@leanandmean/coding-agent 0.74.1-scramjet.7 → 0.74.1-scramjet.71

package/dist/core/model-registry.js

@@ -1,7 +1,7 @@
 /**
  * Model registry - manages built-in and custom models, provides API key resolution.
  */
-import { getModels, getProviders, registerApiProvider, resetApiProviders, } from "@leanandmean/ai";
+import { getModels, getProviders, registerApiProvider, resetApiProviders, validateModelContextLimits, } from "@leanandmean/ai";
 import { registerOAuthProvider, resetOAuthProviders } from "@leanandmean/ai/oauth";
 import { existsSync, readFileSync } from "fs";
 import { join } from "path";
@@ -58,7 +58,12 @@ const ThinkingLevelMapSchema = Type.Object({
     medium: Type.Optional(ThinkingLevelMapValueSchema),
     high: Type.Optional(ThinkingLevelMapValueSchema),
     xhigh: Type.Optional(ThinkingLevelMapValueSchema),
+    max: Type.Optional(ThinkingLevelMapValueSchema), // SCRAMJET-DIVERGENCE: Match the public thinking-map vocabulary.
 });
+// SCRAMJET-DIVERGENCE: strict additionalProperties: false on all compat schemas, compat-key derivation,
+// compatKeysForApi/validateCompatForApi/validateProviderCompatForApis, and validateConfig compat loops.
+// Upstream accepts unknown compat keys silently via permissive union; these changes reject invalid and
+// API-incompatible keys at load time. See also the compat-key sets below.
 const OpenAICompletionsCompatSchema = Type.Object({
     supportsStore: Type.Optional(Type.Boolean()),
     supportsDeveloperRole: Type.Optional(Type.Boolean()),
@@ -81,22 +86,39 @@ const OpenAICompletionsCompatSchema = Type.Object({
     cacheControlFormat: Type.Optional(Type.Literal("anthropic")),
     openRouterRouting: Type.Optional(OpenRouterRoutingSchema),
     vercelGatewayRouting: Type.Optional(VercelGatewayRoutingSchema),
+    zaiToolStream: Type.Optional(Type.Boolean()),
     supportsStrictMode: Type.Optional(Type.Boolean()),
+    sendSessionAffinityHeaders: Type.Optional(Type.Boolean()),
     supportsLongCacheRetention: Type.Optional(Type.Boolean()),
-});
+}, { additionalProperties: false });
 const OpenAIResponsesCompatSchema = Type.Object({
     sendSessionIdHeader: Type.Optional(Type.Boolean()),
     supportsLongCacheRetention: Type.Optional(Type.Boolean()),
-});
+}, { additionalProperties: false });
 const AnthropicMessagesCompatSchema = Type.Object({
     supportsEagerToolInputStreaming: Type.Optional(Type.Boolean()),
     supportsLongCacheRetention: Type.Optional(Type.Boolean()),
-});
+    sendSessionAffinityHeaders: Type.Optional(Type.Boolean()),
+    supportsCacheControlOnTools: Type.Optional(Type.Boolean()),
+    // SCRAMJET-DIVERGENCE: supportsTemperature and forceAdaptiveThinking for Opus 4.8/Fable 5/Sonnet 5 support
+    supportsTemperature: Type.Optional(Type.Boolean()),
+    forceAdaptiveThinking: Type.Optional(Type.Boolean()),
+}, { additionalProperties: false });
 const ProviderCompatSchema = Type.Union([
     OpenAICompletionsCompatSchema,
     OpenAIResponsesCompatSchema,
     AnthropicMessagesCompatSchema,
 ]);
+// SCRAMJET-DIVERGENCE: compat-key sets derived from their TypeBox schemas to avoid lockstep duplication
+const OPENAI_COMPLETIONS_COMPAT_KEYS = new Set(Object.keys(OpenAICompletionsCompatSchema.properties));
+const OPENAI_RESPONSES_COMPAT_KEYS = new Set(Object.keys(OpenAIResponsesCompatSchema.properties));
+const ANTHROPIC_MESSAGES_COMPAT_KEYS = new Set(Object.keys(AnthropicMessagesCompatSchema.properties));
+const RequestLimitsSchema = Type.Array(Type.Object({
+    maxTotalTokens: Type.Number({ exclusiveMinimum: 0 }),
+    maxInputTokens: Type.Optional(Type.Number({ exclusiveMinimum: 0 })),
+    maxOutputTokens: Type.Optional(Type.Number({ exclusiveMinimum: 0 })),
+    supportsTools: Type.Boolean(),
+}, { additionalProperties: false }), { minItems: 1 });
 // Schema for custom model definition
 // Most fields are optional with sensible defaults for local models (Ollama, LM Studio, etc.)
 const ModelDefinitionSchema = Type.Object({
@@ -114,10 +136,104 @@ const ModelDefinitionSchema = Type.Object({
         cacheWrite: Type.Number(),
     })),
     contextWindow: Type.Optional(Type.Number()),
+    maxInputTokens: Type.Optional(Type.Number()),
+    requestLimits: Type.Optional(RequestLimitsSchema),
     maxTokens: Type.Optional(Type.Number()),
     headers: Type.Optional(Type.Record(Type.String(), Type.String())),
     compat: Type.Optional(ProviderCompatSchema),
 });
+// SCRAMJET-DIVERGENCE: Invocation ingress closes reused schemas without tightening persistent configuration.
+function closedInvocationSchema(schema) {
+    const result = structuredClone(schema);
+    function close(value) {
+        if (!value || typeof value !== "object")
+            return;
+        for (const child of Object.values(value))
+            close(child);
+        const node = value;
+        if (node.type === "object")
+            node.additionalProperties = false;
+        if (node.type === "number") {
+            node.minimum ??= -Number.MAX_VALUE;
+            node.maximum ??= Number.MAX_VALUE;
+        }
+    }
+    close(result);
+    return result;
+}
+const InvocationModelDefinitionSchema = closedInvocationSchema(Type.Object({
+    ...Type.Pick(ModelDefinitionSchema, [
+        "id",
+        "name",
+        "reasoning",
+        "input",
+        "thinkingLevelMap",
+        "compat",
+        "cost",
+        "maxInputTokens",
+        "requestLimits",
+    ]).properties,
+    api: Type.Union([
+        Type.Literal("openai-completions"),
+        Type.Literal("openai-responses"),
+        Type.Literal("anthropic-messages"),
+        Type.Literal("google-generative-ai"),
+    ]),
+    baseUrl: Type.String({ minLength: 1 }),
+    apiKeyEnv: Type.String({ pattern: "^[A-Za-z_][A-Za-z0-9_]*$" }),
+    contextWindow: Type.Number({ exclusiveMinimum: 0 }),
+    maxTokens: Type.Integer({ minimum: 1, maximum: Number.MAX_SAFE_INTEGER }),
+}));
+const validateInvocationDefinition = Compile(InvocationModelDefinitionSchema);
+export function validateInvocationModelDefinition(value) {
+    if (!validateInvocationDefinition.Check(value)) {
+        const error = validateInvocationDefinition.Errors(value)[0];
+        const field = error ? formatValidationPath(error).split(".")[0] : undefined;
+        const safeField = field && Object.hasOwn(InvocationModelDefinitionSchema.properties, field) ? field : "object";
+        throw new Error(`model definition ${safeField}: supply the required fields and supported metadata with valid values.`);
+    }
+    if (!value.id.trim())
+        throw new Error("model definition id: supply a nonblank literal backend ID.");
+    const urlError = "model definition baseUrl: supply an absolute HTTP(S) URL with a host and no credentials, query, fragment, controls or surrounding whitespace.";
+    if (value.baseUrl.trim() !== value.baseUrl || /[\s\u0000-\u0020\u007f-\u009f\\?#]/.test(value.baseUrl)) {
+        throw new Error(urlError);
+    }
+    let url;
+    try {
+        url = new URL(value.baseUrl);
+    }
+    catch {
+        throw new Error(urlError);
+    }
+    if (!/^https?:\/\//i.test(value.baseUrl) ||
+        !["http:", "https:"].includes(url.protocol) ||
+        !url.hostname ||
+        url.username ||
+        url.password ||
+        value.baseUrl.split("/")[2].includes("@")) {
+        throw new Error(urlError);
+    }
+    try {
+        validateCompatForApi(value.compat, value.api, "compat");
+    }
+    catch {
+        throw new Error("model definition compat: use only compatibility fields supported by the selected API.");
+    }
+    try {
+        validateModelContextLimits({ ...value, provider: "invocation", id: "definition" });
+    }
+    catch {
+        throw new Error("model definition contextWindow/maxInputTokens/requestLimits: supply positive finite applicable limits.");
+    }
+    // Omitted capabilities and zero price estimates are client metadata, not backend or billing evidence.
+    return {
+        ...value,
+        name: value.name ?? value.id,
+        reasoning: value.reasoning ?? false,
+        input: value.input ?? ["text"],
+        cost: value.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    };
+}
 // Schema for per-model overrides (all fields optional, merged with built-in model)
 const ModelOverrideSchema = Type.Object({
     name: Type.Optional(Type.String({ minLength: 1 })),
@@ -131,6 +247,8 @@ const ModelOverrideSchema = Type.Object({
         cacheWrite: Type.Optional(Type.Number()),
     })),
     contextWindow: Type.Optional(Type.Number()),
+    maxInputTokens: Type.Optional(Type.Number()),
+    requestLimits: Type.Optional(RequestLimitsSchema),
     maxTokens: Type.Optional(Type.Number()),
     headers: Type.Optional(Type.Record(Type.String(), Type.String())),
     compat: Type.Optional(ProviderCompatSchema),
@@ -150,6 +268,12 @@ const ModelsConfigSchema = Type.Object({
     providers: Type.Record(Type.String(), ProviderConfigSchema),
 });
 const validateModelsConfig = Compile(ModelsConfigSchema);
+// SCRAMJET-DIVERGENCE: Reject obsolete policy keys rather than silently changing their meaning.
+function rejectContextWindowBudget(model, provider, id) {
+    if ("contextWindowBudget" in model) {
+        throw new Error(`${provider}/${id}: contextWindowBudget was removed; remove this key and set contextWindow to the evidenced maximum total context. Do not copy a discretionary budget into contextWindow or maxInputTokens.`);
+    }
+}
 function formatValidationPath(error) {
     if (error.keyword === "required") {
         const requiredProperties = error.params.requiredProperties;
@@ -171,6 +295,49 @@ function stripJsonComments(input) {
 function emptyCustomModelsResult(error) {
     return { models: [], overrides: new Map(), modelOverrides: new Map(), error };
 }
+function compatKeysForApi(api) {
+    switch (api) {
+        case "openai-completions":
+            return OPENAI_COMPLETIONS_COMPAT_KEYS;
+        case "openai-responses":
+            return OPENAI_RESPONSES_COMPAT_KEYS;
+        case "anthropic-messages":
+            return ANTHROPIC_MESSAGES_COMPAT_KEYS;
+        default:
+            return undefined;
+    }
+}
+function validateCompatForApi(compat, api, path) {
+    if (!compat)
+        return;
+    const allowedKeys = compatKeysForApi(api);
+    for (const key of Object.keys(compat)) {
+        if (!allowedKeys?.has(key)) {
+            throw new Error(`${path}.${key}: compat field is not valid for api "${api}".`);
+        }
+    }
+}
+function validateProviderCompatForApis(compat, apis, path) {
+    if (!compat)
+        return;
+    for (const key of Object.keys(compat)) {
+        let validForAny = false;
+        for (const api of apis) {
+            const allowedKeys = compatKeysForApi(api);
+            if (allowedKeys?.has(key)) {
+                validForAny = true;
+                break;
+            }
+        }
+        if (!validForAny) {
+            const apiList = [...apis]
+                .sort()
+                .map((a) => `"${a}"`)
+                .join(", ");
+            throw new Error(`${path}.${key}: compat field is not valid for any of the provider's APIs (${apiList}). Use "modelOverrides" to target compat fields to specific models.`);
+        }
+    }
+}
 function mergeCompat(baseCompat, overrideCompat) {
     if (!overrideCompat)
         return baseCompat;
@@ -198,6 +365,7 @@ function mergeCompat(baseCompat, overrideCompat) {
  * Deep merge a model override into a model.
  * Handles nested objects (cost, compat) by merging rather than replacing.
  */
+// SCRAMJET-DIVERGENCE: Total context and genuine input constraints are independently overridable.
 function applyModelOverride(model, override) {
     const result = { ...model };
     // Simple field overrides
@@ -212,6 +380,10 @@ function applyModelOverride(model, override) {
         result.input = override.input;
     if (override.contextWindow !== undefined)
         result.contextWindow = override.contextWindow;
+    if (override.maxInputTokens !== undefined)
+        result.maxInputTokens = override.maxInputTokens;
+    if (override.requestLimits !== undefined)
+        result.requestLimits = override.requestLimits;
     if (override.maxTokens !== undefined)
         result.maxTokens = override.maxTokens;
     // Merge cost (partial override)
@@ -279,13 +451,30 @@ export class ModelRegistry {
             this.loadError = error;
             // Keep built-in models even if custom models failed to load
         }
-        const builtInModels = this.loadBuiltInModels(overrides, modelOverrides);
+        let builtInModels = this.loadBuiltInModels(overrides, modelOverrides);
         let combined = this.mergeCustomModels(builtInModels, customModels);
+        try {
+            this.validateContextLimits(combined);
+        }
+        catch (validationError) {
+            this.appendLoadError(`Failed to load models.json: ${validationError instanceof Error ? validationError.message : validationError}`);
+            this.providerRequestConfigs.clear();
+            this.modelRequestHeaders.clear();
+            builtInModels = this.loadBuiltInModels(new Map(), new Map());
+            combined = builtInModels;
+        }
         // Let OAuth providers modify their models (e.g., update baseUrl)
         for (const oauthProvider of this.authStorage.getOAuthProviders()) {
             const cred = this.authStorage.get(oauthProvider.id);
             if (cred?.type === "oauth" && oauthProvider.modifyModels) {
-                combined = oauthProvider.modifyModels(combined, cred);
+                try {
+                    const transformed = oauthProvider.modifyModels(combined, cred);
+                    this.validateContextLimits(transformed);
+                    combined = transformed;
+                }
+                catch (validationError) {
+                    this.appendLoadError(`Failed to apply OAuth model transform for ${oauthProvider.id}: ${validationError instanceof Error ? validationError.message : validationError}`);
+                }
             }
         }
         this.models = combined;
@@ -378,6 +567,8 @@ export class ModelRegistry {
             const isBuiltIn = builtInProviders.has(providerName);
             const hasProviderApi = !!providerConfig.api;
             const models = providerConfig.models ?? [];
+            const builtInModels = isBuiltIn ? getModels(providerName) : [];
+            const builtInDefaultApi = builtInModels[0]?.api;
             const hasModelOverrides = providerConfig.modelOverrides && Object.keys(providerConfig.modelOverrides).length > 0;
             if (models.length === 0) {
                 // Override-only config: needs baseUrl, headers, compat, modelOverrides, or some combination.
@@ -396,8 +587,24 @@ export class ModelRegistry {
             }
             // Built-in providers with custom models: baseUrl/apiKey/api are optional,
             // inherited from built-in models. Auth comes from env vars / auth storage.
-            for (const modelDef of models) {
+            if (providerConfig.compat) {
+                const providerCompatApis = new Set();
+                for (const model of builtInModels) {
+                    providerCompatApis.add(model.api);
+                }
+                for (const modelDef of models) {
+                    const api = modelDef.api ?? providerConfig.api ?? builtInDefaultApi;
+                    if (api)
+                        providerCompatApis.add(api);
+                }
+                if (!isBuiltIn && providerConfig.api) {
+                    providerCompatApis.add(providerConfig.api);
+                }
+                validateProviderCompatForApis(providerConfig.compat, providerCompatApis, `providers.${providerName}.compat`);
+            }
+            for (const [modelIndex, modelDef] of models.entries()) {
                 const hasModelApi = !!modelDef.api;
+                const api = modelDef.api ?? providerConfig.api ?? builtInDefaultApi;
                 if (!hasProviderApi && !hasModelApi && !isBuiltIn) {
                     throw new Error(`Provider ${providerName}, model ${modelDef.id}: no "api" specified. Set at provider or model level.`);
                 }
@@ -407,8 +614,19 @@ export class ModelRegistry {
                 // Validate contextWindow/maxTokens only if provided (they have defaults)
                 if (modelDef.contextWindow !== undefined && modelDef.contextWindow <= 0)
                     throw new Error(`Provider ${providerName}, model ${modelDef.id}: invalid contextWindow`);
+                rejectContextWindowBudget(modelDef, providerName, modelDef.id);
                 if (modelDef.maxTokens !== undefined && modelDef.maxTokens <= 0)
                     throw new Error(`Provider ${providerName}, model ${modelDef.id}: invalid maxTokens`);
+                if (api) {
+                    validateCompatForApi(modelDef.compat, api, `providers.${providerName}.models[${modelIndex}].compat`);
+                }
+            }
+            for (const [modelId, modelOverride] of Object.entries(providerConfig.modelOverrides ?? {})) {
+                rejectContextWindowBudget(modelOverride, providerName, modelId);
+                const api = builtInModels.find((model) => model.id === modelId)?.api ?? providerConfig.api ?? builtInDefaultApi;
+                if (api) {
+                    validateCompatForApi(modelOverride.compat, api, `providers.${providerName}.modelOverrides.${modelId}.compat`);
+                }
             }
         }
     }
@@ -455,6 +673,8 @@ export class ModelRegistry {
                     input: (modelDef.input ?? ["text"]),
                     cost: modelDef.cost ?? defaultCost,
                     contextWindow: modelDef.contextWindow ?? 128000,
+                    maxInputTokens: modelDef.maxInputTokens,
+                    requestLimits: modelDef.requestLimits,
                     maxTokens: modelDef.maxTokens ?? 16384,
                     headers: undefined,
                     compat,
@@ -642,6 +862,15 @@ export class ModelRegistry {
             }
         }
     }
+    appendLoadError(error) {
+        this.loadError = this.loadError ? `${this.loadError}\n${error}` : error;
+    }
+    validateContextLimits(models) {
+        for (const model of models) {
+            validateModelContextLimits(model);
+            rejectContextWindowBudget(model, model.provider, model.id);
+        }
+    }
     validateProviderConfig(providerName, config) {
         if (config.streamSimple && !config.api) {
             throw new Error(`Provider ${providerName}: "api" is required when registering streamSimple.`);
@@ -660,6 +889,9 @@ export class ModelRegistry {
             if (!api) {
                 throw new Error(`Provider ${providerName}, model ${modelDef.id}: no "api" specified.`);
             }
+            this.validateContextLimits([
+                { ...modelDef, api, provider: providerName, baseUrl: modelDef.baseUrl ?? config.baseUrl },
+            ]);
         }
     }
     applyProviderConfig(providerName, config) {
@@ -681,15 +913,10 @@ export class ModelRegistry {
                 handlesSystemPromptSections: config.handlesSystemPromptSections,
             }, `provider:${providerName}`);
         }
-        this.storeProviderRequestConfig(providerName, config);
         if (config.models && config.models.length > 0) {
-            // Full replacement: remove existing models for this provider
-            this.models = this.models.filter((m) => m.provider !== providerName);
-            // Parse and add new models
-            for (const modelDef of config.models) {
+            const providerModels = config.models.map((modelDef) => {
                 const api = modelDef.api || config.api;
-                this.storeModelHeaders(providerName, modelDef.id, modelDef.headers);
-                this.models.push({
+                return {
                     id: modelDef.id,
                     name: modelDef.name,
                     api: api,
@@ -700,29 +927,46 @@ export class ModelRegistry {
                     input: modelDef.input,
                     cost: modelDef.cost,
                     contextWindow: modelDef.contextWindow,
+                    maxInputTokens: modelDef.maxInputTokens,
+                    requestLimits: modelDef.requestLimits,
                     maxTokens: modelDef.maxTokens,
                     headers: undefined,
                     compat: modelDef.compat,
-                });
-            }
-            // Apply OAuth modifyModels if credentials exist (e.g., to update baseUrl)
+                };
+            });
+            let candidateModels = [...this.models.filter((m) => m.provider !== providerName), ...providerModels];
             if (config.oauth?.modifyModels) {
                 const cred = this.authStorage.get(providerName);
                 if (cred?.type === "oauth") {
-                    this.models = config.oauth.modifyModels(this.models, cred);
+                    try {
+                        const transformed = config.oauth.modifyModels(candidateModels, cred);
+                        this.validateContextLimits(transformed);
+                        candidateModels = transformed;
+                    }
+                    catch (validationError) {
+                        this.appendLoadError(`Failed to apply OAuth model transform for ${providerName}: ${validationError instanceof Error ? validationError.message : validationError}`);
+                    }
                 }
             }
+            this.storeProviderRequestConfig(providerName, config);
+            for (const modelDef of config.models) {
+                this.storeModelHeaders(providerName, modelDef.id, modelDef.headers);
+            }
+            this.models = candidateModels;
         }
-        else if (config.baseUrl || config.headers) {
-            // Override-only: update baseUrl for existing models. Request headers are resolved per request.
-            this.models = this.models.map((m) => {
-                if (m.provider !== providerName)
-                    return m;
-                return {
-                    ...m,
-                    baseUrl: config.baseUrl ?? m.baseUrl,
-                };
-            });
+        else {
+            this.storeProviderRequestConfig(providerName, config);
+            if (config.baseUrl || config.headers) {
+                // Override-only: update baseUrl for existing models. Request headers are resolved per request.
+                this.models = this.models.map((m) => {
+                    if (m.provider !== providerName)
+                        return m;
+                    return {
+                        ...m,
+                        baseUrl: config.baseUrl ?? m.baseUrl,
+                    };
+                });
+            }
         }
     }
 }