@visual-z/xeno 0.8.3 → 0.9.0

package/src/runtime/auth.ts

@@ -1,367 +0,0 @@
-/**
- * Where a credential comes from.
- *
- * The difficulty here is entirely in the priority, not in the reading, so the
- * reading is injected: `env` and `run` are parameters. That is what lets the
- * one rule that actually bites be pinned by a test that touches no
- * environment and no keychain --
- *
- *   A STORED CREDENTIAL OWNS ITS PROVIDER. The environment is consulted only
- *   when nothing is stored, and never as a fallback after a stored entry
- *   fails to resolve. Otherwise someone edits `auth.json`, sees no change,
- *   and has no way to discover that a forgotten `export` from months ago is
- *   still winning. pi states this rule outright in its resolver; it is worth
- *   copying verbatim.
- *
- * The order is command line, auth.json, models.json, then the environment.
- */
-
-import { assertNever } from "../core/exhaustive.ts";
-import type { ModelSpec } from "./model.ts";
-import { providerAccess } from "./provider-access.ts";
-import { SOURCE_PROVIDERS } from "./model-data.ts";
-import {
-  refreshOAuthCredential,
-  GROK_PROVIDER, GROK_BASE_URL,
-  type OAuthCredential,
-  type RefreshEffects,
-} from "./oauth.ts";
-
-export type KeyValue =
-  | { kind: "literal"; value: string }
-  | { kind: "command"; command: string }
-  | { kind: "interpolate"; template: string };
-
-export type StoredCredential =
-  | { type: "api_key"; key: string }
-  | OAuthCredential;
-
-export interface AuthFile {
-  [provider: string]: StoredCredential | undefined;
-}
-
-export function storedIsOAuth(stored: AuthFile, provider: string): boolean {
-  const entry = storedCredential(stored, provider);
-  return entry !== undefined && entry.type === "oauth";
-}
-
-function storedCredential(stored: AuthFile, provider: string): StoredCredential | undefined {
-  // Earlier xeno stored Codex subscriptions under openai. Only OAuth gets this read-compatible alias;
-  // API keys and explicit native records retain their own provider and billing account.
-  return stored[provider] ?? (provider === "openai-codex" && stored["openai"]?.type === "oauth" ? stored["openai"] : undefined);
-}
-
-export type Resolved =
-  | { ok: true; key: string; source: "flag" | "auth.json" | "models.json" | "environment" | "ambient" }
-  | { ok: false; reason: string };
-
-/** The two effects resolution needs, injected so the rules stay testable. */
-export interface ResolveEffects {
-  env(name: string): string | undefined;
-  run(command: string): string;
-}
-
-/**
- * Which of the three forms a configured key value is.
- *
- * A plain uppercase string is a LITERAL, not a variable name. That choice
- * matters: a provider whose key really is `public` or `ollama` is common, and
- * guessing that an uppercase word means a lookup would break those silently.
- * `$` marks a lookup, and nothing else does.
- */
-export function parseKeyValue(raw: string): KeyValue {
-  if (raw.startsWith("!")) return { kind: "command", command: raw.slice(1) };
-  // The escapes are checked before interpolation so a key that genuinely
-  // begins with `$` or `!` can be written down at all.
-  if (raw.startsWith("$$")) return { kind: "literal", value: `$${raw.slice(2)}` };
-  if (raw.startsWith("$!")) return { kind: "literal", value: `!${raw.slice(2)}` };
-  if (raw.includes("$")) return { kind: "interpolate", template: raw };
-  return { kind: "literal", value: raw };
-}
-
-/** `$FOO_BAR` is the variable FOO_BAR; `${FOO}_BAR` is FOO followed by literal text. */
-const VARIABLE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g;
-
-export function resolveKeyValue(
-  raw: string,
-  fx: ResolveEffects,
-): { ok: true; key: string } | { ok: false; reason: string } {
-  const parsed = parseKeyValue(raw);
-  switch (parsed.kind) {
-    case "literal":
-      return { ok: true, key: parsed.value };
-
-    case "command": {
-      let out: string;
-      try {
-        out = fx.run(parsed.command);
-      } catch (err) {
-        return { ok: false, reason: `key command failed: ${(err as Error).message}` };
-      }
-      // Every CLI that prints a secret prints a newline after it, and a key
-      // with a trailing newline is rejected by the API as malformed.
-      const key = out.trim();
-      if (key.length === 0) {
-        return { ok: false, reason: `key command produced no output: ${parsed.command}` };
-      }
-      return { ok: true, key };
-    }
-
-    case "interpolate": {
-      const missing: string[] = [];
-      const key = parsed.template.replace(VARIABLE, (_whole, braced?: string, bare?: string) => {
-        const name = braced ?? bare ?? "";
-        const value = fx.env(name);
-        if (value === undefined || value.length === 0) {
-          missing.push(name);
-          return "";
-        }
-        return value;
-      });
-      // Unresolved is NOT the empty string. An empty key looks legal, gets
-      // sent, and comes back as a 401 that says nothing about the real
-      // mistake -- which is that a variable was never exported.
-      if (missing.length > 0) {
-        return { ok: false, reason: `unset environment variable: ${missing.join(", ")}` };
-      }
-      return { ok: true, key };
-    }
-
-    default: {
-      const never: never = parsed;
-      throw new Error(`unreachable key value: ${JSON.stringify(never)}`);
-    }
-  }
-}
-
-/** Per-provider variables resolve lazily, so order cannot change their meaning or mutate process.env. */
-export function providerEnvironment(spec: ModelSpec, fx: ResolveEffects): { env: Record<string, string>; effects: ResolveEffects } {
-  const configured = providerAccess(spec).env ?? {};
-  const env: Record<string, string> = {};
-  const resolving = new Set<string>();
-  const lookup = (name: string): string | undefined => {
-    if (Object.hasOwn(env, name)) return env[name];
-    const raw = configured[name];
-    if (raw === undefined) return fx.env(name);
-    if (resolving.has(name)) throw new Error(`${spec.provider} env.${name}: cyclic variable reference`);
-    resolving.add(name);
-    try {
-      const got = resolveKeyValue(raw, { ...fx, env: lookup });
-      if (!got.ok) throw new Error(`${spec.provider} env.${name}: could not resolve configured value`);
-      env[name] = got.key;
-      return got.key;
-    } finally { resolving.delete(name); }
-  };
-  for (const name of Object.keys(configured)) lookup(name);
-  const aliases: Record<string, readonly string[]> = {
-    AZURE_OPENAI_API_KEY: ["AZURE_API_KEY"], AZURE_OPENAI_RESOURCE_NAME: ["AZURE_RESOURCE_NAME"], AZURE_OPENAI_BASE_URL: ["AZURE_BASE_URL"],
-    GOOGLE_CLOUD_PROJECT: ["GOOGLE_VERTEX_PROJECT", "GCLOUD_PROJECT"], GOOGLE_CLOUD_LOCATION: ["GOOGLE_VERTEX_LOCATION"],
-  };
-  for (const [target, sources] of Object.entries(aliases)) {
-    const value = lookup(target) ?? sources.map(lookup).find(Boolean);
-    if (value) env[target] = value;
-  }
-  return { env, effects: { ...fx, env: lookup } };
-}
-
-function configuredEffects(spec: ModelSpec, fx: ResolveEffects): { ok: true; effects: ResolveEffects } | { ok: false; reason: string } {
-  if (providerAccess(spec).invalid) return { ok: false, reason: providerAccess(spec).invalid! };
-  try {
-    const scoped = providerEnvironment(spec, fx).effects;
-    if (spec.provider === GROK_PROVIDER && spec.baseUrl?.replace(/\/$/, "") !== GROK_BASE_URL) {
-      return { ok: false, reason: "Grok account tokens require the official inference proxy" };
-    }
-    const access = providerAccess(spec);
-    if (["google-generative-ai", "google-vertex"].includes(spec.api) && (access.auth === false || access.authHeader === false || typeof access.authHeader === "string")) {
-      return { ok: false, reason: `${spec.api} owns API-key authentication; use apiKey or an OpenAI-compatible local endpoint` };
-    }
-    if (!spec.baseUrl && !["anthropic-messages", "google-generative-ai", "google-vertex", "bedrock-converse-stream", "azure-openai-responses"].includes(spec.api)) {
-      return { ok: false, reason: `${spec.provider}: configure baseUrl for ${spec.api}` };
-    }
-    if (spec.baseUrl?.includes("$")) {
-      const endpoint = resolveKeyValue(spec.baseUrl, scoped);
-      if (!endpoint.ok) return { ok: false, reason: `${spec.provider} baseUrl: ${endpoint.reason}` };
-    }
-    if (spec.api === "azure-openai-responses" && !spec.baseUrl && !scoped.env("AZURE_OPENAI_BASE_URL") && !scoped.env("AZURE_OPENAI_RESOURCE_NAME")) {
-      return { ok: false, reason: `${spec.provider}: configure baseUrl or AZURE_OPENAI_RESOURCE_NAME` };
-    }
-    return { ok: true, effects: scoped };
-  } catch (err) { return { ok: false, reason: err instanceof Error ? err.message : "could not resolve provider environment" }; }
-}
-
-export function resolveCredential(
-  spec: ModelSpec,
-  stored: AuthFile,
-  flagKey: string | undefined,
-  fx: ResolveEffects,
-): Resolved {
-  const access = providerAccess(spec);
-  const configured = configuredEffects(spec, fx);
-  if (!configured.ok) return configured;
-  fx = configured.effects;
-  if (flagKey !== undefined && flagKey.length > 0) {
-    const got = resolveKeyValue(flagKey, fx);
-    return got.ok ? { ok: true, key: got.key, source: "flag" } : got;
-  }
-
-  const entry = storedCredential(stored, spec.provider);
-  if (entry !== undefined) {
-    // Deliberately no fallback to the environment on failure. See the header.
-    if (entry.type === "oauth") {
-      if (spec.provider === "openai" && spec.api !== "openai-codex-responses") return { ok: false, reason: "ChatGPT OAuth belongs to openai-codex; choose an openai-codex model or configure an OpenAI API key" };
-      return { ok: true, key: entry.access, source: "auth.json" };
-    }
-    if (entry.type === "api_key") {
-      const got = resolveKeyValue(entry.key, fx);
-      return got.ok
-        ? { ok: true, key: got.key, source: "auth.json" }
-        : { ok: false, reason: `${spec.provider} in auth.json: ${got.reason}` };
-    }
-    return assertNever(entry, "stored credential");
-  }
-
-  if (access.apiKey !== undefined) {
-    const got = resolveKeyValue(access.apiKey, fx);
-    return got.ok ? { ok: true, key: got.key, source: "models.json" }
-      : { ok: false, reason: `${spec.provider} in models.json: could not resolve apiKey` };
-  }
-  if (access.auth === false || access.authHeader === false) return { ok: true, key: "", source: "models.json" };
-  if (access.auth === "ambient") {
-    if (spec.api !== "bedrock-converse-stream" && spec.api !== "google-vertex") return { ok: false, reason: `${spec.api} does not support ambient credentials` };
-    if (spec.api === "google-vertex" && (!fx.env("GOOGLE_CLOUD_PROJECT") || !fx.env("GOOGLE_CLOUD_LOCATION"))) return { ok: false, reason: `${spec.provider}: ambient Vertex authentication requires GOOGLE_CLOUD_PROJECT and GOOGLE_CLOUD_LOCATION` };
-    return { ok: true, key: "", source: "ambient" };
-  }
-  for (const variable of envVarsOf(spec.provider, spec.credentialEnv)) {
-    const value = fx.env(variable);
-    if (value !== undefined && value.length > 0) {
-      return { ok: true, key: value, source: "environment" };
-    }
-  }
-
-  if (spec.api === "bedrock-converse-stream" && (fx.env("AWS_PROFILE")
-      || (fx.env("AWS_ACCESS_KEY_ID") && fx.env("AWS_SECRET_ACCESS_KEY"))
-      || fx.env("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") || fx.env("AWS_CONTAINER_CREDENTIALS_FULL_URI") || fx.env("AWS_WEB_IDENTITY_TOKEN_FILE"))) {
-    return { ok: true, key: "", source: "ambient" };
-  }
-  if (spec.api === "google-vertex" && fx.env("GOOGLE_APPLICATION_CREDENTIALS")
-      && (fx.env("GOOGLE_CLOUD_PROJECT") || fx.env("GOOGLE_VERTEX_PROJECT") || fx.env("GCLOUD_PROJECT"))
-      && (fx.env("GOOGLE_CLOUD_LOCATION") || fx.env("GOOGLE_VERTEX_LOCATION"))) return { ok: true, key: "", source: "ambient" };
-
-  return { ok: false, reason: describeMissingCredential(spec.provider) };
-}
-
-/**
- * Environment variable each provider reads. Same names pi uses, so a machine
- * already set up for one works for the other without re-exporting anything.
- */
-export const ENV_VAR: Readonly<Record<string, string | readonly string[]>> = {
-  anthropic: "ANTHROPIC_API_KEY",
-  openai: "OPENAI_API_KEY",
-  google: ["GOOGLE_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY", "GEMINI_API_KEY"],
-  deepseek: "DEEPSEEK_API_KEY",
-  xai: "XAI_API_KEY",
-  groq: "GROQ_API_KEY",
-  cerebras: "CEREBRAS_API_KEY",
-  mistral: "MISTRAL_API_KEY",
-  openrouter: "OPENROUTER_API_KEY",
-  zai: "ZHIPU_API_KEY",
-  moonshotai: "MOONSHOT_API_KEY",
-  together: "TOGETHER_API_KEY",
-  "amazon-bedrock": "AWS_BEARER_TOKEN_BEDROCK",
-  "azure-openai-responses": ["AZURE_OPENAI_API_KEY", "AZURE_API_KEY"],
-  "google-vertex": "GOOGLE_CLOUD_API_KEY",
-  "kimi-coding": ["KIMI_CODING_API_KEY", "KIMI_API_KEY"],
-  "openai-codex": "OPENAI_CODEX_ACCESS_TOKEN",
-  "xai-grok": "GROK_ACCESS_TOKEN",
-  "ant-ling": "ANT_LING_API_KEY",
-  "qwen-token-plan": "QWEN_TOKEN_PLAN_API_KEY",
-  "qwen-token-plan-cn": "QWEN_TOKEN_PLAN_CN_API_KEY",
-  "qwen-token-plan-individual": "QWEN_TOKEN_PLAN_API_KEY",
-  "vercel-ai-gateway": "AI_GATEWAY_API_KEY",
-  "zai-coding-cn": "ZAI_CODING_CN_API_KEY",
-  "fireworks": "FIREWORKS_API_KEY",
-  "typesafe": "TYPESAFE_API_KEY",
-  "radius": "RADIUS_API_KEY",
-  "opencode-go": "OPENCODE_API_KEY",
-};
-
-export function envVarsOf(provider: string, additional: readonly string[] = []): readonly string[] {
-  const v = ENV_VAR[provider];
-  // A provider name is free text in a user catalog; an environment variable
-  // is not. `kimi-coding` must become KIMI_CODING, or no shell can set it.
-  const declared = [...additional, ...(SOURCE_PROVIDERS[provider]?.env ?? [])].filter(name => /(?:API_KEY|TOKEN|_KEY)$/.test(name)
-    && !/(?:SECRET_ACCESS_KEY|ACCESS_KEY_ID|RESOURCE|PROJECT|LOCATION)/.test(name));
-  const known = typeof v === "string" ? [v] : v ?? [];
-  const names = [...new Set([...known, ...declared])];
-  return names.length ? names : [`${provider.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`];
-}
-
-export function envLabel(provider: string): string {
-  return envVarsOf(provider).join(" or ");
-}
-
-/**
- * What to say when there is no credential.
- *
- * Both routes, named concretely. The failure a person hits on first run
- * should carry its own fix; sending them to read the docs for something this
- * small is the difference between trying the tool and closing it.
- */
-export function describeMissingCredential(provider: string): string {
-  const subscription = provider === "openai-codex" ? "codex" : provider === GROK_PROVIDER ? "grok" : provider === "github-copilot" ? "github-copilot" : undefined;
-  if (subscription) return `no credential for ${provider}. Run /provider ${subscription} to sign in, or export ${envLabel(provider)}`;
-  return (
-    `no credential for ${provider}. Run /provider ${provider} to add a key, ` +
-    `or export ${envLabel(provider)}`
-  );
-}
-
-export interface FreshEffects extends RefreshEffects {
-  persist: (auth: AuthFile) => Promise<void>;
-}
-
-/**
- * Resolve, refreshing an expired OAuth access token first.
- *
- * A dead refresh fails here and names `/provider <provider>`. It does not fall
- * through to the environment: that is the same rule as a stored API key that
- * cannot resolve. Otherwise a forgotten export quietly starts billing a
- * different account.
- */
-export async function ensureFreshCredential(
-  spec: ModelSpec,
-  stored: AuthFile,
-  flagKey: string | undefined,
-  fx: ResolveEffects,
-  oauth: FreshEffects,
-): Promise<Resolved> {
-  const configured = configuredEffects(spec, fx);
-  if (!configured.ok) return configured;
-  if (flagKey !== undefined && flagKey.length > 0) {
-    return resolveCredential(spec, stored, flagKey, fx);
-  }
-  const entry = storedCredential(stored, spec.provider);
-  if (entry !== undefined && entry.type === "oauth") {
-    const resolved = resolveCredential(spec, stored, flagKey, fx);
-    if (!resolved.ok) return resolved;
-    if (oauth.now() < entry.expires) {
-      return { ok: true, key: entry.access, source: "auth.json" };
-    }
-    const refreshOpts: RefreshEffects = {
-      fetch: oauth.fetch,
-      now: oauth.now,
-    };
-    if (oauth.signal !== undefined) refreshOpts.signal = oauth.signal;
-    const refreshed = await refreshOAuthCredential(spec.provider, entry, refreshOpts);
-    if (!refreshed.ok) {
-      return {
-        ok: false,
-        reason: `${spec.provider} OAuth expired. Run /provider ${spec.provider} to sign in again.`,
-      };
-    }
-    const next: AuthFile = { ...stored, [spec.provider]: refreshed.credential };
-    await oauth.persist(next);
-    return { ok: true, key: refreshed.credential.access, source: "auth.json" };
-  }
-  return resolveCredential(spec, stored, flagKey, fx);
-}

package/src/runtime/blind-check.ts

@@ -1,36 +0,0 @@
-/**
- * Running blind checks (feat-blind-checks): in a disposable clone of the
- * final workspace, with the blind files copied in under `.xeno-blind/`. The
- * files are verified against the digests frozen when the session began, so a
- * directory edited since then is reported rather than silently run.
- */
-import { cp, readFile } from "node:fs/promises";
-import { join } from "node:path";
-import type { BlindChecks } from "../core/blind-checks.ts";
-import { observeCommand } from "../store/command.ts";
-import { cloneWorkspace } from "../store/workspace-clone.ts";
-import { blobAddress } from "../store/blobs.ts";
-
-export type BlindCheckResult = { id: string; command: string } & ({ exit: number } | { reason: string });
-
-export async function runBlindChecks(input: { root: string; blind: BlindChecks; timeoutMs: number; maxOutputBytes: number;
-  outputStore: string; signal?: AbortSignal }): Promise<BlindCheckResult[]> {
-  const checks = input.blind.manifest.checks.map(check => ({ id: check.id, command: check.command }));
-  const unavailable = (reason: string) => checks.map(check => ({ ...check, reason }));
-  for (const [path, sha] of Object.entries(input.blind.files)) {
-    const bytes = await readFile(join(input.blind.dir, path)).catch(() => null);
-    if (bytes === null || blobAddress(bytes) !== sha) return unavailable(`blind check file ${path} changed or disappeared since the session began`);
-  }
-  const clone = await cloneWorkspace(input.root, input.signal);
-  if (!clone.ok) return unavailable(clone.reason);
-  try {
-    await cp(input.blind.dir, join(clone.path, ".xeno-blind"), { recursive: true });
-    const results: BlindCheckResult[] = [];
-    for (const check of checks) {
-      const captured = await observeCommand({ command: check.command, cwd: clone.path, outputStore: input.outputStore,
-        maxOutputBytes: input.maxOutputBytes, timeoutMs: input.timeoutMs, ...(input.signal ? { signal: input.signal } : {}) });
-      results.push(captured.stopped ? { ...check, reason: `the check did not finish (${captured.stopped})` } : { ...check, exit: captured.exit });
-    }
-    return results;
-  } finally { await clone.dispose(); }
-}

package/src/runtime/branch-jobs.ts

@@ -1,36 +0,0 @@
-/** O.14: volatile ownership, never a replacement for the durable branch log. */
-export class BranchJobs<T> {
-  private readonly jobs = new Map<number, { controller: AbortController; done: Promise<void>; value?: T; error?: string; detach(): void; ready: boolean }>();
-
-  get active(): number { return [...this.jobs.values()].filter(job => !job.ready).length; }
-  state(node: number): "running" | "ready" | undefined {
-    const job = this.jobs.get(node); return job ? job.ready ? "ready" : "running" : undefined;
-  }
-  nodes(): number[] { return [...this.jobs.keys()]; }
-  start(node: number, controller: AbortController, run: () => Promise<T>, detach: () => void): void {
-    if (this.jobs.has(node)) throw new Error("branch already owned");
-    const job: { controller: AbortController; done: Promise<void>; value?: T; error?: string; detach(): void; ready: boolean } = {
-      controller, ready: false, detach, done: Promise.resolve(),
-    };
-    this.jobs.set(node, job);
-    job.done = run().then(value => { job.value = value; }, () => { job.error = "branch finalization failed; inspect its original log"; })
-      .finally(() => { job.ready = true; job.detach(); });
-  }
-  cancel(node?: number): void {
-    for (const [id, job] of this.jobs) if (node === undefined || node === id) job.controller.abort();
-  }
-  async drain(node?: number): Promise<void> { await Promise.all([...this.jobs].filter(([id]) => node === undefined || node === id).map(([, job]) => job.done)); }
-  async wait(node: number, ms: number): Promise<{ value?: T; error?: string; running: boolean } | undefined> {
-    const job = this.jobs.get(node); if (!job) return undefined;
-    if (!Number.isFinite(ms) || ms < 0 || ms > 60_000) throw new RangeError("wait_ms must be between 0 and 60000");
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    try {
-      if (!job.ready && ms > 0) await Promise.race([job.done, new Promise<void>(resolve => { timer = setTimeout(resolve, ms); })]);
-    } finally { clearTimeout(timer); }
-    return { ...(job.value !== undefined ? { value: job.value } : {}), ...(job.error ? { error: job.error } : {}), running: !job.ready };
-  }
-  forget(node: number): void {
-    if (this.state(node) === "running") throw new Error("cannot forget a running branch");
-    this.jobs.delete(node);
-  }
-}