@livedesk/hub 0.1.15 → 0.1.16

package/src/agents/opencode-go-provider.js

@@ -1,260 +0,0 @@
-import { AgentProviderError, isRetryableProviderError } from './provider-errors.js';
-import { DEFAULT_AGENT_BASE_URL } from './agent-settings.js';
-
-export const OPENCODE_GO_DEFAULT_MODEL_ID = 'deepseek-v4-flash';
-
-const AGENT_OPERATIONS = new Set([
-  'system.health',
-  'gpu.status',
-  'disk.status',
-  'process.list',
-  'service.status',
-  'diagnostics.collect'
-]);
-
-function normalizeBaseUrl(value) {
-  try {
-    const url = new URL(String(value || DEFAULT_AGENT_BASE_URL));
-    if (!['http:', 'https:'].includes(url.protocol)) throw new Error('protocol');
-    return url.toString().replace(/\/+$/, '');
-  } catch {
-    throw new AgentProviderError('agent-invalid-base-url', 'The Agent provider URL is invalid.', { status: 400 });
-  }
-}
-
-function normalizeCapabilities(source = {}) {
-  const capabilities = source.capabilities && typeof source.capabilities === 'object' ? source.capabilities : source;
-  return {
-    supportsReasoningLevel: capabilities.supportsReasoningLevel === true || capabilities.reasoning === true,
-    reasoningParameter: typeof capabilities.reasoningParameter === 'string' ? capabilities.reasoningParameter : '',
-    supportsTemperature: capabilities.supportsTemperature !== false,
-    supportsTopP: capabilities.supportsTopP !== false,
-    supportsStreaming: capabilities.supportsStreaming !== false,
-    supportsTools: capabilities.supportsTools === true,
-    supportsJsonSchema: capabilities.supportsJsonSchema === true
-  };
-}
-
-function normalizeModel(model) {
-  const id = String(model?.id || model?.model || '').trim();
-  if (!id) return null;
-  const protocolValue = String(model?.protocol || model?.api?.protocol || model?.type || '').trim().toLowerCase();
-  const protocol = /anthropic|messages/.test(protocolValue) ? 'anthropic-messages' : 'openai-chat-completions';
-  return {
-    id,
-    name: String(model?.name || model?.display_name || id).trim().slice(0, 200),
-    protocol,
-    available: model?.available !== false && protocol === 'openai-chat-completions',
-    capabilities: normalizeCapabilities(model)
-  };
-}
-
-export function normalizeModelList(payload) {
-  const source = Array.isArray(payload) ? payload : Array.isArray(payload?.data) ? payload.data : [];
-  return source.map(normalizeModel).filter(Boolean);
-}
-
-function delay(ms) {
-  return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-function contentFromCompletion(payload) {
-  const content = payload?.choices?.[0]?.message?.content ?? payload?.choices?.[0]?.text ?? '';
-  if (Array.isArray(content)) return content.map(item => typeof item === 'string' ? item : String(item?.text || '')).join('');
-  return String(content || '');
-}
-
-function parsePlan(content) {
-  const trimmed = String(content || '').trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```$/i, '').trim();
-  let candidate = trimmed;
-  try {
-    return JSON.parse(candidate);
-  } catch {
-    const start = trimmed.indexOf('{');
-    const end = trimmed.lastIndexOf('}');
-    if (start < 0 || end <= start) throw new AgentProviderError('agent-provider-invalid-response', 'The Agent provider returned an invalid plan.', { status: 502 });
-    candidate = trimmed.slice(start, end + 1);
-    try {
-      return JSON.parse(candidate);
-    } catch {
-      throw new AgentProviderError('agent-provider-invalid-response', 'The Agent provider returned an invalid plan.', { status: 502 });
-    }
-  }
-}
-
-function validatePlan(value) {
-  const operation = String(value?.operation || '').trim();
-  if (!AGENT_OPERATIONS.has(operation)) {
-    throw new AgentProviderError('agent-provider-invalid-plan', 'The Agent provider returned an unsupported operation.', { status: 502 });
-  }
-  const targetQuery = operation === 'process.list' && typeof value?.targetQuery === 'string'
-    ? value.targetQuery.replace(/[\0\r\n]/g, ' ').trim().slice(0, 120)
-    : '';
-  return {
-    operation,
-    targetQuery: targetQuery || undefined,
-    title: typeof value?.title === 'string' ? value.title.replace(/[\0\r\n]/g, ' ').trim().slice(0, 120) || undefined : undefined
-  };
-}
-
-export function createOpenCodeGoProvider() {
-  async function requestJson({ settings, apiKey, endpoint, method = 'GET', body, timeoutMs }) {
-    if (!apiKey) throw new AgentProviderError('agent-api-key-missing', 'OpenCode Go API key is not configured.', { status: 401 });
-    const url = `${normalizeBaseUrl(settings.baseUrl)}/${String(endpoint).replace(/^\/+/, '')}`;
-    const retryCount = Math.max(0, Math.min(4, Number(settings.retryCount) || 0));
-    const retryDelayMs = Math.max(100, Math.min(10000, Number(settings.retryDelayMs) || 1000));
-    for (let attempt = 0; attempt <= retryCount; attempt += 1) {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), Math.max(1000, Number(timeoutMs) || 60000));
-      try {
-        const response = await fetch(url, {
-          method,
-          headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
-          body: body === undefined ? undefined : JSON.stringify(body),
-          signal: controller.signal
-        });
-        clearTimeout(timer);
-        if (response.ok) return await response.json();
-        const status = response.status;
-        const retryable = status === 408 || status === 429 || status >= 500;
-        if (retryable && attempt < retryCount) {
-          await delay(retryDelayMs * (attempt + 1));
-          continue;
-        }
-        if (status === 401 || status === 403) throw new AgentProviderError('agent-api-key-invalid', 'OpenCode Go rejected the API key.', { status: 401 });
-        if (status === 429) throw new AgentProviderError('agent-provider-rate-limited', 'OpenCode Go is rate limiting requests.', { status: 429, retryable: true });
-        throw new AgentProviderError(status >= 500 ? 'agent-provider-upstream' : 'agent-provider-request-invalid', 'OpenCode Go rejected the request.', { status: status >= 500 ? 502 : 400, retryable });
-      } catch (error) {
-        clearTimeout(timer);
-        if (error instanceof AgentProviderError) {
-          if (isRetryableProviderError(error) && attempt < retryCount) {
-            await delay(retryDelayMs * (attempt + 1));
-            continue;
-          }
-          throw error;
-        }
-        const code = error?.name === 'AbortError' ? 'agent-provider-timeout' : 'agent-provider-network';
-        const message = code === 'agent-provider-timeout' ? 'OpenCode Go request timed out.' : 'OpenCode Go could not be reached.';
-        const providerError = new AgentProviderError(code, message, { status: code === 'agent-provider-timeout' ? 504 : 502, retryable: true });
-        if (attempt < retryCount) {
-          await delay(retryDelayMs * (attempt + 1));
-          continue;
-        }
-        throw providerError;
-      }
-    }
-    throw new AgentProviderError('agent-provider-network', 'OpenCode Go could not be reached.', { status: 502, retryable: true });
-  }
-
-  async function getModels(settings, apiKey) {
-    return normalizeModelList(await requestJson({ settings, apiKey, endpoint: 'models', timeoutMs: settings.summaryTimeoutMs }));
-  }
-
-  async function selectedModel(settings, apiKey, modelId) {
-    const models = await getModels(settings, apiKey);
-    const selected = models.find(model => model.id === modelId);
-    if (models.length > 0 && (!selected || !selected.available)) {
-      throw new AgentProviderError('agent-model-unavailable', 'The selected model is not available for LiveDesk.', { status: 409 });
-    }
-    return { models, model: selected || { id: modelId, name: modelId, available: true, protocol: 'openai-chat-completions', capabilities: normalizeCapabilities() } };
-  }
-
-  function completionBody({ model, messages, temperature, topP, maxTokens, reasoningLevel }) {
-    const body = { model: model.id, messages, max_tokens: maxTokens };
-    if (model.capabilities.supportsTemperature) body.temperature = temperature;
-    if (model.capabilities.supportsTopP) body.top_p = topP;
-    if (reasoningLevel !== 'auto' && model.capabilities.supportsReasoningLevel && model.capabilities.reasoningParameter) {
-      body[model.capabilities.reasoningParameter] = reasoningLevel;
-    }
-    return body;
-  }
-
-  async function testConnection(settings, apiKey) {
-    const startedAt = Date.now();
-    const modelId = settings.defaultModelId || OPENCODE_GO_DEFAULT_MODEL_ID;
-    const { model } = await selectedModel(settings, apiKey, modelId);
-    const payload = await requestJson({
-      settings,
-      apiKey,
-      endpoint: 'chat/completions',
-      method: 'POST',
-      timeoutMs: settings.planTimeoutMs,
-      body: completionBody({
-        model,
-        messages: [
-          { role: 'system', content: 'Return only the JSON object {"ok":true}. Do not add markdown.' },
-          { role: 'user', content: 'Connection test.' }
-        ],
-        temperature: 0,
-        topP: 1,
-        maxTokens: 32,
-        reasoningLevel: 'auto'
-      })
-    });
-    if (!contentFromCompletion(payload)) throw new AgentProviderError('agent-provider-invalid-response', 'OpenCode Go returned an empty response.', { status: 502 });
-    return { ok: true, modelId: model.id, modelName: model.name, latencyMs: Date.now() - startedAt };
-  }
-
-  async function createPlan({ instruction }, settings, apiKey) {
-    const normalizedInstruction = String(instruction || '').replace(/[\0]/g, ' ').trim().slice(0, 2000);
-    if (!normalizedInstruction) throw new AgentProviderError('agent-invalid-instruction', 'Instruction is required.', { status: 400 });
-    const modelId = settings.planModelId || settings.defaultModelId || OPENCODE_GO_DEFAULT_MODEL_ID;
-    const { model } = await selectedModel(settings, apiKey, modelId);
-    const payload = await requestJson({
-      settings,
-      apiKey,
-      endpoint: 'chat/completions',
-      method: 'POST',
-      timeoutMs: settings.planTimeoutMs,
-      body: completionBody({
-        model,
-        messages: [
-          {
-            role: 'system',
-            content: 'You are the LiveDesk read-only task planner. Return JSON only with exactly these keys: operation, targetQuery, title. Allowed operation values are system.health, gpu.status, disk.status, process.list, service.status, diagnostics.collect. Never suggest shell commands, PowerShell, Bash, file changes, installs, deletion, reboot, credentials, or arbitrary tools. Use targetQuery only for process.list; otherwise use null. If the request is outside the allowlist, return {"operation":null,"targetQuery":null,"title":"Unsupported request"}.'
-          },
-          { role: 'user', content: normalizedInstruction }
-        ],
-        temperature: settings.planTemperature,
-        topP: settings.topP,
-        maxTokens: settings.planMaxOutputTokens,
-        reasoningLevel: settings.reasoningLevel
-      })
-    });
-    return validatePlan(parsePlan(contentFromCompletion(payload)));
-  }
-
-  async function createSummary({ instruction, operation, summary }, settings, apiKey) {
-    const modelId = settings.summaryModelId || settings.defaultModelId || OPENCODE_GO_DEFAULT_MODEL_ID;
-    const { model } = await selectedModel(settings, apiKey, modelId);
-    const payload = await requestJson({
-      settings,
-      apiKey,
-      endpoint: 'chat/completions',
-      method: 'POST',
-      timeoutMs: settings.summaryTimeoutMs,
-      body: completionBody({
-        model,
-        messages: [
-          {
-            role: 'system',
-            content: 'You summarize completed LiveDesk read-only checks. Return plain text only, in at most three short sentences. Never include or invent commands, credentials, file paths, or remediation instructions.'
-          },
-          {
-            role: 'user',
-            content: JSON.stringify({ instruction: String(instruction || '').slice(0, 500), operation, summary })
-          }
-        ],
-        temperature: settings.summaryTemperature,
-        topP: settings.topP,
-        maxTokens: settings.summaryMaxOutputTokens,
-        reasoningLevel: 'auto'
-      })
-    });
-    const text = contentFromCompletion(payload).replace(/[\0]/g, ' ').trim().slice(0, 1200);
-    if (!text) throw new AgentProviderError('agent-provider-invalid-response', 'OpenCode Go returned an empty summary.', { status: 502 });
-    return { summary: text, modelId: model.id };
-  }
-
-  return { getModels, testConnection, createPlan, createSummary };
-}

package/src/agents/secret-store.js

@@ -1,165 +0,0 @@
-import { spawn } from 'node:child_process';
-import { access, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-const DEFAULT_SERVICE = 'livedesk.agent.opencode-go';
-const DEFAULT_ACCOUNT = (() => {
-  try {
-    return os.userInfo().username || 'livedesk-user';
-  } catch {
-    return 'livedesk-user';
-  }
-})();
-
-function secretStoreError(message = 'Secure API key storage is unavailable on this system.') {
-  const error = new Error(message);
-  error.code = 'agent-secret-store-unavailable';
-  error.status = 503;
-  return error;
-}
-function runCommand(command, args, input = '') {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.setEncoding('utf8');
-    child.stderr.setEncoding('utf8');
-    child.stdout.on('data', chunk => { stdout += chunk; });
-    child.stderr.on('data', chunk => { stderr += chunk; });
-    child.once('error', () => reject(secretStoreError()));
-    child.once('close', code => {
-      if (code === 0) {
-        resolve(stdout.trim());
-      } else {
-        reject(secretStoreError());
-      }
-    });
-    child.stdin.end(input);
-  });
-}
-
-function providerGuard(provider) {
-  if (String(provider || '').trim() !== 'opencode-go') {
-    const error = new Error('Unsupported agent provider.');
-    error.code = 'agent-unsupported-provider';
-    error.status = 400;
-    throw error;
-  }
-}
-
-function windowsScript(action) {
-  const source = "$encoded = [Console]::In.ReadToEnd().Trim(); $bytes = [Convert]::FromBase64String($encoded);";
-  if (action === 'protect') {
-    return `${source} Add-Type -AssemblyName System.Security; $protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Convert]::ToBase64String($protected)`;
-  }
-  return `${source} Add-Type -AssemblyName System.Security; $plain = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Convert]::ToBase64String($plain)`;
-}
-
-async function protectWindows(value) {
-  const encoded = Buffer.from(value, 'utf8').toString('base64');
-  return runCommand('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', windowsScript('protect')], `${encoded}\n`);
-}
-
-async function unprotectWindows(value) {
-  const encoded = await runCommand('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', windowsScript('unprotect')], `${String(value).trim()}\n`);
-  try {
-    return Buffer.from(encoded, 'base64').toString('utf8');
-  } catch {
-    throw secretStoreError();
-  }
-}
-
-export function createOsSecretStore({ dataDir = path.join(os.homedir(), '.livedesk'), service = DEFAULT_SERVICE, account = DEFAULT_ACCOUNT } = {}) {
-  const dpapiPath = path.join(dataDir, 'agent-opencode-go.dpapi');
-
-  async function setApiKey(provider, value) {
-    providerGuard(provider);
-    const apiKey = String(value || '').trim();
-    if (!apiKey || apiKey.length > 1000) {
-      const error = new Error('API key is required.');
-      error.code = 'agent-api-key-invalid';
-      error.status = 400;
-      throw error;
-    }
-    if (process.platform === 'win32') {
-      const encrypted = await protectWindows(apiKey);
-      await mkdir(dataDir, { recursive: true });
-      const temporaryPath = `${dpapiPath}.${process.pid}.${Date.now()}.tmp`;
-      await writeFile(temporaryPath, `${encrypted}\n`, { encoding: 'utf8', mode: 0o600 });
-      await rename(temporaryPath, dpapiPath);
-      return;
-    }
-    if (process.platform === 'darwin') {
-      await runCommand('security', ['add-generic-password', '-U', '-a', account, '-s', service, '-w', apiKey]);
-      return;
-    }
-    await runCommand('secret-tool', ['store', '--label=LiveDesk Agent API key', 'service', service, 'account', account], `${apiKey}\n`);
-  }
-
-  async function getApiKey(provider) {
-    providerGuard(provider);
-    if (process.platform === 'win32') {
-      try {
-        const encrypted = await readFile(dpapiPath, 'utf8');
-        return await unprotectWindows(encrypted);
-      } catch (error) {
-        if (error?.code === 'ENOENT') return null;
-        throw secretStoreError();
-      }
-    }
-    if (process.platform === 'darwin') {
-      try {
-        return await runCommand('security', ['find-generic-password', '-a', account, '-s', service, '-w']);
-      } catch (error) {
-        if (error?.code === 'agent-secret-store-unavailable') return null;
-        throw error;
-      }
-    }
-    try {
-      return await runCommand('secret-tool', ['lookup', 'service', service, 'account', account]);
-    } catch {
-      return null;
-    }
-  }
-
-  async function hasApiKey(provider) {
-    providerGuard(provider);
-    if (process.platform === 'win32') {
-      try {
-        await access(dpapiPath);
-        return true;
-      } catch {
-        return false;
-      }
-    }
-    return Boolean(await getApiKey(provider));
-  }
-
-  async function deleteApiKey(provider) {
-    providerGuard(provider);
-    if (process.platform === 'win32') {
-      try {
-        await unlink(dpapiPath);
-      } catch (error) {
-        if (error?.code !== 'ENOENT') throw secretStoreError();
-      }
-      return;
-    }
-    if (process.platform === 'darwin') {
-      try {
-        await runCommand('security', ['delete-generic-password', '-a', account, '-s', service]);
-      } catch {
-        return;
-      }
-      return;
-    }
-    try {
-      await runCommand('secret-tool', ['clear', 'service', service, 'account', account]);
-    } catch {
-      return;
-    }
-  }
-
-  return { setApiKey, getApiKey, hasApiKey, deleteApiKey };
-}