cartethyia 2.7.1 → 2.7.3

package/src/providers/integrations/qoder/qoder-text-tools.ts

@@ -0,0 +1,277 @@
+/**
+ * Recovery for Qoder's INTL text-mode tool-call echo.
+ *
+ * Qoder's own wire is structured `tool_calls` deltas, but the DeepSeek model
+ * sometimes *also* writes a tool call as prose with the marker:
+ *
+ *   assistant 请求调用工具
+ *   {"name":"write","arguments":"…"},{"name":"write","arguments":"…"}
+ *
+ * Left alone the JSON reaches the caller as visible content while nothing runs.
+ * This module owns the single tolerant parser for that echo family (JSON
+ * array/object, bare comma-separated list, unescaped inner quotes). It does
+ * NOT parse DSML/XML markup — that family is gone; only the marker+JSON echo
+ * the model actually emits is recovered here.
+ */
+import { randomUUID } from "node:crypto";
+
+/** One recovered call, in the shape the canonical events want. */
+export interface QoderEchoCall {
+  readonly id: string;
+  readonly name: string;
+  readonly arguments: string;
+}
+
+/** Any spelling of the INTL tool-call leak marker. */
+export const LEAK_MARKER_ANY_RE = /[\[<(]*\s*assistant\s*请求调用工具\s*[\]>)]?/;
+
+/** Canonical marker literals used to seed prefix matching. */
+export const LEAK_MARKER_LITERALS: readonly string[] = [
+  "[assistant 请求调用工具]",
+  "<assistant 请求调用工具>",
+  "assistant 请求调用工具",
+];
+
+/**
+ * Escapes literal control characters that occur inside JSON string values.
+ * DeepSeek often writes multi-line argument content as real newlines instead
+ * of `\n` escapes; only characters inside strings are escaped.
+ */
+function escapeControlInsideStrings(text: string): string {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i] ?? "";
+    if (inString) {
+      if (ch === "\\") {
+        out += ch;
+        i += 1;
+        if (i < text.length) out += text[i];
+        continue;
+      }
+      if (ch === '"') {
+        inString = false;
+        out += ch;
+        continue;
+      }
+      if (ch === "\n") {
+        out += "\\n";
+        continue;
+      }
+      if (ch === "\r") {
+        out += "\\r";
+        continue;
+      }
+      if (ch === "\t") {
+        out += "\\t";
+        continue;
+      }
+      if (ch.charCodeAt(0) < 0x20) {
+        out += "\\u" + ch.charCodeAt(0).toString(16).padStart(4, "0");
+        continue;
+      }
+      out += ch;
+      continue;
+    }
+    if (ch === '"') inString = true;
+    out += ch;
+  }
+  return out;
+}
+
+/** Escapes bare quotes that belong inside a JSON string value. */
+function repairJsonQuotes(text: string): string {
+  const ph = "\u0000";
+  return text.replace(/\\"/g, ph).replace(/"/g, '\\"').replaceAll(ph, '\\"');
+}
+
+/**
+ * Rebuilds the leaked echo when strict parsing fails: inner quotes unescaped
+ * (`[{"name":"read","arguments":"{"path":"a"}"},…]`) or a bare comma-separated
+ * object list. Scans top-level objects without relying on JSON validity.
+ * Returns null when the text is not that shape at all.
+ */
+function salvageEchoArray(rest: string): unknown {
+  const src = rest.trim();
+  if (src.length === 0) return null;
+  const calls: Array<{ name: string; arguments: string }> = [];
+  let i = 0;
+  const bracketed = src[0] === "[";
+  if (bracketed) i = 1;
+  const skipWs = (): void => {
+    while (
+      i < src.length &&
+      (src[i] === " " || src[i] === "\t" || src[i] === "\n" || src[i] === "\r")
+    ) {
+      i += 1;
+    }
+  };
+  const NAME_RE = /"name"\s*:\s*"([^"]{1,200})"/y;
+  const ARG_KEY_RE = /"arguments"\s*:\s*"/y;
+
+  for (;;) {
+    skipWs();
+    if (i >= src.length) break;
+    if (bracketed && src[i] === "]") break;
+    if (src[i] !== "{") return null;
+    i += 1;
+    skipWs();
+    NAME_RE.lastIndex = i;
+    const nameMatch = NAME_RE.exec(src);
+    if (!nameMatch) return null;
+    const name = nameMatch[1] ?? "";
+    i = NAME_RE.lastIndex;
+    skipWs();
+    if (i < src.length && src[i] === ",") {
+      i += 1;
+      skipWs();
+    }
+    ARG_KEY_RE.lastIndex = i;
+    if (!ARG_KEY_RE.exec(src)) return null;
+    const argStart = ARG_KEY_RE.lastIndex;
+    let rawEnd = -1;
+    for (let j = argStart; j + 1 < src.length; j += 1) {
+      if (src[j] === "}" && src[j + 1] === '"') {
+        rawEnd = j;
+        break;
+      }
+    }
+    if (rawEnd < 0) return null;
+    const raw = src.slice(argStart, rawEnd + 1);
+    const parsedArgs = [
+      raw,
+      escapeControlInsideStrings(raw),
+      repairJsonQuotes(raw),
+      escapeControlInsideStrings(repairJsonQuotes(raw)),
+    ].find((candidate) => {
+      try {
+        JSON.parse(candidate);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    if (parsedArgs === undefined) return null;
+    calls.push({ name, arguments: parsedArgs });
+    i = rawEnd + 2;
+    skipWs();
+    if (i >= src.length || src[i] !== "}") return null;
+    i += 1;
+    skipWs();
+    if (i < src.length && src[i] === ",") {
+      i += 1;
+      continue;
+    }
+    if (i < src.length && bracketed && src[i] === "]") continue;
+    if (i < src.length) return null;
+  }
+  return calls.length > 0 ? calls : null;
+}
+
+/**
+ * True when the text is clearly an attempted tool-protocol echo rather than
+ * ordinary prose: a leak marker followed by the start of a JSON array/object,
+ * or of a tool-style tag (`<tool_call>`, `<execute …/>`, angle-wrapped
+ * `<{…}>`). Used by the fail-closed decision: an echo that cannot be recovered
+ * fails the turn instead of surfacing protocol text as visible content.
+ */
+export function isQoderEchoAttempt(text: string): boolean {
+  const fence = text.match(/^```[a-z]*\s*\n?/i);
+  const src = fence && fence[0] ? text.slice(fence[0].length) : text;
+  const marker = LEAK_MARKER_ANY_RE.exec(src);
+  if (!marker) return false;
+  const rest = src.slice(marker.index + marker[0].length).trim();
+  return (
+    rest.startsWith("[") ||
+    rest.startsWith("{") ||
+    /^<[a-zA-Z0-9_.:-]+\b/.test(rest) ||
+    (rest.startsWith("<[") || rest.startsWith("<{"))
+  );
+}
+
+/**
+ * Recovers tool calls the model echoed back as text. Only a well-formed echo
+ * whose every entry names a tool and carries parseable arguments is accepted;
+ * anything else returns no calls and the original text.
+ */
+export function parseQoderTextToolCalls(
+  text: string,
+  allowedNames?: ReadonlySet<string>,
+): { calls: QoderEchoCall[]; clean: string } {
+  if (text.length === 0) {
+    return { calls: [], clean: text };
+  }
+  const fence = text.match(/^```[a-z]*\s*\n?/i);
+  const src = fence && fence[0] ? text.slice(fence[0].length) : text;
+  const marker = LEAK_MARKER_ANY_RE.exec(src);
+  if (!marker) {
+    return { calls: [], clean: text };
+  }
+  const head = src.slice(0, marker.index).trim();
+  let rest = src.slice(marker.index + marker[0].length).trim();
+  rest = rest.replace(/\s*```\s*$/, "").trim();
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rest);
+  } catch {
+    try {
+      parsed = JSON.parse(escapeControlInsideStrings(rest));
+    } catch {
+      // A bare comma-separated object list (`{...},{...}`) is not valid JSON
+      // on its own, but is exactly the echo the model emits. Wrap it in an
+      // array before falling back to salvage.
+      let wrapped: unknown;
+      try {
+        wrapped = JSON.parse(`[${rest}]`);
+      } catch {
+        wrapped = undefined;
+      }
+      const salvaged = salvageEchoArray(rest);
+      if (salvaged === null && wrapped === undefined) {
+        return { calls: [], clean: text };
+      }
+      parsed = salvaged ?? wrapped;
+    }
+  }
+  if (Array.isArray(parsed) && parsed.length === 0) return { calls: [], clean: text };
+
+  const items: unknown[] = Array.isArray(parsed) ? parsed : [parsed];
+  const calls: QoderEchoCall[] = [];
+  for (const item of items) {
+    if (typeof item !== "object" || item === null) return { calls: [], clean: text };
+    const rec = item as Record<string, unknown>;
+    const name = typeof rec["name"] === "string" ? rec["name"].trim() : "";
+    if (name.length === 0) return { calls: [], clean: text };
+    if (allowedNames && !allowedNames.has(name)) return { calls: [], clean: text };
+    const rawArgs = rec["arguments"];
+    let args: string;
+    if (typeof rawArgs === "object" && rawArgs !== null) args = JSON.stringify(rawArgs);
+    else if (typeof rawArgs === "string") args = rawArgs;
+    else return { calls: [], clean: text };
+    const argsText = args.trim();
+    if (argsText.length > 0) {
+      let accepted = argsText;
+      let ok = false;
+      try {
+        JSON.parse(accepted);
+        ok = true;
+      } catch {
+        // fall through to normalization
+      }
+      if (!ok) {
+        accepted = escapeControlInsideStrings(argsText);
+        try {
+          JSON.parse(accepted);
+          ok = true;
+        } catch {
+          // still invalid
+        }
+      }
+      if (!ok) return { calls: [], clean: text };
+      args = accepted;
+    }
+    calls.push({ id: `call_${randomUUID().replace(/-/g, "").slice(0, 16)}`, name, arguments: args });
+  }
+  return { calls, clean: head };
+}

package/src/providers/integrations/qoder/qoder-umid.ts

@@ -0,0 +1,288 @@
+/**
+ * Qoder native machine identity (UMID) — the genuine SG bridge via umidpack.
+ *
+ * Research record (2026-10-30): the daily-credit campaign gates its CREDITS
+ * grant on a *genuine* Alibaba SG-produced identity. Deterministic/generated
+ * tokens do not reveal the grant on a fresh account; the `runtime-info`
+ * bridge does. Primary path therefore runs the real bridge binary from
+ * `vendor/qoder-umid/umidpack/`, auto-picked per host OS.
+ *
+ * Seed semantics (verified live): the Linux ELF resolves the user home via
+ * the passwd entry — it ignores `$HOME`/`XDG_CONFIG_HOME`, so the seed file
+ * is always `/home/<user>/.config/.locale_cfg`, one global file per Linux
+ * user. Per-account isolation therefore lives in the DATABASE (each account
+ * stores its own 350-byte seed) plus a flock-serialized bridge section:
+ * mint = wipe → run → capture seed+token; replay = write stored seed → run.
+ * Verified cycle (umidpack ELF under WSL): mint A, mint B (distinct),
+ * replay A ✓, replay B ✓, replay A again ✓.
+ *
+ * Platform behavior:
+ *   win32  — the exe is hardware-bound: one identity per machine, no seed.
+ *            Still a genuine SG identity (accepted by the campaign surface).
+ *   linux  — direct spawn of the umidpack ELF, serialized seed file.
+ *   darwin — the Mach-O runs directly; seed path is the macOS user home.
+ *   win32 + WSL (this repo's primary deployment) — the ELF runs via WSL with
+ *            flock serialization; the bridge binary is staged into /tmp once.
+ *
+ * The generated path remains a fallback for hosts with no usable bridge: it
+ * produces well-shaped but *not* SG-signed tokens — fine for non-campaign
+ * endpoints, will not surface the daily grant.
+ *
+ * Bridge CLI (donor-verified):
+ *   linux : runtime-info <env>
+ *   darwin: printf '{"account":"<uid>"}\n' | runtime-info <env> --account-stdin
+ *   win32 : runtime-info.exe <env> [--account-stdin]
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { log } from "../../../observability/logger";
+
+/** Valid environment codes (kept for validation/console surface). */
+export const QODER_ENV_CODES = ["0", "3", "4", "5", "6", "7"] as const;
+
+/** Environment code: an upstream "region/flavor", not a device identity. */
+const ENV_CODE = "3";
+
+/** One native identity sample (same shape the bridge prints). */
+export interface QoderNativeIdentity {
+  readonly machineToken: string;
+  readonly machineType: string;
+  readonly machineCode: string;
+  readonly isVm: boolean;
+  readonly source: "runtime-info" | "generated";
+}
+
+/** Length of the base64url payload after the `P1gA` prefix (token total 88). */
+const TOKEN_PAYLOAD_LENGTH = 84;
+/** Hex length of machineType / machineCode in the bridge's output. */
+const MACHINE_TYPE_LENGTH = 18;
+const MACHINE_CODE_LENGTH = 18;
+
+/** Where the umidpack binaries live, relative to the repo root. */
+export function umidpackDir(): string {
+  return join(process.cwd(), "vendor", "qoder-umid", "umidpack");
+}
+
+/** WSL-side staging/seed paths for the Linux bridge on a Windows host. */
+const WSL_BIN = "/tmp/umidpack/runtime-info";
+const WSL_SEED = "/home/risun/.config/.locale_cfg";
+const WSL_LOCK = "/tmp/umidpack/bridge.lock";
+
+type Bridge = { kind: "elf" | "macho" | "pe" | "wsl-elf" };
+
+/** Picks the bridge for this host; `null` when nothing genuine can run. */
+function pickBridge(): Bridge | null {
+  if (process.platform === "win32") {
+    // Prefer the WSL ELF (seed-capable → per-account identities); fall back
+    // to the Windows exe pair (hardware-bound, one identity per machine).
+    const elf = join(umidpackDir(), "elf-x86_64", "runtime-info");
+    if (existsSync(elf)) return { kind: "wsl-elf" };
+    const exe = join(umidpackDir(), "runtime-info.exe");
+    const dll = join(umidpackDir(), "sgsdk.dll");
+    if (existsSync(exe) && existsSync(dll)) return { kind: "pe" };
+    return null;
+  }
+  if (process.platform === "darwin") {
+    const arch = process.arch === "arm64" ? "macho-arm64" : "macho-x86_64";
+    return existsSync(join(umidpackDir(), arch, "runtime-info")) ? { kind: "macho" } : null;
+  }
+  const arch = process.arch === "arm64" ? "elf-aarch64" : "elf-x86_64";
+  if (existsSync(join(umidpackDir(), arch, "runtime-info"))) return { kind: "elf" };
+  return existsSync(join(umidpackDir(), "elf-x86_64", "runtime-info")) ? { kind: "elf" } : null;
+}
+
+/** True when a genuine bridge can run on this host. */
+export function hasGenuineBridge(): boolean {
+  return pickBridge() !== null;
+}
+
+/** Generated (software) identity — deterministic per account id, NOT SG-signed. */
+export function mintQoderGeneratedIdentity(accountId: string): QoderNativeIdentity {
+  const first = createHash("sha256").update(accountId).digest("base64url");
+  const second = createHash("sha256").update(`${accountId}:${first}`).digest("base64url");
+  const token = `P1gA${`${first}${second}`.slice(0, TOKEN_PAYLOAD_LENGTH)}`;
+  return {
+    machineToken: token,
+    machineType: createHash("sha256").update(`${accountId}:type`).digest("hex").slice(0, MACHINE_TYPE_LENGTH),
+    machineCode: createHash("sha256").update(`${accountId}:code`).digest("hex").slice(0, MACHINE_CODE_LENGTH),
+    isVm: false,
+    source: "generated",
+  };
+}
+
+/** Parse one bridge JSON line into an identity; null on any mismatch. */
+function parseBridgeLine(stdout: string): QoderNativeIdentity | null {
+  const line = stdout.split(/\r?\n/).find((l) => l.startsWith("{"));
+  if (!line) return null;
+  try {
+    const rec = JSON.parse(line) as Record<string, unknown>;
+    const machineToken = String(rec.machineToken ?? "").trim();
+    const machineType = String(rec.machineType ?? "").trim();
+    const machineCode = String(rec.machineCode ?? "").trim();
+    if (!machineToken || !machineType || !machineCode) return null;
+    const vmInfo = rec.vmInfo;
+    const isVm = typeof vmInfo === "object" && vmInfo !== null && (vmInfo as Record<string, unknown>).isVm === true;
+    return { machineToken, machineType, machineCode, isVm, source: "runtime-info" };
+  } catch {
+    return null;
+  }
+}
+
+/** Stage the ELF into the WSL filesystem once (idempotent, fast after first). */
+function ensureWslStaged(): void {
+  const src = join(umidpackDir(), "elf-x86_64", "runtime-info").replace(/\\/g, "/");
+  const drive = /^([A-Za-z]):/.exec(src);
+  const wslSrc = drive ? `/mnt/${drive[1]!.toLowerCase()}${src.slice(2)}` : src;
+  wsl(
+    `mkdir -p /tmp/umidpack && cp "${wslSrc}" ${WSL_BIN} && chmod +x ${WSL_BIN} && ` +
+    `mkdir -p $(dirname ${WSL_SEED})`,
+  );
+}
+
+function wsl(script: string, timeout = 120_000): string {
+  const r = spawnSync("wsl", ["-e", "bash", "-lc", script], { encoding: "utf8", timeout, windowsHide: true });
+  return String(r.stdout ?? "");
+}
+
+/** Run the bridge inside WSL under flock; returns the identity or null. */
+
+function seedPath(): string {
+  if (process.platform === "win32") return WSL_SEED;
+  const home = process.env.HOME ?? "";
+  return join(home, ".config", ".locale_cfg");
+}
+
+/**
+ * Mints a fresh genuine identity: wipe the seed (under the lock), run the
+ * bridge, capture the identity AND the seed it wrote. The seed is required
+ * for later replay of this same identity. Returns `null` when the bridge
+ * fails; falls back to the generated identity only when no bridge exists.
+ */
+export function mintQoderNativeIdentity(accountId: string): { identity: QoderNativeIdentity; seed: string } | null {
+  const bridge = pickBridge();
+  if (!bridge) {
+    log.warn("[qoder] no genuine bridge for this host — generated fallback (campaign grant will not surface)");
+    return { identity: mintQoderGeneratedIdentity(accountId), seed: "" };
+  }
+
+  if (bridge.kind === "wsl-elf") {
+    ensureWslStaged();
+    const out = wsl(
+      `exec 9>${WSL_LOCK}; flock 9; rm -f ${WSL_SEED}; ${WSL_BIN} ${ENV_CODE}`,
+    );
+    const identity = parseBridgeLine(out);
+    if (!identity) { log.warn("[qoder] wsl mint failed"); return null; }
+    const seed = wsl(`cat ${WSL_SEED}`);
+    return { identity, seed };
+  }
+
+  if (bridge.kind === "elf") {
+    const exe = join(umidpackDir(), process.arch === "arm64" ? "elf-aarch64" : "elf-x86_64", "runtime-info");
+    const seed = seedPath();
+    const dir = seed.slice(0, seed.lastIndexOf("/"));
+    mkdirSync(dir, { recursive: true });
+    try { spawnSync("rm", ["-f", seed]); } catch { /* ignore */ }
+    const r = spawnSync(exe, [ENV_CODE], { encoding: "utf8", timeout: 25_000 });
+    const identity = parseBridgeLine(String(r.stdout ?? ""));
+    if (!identity) { log.warn("[qoder] elf mint failed"); return null; }
+    return { identity, seed: existsSync(seed) ? readFileSync(seed, "utf8") : "" };
+  }
+
+  if (bridge.kind === "macho") {
+    const arch = process.arch === "arm64" ? "macho-arm64" : "macho-x86_64";
+    const exe = join(umidpackDir(), arch, "runtime-info");
+    const seed = seedPath();
+    const dir = seed.slice(0, seed.lastIndexOf("/"));
+    mkdirSync(dir, { recursive: true });
+    try { spawnSync("rm", ["-f", seed]); } catch { /* ignore */ }
+    const r = spawnSync(exe, [ENV_CODE, "--account-stdin"], {
+      input: `${JSON.stringify({ account: accountId })}\n`,
+      encoding: "utf8",
+      timeout: 25_000,
+    });
+    const identity = parseBridgeLine(String(r.stdout ?? ""));
+    if (!identity) { log.warn("[qoder] macho mint failed"); return null; }
+    return { identity, seed: existsSync(seed) ? readFileSync(seed, "utf8") : "" };
+  }
+
+  // pe — hardware-bound; no seed concept on Windows.
+  const exe = join(umidpackDir(), "runtime-info.exe");
+  const r = spawnSync(exe, [ENV_CODE], { encoding: "utf8", timeout: 30_000, windowsHide: true, cwd: umidpackDir() });
+  const identity = parseBridgeLine(String(r.stdout ?? ""));
+  if (!identity) { log.warn("[qoder] pe mint failed"); return null; }
+  return { identity, seed: "" };
+}
+
+/**
+ * Replays an identity from a stored seed: materialize the seed at the bridge's
+ * fixed path (under the lock) and re-run — the caller verifies the token
+ * matches the stored record. Returns `null` when no seed is available, the
+ * host cannot replay (Windows exe), or the bridge failed.
+ */
+export function replayQoderNativeIdentity(seed: string, accountId: string): QoderNativeIdentity | null {
+  if (!seed) return null;
+  const bridge = pickBridge();
+  if (!bridge) return null;
+
+  if (bridge.kind === "wsl-elf") {
+    ensureWslStaged();
+    const quoted = seed.replace(/'/g, `'\\''`);
+    const out = wsl(
+      `exec 9>${WSL_LOCK}; flock 9; printf '%s' '${quoted}' > ${WSL_SEED}; ${WSL_BIN} ${ENV_CODE}`,
+    );
+    return parseBridgeLine(out);
+  }
+
+  if (bridge.kind === "elf") {
+    const exe = join(umidpackDir(), process.arch === "arm64" ? "elf-aarch64" : "elf-x86_64", "runtime-info");
+    const seed = seedPath();
+    writeFileSync(seed, seed, "utf8");
+    const r = spawnSync(exe, [ENV_CODE], { encoding: "utf8", timeout: 25_000 });
+    return parseBridgeLine(String(r.stdout ?? ""));
+  }
+
+  if (bridge.kind === "macho") {
+    const arch = process.arch === "arm64" ? "macho-arm64" : "macho-x86_64";
+    const exe = join(umidpackDir(), arch, "runtime-info");
+    const seedPathStr = seedPath();
+    writeFileSync(seedPathStr, seed, "utf8");
+    const r = spawnSync(exe, [ENV_CODE, "--account-stdin"], {
+      input: `${JSON.stringify({ account: accountId })}\n`,
+      encoding: "utf8",
+      timeout: 25_000,
+    });
+    return parseBridgeLine(String(r.stdout ?? ""));
+  }
+
+  return null; // pe: cannot replay a seed on a hardware-bound identity
+}
+
+/** Reads the current seed file content (diagnostics). */
+export function readCurrentQoderSeed(): string {
+  const path = seedPath();
+  try {
+    if (process.platform === "win32") return wsl(`cat ${WSL_SEED} 2>/dev/null`);
+    return existsSync(path) ? readFileSync(path, "utf8") : "";
+  } catch {
+    return "";
+  }
+}
+
+/** The six native machine headers for one identity. */
+export function qoderMachineHeaders(identity: QoderNativeIdentity): Record<string, string> {
+  return {
+    "cosy-machineid": identity.machineToken,
+    "cosy-machinetoken": identity.machineToken,
+    "cosy-machinetype": identity.machineType,
+    "cosy-machinecode": identity.machineCode,
+    "cosy-machineos": "x86_64_linux",
+    "cosy-machinehostname": "DESKTOP-QODER",
+  };
+}
+
+/** For tests: force re-mint (identities are pure functions of their seed). */
+export function resetQoderNativeIdentityCache(): void {
+  // no persistent in-process identity cache remains
+}