@nanhara/hara 0.125.3 → 0.126.1

package/dist/config.js

@@ -33,8 +33,49 @@ const PROVIDER_DEFAULTS = {
         baseURL: "https://openrouter.ai/api/v1",
         envKey: "OPENROUTER_API_KEY",
     },
+    ollama: {
+        model: "qwen3",
+        baseURL: "http://127.0.0.1:11434/v1",
+        envKey: "",
+    },
+    lmstudio: {
+        model: "local-model",
+        baseURL: "http://127.0.0.1:1234/v1",
+        envKey: "",
+    },
     "hara-gateway": { model: "", envKey: "HARA_GATEWAY_TOKEN" }, // B-end: enrolled device → token in ~/.hara/org.json, routed by the gateway
 };
+const PROVIDER_LABELS = {
+    anthropic: { label: "Anthropic", location: "cloud", auth: "api-key", customBaseURL: true },
+    openai: { label: "OpenAI / compatible", location: "cloud", auth: "api-key", customBaseURL: true },
+    qwen: { label: "Qwen (DashScope)", location: "cloud", auth: "api-key", customBaseURL: true },
+    "qwen-oauth": { label: "Qwen Coding (browser sign-in)", location: "cloud", auth: "oauth", customBaseURL: false },
+    glm: { label: "GLM (Zhipu)", location: "cloud", auth: "api-key", customBaseURL: true },
+    deepseek: { label: "DeepSeek", location: "cloud", auth: "api-key", customBaseURL: true },
+    openrouter: { label: "OpenRouter", location: "cloud", auth: "api-key", customBaseURL: true },
+    ollama: { label: "Ollama", location: "local", auth: "none", customBaseURL: true },
+    lmstudio: { label: "LM Studio", location: "local", auth: "none", customBaseURL: true },
+    "hara-gateway": { label: "Hara Enterprise Gateway", location: "managed", auth: "managed", customBaseURL: false },
+};
+export const PROVIDER_IDS = Object.freeze(Object.keys(PROVIDER_DEFAULTS));
+export function isProviderId(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(PROVIDER_DEFAULTS, value);
+}
+export function providerRequiresApiKey(provider) {
+    return PROVIDER_LABELS[provider].auth === "api-key";
+}
+export function providerIsLocal(provider) {
+    return PROVIDER_LABELS[provider].location === "local";
+}
+/** Redacted, deterministic catalog shared by CLI setup, serve and Desktop. */
+export function providerCatalog() {
+    return PROVIDER_IDS.map((id) => ({
+        id,
+        ...PROVIDER_LABELS[id],
+        defaultModel: PROVIDER_DEFAULTS[id].model,
+        ...(PROVIDER_DEFAULTS[id].baseURL ? { defaultBaseURL: PROVIDER_DEFAULTS[id].baseURL } : {}),
+    }));
+}
 export const CONFIG_KEYS = ["provider", "apiKey", "model", "baseURL", "approval", "sandbox", "theme", "evolve", "assetCapture", "computerUse", "computerApps", "visionModel", "visionBaseURL", "visionApiKey", "embedProvider", "embedModel", "embedBaseURL", "embedApiKey", "routeModel", "routeBaseURL", "routeApiKey", "guardian", "notify", "runTimeoutMs", "maxAgentRounds", "vimMode", "autoCompact", "fileCheckpoints", "updateCheck", "fallbackModel", "fallbackProvider", "fallbackBaseURL", "fallbackApiKey", "reasoningEffort"];
 export const REASONING_EFFORTS = ["off", "low", "medium", "high", "max"];
 export const APPROVAL_MODES = ["suggest", "auto-edit", "full-auto"];
@@ -251,6 +292,127 @@ export function writeConfigValue(key, value) {
         config[key] = value;
     });
 }
+function cleanProviderModel(value) {
+    const model = value.trim();
+    if (!model || model.length > 256 || /[\u0000-\u001f\u007f]/.test(model)) {
+        throw new Error("model must be 1–256 printable characters");
+    }
+    return model;
+}
+function loopbackHost(hostname) {
+    const host = hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function cleanProviderBaseURL(provider, value) {
+    const raw = value?.trim() || PROVIDER_DEFAULTS[provider].baseURL;
+    if (!raw)
+        return undefined;
+    if (raw.length > 2_048 || /[\u0000-\u001f\u007f]/.test(raw))
+        throw new Error("base URL is invalid");
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error("base URL must be an absolute http(s) URL");
+    }
+    if (!["http:", "https:"].includes(url.protocol))
+        throw new Error("base URL must use http or https");
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error("base URL cannot contain credentials, query parameters, or a fragment");
+    }
+    if (url.protocol === "http:" && !loopbackHost(url.hostname)) {
+        throw new Error("non-loopback provider endpoints must use https");
+    }
+    if (providerIsLocal(provider) && !loopbackHost(url.hostname)) {
+        throw new Error(`${provider} is labeled local and must use localhost/127.0.0.1/::1; use an OpenAI-compatible cloud profile for a remote host`);
+    }
+    return raw.replace(/\/+$/, "");
+}
+function providerEndpointIdentity(provider, value) {
+    const cleaned = cleanProviderBaseURL(provider, value);
+    if (!cleaned)
+        return "";
+    const url = new URL(cleaned);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    return `${url.protocol}//${url.host.toLowerCase()}${pathname}`;
+}
+/** Validate a Desktop/serve candidate without persisting it. Kept beside the writer so a connection test
+ * and the eventual save cannot disagree about endpoint or credential safety. */
+export function normalizePersonalProviderConfig(input) {
+    if (!isProviderId(input.provider) || input.provider === "hara-gateway") {
+        throw new Error("provider is not a configurable personal provider");
+    }
+    const model = cleanProviderModel(input.model);
+    const baseURL = cleanProviderBaseURL(input.provider, input.baseURL);
+    const apiKey = input.apiKey?.trim();
+    if (apiKey && (apiKey.length > 32 * 1024 || /[\u0000-\u001f\u007f]/.test(apiKey))) {
+        throw new Error("API key is invalid");
+    }
+    if (apiKey && !providerRequiresApiKey(input.provider)) {
+        throw new Error(`${input.provider} does not accept an API key`);
+    }
+    return {
+        provider: input.provider,
+        model,
+        ...(baseURL ? { baseURL } : {}),
+        ...(apiKey ? { apiKey } : {}),
+        ...(input.clearApiKey === true ? { clearApiKey: true } : {}),
+    };
+}
+/**
+ * Resolve a credential that may safely be reused for a Desktop connection test/save.
+ *
+ * A provider id is not a credential boundary by itself: OpenAI-compatible providers allow a custom
+ * endpoint. Never replay a stored or environment key when that endpoint changes, even when the provider id
+ * stays the same. Local/OAuth providers never receive this flat API-key slot.
+ */
+export function reusablePersonalProviderApiKey(input, raw, env = process.env) {
+    if (!providerRequiresApiKey(input.provider))
+        return undefined;
+    if (input.apiKey)
+        return input.apiKey;
+    if (input.clearApiKey)
+        return undefined;
+    const previousProvider = isProviderId(raw.provider) ? raw.provider : "anthropic";
+    if (previousProvider !== input.provider)
+        return undefined;
+    const previousEndpoint = providerEndpointIdentity(previousProvider, typeof raw.baseURL === "string" ? raw.baseURL : undefined);
+    const candidateEndpoint = providerEndpointIdentity(input.provider, input.baseURL);
+    if (previousEndpoint !== candidateEndpoint)
+        return undefined;
+    const envKey = providerEnvKey(input.provider);
+    return nonBlankEnv(env.HARA_API_KEY)
+        ?? (envKey ? nonBlankEnv(env[envKey]) : undefined)
+        ?? nonBlankEnv(typeof raw.apiKey === "string" ? raw.apiKey : undefined);
+}
+/** Atomically update the legacy/personal provider slot without returning or logging its credential. */
+export function updatePersonalProviderConfig(input) {
+    const normalized = normalizePersonalProviderConfig(input);
+    const { model, baseURL, apiKey } = normalized;
+    updateRawConfig((config) => {
+        const previousProvider = isProviderId(config.provider) ? config.provider : "anthropic";
+        const previousEndpoint = providerEndpointIdentity(previousProvider, typeof config.baseURL === "string" ? config.baseURL : undefined);
+        const nextEndpoint = providerEndpointIdentity(normalized.provider, baseURL);
+        const endpointChanged = previousProvider !== normalized.provider || previousEndpoint !== nextEndpoint;
+        config.provider = normalized.provider;
+        config.model = model;
+        if (baseURL)
+            config.baseURL = baseURL;
+        else
+            delete config.baseURL;
+        if (!providerRequiresApiKey(normalized.provider) || normalized.clearApiKey === true) {
+            delete config.apiKey;
+        }
+        else if (apiKey) {
+            config.apiKey = apiKey;
+        }
+        else if (endpointChanged) {
+            // A flat legacy key belongs to one exact endpoint, not merely a provider label.
+            delete config.apiKey;
+        }
+    });
+}
 /** Record (or clear, with cap=null) a confirmed per-model vision capability in `modelVision`. */
 export function setModelVisionOverride(model, cap) {
     updateRawConfig((config) => {
@@ -289,11 +451,13 @@ export function loadConfig(opts = {}) {
         ...withoutBlankRoutingValues(overlay),
         ...withoutBlankRoutingValues(project),
     };
-    const provider = (nonBlankEnv(process.env.HARA_PROVIDER) ?? merged.provider ?? "anthropic");
-    const d = PROVIDER_DEFAULTS[provider] ?? PROVIDER_DEFAULTS.anthropic;
+    const requestedProvider = nonBlankEnv(process.env.HARA_PROVIDER) ?? merged.provider ?? "anthropic";
+    const provider = isProviderId(requestedProvider) ? requestedProvider : "anthropic";
+    const d = PROVIDER_DEFAULTS[provider];
     const model = nonBlankEnv(process.env.HARA_MODEL) ?? merged.model ?? d.model;
     const baseURL = nonBlankEnv(process.env.HARA_BASE_URL) ?? merged.baseURL ?? d.baseURL;
-    const apiKey = nonBlankEnv(process.env.HARA_API_KEY) ?? nonBlankEnv(process.env[d.envKey]) ?? merged.apiKey;
+    const providerEnvApiKey = d.envKey ? nonBlankEnv(process.env[d.envKey]) : undefined;
+    const apiKey = nonBlankEnv(process.env.HARA_API_KEY) ?? providerEnvApiKey ?? merged.apiKey;
     const approval = (process.env.HARA_APPROVAL ?? merged.approval ?? "suggest");
     const sandbox = (process.env.HARA_SANDBOX ?? merged.sandbox ?? "off");
     const theme = (process.env.HARA_THEME ?? merged.theme ?? "dark");
@@ -329,7 +493,8 @@ export function loadConfig(opts = {}) {
     const fileCheckpoints = !(process.env.HARA_CHECKPOINTS === "0" || merged.fileCheckpoints === false || merged.fileCheckpoints === "false"); // default ON
     const updateCheck = !(process.env.HARA_UPDATE_CHECK === "0" || merged.updateCheck === false || merged.updateCheck === "false"); // default ON
     const fallbackModel = nonBlankEnv(process.env.HARA_FALLBACK_MODEL) ?? merged.fallbackModel;
-    const fallbackProvider = (nonBlankEnv(process.env.HARA_FALLBACK_PROVIDER) ?? merged.fallbackProvider);
+    const requestedFallbackProvider = nonBlankEnv(process.env.HARA_FALLBACK_PROVIDER) ?? merged.fallbackProvider;
+    const fallbackProvider = isProviderId(requestedFallbackProvider) ? requestedFallbackProvider : undefined;
     const fallbackBaseURL = nonBlankEnv(process.env.HARA_FALLBACK_BASE_URL) ?? merged.fallbackBaseURL;
     const fallbackApiKey = nonBlankEnv(process.env.HARA_FALLBACK_API_KEY) ?? merged.fallbackApiKey;
     const reasoningRaw = process.env.HARA_REASONING_EFFORT ?? merged.reasoningEffort;
@@ -346,3 +511,6 @@ export function providerEnvKey(provider) {
 export function providerDefaultBaseURL(provider) {
     return PROVIDER_DEFAULTS[provider]?.baseURL;
 }
+export function providerDefaultModel(provider) {
+    return PROVIDER_DEFAULTS[provider]?.model ?? PROVIDER_DEFAULTS.anthropic.model;
+}

package/dist/gateway/flows-pending.js

@@ -15,12 +15,9 @@ import { randomUUID } from "node:crypto";
 import { deliverResult } from "../cron/deliver.js";
 import { selfArgv } from "../cron/runner.js";
 import { resolveAgent } from "../org/projects.js";
-import { loadConfig, providerDefaultBaseURL } from "../config.js";
-import { loadActiveProfile, effectiveModel } from "../profile/profile.js";
-import { createAnthropicProvider } from "../providers/anthropic.js";
-import { createOpenAIProvider } from "../providers/openai.js";
-import { getValidQwenAuth } from "../providers/qwen-oauth.js";
-import { resolvePlatform } from "../providers/registry.js";
+import { loadConfig } from "../config.js";
+import { createProviderForTarget } from "../providers/factory.js";
+import { profileForConfig, resolveByokProviderTarget, resolveGatewayModel, } from "../providers/target.js";
 import { validateAgainstSchema } from "../agent/structured.js";
 import { terminateSubprocessTree } from "../security/subprocess-env.js";
 import { sleepSync } from "../sync-sleep.js";
@@ -550,37 +547,18 @@ function spawnOrgTask(role, home, task, notify, context, origin, pendingId, opti
  * project context, or approval mode exists for untrusted flow/judge input to reach. */
 async function buildNoToolProvider() {
     const cfg = loadConfig();
-    const active = loadActiveProfile();
-    if (active.kind === "gateway") {
-        if (!active.gatewayUrl || !active.deviceToken)
+    const { profile } = profileForConfig(cfg);
+    if (profile.kind === "gateway") {
+        if (!profile.gatewayUrl || !profile.deviceToken)
             return null;
-        const baseURL = active.baseURL || `${active.gatewayUrl.replace(/\/$/, "")}/v1`;
-        return createOpenAIProvider({
-            apiKey: active.deviceToken,
-            baseURL,
-            model: cfg.model || effectiveModel(active),
-            label: "hara-gateway",
-            reasoningEffort: cfg.reasoningEffort,
-        });
-    }
-    const provider = (cfg.provider && cfg.provider !== "hara-gateway" ? cfg.provider : active.provider) || "anthropic";
-    const model = cfg.model || effectiveModel(active);
-    if (provider === "qwen-oauth") {
-        const auth = await getValidQwenAuth();
-        if (!auth)
-            return null;
-        return createOpenAIProvider({ apiKey: auth.accessToken, baseURL: auth.baseURL, model, label: provider, reasoningEffort: cfg.reasoningEffort });
-    }
-    const apiKey = cfg.apiKey ?? active.apiKey;
-    if (!apiKey)
-        return null;
-    const baseURL = cfg.baseURL ?? active.baseURL ?? providerDefaultBaseURL(provider);
-    const wire = resolvePlatform(provider, baseURL).wireApi;
-    if (wire === "responses")
-        return null; // unsupported transport: fail closed, never fall back to the CLI agent
-    if (wire === "anthropic")
-        return createAnthropicProvider({ apiKey, model, baseURL, reasoningEffort: cfg.reasoningEffort });
-    return createOpenAIProvider({ apiKey, model, baseURL, label: provider, reasoningEffort: cfg.reasoningEffort });
+        return createProviderForTarget({
+            provider: "hara-gateway",
+            apiKey: profile.deviceToken,
+            baseURL: profile.baseURL || `${profile.gatewayUrl.replace(/\/$/, "")}/v1`,
+            model: resolveGatewayModel(cfg, profile),
+        }, cfg.reasoningEffort);
+    }
+    return createProviderForTarget(resolveByokProviderTarget(cfg, profile, false), cfg.reasoningEffort);
 }
 function extractJson(raw) {
     const trimmed = raw.trim();

package/dist/gateway/wecom.js

@@ -6,10 +6,14 @@
 // reconnecting when `disconnected_event` says another connection has replaced this one.
 import { basename, extname } from "node:path";
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
+import WebSocket from "ws";
 import { chunkText, outboundTransferTimeoutMs, PerChatOutboundLane, withOutboundDeadline, } from "./telegram.js";
 import { InboundMediaBudget, cleanupTransientMedia, decodeBase64Media, readResponseBytesLimited, savePrivateMediaBytes, } from "./media.js";
 const DEFAULT_WS_URL = "wss://openws.work.weixin.qq.com";
-const WSImpl = globalThis.WebSocket;
+// WeCom's production endpoint rejects Node 22's native/undici WebSocket handshake even though a
+// standards-compliant `ws` handshake succeeds. Keep this adapter on the already-bundled `ws` client;
+// the local protocol tests deliberately model that production compatibility boundary.
+const WSImpl = WebSocket;
 const WS_CONNECTING = 0;
 const WS_OPEN = 1;
 const CMD_SUBSCRIBE = "aibot_subscribe";
@@ -555,6 +559,10 @@ function connectOnce(botId, secret, wsUrl, conn, onMessage, signal, shouldDownlo
             }
         };
         const handleMessage = async (event) => {
+            // An auth ACK can already be queued when shutdown wins the race. Never let that late frame
+            // re-authenticate the settled connection or install a heartbeat interval after cleanup.
+            if (settled || signal.aborted)
+                return;
             const data = event?.data;
             if (typeof data === "string" && Buffer.byteLength(data, "utf8") > MAX_FRAME_BYTES) {
                 finish("closed", "received an oversized WeCom frame");