@xfey/tutti 0.1.0

package/dist/providers/openai/chat-assistant.js

@@ -0,0 +1,72 @@
+import { CHAT_ASSISTANT_OUTPUT_SCHEMA, isChatAssistantOutput, } from "../../chat-assistant/index.js";
+import { readOpenAiApiKeyCredential } from "./credential-store.js";
+import { resolveOpenAiProviderConfig, } from "./provider-config.js";
+import { runCodexAppServerReadOnlyProcedure } from "./app-server/read-only-procedure.js";
+export function createOpenAiReadOnlyChatAssistantModel(options) {
+    return {
+        async answer(input) {
+            const result = await runCodexAppServerReadOnlyProcedure({
+                apiKey: options.apiKey,
+                workspaceRoot: options.workspaceRoot,
+                prompt: input.prompt,
+                outputSchema: CHAT_ASSISTANT_OUTPUT_SCHEMA,
+                validateOutput: isChatAssistantOutput,
+                defaultModel: options.config.default_model,
+                ...(options.config.api_base_url === undefined
+                    ? {}
+                    : { apiBaseUrl: options.config.api_base_url }),
+                networkAccess: true,
+                webSearchMode: "live",
+                skillSelectionName: "chat_assistant",
+                ...(options.tuttiHome === undefined ? {} : { tuttiHome: options.tuttiHome }),
+                ...(options.builtInSkillsRoot === undefined
+                    ? {}
+                    : { builtInSkillsRoot: options.builtInSkillsRoot }),
+                ...(options.agentContext === undefined ? {} : { agentContext: options.agentContext }),
+                ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
+                ...(options.requestTimeoutMs === undefined
+                    ? {}
+                    : { requestTimeoutMs: options.requestTimeoutMs }),
+                ...(options.turnTimeoutMs === undefined ? {} : { turnTimeoutMs: options.turnTimeoutMs }),
+                ...(options.baseEnv === undefined ? {} : { baseEnv: options.baseEnv }),
+            });
+            if (options.recordUsage !== undefined && result.usage !== undefined) {
+                options.recordUsage({
+                    provider: "openai",
+                    source: "chat_assistant",
+                    model: result.model,
+                    usage: result.usage,
+                });
+            }
+            return result.output;
+        },
+    };
+}
+export function resolveProjectOpenAiReadOnlyChatAssistantModel(options) {
+    const resolution = resolveOpenAiProviderConfig({
+        tuttiHome: options.tuttiHome,
+        projectId: options.projectId,
+    });
+    if (resolution.kind === "unavailable") {
+        return { kind: "not_configured" };
+    }
+    const config = resolution.config;
+    try {
+        const credential = readOpenAiApiKeyCredential(options.tuttiHome, options.projectId, config.credential_ref);
+        return {
+            kind: "ready",
+            model: createOpenAiReadOnlyChatAssistantModel({
+                config,
+                apiKey: credential.secret,
+                workspaceRoot: options.workspaceRoot,
+                tuttiHome: options.tuttiHome,
+                ...(options.agentContext === undefined ? {} : { agentContext: options.agentContext }),
+                ...(options.recordUsage === undefined ? {} : { recordUsage: options.recordUsage }),
+            }),
+        };
+    }
+    catch {
+        return { kind: "not_configured" };
+    }
+}
+//# sourceMappingURL=chat-assistant.js.map

package/dist/providers/openai/codex-app-server.d.ts

@@ -0,0 +1,126 @@
+export declare const CODEX_APP_SERVER_COMMAND: string;
+export declare const CODEX_APP_SERVER_LISTEN_URL: "stdio://";
+export declare const CODEX_APP_SERVER_CLIENT_NAME: "tutti_host";
+export declare const CODEX_APP_SERVER_CLIENT_TITLE: "Tutti Host";
+export type CodexAppServerSandboxMode = "read-only" | "workspace-write";
+export type CodexAppServerApprovalPolicy = "never" | "on-request" | "on-failure" | "untrusted";
+export type CodexAppServerConfigOverride = {
+    key: string;
+    value: string;
+};
+export type CodexAppServerProcessPlan = {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    transport: {
+        kind: "stdio";
+        listen_url: typeof CODEX_APP_SERVER_LISTEN_URL;
+    };
+};
+export type CodexAppServerRequestPlan<TMethod extends string, TParams> = {
+    method: TMethod;
+    params: TParams;
+};
+export type CodexAppServerNotificationPlan<TMethod extends string> = {
+    method: TMethod;
+};
+export type CodexAppServerInitializeRequestParams = {
+    clientInfo: {
+        name: typeof CODEX_APP_SERVER_CLIENT_NAME;
+        title: typeof CODEX_APP_SERVER_CLIENT_TITLE;
+        version: string;
+    };
+    capabilities: {
+        experimentalApi: false;
+    };
+};
+export type CodexAppServerThreadStartParams = {
+    cwd: string;
+    model: string;
+    approvalPolicy: CodexAppServerApprovalPolicy;
+    sandbox: CodexAppServerSandboxMode;
+    ephemeral: true;
+    experimentalRawEvents: false;
+    persistExtendedHistory: false;
+};
+export type CodexAppServerReadOnlyAccess = {
+    type: "restricted";
+    includePlatformDefaults: boolean;
+    readableRoots: string[];
+} | {
+    type: "fullAccess";
+};
+export type CodexAppServerSandboxPolicy = {
+    type: "readOnly";
+    access: CodexAppServerReadOnlyAccess;
+    networkAccess: boolean;
+} | {
+    type: "workspaceWrite";
+    writableRoots: string[];
+    readOnlyAccess: CodexAppServerReadOnlyAccess;
+    networkAccess: boolean;
+    excludeTmpdirEnvVar: boolean;
+    excludeSlashTmp: boolean;
+};
+export type CodexAppServerTextInput = {
+    type: "text";
+    text: string;
+    text_elements: [];
+};
+export type CodexAppServerTurnStartTemplateParams = {
+    input: [CodexAppServerTextInput];
+    cwd: string;
+    model: string;
+    approvalPolicy: CodexAppServerApprovalPolicy;
+    sandboxPolicy: CodexAppServerSandboxPolicy;
+    outputSchema: unknown;
+};
+export type CodexAppServerTurnStartTemplatePlan = {
+    method: "turn/start";
+    paramsWithoutThreadId: CodexAppServerTurnStartTemplateParams;
+    threadIdSource: "thread/start.response.thread.id";
+};
+export type BuildCodexAppServerProcessPlanOptions = {
+    codexHome: string;
+    configOverrides?: readonly CodexAppServerConfigOverride[];
+};
+export type CodexAppServerNoWriteSmokePlan = {
+    process: CodexAppServerProcessPlan;
+    initialize: CodexAppServerRequestPlan<"initialize", CodexAppServerInitializeRequestParams>;
+    initialized: CodexAppServerNotificationPlan<"initialized">;
+    threadStart: CodexAppServerRequestPlan<"thread/start", CodexAppServerThreadStartParams>;
+    turnStart: CodexAppServerTurnStartTemplatePlan;
+};
+export type CodexNoWriteSmokePlanOptions = {
+    workingDirectory: string;
+    codexHome: string;
+    prompt: string;
+    model?: string;
+    clientVersion?: string;
+    networkAccess?: boolean;
+    configOverrides?: readonly CodexAppServerConfigOverride[];
+};
+export declare const CODEX_NO_WRITE_SMOKE_OUTPUT_SCHEMA: {
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["ok", "summary"];
+    readonly properties: {
+        readonly ok: {
+            readonly type: "boolean";
+        };
+        readonly summary: {
+            readonly type: "string";
+        };
+    };
+};
+export declare function createCodexAppServerProcessEnv(options: {
+    codexHome: string;
+}): Record<string, string>;
+export declare function buildCodexAppServerProcessPlan(options: BuildCodexAppServerProcessPlanOptions): CodexAppServerProcessPlan;
+export declare function createCodexAppServerNoWriteSmokePlan(options: CodexNoWriteSmokePlanOptions): CodexAppServerNoWriteSmokePlan;
+export declare class CodexAppServerJsonlParseError extends Error {
+    readonly lineNumber: number;
+    constructor(lineNumber: number);
+}
+export declare function parseCodexAppServerJsonlMessages(stdout: string): unknown[];
+//# sourceMappingURL=codex-app-server.d.ts.map

package/dist/providers/openai/codex-app-server.js

@@ -0,0 +1,147 @@
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join } from "node:path";
+import { DEFAULT_OPENAI_MODEL } from "./model-config.js";
+const require = createRequire(import.meta.url);
+export const CODEX_APP_SERVER_COMMAND = join(dirname(require.resolve("@openai/codex/package.json")), "bin", "codex.js");
+export const CODEX_APP_SERVER_LISTEN_URL = "stdio://";
+export const CODEX_APP_SERVER_CLIENT_NAME = "tutti_host";
+export const CODEX_APP_SERVER_CLIENT_TITLE = "Tutti Host";
+export const CODEX_NO_WRITE_SMOKE_OUTPUT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["ok", "summary"],
+    properties: {
+        ok: { type: "boolean" },
+        summary: { type: "string" },
+    },
+};
+function assertAbsolutePath(value, field) {
+    if (!isAbsolute(value)) {
+        throw new Error(`${field} must be an absolute path`);
+    }
+}
+function assertNonEmpty(value, field) {
+    if (value.trim() === "") {
+        throw new Error(`${field} must be non-empty`);
+    }
+}
+function pushConfigOverrides(args, overrides) {
+    for (const override of overrides) {
+        assertNonEmpty(override.key, "config override key");
+        args.push("--config", `${override.key}=${override.value}`);
+    }
+}
+export function createCodexAppServerProcessEnv(options) {
+    assertAbsolutePath(options.codexHome, "codexHome");
+    return {
+        CODEX_HOME: options.codexHome,
+    };
+}
+export function buildCodexAppServerProcessPlan(options) {
+    const args = ["app-server", "--listen", CODEX_APP_SERVER_LISTEN_URL];
+    pushConfigOverrides(args, options.configOverrides ?? []);
+    return {
+        command: CODEX_APP_SERVER_COMMAND,
+        args,
+        env: createCodexAppServerProcessEnv({ codexHome: options.codexHome }),
+        transport: {
+            kind: "stdio",
+            listen_url: CODEX_APP_SERVER_LISTEN_URL,
+        },
+    };
+}
+export function createCodexAppServerNoWriteSmokePlan(options) {
+    assertAbsolutePath(options.workingDirectory, "workingDirectory");
+    assertNonEmpty(options.prompt, "prompt");
+    const model = options.model ?? DEFAULT_OPENAI_MODEL;
+    const networkAccess = options.networkAccess ?? true;
+    const processOptions = {
+        codexHome: options.codexHome,
+    };
+    if (options.configOverrides !== undefined) {
+        processOptions.configOverrides = options.configOverrides;
+    }
+    return {
+        process: buildCodexAppServerProcessPlan(processOptions),
+        initialize: {
+            method: "initialize",
+            params: {
+                clientInfo: {
+                    name: CODEX_APP_SERVER_CLIENT_NAME,
+                    title: CODEX_APP_SERVER_CLIENT_TITLE,
+                    version: options.clientVersion ?? "0.0.0",
+                },
+                capabilities: {
+                    experimentalApi: false,
+                },
+            },
+        },
+        initialized: {
+            method: "initialized",
+        },
+        threadStart: {
+            method: "thread/start",
+            params: {
+                cwd: options.workingDirectory,
+                model,
+                approvalPolicy: "never",
+                sandbox: "read-only",
+                ephemeral: true,
+                experimentalRawEvents: false,
+                persistExtendedHistory: false,
+            },
+        },
+        turnStart: {
+            method: "turn/start",
+            threadIdSource: "thread/start.response.thread.id",
+            paramsWithoutThreadId: {
+                input: [
+                    {
+                        type: "text",
+                        text: options.prompt,
+                        text_elements: [],
+                    },
+                ],
+                cwd: options.workingDirectory,
+                model,
+                approvalPolicy: "never",
+                sandboxPolicy: {
+                    type: "readOnly",
+                    access: {
+                        type: "restricted",
+                        includePlatformDefaults: true,
+                        readableRoots: [options.workingDirectory],
+                    },
+                    networkAccess,
+                },
+                outputSchema: CODEX_NO_WRITE_SMOKE_OUTPUT_SCHEMA,
+            },
+        },
+    };
+}
+export class CodexAppServerJsonlParseError extends Error {
+    lineNumber;
+    constructor(lineNumber) {
+        super(`Failed to parse Codex app-server JSONL message at line ${lineNumber}`);
+        this.lineNumber = lineNumber;
+        this.name = "CodexAppServerJsonlParseError";
+    }
+}
+export function parseCodexAppServerJsonlMessages(stdout) {
+    const messages = [];
+    const lines = stdout.split(/\r?\n/u);
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index]?.trim();
+        if (line === undefined || line === "") {
+            continue;
+        }
+        try {
+            messages.push(JSON.parse(line));
+        }
+        catch {
+            throw new CodexAppServerJsonlParseError(index + 1);
+        }
+    }
+    return messages;
+}
+//# sourceMappingURL=codex-app-server.js.map

package/dist/providers/openai/credential-store.d.ts

@@ -0,0 +1,31 @@
+import type { ProjectId } from "@tutti/shared/ids";
+import { OPENAI_API_KEY_AUTH_KIND, OPENAI_PROVIDER } from "./model-config.js";
+export type OpenAiCredentialRef = `cred_${string}`;
+export type StoredOpenAiApiKeyCredential = {
+    provider: typeof OPENAI_PROVIDER;
+    auth_kind: typeof OPENAI_API_KEY_AUTH_KIND;
+    secret: string;
+    created_at: string;
+    updated_at: string;
+};
+export type WriteOpenAiApiKeyCredentialOptions = {
+    tuttiHome: string;
+    projectId: ProjectId;
+    credentialRef: OpenAiCredentialRef;
+    apiKey: string;
+    now?: () => Date;
+};
+export declare class OpenAiCredentialStoreError extends Error {
+    readonly code: "invalid_credential_ref" | "invalid_api_key" | "credential_missing" | "credential_parse_failed" | "credential_invalid";
+    constructor(code: "invalid_credential_ref" | "invalid_api_key" | "credential_missing" | "credential_parse_failed" | "credential_invalid");
+}
+export declare function isOpenAiCredentialRef(value: string): value is OpenAiCredentialRef;
+export declare function createOpenAiCredentialRef(): OpenAiCredentialRef;
+export declare function assertOpenAiCredentialRef(value: string): asserts value is OpenAiCredentialRef;
+export declare function isOpenAiApiKey(value: string): boolean;
+export declare function createRedactedOpenAiApiKeyLabel(apiKey: string): string;
+export declare function resolveOpenAiCredentialPath(tuttiHome: string, projectId: ProjectId, credentialRef?: OpenAiCredentialRef): string;
+export declare function openAiCredentialExists(tuttiHome: string, projectId: ProjectId, credentialRef: OpenAiCredentialRef): boolean;
+export declare function writeOpenAiApiKeyCredential(options: WriteOpenAiApiKeyCredentialOptions): StoredOpenAiApiKeyCredential;
+export declare function readOpenAiApiKeyCredential(tuttiHome: string, projectId: ProjectId, credentialRef: OpenAiCredentialRef): StoredOpenAiApiKeyCredential;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/providers/openai/credential-store.js

@@ -0,0 +1,143 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { REDACTION_LABELS } from "@tutti/shared/utils";
+import { OPENAI_API_KEY_AUTH_KIND, OPENAI_PROVIDER } from "./model-config.js";
+import { readJsonFile, writePrivateJsonFile } from "./machine-local-files.js";
+const CREDENTIAL_REF_PATTERN = /^cred_[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const OPENAI_API_KEY_PATTERN = /^sk-[A-Za-z0-9_-]{8,}$/u;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export class OpenAiCredentialStoreError extends Error {
+    code;
+    constructor(code) {
+        super(`OpenAI credential store error: ${code}`);
+        this.code = code;
+        this.name = "OpenAiCredentialStoreError";
+    }
+}
+export function isOpenAiCredentialRef(value) {
+    return CREDENTIAL_REF_PATTERN.test(value);
+}
+export function createOpenAiCredentialRef() {
+    return `cred_${randomBytes(16).toString("hex")}`;
+}
+export function assertOpenAiCredentialRef(value) {
+    if (!isOpenAiCredentialRef(value)) {
+        throw new OpenAiCredentialStoreError("invalid_credential_ref");
+    }
+}
+export function isOpenAiApiKey(value) {
+    return OPENAI_API_KEY_PATTERN.test(value);
+}
+export function createRedactedOpenAiApiKeyLabel(apiKey) {
+    if (!isOpenAiApiKey(apiKey)) {
+        return REDACTION_LABELS.providerApiKey;
+    }
+    const prefix = apiKey.startsWith("sk-proj-") ? "sk-proj" : "sk";
+    return `${prefix}...${apiKey.slice(-4)}`;
+}
+export function resolveOpenAiCredentialPath(tuttiHome, projectId, credentialRef) {
+    if (credentialRef !== undefined) {
+        assertOpenAiCredentialRef(credentialRef);
+    }
+    return join(tuttiHome, "projects", projectId, "auth.json");
+}
+export function openAiCredentialExists(tuttiHome, projectId, credentialRef) {
+    if (!existsSync(resolveOpenAiCredentialPath(tuttiHome, projectId))) {
+        return false;
+    }
+    try {
+        readOpenAiApiKeyCredential(tuttiHome, projectId, credentialRef);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function emptyAuthFile() {
+    return {
+        schema_version: 1,
+        openai: {
+            credentials: {},
+        },
+    };
+}
+function parseAuthFile(value) {
+    if (!isRecord(value) ||
+        value.schema_version !== 1 ||
+        !isRecord(value.openai) ||
+        !isRecord(value.openai.credentials)) {
+        throw new OpenAiCredentialStoreError("credential_invalid");
+    }
+    const credentials = {};
+    for (const [credentialRef, rawCredential] of Object.entries(value.openai.credentials)) {
+        if (!isOpenAiCredentialRef(credentialRef)) {
+            throw new OpenAiCredentialStoreError("credential_invalid");
+        }
+        if (!isRecord(rawCredential) ||
+            rawCredential.provider !== OPENAI_PROVIDER ||
+            rawCredential.auth_kind !== OPENAI_API_KEY_AUTH_KIND ||
+            typeof rawCredential.secret !== "string" ||
+            !isOpenAiApiKey(rawCredential.secret) ||
+            typeof rawCredential.created_at !== "string" ||
+            typeof rawCredential.updated_at !== "string") {
+            throw new OpenAiCredentialStoreError("credential_invalid");
+        }
+        credentials[credentialRef] = {
+            provider: rawCredential.provider,
+            auth_kind: rawCredential.auth_kind,
+            secret: rawCredential.secret,
+            created_at: rawCredential.created_at,
+            updated_at: rawCredential.updated_at,
+        };
+    }
+    return {
+        schema_version: 1,
+        openai: { credentials },
+    };
+}
+function readAuthFile(tuttiHome, projectId) {
+    const readResult = readJsonFile(resolveOpenAiCredentialPath(tuttiHome, projectId));
+    if (readResult.kind === "missing") {
+        return emptyAuthFile();
+    }
+    if (readResult.kind === "parse_failed") {
+        throw new OpenAiCredentialStoreError("credential_parse_failed");
+    }
+    return parseAuthFile(readResult.value);
+}
+export function writeOpenAiApiKeyCredential(options) {
+    assertOpenAiCredentialRef(options.credentialRef);
+    if (!isOpenAiApiKey(options.apiKey)) {
+        throw new OpenAiCredentialStoreError("invalid_api_key");
+    }
+    const now = (options.now ?? (() => new Date()))().toISOString();
+    const credential = {
+        provider: OPENAI_PROVIDER,
+        auth_kind: OPENAI_API_KEY_AUTH_KIND,
+        secret: options.apiKey,
+        created_at: now,
+        updated_at: now,
+    };
+    const authFile = {
+        schema_version: 1,
+        openai: {
+            credentials: {
+                [options.credentialRef]: credential,
+            },
+        },
+    };
+    writePrivateJsonFile(resolveOpenAiCredentialPath(options.tuttiHome, options.projectId), authFile);
+    return credential;
+}
+export function readOpenAiApiKeyCredential(tuttiHome, projectId, credentialRef) {
+    assertOpenAiCredentialRef(credentialRef);
+    const credential = readAuthFile(tuttiHome, projectId).openai.credentials[credentialRef];
+    if (credential === undefined) {
+        throw new OpenAiCredentialStoreError("credential_missing");
+    }
+    return credential;
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/providers/openai/credential-validation.d.ts

@@ -0,0 +1,45 @@
+export type OpenAiCredentialValidationFailureReason = "provider_auth_invalid" | "provider_quota_or_billing_required" | "provider_rate_limited" | "provider_model_unavailable" | "provider_network_error";
+export type OpenAiCredentialValidationDiagnostic = {
+    error_name: string;
+    http_status?: number;
+    provider_error_code?: string | null;
+    retryable_evidence: string[];
+};
+export type OpenAiCredentialValidationInput = {
+    apiKey: string;
+    defaultModel?: string;
+    apiBaseUrl?: string;
+    organizationId?: string;
+    openAiProjectId?: string;
+};
+export type OpenAiCredentialValidationResult = {
+    kind: "ok";
+    default_model: string;
+    validated_at: string;
+} | {
+    kind: "failed";
+    reason: OpenAiCredentialValidationFailureReason;
+    retryable: boolean;
+    diagnostic?: OpenAiCredentialValidationDiagnostic;
+};
+export type OpenAiCredentialValidationClient = {
+    responses: {
+        create: (body: {
+            model: string;
+            input: string;
+            max_output_tokens: number;
+        }, options?: {
+            timeout?: number;
+            maxRetries?: number;
+        }) => Promise<unknown>;
+    };
+};
+export type ValidateOpenAiCredentialOptions = {
+    client?: OpenAiCredentialValidationClient;
+    now?: () => Date;
+};
+export declare function summarizeOpenAiCredentialValidationError(error: unknown, reason: OpenAiCredentialValidationFailureReason): OpenAiCredentialValidationDiagnostic;
+export declare function classifyOpenAiCredentialValidationError(error: unknown): OpenAiCredentialValidationFailureReason;
+export declare function isOpenAiCredentialValidationFailureRetryable(reason: OpenAiCredentialValidationFailureReason): boolean;
+export declare function validateOpenAiCredential(input: OpenAiCredentialValidationInput, options?: ValidateOpenAiCredentialOptions): Promise<OpenAiCredentialValidationResult>;
+//# sourceMappingURL=credential-validation.d.ts.map