@xopcai/xopc 0.0.165 → 0.0.167

package/dist/src/media-shared/http/index.js

@@ -4,5 +4,5 @@ import { BlockedPrivateNetworkError, assertNotPrivateNetwork, classifyHost, defa
 import { resolveProviderHttpRequestConfig } from "./resolve-provider-http-request-config.js";
 import { ProviderHttpError, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, createProviderHttpError, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, formatProviderErrorPayload, formatProviderHttpErrorMessage, readResponseTextLimited, truncateErrorDetail } from "./provider-http-errors.js";
 import { SsrfBlockedError, assertSafeUrl, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6 } from "./ssrf-guard.js";
-import { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, waitProviderOperationPollInterval } from "./provider-http.js";
-export { BlockedPrivateNetworkError, ProviderHttpError, SsrfBlockedError, TimeoutAbortError, assertNotPrivateNetwork, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, assertSafeUrl, classifyHost, collectProviderApiKeysForExecution, createProviderHttpError, createProviderOperationDeadline, defaultPolicy as defaultPrivateNetworkPolicy, executeWithApiKeyRotation, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, fetchWithTimeoutGuarded, formatProviderErrorPayload, formatProviderHttpErrorMessage, getJsonRequest, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6, isRotatableAuthFailure, isTimeoutAbortError, normalizeBaseUrl, pickEffectiveTimeoutMs, pickTimeoutMsOrFallback, postJsonRequest, postMultipartRequest, privateNetworkPolicyToSsrfGuardOptions, readResponseTextLimited, resolveDeadline, resolveProviderHttpRequestConfig, truncateErrorDetail, waitProviderOperationPollInterval };
+import { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, readJsonResponseLimited, waitProviderOperationPollInterval } from "./provider-http.js";
+export { BlockedPrivateNetworkError, ProviderHttpError, SsrfBlockedError, TimeoutAbortError, assertNotPrivateNetwork, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, assertSafeUrl, classifyHost, collectProviderApiKeysForExecution, createProviderHttpError, createProviderOperationDeadline, defaultPolicy as defaultPrivateNetworkPolicy, executeWithApiKeyRotation, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, fetchWithTimeoutGuarded, formatProviderErrorPayload, formatProviderHttpErrorMessage, getJsonRequest, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6, isRotatableAuthFailure, isTimeoutAbortError, normalizeBaseUrl, pickEffectiveTimeoutMs, pickTimeoutMsOrFallback, postJsonRequest, postMultipartRequest, privateNetworkPolicyToSsrfGuardOptions, readJsonResponseLimited, readResponseTextLimited, resolveDeadline, resolveProviderHttpRequestConfig, truncateErrorDetail, waitProviderOperationPollInterval };

package/dist/src/media-shared/http/provider-http.d.ts

@@ -39,6 +39,8 @@ export interface GetJsonRequestOptions extends ProviderHttpRequestConfig {
     headers?: Record<string, string> | Headers;
 }
 export declare function getJsonRequest(url: string | URL, options: GetJsonRequestOptions): Promise<Response>;
+/** Read and parse a JSON response without allowing an unbounded body allocation. */
+export declare function readJsonResponseLimited(response: Response, maxBytes: number): Promise<unknown>;
 /**
  * Normalize a base URL: trim trailing slash, force http(s) scheme.
  */

package/dist/src/media-shared/http/provider-http.js

@@ -49,7 +49,8 @@ async function postJsonRequest(url, options) {
 		init: {
 			method: "POST",
 			headers,
-			body: JSON.stringify(options.body)
+			body: JSON.stringify(options.body),
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
@@ -62,7 +63,8 @@ async function postMultipartRequest(url, options) {
 		init: {
 			method: "POST",
 			headers,
-			body: options.body
+			body: options.body,
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
@@ -75,12 +77,49 @@ async function getJsonRequest(url, options) {
 		...options,
 		init: {
 			method: "GET",
-			headers
+			headers,
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
 	return response;
 }
+/** Read and parse a JSON response without allowing an unbounded body allocation. */
+async function readJsonResponseLimited(response, maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("JSON response byte limit must be a positive safe integer.");
+	const declaredLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
+	if (Number.isFinite(declaredLength) && declaredLength > maxBytes) throw new Error(`Provider JSON response exceeds ${maxBytes} bytes.`);
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("Provider returned an empty JSON response.");
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (!value?.byteLength) continue;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel().catch(() => {});
+				throw new Error(`Provider JSON response exceeds ${maxBytes} bytes.`);
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder().decode(body));
+	} catch {
+		throw new Error("Provider returned invalid JSON.");
+	}
+}
 /**
 * Normalize a base URL: trim trailing slash, force http(s) scheme.
 */
@@ -107,4 +146,4 @@ async function waitProviderOperationPollInterval(intervalMs, signal) {
 	await setTimeout$1(intervalMs, void 0, { signal });
 }
 //#endregion
-export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, waitProviderOperationPollInterval };
+export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, readJsonResponseLimited, waitProviderOperationPollInterval };

package/dist/src/notes/service.js

@@ -4,8 +4,8 @@ import { buildNoteAttachmentRef } from "./attachment-ref.js";
 import { parseNoteMarkdown } from "./note-markdown.js";
 import { changedFieldsFromPatch, emitActivity, previewText, systemActivityActor, systemActivitySource } from "../activity/emitter.js";
 import { getDefaultModelSync, init_providers, resolveModel } from "../providers/index.js";
-import { completeWithResolvedCredentials } from "../providers/model-call.js";
 import { publishAutomationProductEvent } from "../automations/product-events.js";
+import { completeWithResolvedCredentials } from "../providers/model-call.js";
 import { NotesStore } from "./store.js";
 import { partitionAttachmentsByReference } from "./note-attachment-sync.js";
 import { buildNoteAgentContextArtifact, getCachedNoteAgentContextArtifact } from "./agent-context.js";

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
+import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,10 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
+import { getOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
+import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
-import { getOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials, resolveApiKey } from "../auth/credentials.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";
@@ -90,8 +91,9 @@ function resolveModel(ref) {
 	if (!trimmedRef) throw new Error("No default model configured. Choose a model in onboarding or set agents.capabilityPresets.default.models.roles.<role>.model.");
 	const customModel = getModelRegistry().resolve(trimmedRef);
 	if (customModel) return customModel;
-	if (trimmedRef.includes("/")) {
-		const [provider, modelId] = trimmedRef.split("/");
+	const qualifiedRef = splitProviderModelRef(trimmedRef);
+	if (qualifiedRef) {
+		const { provider, modelId } = qualifiedRef;
 		const piAiModel = getModel(provider, modelId);
 		if (piAiModel) return normalizeProviderModel(piAiModel);
 		const supplementalModel = getSupplementalModels().find((m) => m.provider === provider && m.id === modelId);
@@ -316,6 +318,7 @@ var init_providers = __esmMin((() => {
 	init_env_keys();
 	init_constants();
 	init_model_supplements();
+	init_model_ref();
 	init_plugin_registry();
 	OPENAI_CODEX_CANONICAL_BASE_URL = "https://chatgpt.com/backend-api/codex";
 	PROVIDER_META = {

package/dist/src/providers/model-ref.d.ts

@@ -0,0 +1,6 @@
+export interface ProviderModelRef {
+    provider: string;
+    modelId: string;
+}
+/** Split a provider-qualified model reference while preserving slashes in the model ID. */
+export declare function splitProviderModelRef(ref: string): ProviderModelRef | undefined;

package/dist/src/providers/model-ref.js

@@ -0,0 +1,15 @@
+import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+//#region src/providers/model-ref.ts
+/** Split a provider-qualified model reference while preserving slashes in the model ID. */
+function splitProviderModelRef(ref) {
+	const slashIndex = ref.indexOf("/");
+	if (slashIndex <= 0 || slashIndex === ref.length - 1) return void 0;
+	return {
+		provider: ref.slice(0, slashIndex),
+		modelId: ref.slice(slashIndex + 1)
+	};
+}
+var init_model_ref = __esmMin((() => {}));
+//#endregion
+init_model_ref();
+export { init_model_ref, splitProviderModelRef };

package/dist/src/providers/model-reference-auditor.d.ts

@@ -11,4 +11,5 @@ export interface ModelReferenceHealth {
 export declare function auditModelReferences(config: Config, sessionConfigs?: ReadonlyMap<string, SessionAgentConfig>, deps?: {
     registry?: ModelRegistry;
     catalog?: ModelCatalogSnapshot;
+    resolveImageGenerationModel?: (ref: string) => boolean;
 }): ModelReferenceHealth[];

package/dist/src/providers/model-reference-auditor.js

@@ -1,22 +1,25 @@
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getModelRegistry, init_model_registry } from "./model-registry.js";
+import { parseImageGenerationModelRef } from "../agent/image/generation/model-ref.js";
+import { getImageGenerationProvider } from "../agent/image/generation/provider-registry.js";
 //#region src/providers/model-reference-auditor.ts
 init_model_catalog_store();
 init_model_registry();
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function addRef(out, value, location) {
+function addRef(out, value, location, kind = "text") {
 	if (typeof value === "string" && value.trim()) out.push({
 		ref: value.trim(),
-		location
+		location,
+		kind
 	});
 }
-function collectToolModel(out, value, location) {
+function collectToolModel(out, value, location, kind = "text") {
 	const model = asRecord(value);
 	if (!model) return;
-	addRef(out, model.primary, `${location}.primary`);
-	if (Array.isArray(model.fallbacks)) model.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.fallbacks[${index}]`));
+	addRef(out, model.primary, `${location}.primary`, kind);
+	if (Array.isArray(model.fallbacks)) model.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.fallbacks[${index}]`, kind));
 }
 function collectModelPolicy(out, value, location) {
 	const policy = asRecord(value);
@@ -29,7 +32,7 @@ function collectModelPolicy(out, value, location) {
 		if (Array.isArray(role.fallbacks)) role.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.roles.${roleId}.fallbacks[${index}]`));
 	}
 	collectToolModel(out, policy.imageModel, `${location}.imageModel`);
-	collectToolModel(out, policy.imageGenerationModel, `${location}.imageGenerationModel`);
+	collectToolModel(out, policy.imageGenerationModel, `${location}.imageGenerationModel`, "image-generation");
 }
 function collectReferences(config, sessionConfigs) {
 	const out = [];
@@ -47,22 +50,29 @@ function suggestedRef(ref, catalog) {
 	const first = source.models.find((model) => model.availability === "available");
 	return first ? `${providerId}/${first.id}` : void 0;
 }
+function hasImageGenerationModel(ref) {
+	const parsed = parseImageGenerationModelRef(ref);
+	if (!parsed) return false;
+	return getImageGenerationProvider(parsed.provider)?.models.includes(parsed.model) ?? false;
+}
 function auditModelReferences(config, sessionConfigs = /* @__PURE__ */ new Map(), deps = {}) {
 	const registry = deps.registry ?? getModelRegistry();
 	const catalog = deps.catalog ?? getModelCatalogStore().load();
+	const resolveImageGenerationModel = deps.resolveImageGenerationModel ?? hasImageGenerationModel;
 	const grouped = /* @__PURE__ */ new Map();
 	for (const reference of collectReferences(config, sessionConfigs)) {
-		const locations = grouped.get(reference.ref) ?? [];
-		locations.push(reference.location);
-		grouped.set(reference.ref, locations);
+		const references = grouped.get(reference.ref) ?? [];
+		references.push(reference);
+		grouped.set(reference.ref, references);
 	}
-	return [...grouped.entries()].map(([ref, locations]) => {
-		const availability = registry.resolve(ref) ? "available" : "unavailable";
-		const suggestion = availability === "unavailable" ? suggestedRef(ref, catalog) : void 0;
+	return [...grouped.entries()].map(([ref, references]) => {
+		const availability = references.every((reference) => reference.kind === "image-generation" ? resolveImageGenerationModel(ref) : Boolean(registry.resolve(ref))) ? "available" : "unavailable";
+		const textOnly = references.every((reference) => reference.kind === "text");
+		const suggestion = availability === "unavailable" && textOnly ? suggestedRef(ref, catalog) : void 0;
 		return {
 			ref,
 			availability,
-			locations,
+			locations: references.map((reference) => reference.location),
 			...suggestion ? { suggestedRef: suggestion } : {}
 		};
 	}).sort((a, b) => a.ref.localeCompare(b.ref));

package/dist/src/providers/model-registry.js

@@ -1,11 +1,12 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { resolveModelsJsonPath } from "../config/paths.js";
+import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
+import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { existsSync, readFileSync } from "fs";
 import { getModels, getProviders } from "@earendil-works/pi-ai/compat";
 //#region src/providers/model-registry.ts
@@ -96,6 +97,7 @@ var init_model_registry = __esmMin((() => {
 	init_logger();
 	init_env_keys();
 	init_model_catalog_store();
+	init_model_ref();
 	log = createLogger("ModelRegistry");
 	ModelRegistry = class {
 		models = [];
@@ -176,8 +178,9 @@ var init_model_registry = __esmMin((() => {
 		*/
 		resolve(ref) {
 			this.ensureLoaded();
-			if (ref.includes("/")) {
-				const [provider, modelId] = ref.split("/");
+			const qualifiedRef = splitProviderModelRef(ref);
+			if (qualifiedRef) {
+				const { provider, modelId } = qualifiedRef;
 				return this.find(provider, modelId);
 			}
 			for (const model of this.models) if (model.id === ref) return model;

package/dist/src/tui/tui-startup-resources.js

@@ -1,13 +1,13 @@
 import { resolveStateDir } from "../config/paths-state.js";
-import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir, resolveUserProfilePath } from "../config/paths.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { init_paths, resolveAgentProfileDir, resolveBundledSkillsDir, resolveUserProfilePath } from "../config/paths.js";
 import { resolveBootstrapFilesSync } from "../agent/bootstrap/bootstrap-files.js";
 import { createSkillConfigManager, isSkillEnabled } from "../agent/skills/config.js";
 import { createWorkflowCatalog } from "../agent/workflow/catalog.js";
 import { loadSkills } from "../agent/skills/index.js";
+import { listConnectorInstances } from "../connectors/instances.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { listConnectorInstances } from "../connectors/instances.js";
 import { basename } from "node:path";
 //#region src/tui/tui-startup-resources.ts
 init_paths();

package/dist/src/tui/tui.js

@@ -2,10 +2,10 @@ import { version } from "../../package.js";
 import { resolveStateDir, resolveXopcDatabasePath } from "../config/paths-state.js";
 import { parseAgentSessionKey } from "../routing/session-key-utils.js";
 import { init_agent_session_key, normalizeAgentId } from "../routing/agent-session-key.js";
+import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { init_paths } from "../config/paths.js";
 import { loadConfig } from "../config/loader.js";
 import { getAllModels, getAllProviders, getApiKey, init_providers, isProviderConfiguredSync } from "../providers/index.js";
-import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
 import { renderWorkflowFinalSummary, renderWorkflowPanel } from "../agent/workflow/snapshot.js";
 import { runViewToSnapshot } from "../workflows/service/run-view-to-snapshot.js";
 import { ProjectTrustStore, hasTrustRequiringProjectResources } from "../project-trust/trust-store.js";

package/dist/src/workflows/service/workflow-run-service.js

@@ -1,5 +1,5 @@
-import { init_providers, resolveModel } from "../../providers/index.js";
 import { extractProfileAgentId } from "../../config/agent-profile.js";
+import { init_providers, resolveModel } from "../../providers/index.js";
 import { publishAutomationProductEvent } from "../../automations/product-events.js";
 import { GoalService } from "../../goals/goal-service.js";
 import "../../goals/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.165",
+  "version": "0.0.167",
   "description": "Local-first AI system that remembers context, coordinates AI, and sustains long-term progress.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -100,7 +100,7 @@
     "semver": "^7.8.1",
     "silk-wasm": "^3.7.1",
     "thread-stream": "^4.2.0",
-    "undici": "^8.5.0",
+    "undici": "^8.9.0",
     "uuid": "^14.0.0",
     "ws": "^8.21.0",
     "zod": "^4.4.3"