@securecoms/agent-runtime 0.5.0 → 0.6.0

package/dist/bin.js

@@ -440,10 +440,16 @@ var LLMDispatcher = class {
   endpoint;
   model;
   apiKey;
+  chatPath;
+  chatAuth;
+  authHeaderName;
   constructor(endpoint, model, opts = {}) {
     this.endpoint = normalizeEndpoint(endpoint);
     this.model = model;
     this.apiKey = opts.apiKey;
+    this.chatPath = opts.chatPath ?? "/v1/chat/completions";
+    this.chatAuth = opts.chatAuth ?? "bearer";
+    this.authHeaderName = opts.authHeaderName ?? "x-api-key";
   }
   async complete(messages, tools) {
     const body = {
@@ -454,10 +460,12 @@ var LLMDispatcher = class {
     if (tools && tools.length > 0) {
       body.tools = tools;
     }
-    const url = `${this.endpoint}/v1/chat/completions`;
+    const url = `${this.endpoint}${this.chatPath}`;
     const headers = { "Content-Type": "application/json" };
-    if (this.apiKey) {
+    if (this.apiKey && this.chatAuth === "bearer") {
       headers.Authorization = `Bearer ${this.apiKey}`;
+    } else if (this.apiKey && this.chatAuth === "x-api-key") {
+      headers[this.authHeaderName] = this.apiKey;
     }
     const resp = await fetch(url, {
       method: "POST",
@@ -486,10 +494,13 @@ import { join as join2 } from "node:path";
 
 // src/llm-providers.json
 var llm_providers_default = {
-  openrouter: { chat_base: "https://openrouter.ai/api/v1", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", needs_key: true },
-  anthropic: { chat_base: "https://openrouter.ai/api/v1", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", needs_key: true },
-  openai: { chat_base: "https://api.openai.com/v1", models_url: "https://api.openai.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.openai.com/v1/models", needs_key: true },
-  local: { chat_base: "http://127.0.0.1:11434", models_url: "http://127.0.0.1:11434/api/tags", models_id_path: "models[].name", validate_url: null, needs_key: false }
+  openrouter: { chat_base: "https://openrouter.ai/api/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://openrouter.ai/api/v1/models", models_id_path: "data[].id", validate_url: "https://openrouter.ai/api/v1/key", probe_auth: "bearer", extra_headers: null, catalog_prefix: "self", needs_key: true },
+  openai: { chat_base: "https://api.openai.com/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.openai.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.openai.com/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "openai/", needs_key: true },
+  anthropic: { chat_base: "https://api.anthropic.com/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.anthropic.com/v1/models", models_id_path: "data[].id", validate_url: "https://api.anthropic.com/v1/models", probe_auth: "x-api-key", extra_headers: { "anthropic-version": "2023-06-01" }, catalog_prefix: "anthropic/", needs_key: true },
+  gemini: { chat_base: "https://generativelanguage.googleapis.com/v1beta/openai", chat_path: "/chat/completions", chat_auth: "bearer", models_url: "https://generativelanguage.googleapis.com/v1beta/openai/models", models_id_path: "data[].id", validate_url: "https://generativelanguage.googleapis.com/v1beta/openai/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "google/", needs_key: true },
+  meta: { chat_base: "https://api.meta.ai/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.meta.ai/v1/models", models_id_path: "data[].id", validate_url: "https://api.meta.ai/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: null, needs_key: true },
+  xai: { chat_base: "https://api.x.ai/v1", chat_path: "/v1/chat/completions", chat_auth: "bearer", models_url: "https://api.x.ai/v1/models", models_id_path: "data[].id", validate_url: "https://api.x.ai/v1/models", probe_auth: "bearer", extra_headers: null, catalog_prefix: "x-ai/", needs_key: true },
+  local: { chat_base: "http://127.0.0.1:11434", chat_path: "/v1/chat/completions", chat_auth: "none", models_url: "http://127.0.0.1:11434/api/tags", models_id_path: "models[].name", validate_url: null, probe_auth: "none", extra_headers: null, catalog_prefix: null, needs_key: false }
 };
 
 // src/llm-key.ts
@@ -513,7 +524,12 @@ function resolveLlmApiKey(cfg, readFile) {
 
 // src/llm-source.ts
 var PROVIDER_TABLE = Object.freeze(Object.fromEntries(
-  Object.entries(llm_providers_default).map(([p, e]) => [p, Object.freeze({ endpoint: e.chat_base, needsKey: e.needs_key })])
+  Object.entries(llm_providers_default).map(([p, e]) => [p, Object.freeze({
+    endpoint: e.chat_base,
+    needsKey: e.needs_key,
+    chatPath: e.chat_path,
+    chatAuth: e.chat_auth
+  })])
 ));
 var LlmSourceUnavailableError = class extends Error {
 };
@@ -523,6 +539,9 @@ function providerOrigin(provider) {
   const u = new URL(entry.endpoint);
   return `${u.protocol}//${u.host}`.toLowerCase();
 }
+function providerSlug(provider) {
+  return providerOrigin(provider).replace("://", "_").replace(/:/g, "-");
+}
 var explicitEndpointSet = (env) => Boolean(env.SECURECOMS_LLM_ENDPOINT || env.SECURECOMS_LLM_API_KEY_FILE || env.SECURECOMS_LLM_API_KEY);
 function isExplicitSource(cfg, env) {
   return explicitEndpointSet(env) || Boolean(cfg.llmApiKeyFile) || Boolean(cfg.llmApiKey);
@@ -539,7 +558,9 @@ function resolveLlmSource(cfg, explicit, deps) {
       model: cfg.llmModel,
       apiKey: resolveLlmApiKey(cfg, deps.readFile),
       provider: "env",
-      origin: "env"
+      origin: "env",
+      chatPath: "/v1/chat/completions",
+      chatAuth: "bearer"
     };
   }
   const managedDir = join2(deps.home, ".securecoms", "runtime-config", cfg.identityId);
@@ -567,6 +588,11 @@ function resolveLlmSource(cfg, explicit, deps) {
     if (typeof provider !== "string" || typeof model !== "string") {
       throw new LlmSourceUnavailableError(`${sourcePath} is missing "provider" or "model"`);
     }
+    if (!Object.hasOwn(llm_providers_default, provider)) {
+      throw new LlmSourceUnavailableError(
+        `unknown LLM provider ${JSON.stringify(provider)} in ${sourcePath}`
+      );
+    }
     const entry = PROVIDER_TABLE[provider];
     if (!entry) {
       throw new LlmSourceUnavailableError(
@@ -575,53 +601,63 @@ function resolveLlmSource(cfg, explicit, deps) {
     }
     let apiKey;
     if (entry.needsKey) {
-      const keyPath = join2(managedDir, "llm.key");
-      const hostPath = join2(managedDir, "llm.key.host");
-      if (!deps.exists(keyPath)) {
+      const expectedOrigin = providerOrigin(provider);
+      const slug = providerSlug(provider);
+      const keyPath = join2(managedDir, `llm.key.${slug}`);
+      const hostPath = join2(managedDir, `llm.key.${slug}.host`);
+      const legacyKey = join2(managedDir, "llm.key");
+      const legacyHost = join2(managedDir, "llm.key.host");
+      const useLegacy = !deps.exists(keyPath) && deps.exists(legacyKey) && deps.exists(legacyHost);
+      const boundKey = useLegacy ? legacyKey : keyPath;
+      const boundHost = useLegacy ? legacyHost : hostPath;
+      if (!deps.exists(boundKey)) {
         throw new LlmSourceUnavailableError(
           `${keyPath} does not exist \u2014 no key has been written for this managed source, refusing to read it`
         );
       }
       let mode;
       try {
-        ({ mode } = deps.statFile(keyPath));
+        ({ mode } = deps.statFile(boundKey));
       } catch (e) {
         throw new LlmSourceUnavailableError(
-          `cannot stat ${keyPath}: ${e instanceof Error ? e.message : String(e)}`
+          `cannot stat ${boundKey}: ${e instanceof Error ? e.message : String(e)}`
         );
       }
       if ((mode & 63) !== 0) {
         throw new LlmSourceUnavailableError(
-          `${keyPath} is readable by other users on this machine \u2014 tighten its permissions to owner-only`
+          `${boundKey} is readable by other users on this machine \u2014 tighten its permissions to owner-only`
         );
       }
-      const expectedOrigin = providerOrigin(provider);
-      if (!deps.exists(hostPath)) {
+      if (!deps.exists(boundHost)) {
         throw new LlmSourceUnavailableError(
-          `${keyPath} has no ${hostPath} sidecar recording which origin it belongs to \u2014 refusing to send it to ${expectedOrigin}`
+          `${boundKey} has no ${boundHost} sidecar recording which origin it belongs to \u2014 refusing to send it to ${expectedOrigin}`
         );
       }
-      const actualOrigin = deps.readFile(hostPath).trim();
+      const actualOrigin = deps.readFile(boundHost).trim();
       if (actualOrigin !== expectedOrigin) {
         throw new LlmSourceUnavailableError(
-          `${hostPath} is bound to ${actualOrigin}, but provider ${JSON.stringify(provider)} requires ${expectedOrigin} \u2014 refusing to send the key across origins`
+          `${boundHost} is bound to ${actualOrigin}, but provider ${JSON.stringify(provider)} requires ${expectedOrigin} \u2014 refusing to send the key across origins`
         );
       }
-      apiKey = resolveLlmApiKey({ llmApiKeyFile: keyPath }, deps.readFile);
+      apiKey = resolveLlmApiKey({ llmApiKeyFile: boundKey }, deps.readFile);
     }
     return {
       endpoint: entry.endpoint,
       model,
       ...apiKey !== void 0 ? { apiKey } : {},
       provider,
-      origin: "managed"
+      origin: "managed",
+      chatPath: entry.chatPath,
+      chatAuth: entry.chatAuth
     };
   }
   return {
     endpoint: cfg.llmEndpoint,
     model: cfg.llmModel,
     provider: "default",
-    origin: "default"
+    origin: "default",
+    chatPath: "/v1/chat/completions",
+    chatAuth: "bearer"
   };
 }
 
@@ -637,7 +673,11 @@ function buildLlmShim(cfg, explicit, deps) {
   return {
     async complete(messages, tools) {
       const src = resolveLlmSource(cfg, explicit, deps);
-      const dispatcher = new LLMDispatcher(src.endpoint, src.model, { apiKey: src.apiKey });
+      const dispatcher = new LLMDispatcher(src.endpoint, src.model, {
+        apiKey: src.apiKey,
+        chatPath: src.chatPath,
+        chatAuth: src.chatAuth
+      });
       return dispatcher.complete(messages, tools);
     }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@securecoms/agent-runtime",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "bin": {
     "securecoms-agent": "dist/bin.js"