@north-light/crouter 0.3.160 → 0.3.162

package/dist/daemon/api/__tests__/full/api-server.test.js

@@ -128,15 +128,18 @@ test('A3: messages append inbox.jsonl; final report writes + notifies subscriber
     assert.equal(h.node(B)?.status, 'done', 'row status is done after final');
 });
 // ---------------------------------------------------------------------------
-// A4 — WS attach → welcome.snapshot byte-identical vs a direct ViewSocketClient;
-//      ?revive=0 on a dormant node → 409 without launching a broker
+// A4 — WS attach reconstructs the same settled broker snapshot as a direct
+//      ViewSocketClient; ?revive=0 on a dormant node → 409 without launching a broker
 // ---------------------------------------------------------------------------
 test('A4a: WS attach welcome.snapshot is byte-identical to a direct ViewSocketClient snapshot', async () => {
     const root = h.spawnRoot('a4 root');
     const id = (await client.createNode({ kind: 'developer', parent: root, prompt: 'a4 worker' })).node_id;
     await h.awaitBoot(id);
-    // Direct capture via the production ViewSocketClient (the attach kit).
-    const direct = await kit.attach(id, 'observer', 'a4-direct');
+    // Await the fake engine's startup turn settling before either transport is
+    // compared. `awaitBoot()` proves the process started, not that its initial
+    // prompt has stopped streaming; comparing it with a later WS welcome races
+    // two real broker instants.
+    const direct = await kit.attachUntil(id, 'observer', 'a4-direct', (attached) => attached.welcome.snapshot.state.isStreaming === false, 'settled direct broker snapshot');
     // WS capture over the unix socket at the attach path. The node is already
     // live+booted, so ?revive=0 is fine (the socket is listenable).
     const wsWelcome = await new Promise((resolveWelcome, rejectWelcome) => {
@@ -164,8 +167,8 @@ test('A4a: WS attach welcome.snapshot is byte-identical to a direct ViewSocketCl
             rejectWelcome(err);
         });
     });
-    // Compare the SNAPSHOT field only (role differs controller/observer between the
-    // two connections; the reconstructed snapshot of an idle broker is stable).
+    // Compare the SNAPSHOT field only (role is outside the snapshot). Both
+    // transports captured the same settled broker state.
     assert.equal(JSON.stringify(wsWelcome.snapshot), JSON.stringify(direct.welcome.snapshot), 'WS welcome.snapshot is byte-identical to the direct ViewSocketClient snapshot');
     direct.close();
 });

package/dist/daemon/api/__tests__/full/b10-attach-modelauth.test.js

@@ -34,7 +34,8 @@ import assert from 'node:assert/strict';
 import { existsSync, readFileSync, mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { setAuthCredential } from '../../../../core/auth-file.js';
+import { readAuthCredentials, setAuthCredential } from '../../../../core/auth-file.js';
+import { readSubscriptionPool, writeSubscriptionPool } from '../../../../core/subscription-state.js';
 import { createHeadlessHarness } from '../../../../core/__tests__/helpers/harness.js';
 import { createAttachKit } from '../../../../core/__tests__/helpers/broker-clients.js';
 import { CrtrClient } from '../../../../api/index.js';
@@ -218,3 +219,124 @@ test('B2-modelauth-oauth: installCredential(oauth) preserves extra fields (enter
         rmSync(apiDir, { recursive: true, force: true });
     }
 });
+// ---------------------------------------------------------------------------
+// Credential truth/removal — GET exposes only connection state and DELETE
+// clears exactly its provider's durable store.
+// ---------------------------------------------------------------------------
+test('B2-modelauth-status: list is sanitized and delete clears only the selected provider', async () => {
+    const savedPiDir = process.env['PI_CODING_AGENT_DIR'];
+    const apiDir = mkdtempSync(join(tmpdir(), 'crtr-b10-status-'));
+    process.env['PI_CODING_AGENT_DIR'] = apiDir;
+    const expires = 1_900_000_000_000;
+    const cooldown = 1_900_000_100_000;
+    try {
+        await writeSubscriptionPool('anthropic', [
+            {
+                label: 'Claude One',
+                refresh: 'anthropic-refresh-secret',
+                access: 'anthropic-access-secret',
+                expires,
+                rateLimitedUntil: cooldown,
+                lastAttemptAt: 0,
+                lastRateLimitedAt: 0,
+                authFailure: 'invalid_grant',
+                accountId: 'anthropic-account-id',
+            },
+            {
+                label: 'Claude Two',
+                refresh: 'second-refresh-secret',
+                access: 'second-access-secret',
+                expires,
+                rateLimitedUntil: 0,
+                lastAttemptAt: 0,
+                lastRateLimitedAt: 0,
+            },
+        ]);
+        await writeSubscriptionPool('openai-codex', [
+            {
+                label: 'ChatGPT',
+                refresh: 'codex-refresh-secret',
+                access: 'codex-access-secret',
+                expires,
+                rateLimitedUntil: 0,
+                lastAttemptAt: 0,
+                lastRateLimitedAt: 0,
+                accountId: 'codex-account-id',
+            },
+        ]);
+        await setAuthCredential('github-copilot', {
+            type: 'oauth',
+            access: 'copilot-access-secret',
+            refresh: 'copilot-refresh-secret',
+            expires,
+        }, join(apiDir, 'auth.json'));
+        // A managed provider may also have a hand-configured API key. It remains
+        // intentionally absent from status, but DELETE must remove it too.
+        await setAuthCredential('anthropic', { type: 'api_key', key: 'anthropic-api-key-secret' }, join(apiDir, 'auth.json'));
+        const status = await client.listModelAuth();
+        assert.deepEqual(status.providers, [
+            {
+                provider: 'anthropic',
+                managed: true,
+                configured: true,
+                accounts: [
+                    {
+                        label: 'Claude One',
+                        expires_at: new Date(expires).toISOString(),
+                        rate_limited_until: new Date(cooldown).toISOString(),
+                        auth_failure: 'invalid_grant',
+                        account_id: 'anthropic-account-id',
+                    },
+                    {
+                        label: 'Claude Two',
+                        expires_at: new Date(expires).toISOString(),
+                        rate_limited_until: new Date(0).toISOString(),
+                    },
+                ],
+            },
+            {
+                provider: 'openai-codex',
+                managed: true,
+                configured: true,
+                accounts: [
+                    {
+                        label: 'ChatGPT',
+                        expires_at: new Date(expires).toISOString(),
+                        rate_limited_until: new Date(0).toISOString(),
+                        account_id: 'codex-account-id',
+                    },
+                ],
+            },
+            { provider: 'github-copilot', managed: false, configured: true, kind: 'oauth' },
+        ]);
+        const wire = JSON.stringify(status);
+        for (const secret of [
+            'anthropic-refresh-secret',
+            'anthropic-access-secret',
+            'second-refresh-secret',
+            'second-access-secret',
+            'codex-refresh-secret',
+            'codex-access-secret',
+            'copilot-refresh-secret',
+            'copilot-access-secret',
+            'anthropic-api-key-secret',
+        ]) {
+            assert.ok(!wire.includes(secret), `status never exposes ${secret}`);
+        }
+        const removedManaged = await client.removeCredential('anthropic');
+        assert.deepEqual(removedManaged, { provider: 'anthropic', removed_accounts: 3 });
+        assert.deepEqual(readSubscriptionPool('anthropic'), [], 'selected managed pool is empty');
+        assert.ok(!Object.hasOwn(await readAuthCredentials(join(apiDir, 'auth.json')), 'anthropic'), 'managed API key is removed');
+        assert.equal(readSubscriptionPool('openai-codex').length, 1, 'other managed pool is unchanged');
+        const removedOauth = await client.removeCredential('github-copilot');
+        assert.deepEqual(removedOauth, { provider: 'github-copilot', removed_accounts: 1 });
+        assert.deepEqual((await client.listModelAuth()).providers.map((provider) => provider.provider), ['anthropic', 'openai-codex'], 'deleted auth.json credential no longer appears in status');
+    }
+    finally {
+        if (savedPiDir === undefined)
+            delete process.env['PI_CODING_AGENT_DIR'];
+        else
+            process.env['PI_CODING_AGENT_DIR'] = savedPiDir;
+        rmSync(apiDir, { recursive: true, force: true });
+    }
+});

package/dist/daemon/api/handlers/modelauth.js

@@ -8,12 +8,14 @@
 // fans `reload_auth` to live brokers — a write here is picked up by that watcher
 // (do NOT re-implement the fan).
 //
+//   GET /v1/model-auth             sanitized credential presence
 //   PUT /v1/model-auth/:provider   install/rotate a credential (idempotent)
+//   DELETE /v1/model-auth/:provider remove all credentials for one provider
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { setAuthCredential } from '../../../core/auth-file.js';
+import { deleteAuthCredential, readAuthCredentials, setAuthCredential } from '../../../core/auth-file.js';
 import { ApiError } from '../../../api/index.js';
-import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, commitManagedLogin, readSubscriptionPool, } from '../../../core/subscription-state.js';
+import { ANTHROPIC_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID, commitManagedLogin, readSubscriptionPool, removeAllManagedAccounts, } from '../../../core/subscription-state.js';
 /** Resolve the shared pi credentials file, matching the daemon's auth.json
  *  mtime watcher exactly (`PI_CODING_AGENT_DIR` env, else `~/.pi/agent`) so a
  *  write here is the file that watcher fans a `reload_auth` for. */
@@ -43,6 +45,37 @@ function requireField(kind, field, value) {
     }
     return value;
 }
+function toManagedAccountStatus(account) {
+    return {
+        label: account.label,
+        expires_at: new Date(account.expires).toISOString(),
+        rate_limited_until: new Date(account.rateLimitedUntil).toISOString(),
+        ...(account.authFailure ? { auth_failure: account.authFailure } : {}),
+        ...(account.accountId ? { account_id: account.accountId } : {}),
+    };
+}
+function managedStatus(provider) {
+    const accounts = readSubscriptionPool(provider).map(toManagedAccountStatus);
+    return { provider, managed: true, configured: accounts.length > 0, accounts };
+}
+/** `GET /v1/model-auth` — credential truth projected without tokens, keys, or
+ * other auth-file material. Managed providers always reflect their complete
+ * pool rows, while non-managed presence reflects supported auth.json kinds. */
+async function handleList() {
+    const credentials = await readAuthCredentials(authPath());
+    const providers = [
+        managedStatus(ANTHROPIC_PROVIDER_ID),
+        managedStatus(OPENAI_CODEX_PROVIDER_ID),
+    ];
+    for (const [provider, credential] of Object.entries(credentials)) {
+        if (isManagedProvider(provider))
+            continue;
+        if (credential.type !== 'api_key' && credential.type !== 'oauth')
+            continue;
+        providers.push({ provider, managed: false, configured: true, kind: credential.type });
+    }
+    return { status: 200, body: { providers } };
+}
 /** `PUT /v1/model-auth/:provider` — idempotent upsert/rotate keyed by provider
  *  (and `account_id` for a managed account). */
 async function handleInstall(ctx) {
@@ -111,6 +144,22 @@ async function handleInstall(ctx) {
             throw new ApiError(400, 'invalid_request', `unknown credential kind: ${String(req.kind)}`);
     }
 }
+/** `DELETE /v1/model-auth/:provider` — remove all durable user credentials for
+ * one provider. Managed OAuth accounts are cleared through their pool lock and
+ * any managed-provider API key through the auth.json lock; other providers use
+ * the auth.json owner alone. */
+async function handleDelete(ctx) {
+    const provider = ctx.params['provider'];
+    if (isManagedProvider(provider)) {
+        const removedAccounts = await removeAllManagedAccounts(provider);
+        const removedApiKey = await deleteAuthCredential(provider, authPath());
+        return { status: 200, body: { provider, removed_accounts: removedAccounts + (removedApiKey ? 1 : 0) } };
+    }
+    const removedAccounts = await deleteAuthCredential(provider, authPath()) ? 1 : 0;
+    return { status: 200, body: { provider, removed_accounts: removedAccounts } };
+}
 export const modelAuthRoutes = [
+    { method: 'GET', pattern: '/v1/model-auth', handler: handleList },
     { method: 'PUT', pattern: '/v1/model-auth/:provider', handler: handleInstall },
+    { method: 'DELETE', pattern: '/v1/model-auth/:provider', handler: handleDelete },
 ];

package/dist/daemon/api/handlers/nodes.js

@@ -365,6 +365,7 @@ function handleDemote(ctx) {
         ...(meta.launch?.modelProviderPinned !== undefined
             ? { modelProviderPinned: meta.launch.modelProviderPinned }
             : {}),
+        ...(meta.launch?.modelIntent !== undefined ? { modelIntent: meta.launch.modelIntent } : {}),
         cwd: meta.cwd,
         profileId: meta.profile_id ?? null,
     });
@@ -485,6 +486,7 @@ async function handleConfig(ctx) {
             hasManager: meta.parent !== null,
             ...(meta.model_override != null ? { model: meta.model_override } : {}),
             ...(meta.launch?.modelProviderPinned !== undefined ? { modelProviderPinned: meta.launch.modelProviderPinned } : {}),
+            ...(meta.launch?.modelIntent !== undefined ? { modelIntent: meta.launch.modelIntent } : {}),
             cwd: meta.cwd,
             profileId: meta.profile_id ?? null,
         });

package/dist/types.d.ts

@@ -99,6 +99,19 @@ export interface ModelLaddersConfig {
     anthropic: Record<ModelStrength, string>;
     openai: Record<ModelStrength, string>;
 }
+/** A declared provider/model route. Route ids are the keys of `modelRoutes` so
+ * scopes can override one route without restating the registry. */
+export interface ModelRouteConfig {
+    family: string;
+    credentialSource: string;
+    providerId: string;
+    models: Partial<Record<ModelStrength, string>>;
+}
+export interface ModelRoutingConfig {
+    credentialSourceOrder?: string[];
+    familyOrder?: string[];
+    strengthFallback?: ModelStrength[];
+}
 /** Launch metadata for one kind (a top-level kind like `developer`, or a full
  *  sub-kind string like `plan/reviewers/security`) — the settings-file
  *  replacement for per-kind persona frontmatter. `model`/`tools`/`extensions`
@@ -159,6 +172,10 @@ export interface ScopeConfig {
     fold_finished_tools: boolean;
     keybindings: KeybindingOverrides;
     modelLadders: ModelLaddersConfig;
+    /** Declarative provider/model routes. Absent uses the synthesized ladder registry. */
+    modelRoutes?: Record<string, ModelRouteConfig>;
+    /** Ordering overrides for declared model routes. */
+    modelRouting?: ModelRoutingConfig;
     /** The kind registry (spec §1.5): kind existence + launch knobs, keyed by
      *  full kind string (top-level e.g. `developer`, or sub-kind e.g.
      *  `plan/reviewers/security`). Builtins ship a default registry via