@lerianstudio/matcher-mcp 1.3.0 → 1.4.0-beta.1

package/README.md

@@ -197,6 +197,32 @@ spans and metrics record **only** the tool name and call outcome (plus the
 matcher HTTP status on failure) — never tool arguments, headers, tenant
 identifiers, or the token.
 
+### Copilot (`POST /agent/turns`)
+
+The in-app copilot the matcher console's dock calls is **optional**: the tool
+relay above works with no copilot config at all. Set a provider key to enable
+the streaming agent endpoint; with none set, `POST /agent/turns` returns a calm
+`copilot_unconfigured` and the rest of the server runs normally. **The provider
+key lives in this MCP process — not the Matcher backend, not the UI** — and is
+read server-side only, never sent to the browser.
+
+| Variable                      | Default              | Purpose |
+|-------------------------------|----------------------|---------|
+| `COPILOT_PROVIDER`            | `anthropic`          | Which LLM provider drives the copilot. One of `anthropic` \| `openrouter`. |
+| `ANTHROPIC_API_KEY`           | _(unset)_            | Anthropic API key. Required when `COPILOT_PROVIDER=anthropic`. Never logged, never returned. |
+| `OPENROUTER_API_KEY`          | _(unset)_            | OpenRouter API key. Required when `COPILOT_PROVIDER=openrouter`. Never logged, never returned. |
+| `COPILOT_MODEL`               | _(provider default)_ | Model id passed to the selected provider. Anthropic falls back to its own default when unset; OpenRouter has **no** safe default and requires `COPILOT_MODEL` to be set explicitly (an Anthropic id 404s there), otherwise provider construction raises `CopilotModelRequiredError`. |
+| `COPILOT_MAX_TOOL_ITERATIONS` | `8`                  | Max read-tool rounds the agent loop runs before forcing a stop. Integer `1..20`. |
+| `COPILOT_MAX_TURN_TOKENS`     | `100000`             | Per-turn token ceiling; the loop truncates between rounds once crossed. |
+| `COPILOT_RATE_LIMIT_PER_MIN`  | `60`                 | Per-tenant token-bucket refill rate (turns/min). Per-tenant-overridable. |
+| `COPILOT_RATE_LIMIT_BURST`    | `20`                 | Per-tenant token-bucket burst capacity. Per-tenant-overridable. |
+| `COPILOT_TENANT_CONFIG_PATH`  | _(unset)_            | Path to a JSON file mapping `tenantId → { provider, model?, apiKey, maxTurnTokens?, rateLimitPerMin?, rateLimitBurst? }` for per-tenant provider/key overrides. Unset = one global config (BYOC single-tenant). |
+
+Before spending any provider tokens, a copilot turn relays the caller's bearer
+to Matcher and probes Matcher's `Authorize` (`GET /v1/contexts`); a token Matcher
+rejects never reaches the paid model, so the endpoint cannot be used as an
+unauthenticated LLM proxy.
+
 ## Tool catalog
 
 The server exposes a **curated** typed surface (one ergonomic tool per common

package/dist/auth/request-token.js

@@ -17,8 +17,12 @@
 //
 // Security invariants (asserted by tests):
 //   - The token is NEVER logged and NEVER placed in an error message.
-//   - No tenant identifier is read or injected anywhere — tenant identity
-//     derives solely from the relayed JWT (matcher + plugin-auth own it).
+//   - The tenant id MAY be decoded from the relayed JWT (getRequestTenantId),
+//     but ONLY unverified and KEY-ONLY: used solely to SCOPE config, limits, and
+//     telemetry to an organization, NEVER as an authorization input. Matcher
+//     still owns enforcement via the verbatim relayed token, so the tenant
+//     third rail stays intact (the decode is not trusted for authz). The token
+//     and its decoded claims are never logged.
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { loadConfig } from '../config.js';
 import { createMatcherClient } from '../matcher/client.js';
@@ -98,6 +102,50 @@ export function getRequestBearerToken(extra) {
     }
     return parseBearer(authStorage.getStore()?.authorization);
 }
+/**
+ * Decode the tenant id from the relayed JWT, request-scoped. UNVERIFIED and
+ * KEY-ONLY: the value SCOPES config / rate limits / telemetry to an
+ * organization — it is NEVER an authorization input. Matcher owns enforcement
+ * via the verbatim relayed token, so the tenant third rail stays intact even
+ * though this reads the claim.
+ *
+ * Reads the same request-scoped bearer `getRequestBearerToken` resolves, splits
+ * the JWT, base64url-decodes the payload segment (Node stdlib `Buffer` — NO JWT
+ * library), and reads the tenant claim. Matches the Go/lib-auth extraction order
+ * (`claimString(claims, "tenant_id", "tenantId")`): prefers `tenant_id`, then
+ * `tenantId`. Returns `undefined` on ANY malformed/absent token or a
+ * missing/non-string/empty claim, and NEVER throws — a decode failure fails open
+ * to the global-config path rather than breaking the turn. The token and its
+ * claims are never logged.
+ */
+export function getRequestTenantId(extra) {
+    const token = getRequestBearerToken(extra);
+    if (token === undefined) {
+        return undefined;
+    }
+    const segments = token.split('.');
+    if (segments.length !== 3) {
+        return undefined;
+    }
+    const payloadSegment = segments[1];
+    if (payloadSegment === undefined || payloadSegment.length === 0) {
+        return undefined;
+    }
+    try {
+        const decoded = Buffer.from(payloadSegment, 'base64url').toString('utf8');
+        const claims = JSON.parse(decoded);
+        if (typeof claims !== 'object' || claims === null) {
+            return undefined;
+        }
+        const record = claims;
+        const tenant = record.tenant_id ?? record.tenantId;
+        return typeof tenant === 'string' && tenant.length > 0 ? tenant : undefined;
+    }
+    catch {
+        // Any decode/parse failure fails open — the caller degrades to global config.
+        return undefined;
+    }
+}
 /**
  * The single chokepoint every matcher-touching tool calls. Reads the caller's
  * request-scoped token and, when present, returns a `MatcherClient` bound to it.

package/dist/auth/request-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-token.js","sourceRoot":"","sources":["../../src/auth/request-token.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AACpE,+BAA+B;AAC/B,EAAE;AACF,2CAA2C;AAC3C,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAA;AAQ9E,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAoB,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E,CAAA;AAEjF;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAaD,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,aAAiC,EACjC,EAAW;IAEX,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAmC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,aAAiC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAC9B,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAwB,EACxB,SAAiB,UAAU,EAAE;IAE7B,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC"}
+{"version":3,"file":"request-token.js","sourceRoot":"","sources":["../../src/auth/request-token.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AACpE,+BAA+B;AAC/B,EAAE;AACF,2CAA2C;AAC3C,sEAAsE;AACtE,8EAA8E;AAC9E,iFAAiF;AACjF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,+CAA+C;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAA;AAQ9E,MAAM,WAAW,GAAG,IAAI,iBAAiB,EAAoB,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E,CAAA;AAEjF;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,UAAkB,2BAA2B;QACvD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAaD,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAChC,aAAiC,EACjC,EAAW;IAEX,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAmC;IACjE,MAAM,OAAO,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,CAAA;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,aAAiC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAC9B,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAiC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAA;QAClD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAwB,EACxB,SAAiB,UAAU,EAAE;IAE7B,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;AACzD,CAAC"}

package/dist/config.js

@@ -5,11 +5,17 @@
 // 4018; this server defaults to 4019). The matcher base URL is surfaced here
 // so the HTTP client (task 1.3.1) and the generic invoke / curated tools
 // consume a single source of truth instead of reading process.env directly.
+import { loadTenantConfig } from './copilot/tenant-config.js';
 const DEFAULT_PORT = 4019;
 const DEFAULT_MATCHER_API_URL = 'http://localhost:4018';
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_BODY_BYTES = 1_048_576; // 1 MiB
 const DEFAULT_OTEL_SERVICE_NAME = 'matcher-mcp';
+const DEFAULT_COPILOT_PROVIDER = 'anthropic';
+const DEFAULT_COPILOT_MAX_TOOL_ITERATIONS = 8;
+const DEFAULT_COPILOT_MAX_TURN_TOKENS = 100_000;
+const DEFAULT_COPILOT_RATE_LIMIT_PER_MIN = 60;
+const DEFAULT_COPILOT_RATE_LIMIT_BURST = 20;
 /**
  * Parse a port from a raw env string, falling back to the default when unset.
  * An explicitly-set but invalid value is a misconfiguration and throws, rather
@@ -74,6 +80,52 @@ function parseBool(raw, fallback, key) {
     }
     throw new Error(`invalid ${key}: ${raw} (expected one of true, false, 1, 0)`);
 }
+/**
+ * Parse the copilot provider from a raw env string, falling back to the default
+ * when unset. Trimmed + case-insensitive. An explicitly-set but unrecognized
+ * value is a misconfiguration and throws, rather than silently coercing to a
+ * default (fail-loud at boot), mirroring parseBool.
+ */
+function parseCopilotProvider(raw, fallback) {
+    if (raw === undefined || raw === '') {
+        return fallback;
+    }
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === 'anthropic' || normalized === 'openrouter') {
+        return normalized;
+    }
+    throw new Error(`invalid COPILOT_PROVIDER: ${raw} (expected one of anthropic, openrouter)`);
+}
+/**
+ * Parse the agent-loop iteration cap from a raw env string, falling back to the
+ * default when unset. Bounded to 1..20. An explicitly-set but out-of-range or
+ * non-integer value is a misconfiguration and throws (fail-loud at boot).
+ */
+function parseMaxToolIterations(raw, fallback) {
+    if (raw === undefined || raw === '') {
+        return fallback;
+    }
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 1 || value > 20) {
+        throw new Error(`invalid COPILOT_MAX_TOOL_ITERATIONS: ${raw} (expected an integer in 1..20)`);
+    }
+    return value;
+}
+/**
+ * Parse a positive integer from a raw env string, falling back to the default
+ * when unset. An explicitly-set non-positive or non-integer value is a
+ * misconfiguration and throws (fail-loud at boot), mirroring parseMaxBodyBytes.
+ */
+function parsePositiveInt(raw, fallback, key) {
+    if (raw === undefined || raw === '') {
+        return fallback;
+    }
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 1) {
+        throw new Error(`invalid ${key}: ${raw} (expected a positive integer)`);
+    }
+    return value;
+}
 /**
  * Build the config from a given environment map (defaults to process.env).
  * Pure and side-effect-free so tests can drive it with a synthetic env.
@@ -90,6 +142,15 @@ export function loadConfig(env = process.env) {
         enableTelemetry: parseBool(env.ENABLE_TELEMETRY, false, 'ENABLE_TELEMETRY'),
         otelExporterOtlpEndpoint: otelEndpoint || undefined,
         otelServiceName,
+        anthropicApiKey: env.ANTHROPIC_API_KEY?.trim() || undefined,
+        openrouterApiKey: env.OPENROUTER_API_KEY?.trim() || undefined,
+        copilotProvider: parseCopilotProvider(env.COPILOT_PROVIDER, DEFAULT_COPILOT_PROVIDER),
+        copilotModel: env.COPILOT_MODEL?.trim() || undefined,
+        copilotMaxToolIterations: parseMaxToolIterations(env.COPILOT_MAX_TOOL_ITERATIONS, DEFAULT_COPILOT_MAX_TOOL_ITERATIONS),
+        copilotMaxTurnTokens: parsePositiveInt(env.COPILOT_MAX_TURN_TOKENS, DEFAULT_COPILOT_MAX_TURN_TOKENS, 'COPILOT_MAX_TURN_TOKENS'),
+        copilotRateLimitPerMin: parsePositiveInt(env.COPILOT_RATE_LIMIT_PER_MIN, DEFAULT_COPILOT_RATE_LIMIT_PER_MIN, 'COPILOT_RATE_LIMIT_PER_MIN'),
+        copilotRateLimitBurst: parsePositiveInt(env.COPILOT_RATE_LIMIT_BURST, DEFAULT_COPILOT_RATE_LIMIT_BURST, 'COPILOT_RATE_LIMIT_BURST'),
+        copilotTenantConfig: loadTenantConfig(env),
     });
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AA4C5E,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,uBAAuB,GAAG,uBAAuB,CAAA;AACvD,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,sBAAsB,GAAG,SAAS,CAAA,CAAC,QAAQ;AACjD,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,oCAAoC,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAuB,EAAE,QAAgB;IAC/D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gDAAgD,CACnF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAuB,EAAE,QAAgB;IAClE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,yCAAyC,CACxE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAiB,EAAE,GAAW;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,WAAW,GAAG,KAAK,GAAG,sCAAsC,CAC7D,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,uBAAuB,CAAA;IAC5E,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC5D,MAAM,eAAe,GACnB,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,yBAAyB,CAAA;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC3C,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrE,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC;QAC3E,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,CAAC;QAC3E,wBAAwB,EAAE,YAAY,IAAI,SAAS;QACnD,eAAe;KAChB,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAE5E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,4BAA4B,CAAA;AAuG1F,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,uBAAuB,GAAG,uBAAuB,CAAA;AACvD,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,sBAAsB,GAAG,SAAS,CAAA,CAAC,QAAQ;AACjD,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,wBAAwB,GAAG,WAAW,CAAA;AAC5C,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAC7C,MAAM,+BAA+B,GAAG,OAAO,CAAA;AAC/C,MAAM,kCAAkC,GAAG,EAAE,CAAA;AAC7C,MAAM,gCAAgC,GAAG,EAAE,CAAA;AAE3C;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,oCAAoC,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAuB,EAAE,QAAgB;IAC/D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gDAAgD,CACnF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAuB,EAAE,QAAgB;IAClE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,yCAAyC,CACxE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAiB,EAAE,GAAW;IACxE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CACb,WAAW,GAAG,KAAK,GAAG,sCAAsC,CAC7D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,GAAuB,EACvB,QAAoC;IAEpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC9D,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,0CAA0C,CAC3E,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAuB,EAAE,QAAgB;IACvE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,wCAAwC,GAAG,iCAAiC,CAC7E,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB,EAAE,GAAW;IAC9E,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,GAAG,gCAAgC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,uBAAuB,CAAA;IAC5E,MAAM,YAAY,GAAG,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAA;IAC5D,MAAM,eAAe,GACnB,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,yBAAyB,CAAA;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC3C,aAAa,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACrE,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAC;QAC3E,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,CAAC;QAC3E,wBAAwB,EAAE,YAAY,IAAI,SAAS;QACnD,eAAe;QACf,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC3D,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS;QAC7D,eAAe,EAAE,oBAAoB,CACnC,GAAG,CAAC,gBAAgB,EACpB,wBAAwB,CACzB;QACD,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS;QACpD,wBAAwB,EAAE,sBAAsB,CAC9C,GAAG,CAAC,2BAA2B,EAC/B,mCAAmC,CACpC;QACD,oBAAoB,EAAE,gBAAgB,CACpC,GAAG,CAAC,uBAAuB,EAC3B,+BAA+B,EAC/B,yBAAyB,CAC1B;QACD,sBAAsB,EAAE,gBAAgB,CACtC,GAAG,CAAC,0BAA0B,EAC9B,kCAAkC,EAClC,4BAA4B,CAC7B;QACD,qBAAqB,EAAE,gBAAgB,CACrC,GAAG,CAAC,wBAAwB,EAC5B,gCAAgC,EAChC,0BAA0B,CAC3B;QACD,mBAAmB,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC3C,CAAC,CAAA;AACJ,CAAC"}

package/dist/copilot/agent.js

@@ -0,0 +1,181 @@
+// The copilot agent loop — orchestrates one provider ↔ tool-executor turn.
+//
+// One turn is a bounded series of provider round-trips: `streamTurn` streams
+// assistant text (forwarded to the SSE sink) and may end requesting tool calls.
+// The loop executes those reads through the capability layer, feeds the results
+// back as the next round's `toolResults`, and repeats until the model produces a
+// final answer or the iteration cap trips. It holds the within-turn tool
+// round-trips in memory only — nothing persists across turns (the browser
+// replays the conversation each POST).
+//
+// The loop is provider- and matcher-agnostic: `system`, `tools`, and the sink
+// are handed in, and the executor is injectable, so it is fully unit-testable
+// with a fake provider + fake executor. The bearer token never reaches this
+// module — the request-scoped executor resolves it from the ALS store.
+import { instrumentCopilotTool, instrumentCopilotTurn, instrumentProviderStream, recordCopilotTokens, } from '../observability/otel.js';
+import { InvokeError, Invoker } from '../tools/generic/invoke.js';
+import { executeReadTool, WRITE_ALLOWLIST } from './tools.js';
+/**
+ * Sum a round's input+output tokens, failing open: `undefined` usage (a provider
+ * that never reports it) is 0, and a non-finite field (a misreporting stream) is
+ * treated as 0 rather than poisoning the running sum with NaN. Metering must
+ * never turn an otherwise-successful turn into a crash.
+ */
+function usageTokens(usage) {
+    if (usage === undefined) {
+        return 0;
+    }
+    const input = Number.isFinite(usage.inputTokens) ? usage.inputTokens : 0;
+    const output = Number.isFinite(usage.outputTokens) ? usage.outputTokens : 0;
+    return input + output;
+}
+/**
+ * The write-barrier. The model asked for an allow-listed config write: NEVER
+ * execute it. Mint the payload through `Invoker.assemble` — the same pure path
+ * `matcher_invoke` uses, so the tenant guardrail (third rail) and ajv body
+ * validation run before anything leaves the server — then emit a `proposal` and
+ * end the turn with `done('proposal')`. There is no server-side dispatch on this
+ * path; the browser renders a confirmation card and executes the write itself.
+ *
+ * `params` carries the assembled request body (params-as-new per the v1 card
+ * design); the path already has its params substituted by `assemble`. If
+ * `assemble` rejects (bad params / missing path param / tenant guardrail / body
+ * validation), emit an `error` and end with `done('end')` — never a proposal for
+ * an unvalidated write. `InvokeError` messages are safe, operator-facing text;
+ * anything else collapses to a fixed message so no internal detail leaks.
+ *
+ * Returns the terminal stop reason (`proposal` on success, `end` when the write
+ * was rejected) so the caller can label the turn span's `copilot.stop` honestly.
+ */
+function emitProposal(call, index, sink) {
+    const pathParams = call.input.pathParams;
+    const query = call.input.query;
+    const body = call.input.body;
+    try {
+        // ponytail: one Invoker per proposal (a fresh Ajv2020 compiling the body
+        // schema once); proposals are human-gated and rare, so negligible.
+        const request = new Invoker(index).assemble({
+            operationId: call.name,
+            ...(pathParams !== undefined ? { pathParams } : {}),
+            ...(query !== undefined ? { query } : {}),
+            ...(body !== undefined ? { body } : {}),
+        });
+        // Fail closed on a dropped query: `assemble` honors query params, but the
+        // proposal forwards only method/path/body-derived params — `request.query`
+        // is discarded. No write-allowlist op declares a query param today, so this
+        // is latent; but a future one would execute WITHOUT it (a silently wrong
+        // write). Refuse loudly instead of minting a lossy proposal.
+        if (request.query !== undefined && Object.keys(request.query).length > 0) {
+            sink.error('proposal_invalid', 'write proposals cannot carry query parameters');
+            sink.done('end');
+            return 'end';
+        }
+        const op = index.operations.get(call.name);
+        const summary = op !== undefined && op.summary.length > 0
+            ? op.summary
+            : `${request.method} ${call.name}`;
+        const params = request.body !== null &&
+            typeof request.body === 'object' &&
+            !Array.isArray(request.body)
+            ? request.body
+            : {};
+        sink.proposal({
+            operationId: call.name,
+            method: request.method,
+            path: request.path,
+            params,
+            summary,
+        });
+        sink.done('proposal');
+        return 'proposal';
+    }
+    catch (err) {
+        const detail = err instanceof InvokeError ? err.message : 'failed to prepare the proposal';
+        sink.error('proposal_invalid', detail);
+        sink.done('end');
+        return 'end';
+    }
+}
+/**
+ * Run one agent turn to completion, emitting the full SSE event stream via the
+ * sink. Returns once the turn is done (a clean `done('end')`) — including the
+ * iteration-cap path, which emits `error('tool_iteration_limit', …)` then
+ * `done('end')` so the browser always sees a terminal event.
+ */
+export async function runAgentTurn(opts) {
+    const { provider, tools, index, system, messages, sink, maxIterations } = opts;
+    const { maxTurnTokens, model, tenant } = opts;
+    const providerName = opts.providerName ?? 'unknown';
+    const executeTool = opts.executeTool ?? executeReadTool;
+    await instrumentCopilotTurn({
+        provider: providerName,
+        ...(model !== undefined ? { model } : {}),
+        ...(tenant !== undefined ? { tenant } : {}),
+        maxIterations,
+    }, async (setStop) => {
+        let toolResults;
+        let totalTokens = 0;
+        for (let iteration = 0; iteration < maxIterations; iteration += 1) {
+            // Client hung up: stop before billing another LLM round-trip / matcher
+            // read. Bounds waste to at most the in-flight round (AbortSignal is Phase 4).
+            if (sink.isClosed()) {
+                setStop('aborted');
+                return;
+            }
+            const result = await instrumentProviderStream({ provider: providerName, ...(model !== undefined ? { model } : {}) }, () => provider.streamTurn({
+                system,
+                messages,
+                tools,
+                ...(toolResults !== undefined ? { toolResults } : {}),
+            }, { onTextDelta: (delta) => sink.text(delta) }));
+            // Meter this round (fail-open: a provider that omits usage counts as 0,
+            // so a turn that would otherwise succeed never crashes on missing usage).
+            recordCopilotTokens(providerName, result.usage);
+            totalTokens += usageTokens(result.usage);
+            if (result.stop === 'end') {
+                // A completed answer is NEVER truncated, whatever it cost — the ceiling
+                // only bounds a model that wants to keep going.
+                setStop('end');
+                sink.done('end');
+                return;
+            }
+            // Runaway guard: the model wants more rounds but the turn's token budget
+            // is spent. Truncate BETWEEN rounds — this round's tools do not run and
+            // no new model round-trip is billed. A real truncation (NOT calm): it
+            // renders as an error, mirroring the iteration-cap path.
+            if (maxTurnTokens !== undefined && totalTokens >= maxTurnTokens) {
+                setStop('token_limit');
+                sink.error('turn_token_limit', `reached the per-turn token limit (${maxTurnTokens})`);
+                sink.done('end');
+                return;
+            }
+            // ponytail: sequential tool exec; parallelize only if a turn routinely
+            // fans out many reads. Matcher reads are cheap, so ordering keeps the SSE
+            // chip stream legible for little cost.
+            const results = [];
+            for (const call of result.calls) {
+                // Write-barrier: an allow-listed config write is PROPOSED, never
+                // executed. The first write ends the turn (one proposal per turn);
+                // reads keep going.
+                if (WRITE_ALLOWLIST.has(call.name)) {
+                    setStop(emitProposal(call, index, sink));
+                    return;
+                }
+                sink.tool(call.name, 'running');
+                // Active tool span (via instrumentCopilotTool) fixes matcher trace
+                // correlation and records the outcome from the swallowed isError.
+                const r = await instrumentCopilotTool(call.name, () => executeTool(call, index));
+                sink.tool(call.name, r.isError === true ? 'error' : 'ok');
+                results.push(r);
+            }
+            // Accumulate across rounds so a later round grounds on every prior round's
+            // results — replacing would drop earlier reads a dependent answer needs.
+            toolResults = [...(toolResults ?? []), ...results];
+        }
+        // Ran `maxIterations` tool rounds and the model still wants more: hard stop.
+        setStop('iteration_limit');
+        sink.error('tool_iteration_limit', `reached the tool-call limit (${maxIterations})`);
+        sink.done('end');
+    });
+}
+//# sourceMappingURL=agent.js.map

package/dist/copilot/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/copilot/agent.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,0EAA0E;AAC1E,uCAAuC;AACvC,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AAEvE,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AAUjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA+B7D;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAA2B;IAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3E,OAAO,KAAK,GAAG,MAAM,CAAA;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,YAAY,CACnB,IAAiB,EACjB,KAAqB,EACrB,IAAa;IAEb,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAgD,CAAA;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAoD,CAAA;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAA;IAC5B,IAAI,CAAC;QACH,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAA;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAA;YAC/E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,OAAO,GACX,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACvC,CAAC,CAAC,EAAE,CAAC,OAAO;YACZ,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;QACtC,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,IAAI;YACrB,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1B,CAAC,CAAE,OAAO,CAAC,IAAgC;YAC3C,CAAC,CAAC,EAAE,CAAA;QACR,IAAI,CAAC,QAAQ,CAAC;YACZ,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM;YACN,OAAO;SACR,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACrB,OAAO,UAAU,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAA;QAC7E,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChB,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAA;IAC9E,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAA;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,eAAe,CAAA;IAEvD,MAAM,qBAAqB,CACzB;QACE,QAAQ,EAAE,YAAY;QACtB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,aAAa;KACd,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,IAAI,WAAwC,CAAA;QAC5C,IAAI,WAAW,GAAG,CAAC,CAAA;QAEnB,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,aAAa,EAAE,SAAS,IAAI,CAAC,EAAE,CAAC;YAClE,uEAAuE;YACvE,8EAA8E;YAC9E,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,SAAS,CAAC,CAAA;gBAClB,OAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAC3C,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrE,GAAG,EAAE,CACH,QAAQ,CAAC,UAAU,CACjB;gBACE,MAAM;gBACN,QAAQ;gBACR,KAAK;gBACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,EACD,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC7C,CACJ,CAAA;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;YAC/C,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAExC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,wEAAwE;gBACxE,gDAAgD;gBAChD,OAAO,CAAC,KAAK,CAAC,CAAA;gBACd,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChB,OAAM;YACR,CAAC;YAED,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,yDAAyD;YACzD,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;gBAChE,OAAO,CAAC,aAAa,CAAC,CAAA;gBACtB,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,qCAAqC,aAAa,GAAG,CAAC,CAAA;gBACrF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChB,OAAM;YACR,CAAC;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,uCAAuC;YACvC,MAAM,OAAO,GAAoB,EAAE,CAAA;YACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChC,iEAAiE;gBACjE,mEAAmE;gBACnE,oBAAoB;gBACpB,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;oBACxC,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC/B,mEAAmE;gBACnE,kEAAkE;gBAClE,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;gBAChF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;YACD,2EAA2E;YAC3E,yEAAyE;YACzE,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAA;QACpD,CAAC;QAED,6EAA6E;QAC7E,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC1B,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,gCAAgC,aAAa,GAAG,CAAC,CAAA;QACpF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClB,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/copilot/provider-anthropic.js

@@ -0,0 +1,151 @@
+// Anthropic-native LLMProvider.
+//
+// Translates the normalized LLMTurnInput into the Anthropic Messages API's
+// streaming tool-use format and back into the LLMProvider seam. Stateless per
+// call — nothing persists across turns.
+import Anthropic from '@anthropic-ai/sdk';
+import { CopilotUnconfiguredError } from './provider-factory.js';
+import { parseToolInput } from './provider-shared.js';
+// Max tokens the Messages API requires per request. A fixed ceiling is fine for
+// grounded read-only answers.
+// ponytail: fixed cap; make configurable if turns start truncating.
+const ANTHROPIC_MAX_TOKENS = 4096;
+// Anthropic-specific default model, used when COPILOT_MODEL is unset. Kept here
+// (not in config) so the zero-config anthropic path resolves its own default
+// while the openrouter provider — which has no safe default — fails loud instead.
+const ANTHROPIC_DEFAULT_MODEL = 'claude-opus-4-8';
+// The seam's LLMToolResult carries only { id, content } — not the name/input of
+// the tool_use it answers. Anthropic requires each tool_result to follow a
+// tool_use with a matching id, so we synthesize one with a placeholder name and
+// empty input. The model answers from the tool_result content, which is intact.
+// ponytail: placeholder name/input is a known ceiling — enrich LLMToolResult
+// with the originating name/input if the model needs to see its prior args.
+const SYNTHETIC_TOOL_USE_NAME = 'tool';
+/**
+ * Build a provider backed by Anthropic. When `streamFn` is omitted the key is
+ * required (its absence throws CopilotUnconfiguredError here, at construction);
+ * tests inject a `streamFn` and skip the live client entirely.
+ */
+export function createAnthropicProvider(config, streamFn) {
+    const openStream = streamFn ?? defaultAnthropicStream(config);
+    return {
+        async streamTurn(input, handlers) {
+            const tools = input.tools.map(toAnthropicTool);
+            const params = {
+                model: config.copilotModel ?? ANTHROPIC_DEFAULT_MODEL,
+                max_tokens: ANTHROPIC_MAX_TOKENS,
+                system: input.system,
+                messages: buildAnthropicMessages(input),
+                ...(tools.length > 0 ? { tools } : {}),
+            };
+            // Accumulate streamed tool_use blocks by their content-block index; their
+            // input arrives as fragmented input_json_delta pieces we parse at the end.
+            const toolBlocks = new Map();
+            // Token usage: input arrives once on message_start, output accrues on
+            // message_delta (cumulative). Left undefined when the stream reports
+            // neither, so the loop meters this round as 0 (fail-open).
+            let inputTokens;
+            let outputTokens;
+            for await (const event of openStream(params)) {
+                if (event.type === 'message_start') {
+                    inputTokens = event.message.usage.input_tokens;
+                    outputTokens = event.message.usage.output_tokens;
+                }
+                else if (event.type === 'message_delta') {
+                    outputTokens = event.usage.output_tokens;
+                }
+                else if (event.type === 'content_block_start' &&
+                    event.content_block.type === 'tool_use') {
+                    toolBlocks.set(event.index, {
+                        id: event.content_block.id,
+                        name: event.content_block.name,
+                        json: '',
+                    });
+                }
+                else if (event.type === 'content_block_delta') {
+                    if (event.delta.type === 'text_delta') {
+                        handlers.onTextDelta(event.delta.text);
+                    }
+                    else if (event.delta.type === 'input_json_delta') {
+                        const block = toolBlocks.get(event.index);
+                        if (block !== undefined) {
+                            block.json += event.delta.partial_json;
+                        }
+                    }
+                }
+            }
+            const usage = usageFrom(inputTokens, outputTokens);
+            if (toolBlocks.size === 0) {
+                // ponytail: turn-end is inferred from the absence of tool_use blocks —
+                // we do NOT inspect stop_reason, so a max_tokens-truncated text answer
+                // renders as a clean end. Acceptable: 4096 tokens is ample for grounded
+                // config answers, and a truncated WRITE fails safe (partial tool JSON →
+                // parseToolInput → {} → assemble rejects → proposal_invalid). Upgrade
+                // path: capture stop_reason into the done label if operators hit it.
+                return { stop: 'end', ...(usage !== undefined ? { usage } : {}) };
+            }
+            const calls = [...toolBlocks.values()].map((block) => ({
+                id: block.id,
+                name: block.name,
+                input: parseToolInput(block.json),
+            }));
+            return { stop: 'tool_use', calls, ...(usage !== undefined ? { usage } : {}) };
+        },
+    };
+}
+/** Bind a live Anthropic client, failing closed on a missing key at construction. */
+function defaultAnthropicStream(config) {
+    const apiKey = config.anthropicApiKey;
+    if (apiKey === undefined) {
+        throw new CopilotUnconfiguredError('anthropic');
+    }
+    const client = new Anthropic({ apiKey });
+    return (params) => client.messages.stream(params);
+}
+/**
+ * Build an LLMUsage from the tracked token counts, or `undefined` when the
+ * stream reported neither (so the loop meters this round as 0 — fail-open). A
+ * missing half defaults to 0 rather than dropping the whole usage.
+ */
+function usageFrom(inputTokens, outputTokens) {
+    if (inputTokens === undefined && outputTokens === undefined) {
+        return undefined;
+    }
+    return { inputTokens: inputTokens ?? 0, outputTokens: outputTokens ?? 0 };
+}
+function toAnthropicTool(def) {
+    return {
+        name: def.name,
+        description: def.description,
+        input_schema: def.inputSchema,
+    };
+}
+/**
+ * Map the turn's conversation to Anthropic messages. When prior tool results are
+ * present, append the synthetic assistant tool_use turn they answer followed by
+ * the tool_result user turn (Anthropic requires that pairing).
+ */
+function buildAnthropicMessages(input) {
+    const messages = input.messages.map((message) => ({
+        role: message.role,
+        content: message.content,
+    }));
+    if (input.toolResults !== undefined && input.toolResults.length > 0) {
+        const toolUseBlocks = input.toolResults.map((result) => ({
+            type: 'tool_use',
+            id: result.id,
+            name: SYNTHETIC_TOOL_USE_NAME,
+            input: {},
+        }));
+        const toolResultBlocks = input.toolResults.map((result) => ({
+            type: 'tool_result',
+            tool_use_id: result.id,
+            content: result.content,
+            ...(result.isError === true ? { is_error: true } : {}),
+        }));
+        messages.push({ role: 'assistant', content: toolUseBlocks });
+        messages.push({ role: 'user', content: toolResultBlocks });
+    }
+    return messages;
+}
+//# sourceMappingURL=provider-anthropic.js.map

package/dist/copilot/provider-anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-anthropic.js","sourceRoot":"","sources":["../../src/copilot/provider-anthropic.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,wCAAwC;AAExC,OAAO,SAAS,MAAM,mBAAmB,CAAA;AAGzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAWrD,gFAAgF;AAChF,8BAA8B;AAC9B,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEjC,gFAAgF;AAChF,6EAA6E;AAC7E,kFAAkF;AAClF,MAAM,uBAAuB,GAAG,iBAAiB,CAAA;AAEjD,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAOtC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,QAA4B;IAE5B,MAAM,UAAU,GAAG,QAAQ,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAE7D,OAAO;QACL,KAAK,CAAC,UAAU,CACd,KAAmB,EACnB,QAA2B;YAE3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC9C,MAAM,MAAM,GAAkC;gBAC5C,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,uBAAuB;gBACrD,UAAU,EAAE,oBAAoB;gBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,CAAA;YAED,0EAA0E;YAC1E,2EAA2E;YAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsD,CAAA;YAEhF,sEAAsE;YACtE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,WAA+B,CAAA;YACnC,IAAI,YAAgC,CAAA;YAEpC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACnC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAA;oBAC9C,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAA;gBAClD,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBAC1C,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAA;gBAC1C,CAAC;qBAAM,IACL,KAAK,CAAC,IAAI,KAAK,qBAAqB;oBACpC,KAAK,CAAC,aAAa,CAAC,IAAI,KAAK,UAAU,EACvC,CAAC;oBACD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE;wBAC1B,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;wBAC1B,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI;wBAC9B,IAAI,EAAE,EAAE;qBACT,CAAC,CAAA;gBACJ,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAChD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACtC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBACxC,CAAC;yBAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;wBACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;wBACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;4BACxB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAA;wBACxC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;YAClD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,uEAAuE;gBACvE,uEAAuE;gBACvE,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;YACnE,CAAC;YACD,MAAM,KAAK,GAAkB,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpE,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC,CAAA;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC/E,CAAC;KACF,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IACxC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,WAA+B,EAC/B,YAAgC;IAEhC,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,CAAC,EAAE,YAAY,EAAE,YAAY,IAAI,CAAC,EAAE,CAAA;AAC3E,CAAC;AAED,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,YAAY,EAAE,GAAG,CAAC,WAAyC;KAC5D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,QAAQ,GAA6B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC,CAAA;IAEH,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,aAAa,GAAkC,KAAK,CAAC,WAAW,CAAC,GAAG,CACxE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,EAAE;SACV,CAAC,CACH,CAAA;QACD,MAAM,gBAAgB,GAAkC,KAAK,CAAC,WAAW,CAAC,GAAG,CAC3E,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CACH,CAAA;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;QAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/copilot/provider-factory.js

@@ -0,0 +1,46 @@
+// Provider factory — resolves the config-selected LLMProvider.
+//
+// `getProvider(config)` switches on `config.copilotProvider` and returns a
+// working provider backed by Anthropic (native) or OpenRouter (OpenAI-compatible).
+// The API key is the point-of-use secret: it is validated here (via the
+// per-provider constructor), never at boot, so a matcher deploy without the
+// copilot still starts — only hitting `/agent/turns` surfaces a missing key.
+import { createAnthropicProvider } from './provider-anthropic.js';
+import { createOpenRouterProvider } from './provider-openrouter.js';
+/**
+ * Raised when the selected copilot provider has no API key. Thrown at provider
+ * construction (endpoint-hit time), not at `loadConfig` — the handler maps it to
+ * a single SSE `copilot_unconfigured` error. The message never includes the key.
+ */
+export class CopilotUnconfiguredError extends Error {
+    provider;
+    constructor(provider) {
+        super(`copilot provider "${provider}" is not configured: missing API key`);
+        this.provider = provider;
+        this.name = 'CopilotUnconfiguredError';
+    }
+}
+/**
+ * Raised when the selected provider needs an explicit COPILOT_MODEL and none was
+ * set — the openrouter provider has no safe default (an Anthropic id 404s there).
+ * Subclasses CopilotUnconfiguredError so the turns handler's existing catch maps
+ * it to the same `copilot_unconfigured` SSE error (a named config fault, not an
+ * opaque `internal`). Thrown at provider construction. Message bears no secret.
+ */
+export class CopilotModelRequiredError extends CopilotUnconfiguredError {
+    constructor(provider) {
+        super(provider);
+        this.message = `copilot provider "${provider}" requires COPILOT_MODEL to be set (no default model for this provider)`;
+        this.name = 'CopilotModelRequiredError';
+    }
+}
+/** Resolve the LLMProvider the config selects. Throws CopilotUnconfiguredError on a missing key. */
+export function getProvider(config) {
+    switch (config.copilotProvider) {
+        case 'anthropic':
+            return createAnthropicProvider(config);
+        case 'openrouter':
+            return createOpenRouterProvider(config);
+    }
+}
+//# sourceMappingURL=provider-factory.js.map

package/dist/copilot/provider-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-factory.js","sourceRoot":"","sources":["../../src/copilot/provider-factory.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,2EAA2E;AAC3E,mFAAmF;AACnF,wEAAwE;AACxE,4EAA4E;AAC5E,6EAA6E;AAG7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAGnE;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC5B;IAArB,YAAqB,QAAoC;QACvD,KAAK,CAAC,qBAAqB,QAAQ,sCAAsC,CAAC,CAAA;QADvD,aAAQ,GAAR,QAAQ,CAA4B;QAEvD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,yBAA0B,SAAQ,wBAAwB;IACrE,YAAY,QAAoC;QAC9C,KAAK,CAAC,QAAQ,CAAC,CAAA;QACf,IAAI,CAAC,OAAO,GAAG,qBAAqB,QAAQ,yEAAyE,CAAA;QACrH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAC3C,CAAC;AACH,CAAC"}