@open-everywhere/create 0.6.0 → 0.8.0

package/template/scripts/model-config-check.ts

@@ -0,0 +1,81 @@
+// THE LIVE MODEL CONFIG CHECK — `npm run check:model-config` (OPE-2556).
+//
+//   npm run check:model-config            check this app's resolved models against its models.targets and models.dataPolicy
+//   npm run check:model-config -- --json  the same, as one JSON object
+//
+// It loads the app's own config (settings, stack, domains, roles), lists the models the deployment can resolve (the stack
+// roles, the gateway transcription routes, the domain and role routes, models.force, and each declared subagent's
+// bare model id on the target it goes through), and
+// reads the gateway's PUBLIC `/v1/models/<id>/endpoints` for each one. A `models.dataPolicy` row or a `providers.only`
+// row that no provider can meet is named, for example "region eu: no provider for deepseek/deepseek-v4-flash-0731".
+// Run it BEFORE a deploy that changes either setting: under such a row every call of that model fails closed.
+//
+// 🔴 TWO COPIES, ONE TEXT (OPE-2563). The repository runs this file, and the scaffold template ships the same bytes
+// at the same app-relative path, so a scaffolded app runs the check before its first deploy and the setup skill
+// names one command in both homes. `test:scaffold` refuses a copy that drifts.
+//
+// It needs the network and no credential: the endpoints read is unauthenticated. So it is NOT in the `npm test` chain.
+// The same check runs on a deployment, in the `model-route` row of `GET /eve/v1/oe/status` (adapters gateway-probe.ts),
+// which `npx @open-everywhere/create --check --host <url>` reports.
+//
+// A bare model id that no stack role names goes through the primary role's target (OPE-2566). The check names each
+// such id, so a subagent that would leave its role's target is visible before a deploy.
+//
+// Exit: 0 when every demand can be served or a part is unknown (printed), 1 when a demand cannot be served, or when a
+// role names a target other than `gateway` and the app does not register its roles for bare ids.
+
+import { getConfig } from "@open-everywhere/core/agent/access/config.js";
+import { getSettings } from "@open-everywhere/core/agent/settings/settings.js";
+import { modelTargetFor, resolvableModels } from "@open-everywhere/core/agent/model/targets.js";
+import { bareModelFallbacks, bareModelRoutes, bareModelRoutesUnregistered, bareModelVia } from "@open-everywhere/core/agent/model/bare-model-via.js";
+import { declaredSubagentModels } from "@open-everywhere/core/agent/ops/sovereignty-facts.js";
+import { importAppModule, resolveAppRoot } from "@open-everywhere/core/agent/scaffold/app-root.js";
+import { checkModelConfig, configCheckSummary } from "@open-everywhere/adapters/agent/model/model-config-check.js";
+import { targetBaseUrl } from "@open-everywhere/adapters/agent/model/target-url.js";
+
+// The deployer's app config loads from the app root (`OE_APP_ROOT`, else the directory npm ran in — OPE-2195).
+const APP_ROOT = resolveAppRoot();
+await importAppModule("agent/lib/register-config.ts", APP_ROOT);
+const { MODELS, TRANSCRIPTION_ROLE } = await importAppModule<typeof import("../agent/model/models.js")>("agent/model/models.ts", APP_ROOT);
+
+const settings = getSettings().models;
+// The gateway transcription routes carry the `gateway` target's rows too, so they are checked with the roles.
+const transcription = [TRANSCRIPTION_ROLE.primary, TRANSCRIPTION_ROLE.fallback].flatMap((r) => (r?.via === "gateway" ? [{ id: r.id }] : []));
+// A declared subagent's bare id is checked on the target it goes through: its role's, else the primary role's.
+const routes = bareModelRoutes(Object.values(MODELS));
+// The app's `agent/model/models.ts` registers the roles at load (the import above ran it). An app scaffolded before
+// 0.8.0 does not, so at run time every bare id still goes through `gateway`, whatever this check computes.
+// That matters only when a role names a target other than `gateway`: then a bare id leaves the role's target.
+const unregisteredLeak = bareModelRoutesUnregistered(routes);
+const declared = (await declaredSubagentModels(APP_ROOT)) ?? [];
+// A subagent whose module did not load has an unknown model: it is named, and the check cannot read it.
+const unloaded = declared.filter((b) => b.id === undefined).map((b) => b.where);
+const subagents = declared.flatMap((b) => (b.id === undefined ? [] : [{ where: b.where, id: b.id }]));
+const bare = subagents.map((b) => ({ id: b.id, via: bareModelVia(b.id, routes).via }));
+const fallbacks = bareModelFallbacks(subagents, routes);
+const models = resolvableModels([...Object.values(MODELS), ...transcription, ...bare], getConfig().loadDomains(), getConfig().loadRoles?.() ?? [], settings.force);
+const result = await checkModelConfig({
+  models,
+  targets: settings.targets,
+  policy: settings.dataPolicy,
+  baseUrlFor: (via) => targetBaseUrl(via, modelTargetFor(via, settings.targets)),
+  timeoutMs: 15_000,
+});
+
+if (process.argv.includes("--json")) {
+  console.log(JSON.stringify({ met: result.met, checked: result.checked, models, findings: result.findings, bareRoutesUnregistered: unregisteredLeak, bareDefaultVia: routes.fallback, bareFallbacks: fallbacks, unloadedSubagents: unloaded }, null, 2));
+} else {
+  console.log(configCheckSummary(result));
+  for (const f of result.findings) console.log(`  ${f.met === "no" ? "✗" : "?"} ${f.detail}`);
+  if (unregisteredLeak) {
+    console.log("  ✗ agent/model/models.ts does not call registerBareModelRoutes, so every bare id goes via gateway, not the targets below. Add the line from the 0.8.0 template.");
+  }
+  // Every declared subagent, with the target its bare id goes through; then the target of any other bare id.
+  for (const b of subagents) {
+    const r = bareModelVia(b.id, routes);
+    console.log(r.source === "role" ? `  · ${b.where}: via ${r.via}, its role's target` : `  · ${b.where}: no role names ${b.id}, so it goes via ${r.via}, the primary role's target`);
+  }
+  for (const w of unloaded) console.log(`  ? ${w}: model unknown, its module did not load, so it was not checked`);
+  console.log(`  · any other bare id (eve evaluate()): via ${routes.fallback}, the primary role's target`);
+}
+process.exit(result.met === "no" || unregisteredLeak ? 1 : 0);

package/template/scripts/ops-mcp.ts

@@ -47,5 +47,5 @@ registerSurfaceTrustPreflight();
 const server = buildOpsServer();
 await server.connect(new StdioServerTransport());
 process.stderr.write(
-  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · surface_app_package · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
+  "open-everywhere-ops MCP server ready on stdio (preflight · surface_manifest · surface_app_package · surface_app_create · scaffold_env · scaffold_credential_key · secret_set/list/rm)\n",
 );