@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/shared/tests/settings-file.test.ts

@@ -13,7 +13,7 @@
  *     --test server/shared/tests/settings-file.test.ts
  */
 import assert from 'node:assert/strict';
-import { chmodSync, mkdtempSync, rmSync, utimesSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, utimesSync, writeFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
@@ -21,6 +21,8 @@ import test from 'node:test';
 import {
   createSettingsBlockSource,
   defaultServerSettingsPath,
+  legacyServerSettingsPath,
+  migrateLegacyServerSettingsFile,
   readBoolean,
   readInteger,
   readString,
@@ -224,4 +226,84 @@ test('the default server settings path honours the supplied home', () => {
     defaultServerSettingsPath('/tmp/example-home'),
     path.join('/tmp/example-home', '.config', 'cloudpit', 'server.settings.json'),
   );
+  assert.equal(
+    legacyServerSettingsPath('/tmp/example-home'),
+    path.join('/tmp/example-home', '.config', 'claudecodeui', 'server.settings.json'),
+  );
+});
+
+// ── v3.0: the one-time legacy-settings migration ───────────────────────────
+
+test('AC4 migration: the first run copies the legacy settings to the Cloudpit path, 0600', (t) => {
+  const directory = temporaryDirectory(t, 'settings-migration-copy-');
+  const legacyPath = legacyServerSettingsPath(directory);
+  const targetPath = defaultServerSettingsPath(directory);
+  mkdirSync(path.dirname(legacyPath), { recursive: true });
+  writeFileSync(legacyPath, '{"cockpit":{"sessionStart":{"model":"legacy"}}}\n');
+
+  const outcome = migrateLegacyServerSettingsFile({ legacyPath, targetPath });
+
+  assert.deepEqual(outcome, { migrated: true, reason: 'copied' });
+  assert.equal(readFileSync(targetPath, 'utf8'), '{"cockpit":{"sessionStart":{"model":"legacy"}}}\n');
+  assert.equal(
+    statSync(targetPath).mode & 0o777,
+    0o600,
+    'a migrated settings file may carry credentials and is created 0600',
+  );
+  assert.ok(existsSync(legacyPath), 'the legacy file stays on disk');
+});
+
+test('AC4 migration: a second run is a no-op and never overwrites the user file', (t) => {
+  const directory = temporaryDirectory(t, 'settings-migration-idempotent-');
+  const legacyPath = legacyServerSettingsPath(directory);
+  const targetPath = defaultServerSettingsPath(directory);
+  mkdirSync(path.dirname(legacyPath), { recursive: true });
+  writeFileSync(legacyPath, '{"cockpit":{"sessionStart":{"model":"legacy"}}}\n');
+
+  assert.deepEqual(migrateLegacyServerSettingsFile({ legacyPath, targetPath }), {
+    migrated: true,
+    reason: 'copied',
+  });
+
+  const userDocument = '{"cockpit":{"sessionStart":{"model":"saved-by-user"}}}\n';
+  writeFileSync(targetPath, userDocument);
+  const second = migrateLegacyServerSettingsFile({ legacyPath, targetPath });
+
+  assert.deepEqual(second, { migrated: false, reason: 'target-exists' });
+  assert.equal(
+    readFileSync(targetPath, 'utf8'),
+    userDocument,
+    'the second run must not overwrite the newer Cloudpit file',
+  );
+});
+
+test('AC4 migration: no legacy file means nothing is written', (t) => {
+  const directory = temporaryDirectory(t, 'settings-migration-none-');
+  const outcome = migrateLegacyServerSettingsFile({
+    legacyPath: legacyServerSettingsPath(directory),
+    targetPath: defaultServerSettingsPath(directory),
+  });
+
+  assert.deepEqual(outcome, { migrated: false, reason: 'no-legacy' });
+  assert.equal(existsSync(defaultServerSettingsPath(directory)), false);
+});
+
+test('AC4 migration: a copy failure is reported, not thrown', (t) => {
+  const directory = temporaryDirectory(t, 'settings-migration-failed-');
+  const legacyPath = legacyServerSettingsPath(directory);
+  const targetPath = defaultServerSettingsPath(directory);
+  mkdirSync(path.dirname(legacyPath), { recursive: true });
+  writeFileSync(legacyPath, '{}\n');
+
+  const outcome = migrateLegacyServerSettingsFile({
+    legacyPath,
+    targetPath,
+    writeTarget: () => {
+      throw new Error('EROFS: read-only file system');
+    },
+  });
+
+  assert.equal(outcome.migrated, false);
+  assert.equal(outcome.reason, 'copy-failed');
+  assert.match(outcome.error ?? '', /EROFS: read-only file system/);
 });

package/server/shared/types.ts

@@ -458,7 +458,7 @@ export type ProviderModelOption = {
   description?: string;
   /** Stable SQLite row id used only by model-management actions. */
   recordId?: number;
-  /** True for user-created rows; false for immutable CloudCLI defaults. */
+  /** True for user-created rows; false for immutable Cloudpit defaults. */
   isCustom?: boolean;
   /** Custom-model env config as returned to clients; secret values are never included. */
   config?: ProviderModelPublicConfig | null;
@@ -469,6 +469,14 @@ export type ProviderModelOption = {
       description?: string;
     }[];
   };
+  /**
+   * The context window a catalog entry declares for this model, in tokens.
+   * When present it is the fact source a Codex launch passes as
+   * `model_context_window`, the same tier a Claude profile's window occupies.
+   */
+  contextWindow?: number;
+  /** The catalog entry's auto-compaction threshold (`model_auto_compact_token_limit`). */
+  autoCompactTokenLimit?: number;
 };
 
 /**
@@ -532,17 +540,91 @@ export type ProviderModelPublicEnvRow =
   | { key: string; kind: 'secret'; isSet: true };
 
 export type ProviderModelPublicConfig = {
+  /**
+   * The project Codex upstream provider a Codex model entry runs against.
+   * Absent means "inherit the Codex global default" (`openai`), which is the
+   * behaviour every pre-existing row keeps. Never a secret: it is a provider
+   * id from the project-owned Codex provider registry.
+   */
+  codexProviderId?: string;
   env: ProviderModelPublicEnvRow[];
 };
 
 /**
  * Per-model config stored in `provider_models.config_json`. `env` is ordered
  * and each key may appear at most once.
+ *
+ * `codexProviderId` names the project-owned Codex upstream provider this model
+ * entry runs against. It is optional: an entry that omits it inherits the Codex
+ * global default, which is what every row written before the provider registry
+ * existed does. The Providers service refuses a value that names no existing
+ * registry entry (409) rather than persisting a dangling reference, so the id
+ * is resolved against the live registry at write time.
  */
 export type ProviderModelConfig = {
+  codexProviderId?: string;
   env: ProviderModelEnvRow[];
 };
 
+// ---------------------------
+//----------------- CODEX UPSTREAM MODEL PROVIDER TYPES ------------
+/**
+ * One Codex upstream provider as `GET /api/settings/codex/model-providers` returns it.
+ *
+ * `id` is the key Codex uses in `model_providers.<id>`; the built-in ids (`openai`, `ollama`,
+ * `lmstudio`) are reserved and can never appear. `baseUrl` is the Responses API root, `envKey`
+ * is the child environment variable the secret is handed over in, and `tokenFile` is the
+ * resolved path the runtime reads the secret from. The secret itself is NEVER part of this
+ * reading: `tokenSet` says only whether the token file currently holds a non-empty value.
+ * `wireApi` is always `responses` because Codex 0.166 refuses to load a provider that asks for
+ * Chat Completions. `warnings` names fields the project file carried that this surface does not
+ * understand (for example Codex's own `api`) plus an unusable token file, so neither is lost
+ * silently.
+ *
+ * Mirrored by hand in `src/shared/types.ts` and compared field-for-field by
+ * `src/shared/tests/wireContractTypeSync.test.ts`.
+ */
+export type CodexModelProvider = {
+  id: string;
+  name: string;
+  baseUrl: string;
+  envKey: string;
+  tokenFile: string;
+  wireApi: 'responses';
+  /** Static request headers Codex sends to this provider (`http_headers`). */
+  httpHeaders?: Record<string, string>;
+  /** Header name → environment variable holding that header's value. */
+  envHttpHeaders?: Record<string, string>;
+  /** Query parameters appended to every request (`query_params`). */
+  queryParams?: Record<string, string>;
+  requestMaxRetries?: number;
+  streamMaxRetries?: number;
+  streamIdleTimeoutMs?: number;
+  /** A Codex-native model catalog URL this provider serves (`model_catalog_url`). */
+  modelCatalogUrl?: string;
+  /** Top-level Codex `model_context_window` override for this provider's models. */
+  modelContextWindow?: number;
+  /** Top-level Codex `model_auto_compact_token_limit` override. */
+  modelAutoCompactTokenLimit?: number;
+  tokenSet: boolean;
+  warnings: string[];
+};
+
+/**
+ * The whole `GET /api/settings/codex/model-providers` reading.
+ *
+ * `path` is the project settings file this process reads and writes, `version` is its content
+ * hash (the value a save must send back as `expectedVersion`), `providers` is the sorted
+ * registry, and top-level `warnings` reports document-level problems (a provider entry that was
+ * skipped). Mirrored by hand in `src/shared/types.ts` (TypeSync row).
+ */
+export type CodexModelProvidersReading = {
+  path: string;
+  version: string;
+  providers: CodexModelProvider[];
+  warnings: string[];
+};
+
 // ---------------------------
 //----------------- PROVIDER ACTIVE MODEL TYPES ------------
 /**
@@ -593,6 +675,26 @@ export type ProviderSessionModel = {
    * default" rather than as a mode of its own.
    */
   permissionMode: string | null;
+  /**
+   * The upstream provider this session's model is bound to (a Codex
+   * `model_providers.<id>` id, recorded by the session's first send). NULL
+   * means no binding has been recorded — the run uses the provider's own
+   * default — and is not the same answer as "the default provider".
+   *
+   * The id is part of the conversation's identity: a session cannot move to a
+   * different one in place, so a composer that offers a model from another
+   * provider must fork or start a new session instead.
+   */
+  modelProviderId: string | null;
+  /**
+   * A readable statement of why the recorded provider id cannot be used any
+   * more (the provider was deleted or renamed), or NULL when it still resolves.
+   *
+   * It is a MARK, not a fallback: `model` keeps the value the session actually
+   * ran with, so the client can offer the fork/new-session action instead of
+   * silently showing a default model the conversation never used.
+   */
+  modelProviderProblem: string | null;
   source: ProviderSessionModelSource;
 };
 
@@ -1505,7 +1607,7 @@ export type WorktreePorcelainEntry = {
  *
  * Extends the porcelain entry with everything the Worktrees panel renders:
  * dirty-file count, ahead/behind relative to the base branch (the branch
- * checked out in the main worktree), last-commit metadata, and the CloudCLI
+ * checked out in the main worktree), last-commit metadata, and the Cloudpit
  * project row linked to the worktree directory (if one was registered).
  */
 export type WorktreeDescriptor = {
@@ -1584,7 +1686,7 @@ export type CreateAndOpenWorktreeResult = CreateWorktreeResult & {
 };
 
 /**
- * Input accepted when registering an existing worktree as a CloudCLI project.
+ * Input accepted when registering an existing worktree as a Cloudpit project.
  *
  * The service verifies that `worktreePath` belongs to the repository containing
  * `projectPath` before it creates or restores any project record.
@@ -1595,7 +1697,7 @@ export type OpenWorktreeInput = {
 };
 
 /**
- * Project view returned after a worktree is opened in CloudCLI.
+ * Project view returned after a worktree is opened in Cloudpit.
  *
  * This deliberately mirrors the project-selection payload used by the Projects
  * module so the frontend can switch to the worktree without another lookup.
@@ -2493,7 +2595,7 @@ export type VoiceLogPort = {
  * One stored frequency row of the U-source lexicon.
  *
  * `tokenLower` is the lookup key (`canonical` lowercased) and `canonical` is the
- * spelling first seen — the pair is what lets `CloudCLI` and `cloudcli` be one
+ * spelling first seen — the pair is what lets `Cloudpit` and `cloudcli` be one
  * token that still displays a real casing. `firstSeenAt` / `lastSeenAt` are epoch
  * milliseconds supplied by the service's clock, not `CURRENT_TIMESTAMP`, so a
  * caller can pin them. `projectKey` is the path the message was sent from, which
@@ -4555,7 +4657,7 @@ export type QuaySnapshot = {
   /**
    * The project's quay-fleet registry id, joined from the fleet registry by matching the
    * project root. It is the ONLY project segment a `quay://` reference may carry: the fleet
-   * dereferences by its own registry id, so CloudCLI's project UUID would read `unknown-project`
+   * dereferences by its own registry id, so Cloudpit's project UUID would read `unknown-project`
    * there. `null` means the root is not registered with quay-fleet, and the panel then declares
    * no addressable objects (「未登记到 quay-fleet」) rather than minting a UUID reference.
    */
@@ -4837,6 +4939,17 @@ export type CockpitKnowledgeCase = {
   caseId: string;
   /** The knowledge entry the suggestion came from. */
   knowledgeId?: string;
+  /**
+   * The knowledge entry's title, exactly as the provider stated it. A card draws it above the
+   * case state so the person can read what the suggestion is about before choosing. Omitted
+   * when the provider states none — an older card's block is unchanged field for field.
+   */
+  title?: string;
+  /**
+   * The knowledge entry revision's full statement text, verbatim from the provider (the
+   * revision's Markdown body, not a restatement). Omitted when the provider states none.
+   */
+  statement?: string;
   /** The version of the knowledge entry this proposal was derived from. */
   knowledgeRevision: number;
   /** The version of the proposal itself; both must match what the person saw. */
@@ -4986,7 +5099,7 @@ export type CockpitCardFeedbackOutcome = {
 /**
  * One sent-but-unacknowledged feedback call, as the display reads it.
  *
- * This is CloudCLI's own lifecycle state, not a provider statement: the provider only answers a
+ * This is Cloudpit's own lifecycle state, not a provider statement: the provider only answers a
  * receipt. The card keeps its place in the provider's order, but its options and confirmation
  * are locked while this overlay exists (the action already ran; only the feedback may be resent).
  */
@@ -5469,7 +5582,7 @@ export type SessionAskEventKind = 'session.asking' | 'session.answered' | 'sessi
  * text, the UNTRUNCATED full text, omitted when the text is blank. `questionText`
  * exists ONLY so fleet can dedup by 「session + normalised question text」 (it hashes that text
  * into the key, falling back to the old askId key when absent). It is NOT a display field: the
- * cockpit renders the question from its own card/`contentRef` resolution, and no CloudCLI UI
+ * cockpit renders the question from its own card/`contentRef` resolution, and no Cloudpit UI
  * reads `questionText`. Do NOT truncate it for size — a cut merges distinct questions into one key.
  */
 export type SessionAskEvent = {

package/server/shared/utils.ts

@@ -1703,7 +1703,7 @@ export class ClaudeSessionOccupiedError extends Error {
 
   constructor(owner: ClaudeBackgroundSessionOwner) {
     super(
-      `该会话正由 Claude Code 后台任务占用（job ${owner.jobId}，pid ${owner.pid}），CloudCLI 无法接管。` +
+      `该会话正由 Claude Code 后台任务占用（job ${owner.jobId}，pid ${owner.pid}），Cloudpit 无法接管。` +
         `请先执行 \`claude stop ${owner.jobId}\` 停止它后重试，或 fork 该会话。`,
     );
     this.name = 'ClaudeSessionOccupiedError';

package/dist/assets/channel-D7XqNTJC.js

@@ -1 +0,0 @@
-import{af as o,ag as n}from"./mermaid.core-BxxInCBm.js";const t=(a,r)=>o.lang.round(n.parse(a)[r]);export{t as c};

package/dist/assets/channel-sbQyI1an.js

@@ -1 +0,0 @@
-import{af as o,ag as n}from"./mermaid.core-2Spxcrg7.js";const t=(a,r)=>o.lang.round(n.parse(a)[r]);export{t as c};

package/dist/assets/classDiagram-JCYQIIEL-DHudi-zH.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-C6f2SgCw.js";import{_ as i}from"./mermaid.core-BxxInCBm.js";import"./chunk-5VM5RSS4-DioqTIvB.js";import"./chunk-XXDRQBXY-B1FIfsqq.js";import"./chunk-KBJHAD2P-9TCQV92m.js";import"./chunk-2GRJ4B5K-DbwzBiPF.js";import"./index-D5nLH7qP.js";import"./vendor-codemirror-BfCHTlzg.js";import"./vendor-react-D0N9rdhf.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};

package/dist/assets/classDiagram-JCYQIIEL-DV7ybJJG.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-DzD9aOyp.js";import{_ as i}from"./mermaid.core-2Spxcrg7.js";import"./chunk-5VM5RSS4-B9Lv3cWR.js";import"./chunk-XXDRQBXY-B4YfaqTO.js";import"./chunk-KBJHAD2P-DDnJp7kJ.js";import"./chunk-2GRJ4B5K-D7WqZewM.js";import"./index-CqyOGerp.js";import"./vendor-codemirror-BfCHTlzg.js";import"./vendor-react-D0N9rdhf.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};

package/dist/assets/classDiagram-v2-OCEON4UE-DHudi-zH.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-C6f2SgCw.js";import{_ as i}from"./mermaid.core-BxxInCBm.js";import"./chunk-5VM5RSS4-DioqTIvB.js";import"./chunk-XXDRQBXY-B1FIfsqq.js";import"./chunk-KBJHAD2P-9TCQV92m.js";import"./chunk-2GRJ4B5K-DbwzBiPF.js";import"./index-D5nLH7qP.js";import"./vendor-codemirror-BfCHTlzg.js";import"./vendor-react-D0N9rdhf.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};

package/dist/assets/classDiagram-v2-OCEON4UE-DV7ybJJG.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-GF5L2VYU-DzD9aOyp.js";import{_ as i}from"./mermaid.core-2Spxcrg7.js";import"./chunk-5VM5RSS4-B9Lv3cWR.js";import"./chunk-XXDRQBXY-B4YfaqTO.js";import"./chunk-KBJHAD2P-DDnJp7kJ.js";import"./chunk-2GRJ4B5K-D7WqZewM.js";import"./index-CqyOGerp.js";import"./vendor-codemirror-BfCHTlzg.js";import"./vendor-react-D0N9rdhf.js";import"./vendor-xterm-CS4rQ5Mr.js";var c={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{c as diagram};