@sayknow-cli/coding-agent 0.5.21 → 0.5.22

package/src/session/agent-session.ts

@@ -202,6 +202,8 @@ import { onAppendOnlyModeChanged } from "../config/settings";
 import type { SettingPath } from "../config/settings-schema";
 import { getDefault } from "../config/settings-schema";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
+import { createDecisionService } from "../decisions";
+import { createSemanticSkillRouter, type SkillRouter } from "../decisions/skill-routing";
 import { loadCapability } from "../discovery";
 import { expandApplyPatchToEntries, normalizeDiff, normalizeToLF, ParseError, previewPatch, stripBom } from "../edit";
 import { MAX_EDIT_FILE_BYTES } from "../edit/read-file";
@@ -260,7 +262,11 @@ import { expandSlashCommand, type FileSlashCommand } from "../extensibility/slas
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
-import { buildSkillStopOutput, ensureWorkflowSkillActivationState } from "../hooks/skill-state";
+import {
+	buildSkillStopOutput,
+	detectPrimarySkillKeyword,
+	ensureWorkflowSkillActivationState,
+} from "../hooks/skill-state";
 import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { shutdownAll as shutdownAllLspClients } from "../lsp/client";
 import { resolveMemoryBackend } from "../memory-backend";
@@ -1842,6 +1848,9 @@ export class AgentSession {
 	// Model registry for API key resolution
 	#modelRegistry: ModelRegistry;
 
+	/** Built on first use; the decision service resolves model and credential lazily. */
+	#semanticSkillRouter?: SkillRouter;
+
 	// Tool registry and prompt builder for extensions
 	#toolRegistry: Map<string, AgentTool>;
 	#workflowGateToolSession: ToolSession | undefined;
@@ -7548,6 +7557,41 @@ export class AgentSession {
 	 * @throws Error if streaming and no streamingBehavior specified
 	 * @throws Error if no model selected or no API key available (when not streaming)
 	 */
+	/**
+	 * Second-stage workflow routing for prompts the keyword table cannot see.
+	 *
+	 * Runs in this process, not the hook process: the hook only receives paths and
+	 * config, so it has no model registry and no credentials to call anything with.
+	 *
+	 * Deliberately best-effort — a disabled setting, a missing credential, a timeout or
+	 * a nonsense answer all resolve to "no activation", which is precisely the
+	 * behaviour before this stage existed.
+	 */
+	async #routeWorkflowSemantically(text: string): Promise<void> {
+		if (!this.settings.get("decisions.enabled")) return;
+		if (detectPrimarySkillKeyword(text)) return; // deterministic stage already decided
+		try {
+			this.#semanticSkillRouter ??= createSemanticSkillRouter(
+				createDecisionService({
+					registry: this.#modelRegistry,
+					settings: this.settings,
+					sessionId: this.sessionManager.getSessionId(),
+					enabled: true,
+				}),
+			);
+			const skill = await this.#semanticSkillRouter(text);
+			if (!skill) return;
+			await ensureWorkflowSkillActivationState({
+				cwd: this.sessionManager.getCwd(),
+				skill,
+				sessionId: this.sessionManager.getSessionId(),
+			});
+			this.#attachAskTool();
+		} catch (error) {
+			logger.debug("agent-session: semantic workflow routing failed", { error: String(error) });
+		}
+	}
+
 	async prompt(text: string, options?: PromptOptions): Promise<void> {
 		this.#assertRecoveryHydrationPromoted();
 		const expandPromptTemplates = options?.expandPromptTemplates ?? true;
@@ -7606,6 +7650,12 @@ export class AgentSession {
 		const deepInterviewUserIntentEpoch =
 			claimsGenuineUserIntent && !this.isStreaming ? this.#claimDeepInterviewUserIntent() : undefined;
 
+		// The keyword table in `hooks/skill-keywords.ts` is thirteen literal strings, so a
+		// Korean phrasing of "plan this before you touch code" activates nothing. Ask a
+		// cheap model only when the deterministic stage found nothing, and only for real
+		// user turns. Any failure leaves routing to the system prompt, exactly as before.
+		if (claimsGenuineUserIntent && !this.isStreaming) await this.#routeWorkflowSemantically(expandedText);
+
 		// If streaming, queue via steer() or followUp() based on option
 		if (this.isStreaming) {
 			if (!options?.streamingBehavior) {

package/src/setup/decision-provider.ts

@@ -0,0 +1,94 @@
+/**
+ * Store a TypeSafe key so the typed-decision service can use the hosted model.
+ *
+ * TypeSafe is **not** a chat provider: no streaming, no messages, no text output. So it
+ * must not be written into `models.yml` the way `addApiCompatibleProvider` writes
+ * OpenAI-compatible endpoints — that would invent a chat model that cannot answer a
+ * chat request and would show up in the model picker as something users could select.
+ *
+ * Only the credential is stored. The decision backend reads it through the same
+ * `getApiKeyForProvider` path every other provider uses, so adding a key turns the
+ * backend on and removing it turns the backend off, with nothing else to configure.
+ */
+import { AuthStorage } from "@sayknow-cli/ai";
+import { getAgentDbPath } from "@sayknow-cli/utils";
+import { TYPESAFE_PROVIDER } from "../decisions";
+
+const VERIFY_ENDPOINT = "https://api.typesafe.ai/v1/models";
+const VERIFY_TIMEOUT_MS = 10_000;
+
+export interface TypeSafeKeySetupResult {
+	provider: string;
+	verified: boolean;
+	/** Present when verification ran and failed; the key is not stored in that case. */
+	error?: string;
+}
+
+/**
+ * Verify a key against the live API before storing it.
+ *
+ * Storing an unverified key is worse than refusing it: the decision service fails open,
+ * so a bad key produces no error anywhere — it silently falls back to the user's own
+ * model forever, and the user believes TypeSafe is active.
+ */
+export async function verifyTypeSafeKey(apiKey: string, fetchImpl: typeof fetch = fetch): Promise<string | null> {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), VERIFY_TIMEOUT_MS);
+	try {
+		const response = await fetchImpl(VERIFY_ENDPOINT, {
+			headers: { Authorization: `Bearer ${apiKey}` },
+			signal: controller.signal,
+		});
+		if (response.ok) return null;
+		if (response.status === 401 || response.status === 403) return "key rejected by TypeSafe (401/403)";
+		return `TypeSafe returned ${response.status}`;
+	} catch (error) {
+		return `could not reach TypeSafe: ${error instanceof Error ? error.message : String(error)}`;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+export interface SetTypeSafeKeyOptions {
+	apiKey: string;
+	/** Skip the live check. Only for offline setup; the key may be wrong. */
+	skipVerify?: boolean;
+	fetchImpl?: typeof fetch;
+	dbPath?: string;
+}
+
+export async function setTypeSafeKey(options: SetTypeSafeKeyOptions): Promise<TypeSafeKeySetupResult> {
+	const apiKey = options.apiKey.trim();
+	if (!apiKey) throw new Error("TypeSafe API key must not be empty");
+
+	let verified = false;
+	if (!options.skipVerify) {
+		const failure = await verifyTypeSafeKey(apiKey, options.fetchImpl ?? fetch);
+		if (failure) return { provider: TYPESAFE_PROVIDER, verified: false, error: failure };
+		verified = true;
+	}
+
+	const authStorage = await AuthStorage.create(options.dbPath ?? getAgentDbPath());
+	try {
+		await authStorage.set(TYPESAFE_PROVIDER, { type: "api_key", key: apiKey });
+	} finally {
+		authStorage.close();
+	}
+	return { provider: TYPESAFE_PROVIDER, verified };
+}
+
+export async function removeTypeSafeKey(dbPath?: string): Promise<void> {
+	const authStorage = await AuthStorage.create(dbPath ?? getAgentDbPath());
+	try {
+		await authStorage.remove(TYPESAFE_PROVIDER);
+	} finally {
+		authStorage.close();
+	}
+}
+
+export function formatTypeSafeKeyResult(result: TypeSafeKeySetupResult): string {
+	if (result.error) return `✗ TypeSafe key not stored: ${result.error}`;
+	return result.verified
+		? "✓ TypeSafe key verified and stored. Typed decisions will use the hosted model."
+		: "✓ TypeSafe key stored (unverified). Typed decisions will try the hosted model.";
+}