.(value.byteLength);
+        if (total > maxBytes) throw new OverflowError();
+        chunks.push(decoder.decode(value, { stream: true }));
+      }
+      chunks.push(decoder.decode());
+      return chunks.join('');
+    } finally {
+      reader.releaseLock?.();
+    }
+  }
+  // Async-iterable fallback.
+  for await (const value of body) {
+    if (!value) continue;
+    if (!(value instanceof Uint8Array) && !(value instanceof ArrayBuffer)) throw new ProtocolError('body requires bytes');
+    total += value.byteLength;
+    observeBytes?.(value.byteLength);
+    if (total > maxBytes) throw new OverflowError();
+    chunks.push(decoder.decode(value, { stream: true }));
+  }
+  chunks.push(decoder.decode());
+  return chunks.join('');
+}

package/src/native/model-provider-compat.mjs

@@ -0,0 +1,129 @@
+// Frozen Chat Completions request policy, ported from the pinned Python
+// model_proxy.compat and transform.model-effort-map/v2. No IO or retries here.
+import { admitInlineReasoningPolicy, resolveCompatibilityRule } from './model-inline-reasoning.mjs';
+import { ProtocolError } from './model-normalize.mjs';
+
+const strict = new Set(['openai', 'strict-openai', 'cerebras', 'groq']);
+const requiredAuto = new Set(['claude-opus-5-5', 'claude-sonnet-5-5', 'claude-fable-5-1', 'claude-mythos-5-1']);
+const mandatory = new Set(['claude-fable-5-1', 'claude-opus-5-5', 'claude-sonnet-5-5']);
+const ranks = { none: 0, minimal: 1, low: 2, medium: 3, high: 4, xhigh: 5, max: 5 };
+const normalized = model => String(model ?? '').trim().toLowerCase().replaceAll('_', '-');
+const object = value => value && typeof value === 'object' && !Array.isArray(value);
+// Provider capability, independent of text streaming. Without tool_stream,
+// these services may buffer a large argument until generation completes.
+// https://docs.bigmodel.cn/cn/guide/capabilities/stream-tool
+// Unknown models retain their configured wire behavior, including explicit
+// tool_stream. Freeze v2 at admission; v1 recovery must retain its old bytes.
+const incrementalToolModels = new Set(['glm-5', 'glm-5.1', 'glm-5.2', 'glm-5.2-fast-preview',
+  'glm-5.3', 'glm-5.3-flash', 'glm-5.3-flashx']);
+
+// Exact pinned catalog entries. Aliases and future names retain legacy wire behavior.
+export function admitAnthropicPolicies(protocol, model) {
+  if (protocol !== 'anthropic-messages') return {};
+  const known = [...mandatory, 'claude-haiku-5-5'].includes(String(model).trim().toLowerCase());
+  return { anthropicPolicy: { contract: 'anthropic-wire/v1', midSystem: known, blockBinding: known ? 'drop_block' : 'disabled' },
+    ...(known ? { promptCachePolicy: 'anthropic-prefix/v1', operatorGuidancePolicy: 'journaled-system/v1', toolCatalogPolicy: 'stable-task/v1',
+      providerReplayProjectionPolicy: 'anthropic-client-compaction/v1' } : {}) };
+}
+
+export function applyAnthropicThinking(payload, profile, binding) {
+  if (!profile.anthropicPolicy) return payload;
+  const compat = resolveProviderCompatibility(profile.providerCompatibilityPolicy, binding);
+  const effort = profile.reasoningEffort ?? payload.reasoning_effort ?? null;
+  const mode = profile.thinkingMode ?? payload.thinking?.type;
+  if (profile.thinkingMode === 'enabled') throw new ProtocolError('model_thinking_mode_unsupported');
+  const disable = compat?.supportsThinking && (compat.disabledEfforts === null || compat.disabledEfforts.includes(effort))
+    && (mode === 'disabled' || compat.disabledEfforts?.includes(effort)
+      || compat.toolThinkingOff && !!payload.tools?.length
+      || compat.thinkingBudget !== null && payload.max_tokens <= compat.thinkingBudget);
+  if (disable) return { ...payload, thinking: { type: 'disabled' } };
+  if (profile.anthropicPolicy.blockBinding !== 'drop_block') return payload;
+  const thinking = { ...(payload.thinking ?? { type: 'adaptive' }) };
+  if (['adaptive', 'enabled'].includes(thinking.type)) thinking.block_binding = { prefix_mismatch_behavior: 'drop_block' };
+  return { ...payload, thinking };
+}
+
+export function admitProviderCompatibilityPolicy(override) {
+  return { contract: 'provider-compat/v2', rule: admitInlineReasoningPolicy(override).rule };
+}
+
+export function resolveProviderCompatibility(policy, binding) {
+  if (!policy) return null;
+  if (!['provider-compat/v1', 'provider-compat/v2'].includes(policy.contract)) throw new ProtocolError('invalid_provider_compatibility_policy');
+  const rule = resolveCompatibilityRule(policy.rule, binding);
+  const name = String(binding.model ?? '').trim().toLowerCase();
+  const kimi = ['kspmas-gateway', 'moonshot'].includes(rule)
+    && ['kimi-k2.7-code', 'kimi-k2.7-code-highspeed'].includes(name);
+  const disabledEfforts = mandatory.has(name) ? [] : name === 'claude-haiku-5-5' ? ['low', 'medium', 'high'] : null;
+  return { rule, supportsUsage: !strict.has(rule), supportsThinking: !strict.has(rule) && !kimi,
+    supportsToolArgumentStreaming: policy.contract === 'provider-compat/v2'
+      && ['zai', 'kspmas-gateway'].includes(rule) && incrementalToolModels.has(normalized(binding.model)),
+    supportsEffort: !kimi, toolThinkingOff: ['zai', 'kspmas-gateway'].includes(rule) && !kimi,
+    thinkingBudget: rule === 'zai' && !kimi && !disabledEfforts ? 32000 : null,
+    disabledEfforts, requiredAuto: kimi || requiredAuto.has(name),
+    echo: kimi || ['deepseek', 'mimo'].includes(rule) ? 'preserve' : strict.has(rule) ? 'strip' : 'thinking',
+    hints: kimi ? ['kimi-k2.7-code'] : { moonshot: ['kimi'], deepseek: ['deepseek'],
+      zai: ['glm', 'zai', 'bigmodel'], 'kspmas-gateway': ['glm', 'deepseek'], mimo: ['mimo'] }[rule] ?? [] };
+}
+
+export function clampReasoningEffort(model, effort) {
+  if (typeof effort !== 'string' || typeof model !== 'string') return effort;
+  if (model.startsWith('glm-5.3-flash') && !['low', 'high', 'max'].includes(effort)) {
+    const rank = ranks[effort];
+    effort = rank === undefined ? 'low' : ['low', 'high', 'max'].find(value => ranks[value] >= rank) ?? 'max';
+  }
+  if (['qwen3.7', 'qwen3.6', 'qwen3.5'].some(prefix => model.startsWith(prefix)) && ranks[effort] > ranks.high) return 'high';
+  return effort;
+}
+
+export function projectProviderToolChoice(choice, compat) {
+  const named = object(choice) && Object.keys(choice).length === 2 && choice.type === 'function'
+    && object(choice.function) && Object.keys(choice.function).length === 1
+    && typeof choice.function.name === 'string' && choice.function.name.trim();
+  return compat?.requiredAuto && (choice === 'required' || named) ? 'auto' : choice;
+}
+
+export function applyProviderChatCompatibility(payload, request, binding) {
+  const compat = resolveProviderCompatibility(request.profile.providerCompatibilityPolicy, binding);
+  if (!compat) return payload;
+  const result = { ...payload }, options = request.profile;
+  if (compat.supportsToolArgumentStreaming && result.stream && result.tools?.length && result.tool_choice !== 'none') {
+    if (result.tool_stream !== undefined && typeof result.tool_stream !== 'boolean') throw new ProtocolError('invalid_tool_stream');
+    result.tool_stream ??= true;
+  }
+  const model = binding.model, name = normalized(model);
+  const requested = options.reasoningEffort ?? result.reasoning_effort ?? null;
+  let effort = requested;
+  if (requested === null && options.controllerReasoningPolicy === 'disclosed-delegate/v1'
+    && ['zai', 'kspmas-gateway'].includes(compat.rule) && name.startsWith('glm-5.3')
+    && result.tools?.some(tool => tool.type === 'function' && tool.function?.name === 'delegate_task')) effort = 'low';
+  if (requested === null && request.purpose === 'compaction' && compat.rule === 'kspmas-gateway'
+    && ['glm-5.2', 'deepseek-v4-flash'].includes(name)) effort = 'none';
+  effort = compat.supportsEffort ? clampReasoningEffort(model, effort) : null;
+  if (effort !== null) result.reasoning_effort = effort;
+  if (result.stream) result.stream_options = { ...(object(result.stream_options) ? result.stream_options : {}), include_usage: true };
+  if (!compat.supportsUsage && object(result.stream_options)) {
+    result.stream_options = { ...result.stream_options }; delete result.stream_options.include_usage;
+    if (!Object.keys(result.stream_options).length) delete result.stream_options;
+  }
+  const mode = options.thinkingMode ?? result.thinking?.type;
+  const mayDisable = compat.supportsThinking && (compat.disabledEfforts === null || compat.disabledEfforts.includes(effort));
+  const summaryOff = request.purpose === 'compaction' && requested === null && compat.rule === 'kspmas-gateway' && name === 'glm-5.3-flash';
+  const budget = result.max_completion_tokens ?? result.max_tokens;
+  if (mode === 'enabled') {
+    if (!compat.supportsThinking) throw new ProtocolError('model_thinking_mode_unsupported');
+    result.thinking = { type: 'enabled' };
+  } else if (mayDisable && (mode === 'disabled' || summaryOff
+    || compat.toolThinkingOff && !!result.tools?.length && result.tool_choice !== 'none'
+    || compat.thinkingBudget !== null && budget <= compat.thinkingBudget)) result.thinking = { type: 'disabled' };
+  if (!compat.supportsThinking) delete result.thinking;
+  if (!compat.supportsEffort) delete result.reasoning_effort;
+  if (result.tool_choice !== undefined) result.tool_choice = projectProviderToolChoice(result.tool_choice, compat);
+  if (compat.echo === 'strip' || compat.echo === 'thinking' && !compat.hints.some(hint => normalized(model).includes(hint))) {
+    result.messages = result.messages.map(message => {
+      if (message.role !== 'assistant') return message;
+      const copy = { ...message }; delete copy.reasoning_content; return copy;
+    });
+  }
+  return result;
+}

package/src/native/model-replay.mjs

@@ -0,0 +1,153 @@
+// Private provider replay sealing for the native model adapter.
+//
+// Ports ksadk.harness.native.model_replay. Private protocol material (chat
+// reasoning_content, or Anthropic signed-thinking + tool_use content blocks)
+// is bound to the host's pinned profile and echoed only to the same profile on
+// the next attempt. It authorizes neither a tool nor a final answer, and never
+// enters a public stream event's payload — only ModelResult.providerReplay.
+//
+// The binding fingerprint is profileId + profileVersion + compatibilityDigest.
+// The sealed replay also carries compatibilityDigest explicitly: the kernel's
+// boundReplay checks `result.providerReplay.compatibilityDigest ===
+// config.profile.compatibilityDigest` and rejects a mismatch, so a replay that
+// does not prove its profile lineage cannot authorize history. On input
+// re-projection the adapter re-checks the full fingerprint so cross-profile
+// private material is dropped, never leaked onto another model's wire.
+
+import { createHash } from 'node:crypto';
+import { canonical, modelWireToolCall } from '@kingsoftcloud/agentkit-harness-core';
+import { ProtocolError } from './model-normalize.mjs';
+
+const SEALED_KINDS = new Set(['tool_calls', 'final_candidate', 'output_limit']);
+
+export function profileFingerprint(profile) {
+  return `${String(profile?.profileId ?? '')}\0${String(profile?.profileVersion ?? '')}\0${String(profile?.compatibilityDigest ?? '')}`;
+}
+
+// Seal chat reasoning_content replay. The replay carries compatibilityDigest
+// for the kernel's boundReplay check and the fingerprint for input re-projection.
+export function sealModelReplay(result, profile, reasoningContent) {
+  if (profile?.providerReplayMode !== 'reasoning_content') return result;
+  if (!SEALED_KINDS.has(result.kind)) return result;
+  return {
+    ...result,
+    providerReplay: {
+      version: 'model-replay/v1',
+      profileFingerprint: profileFingerprint(profile),
+      compatibilityDigest: String(profile.compatibilityDigest ?? ''),
+      reasoningContent: String(reasoningContent || ''),
+    },
+    usageReported: result.usageReported,
+  };
+}
+
+// Seal Anthropic original content blocks (text + signed thinking + tool_use
+// with original provider ids) for anthropic_content replay. The blocks keep
+// the provider's original tool_use ids; the kernel later adds replayToolIds to
+// the ModelResult if it remaps colliding ids, and the adapter applies that map
+// on input re-projection.
+export function sealAnthropicReplay(result, profile, contentBlocks) {
+  if (profile?.providerReplayMode !== 'anthropic_content') return result;
+  if (!SEALED_KINDS.has(result.kind)) return result;
+  return {
+    ...result,
+    providerReplay: {
+      version: 'model-replay/v2',
+      profileFingerprint: profileFingerprint(profile),
+      compatibilityDigest: String(profile.compatibilityDigest ?? ''),
+      anthropicContent: Array.isArray(contentBlocks) ? contentBlocks : [],
+    },
+    usageReported: result.usageReported,
+  };
+}
+
+// Re-project an assistant message's providerReplay onto the OpenAI chat wire.
+// The replay must belong to the current profile (full fingerprint match) or it
+// is dropped — cross-profile private reasoning never leaks onto another wire.
+// Returns { reasoning_content } to merge into the assistant message, or {}.
+export function openAIReplayFields(message, profile) {
+  if (profile?.providerReplayMode !== 'reasoning_content') return {};
+  const replay = message?.providerReplay;
+  if (!replay || replay.version !== 'model-replay/v1') return {};
+  if (replay.profileFingerprint !== profileFingerprint(profile)) return {};
+  if (!replay.reasoningContent) return {};
+  return { reasoning_content: replay.reasoningContent };
+}
+
+// Re-project an assistant message's anthropic_content replay onto the Anthropic
+// Messages wire. The replay must belong to the current profile; its tool_use
+// ids are mapped through message.replayToolIds (original -> canonical) without
+// touching the signature or private thinking text. The mapped tool_use blocks
+// must pair exactly with the message's sealed toolCalls (id/name/arguments) and
+// the text blocks must reconstruct message.content — otherwise the replay is
+// inconsistent and dropped (never allowed to inject extra tools or replace a
+// sealed call). The original providerReplay object is never mutated.
+export function anthropicReplayContent(message, profile) {
+  if (profile?.providerReplayMode !== 'anthropic_content') return null;
+  const replay = message?.providerReplay;
+  if (!replay || replay.version !== 'model-replay/v2') return null;
+  if (replay.profileFingerprint !== profileFingerprint(profile)) return null;
+  if (!Array.isArray(replay.anthropicContent)) return null;
+  const idMap = message.replayToolIds || {};
+  let blocks = structuredClone(replay.anthropicContent).map((block) => {
+    if (block && block.type === 'tool_use') {
+      const mappedId = Object.prototype.hasOwnProperty.call(idMap, block.id) ? idMap[block.id] : block.id;
+      return { ...block, id: mappedId };
+    }
+    return block == null ? block : { ...block };
+  });
+  if (!validateReplayPairing(blocks, message)) return null;
+  const view = message.providerReplayProjection;
+  if (view) {
+    const contentDigest = createHash('sha256').update(canonical(replay.anthropicContent)).digest('hex');
+    if (profile.providerReplayProjectionPolicy !== 'anthropic-client-compaction/v1'
+      || view.version !== 'anthropic-client-compaction/v1' || view.profileDigest !== profile.compatibilityDigest
+      || view.originalContentDigest !== contentDigest || !/^[0-9a-f]{64}$/.test(view.prefixDigest))
+      throw new ProtocolError('anthropic_replay_projection_mismatch');
+    blocks = blocks.filter(block => !['thinking', 'redacted_thinking'].includes(block?.type));
+  }
+  return blocks;
+}
+
+// Validate that the replay blocks pair exactly with the sealed message facts:
+// text blocks reconstruct message.content, and tool_use blocks (in order)
+// match message.toolCalls by callId/name/arguments. A mismatch means the replay
+// is not a faithful original of this sealed turn; drop it rather than let it
+// inject or replace tool facts.
+function validateReplayPairing(blocks, message) {
+  const text = blocks.filter((b) => b && b.type === 'text').map((b) => b.text || '').join('');
+  if (text !== (message.content || '')) return false;
+  const toolUses = blocks.filter((b) => b && b.type === 'tool_use');
+  const calls = message.toolCalls || [];
+  if (toolUses.length !== calls.length) return false;
+  for (let i = 0; i < toolUses.length; i++) {
+    const tu = toolUses[i];
+    const call = calls[i] && modelWireToolCall(calls[i]);
+    if (!tu || !call) return false;
+    if (tu.id !== call.callId) return false;
+    if (tu.name !== call.name) return false;
+    if (!jsonEqual(tu.input, call.arguments)) return false;
+  }
+  return true;
+}
+
+function jsonEqual(a, b) {
+  if (a === b) return true;
+  if (a == null || b == null || typeof a !== 'object' || typeof b !== 'object') return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    if (a.length !== b.length) return false;
+    return a.every((v, i) => jsonEqual(v, b[i]));
+  }
+  const ka = Object.keys(a).sort();
+  const kb = Object.keys(b).sort();
+  if (ka.length !== kb.length || !ka.every((k, i) => k === kb[i])) return false;
+  return ka.every((k) => jsonEqual(a[k], b[k]));
+}
+
+// True when the message carries a replay that belongs to the given profile.
+export function replayMatchesProfile(message, profile) {
+  const replay = message?.providerReplay;
+  if (!replay) return true;
+  return replay.profileFingerprint === profileFingerprint(profile);
+}

package/src/native/model-request.mjs

@@ -0,0 +1,15 @@
+import { buildOpenAIRequest } from './model-openai-chat.mjs';
+import { buildAnthropicRequest } from './model-anthropic.mjs';
+import { buildResponsesRequest } from './model-responses.mjs';
+import { ProtocolError } from './model-normalize.mjs';
+import { projectRequestMedia } from './model-media.mjs';
+
+/** One pure dispatch projection shared by request admission and actual HTTP. */
+export function buildNativeModelRequest(binding, request) {
+  if (!binding || typeof binding !== 'object') throw new ProtocolError('binding missing');
+  const view = projectRequestMedia(request);
+  if (binding.protocol === 'anthropic-messages') return buildAnthropicRequest(binding, view);
+  if (binding.protocol === 'openai-chat') return buildOpenAIRequest(binding, view);
+  if (binding.protocol === 'openai-responses') return buildResponsesRequest(binding, view);
+  throw new ProtocolError('unsupported binding protocol');
+}