cartethyia 2.7.8 → 2.8.0

package/src/providers/configured-openai-providers.ts

@@ -1,120 +0,0 @@
-import type { ApiKeyProviderSpec } from "./configured-provider";
-import type { ProviderId } from "./provider-contracts";
-
-/**
- * The shared spec builder for every builtin bearer-AI provider: "bearer auth
- * against the provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible
- * chat + responses, with the endpoint paths declared *below* the version root".
- *
- * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
- * base already rooted at a version (`/openai/v1`, `/v1/openai`, `/v3/openai`,
- * `/api/v1`, `/v2`, `/inference/v1`) plus a `/v1/…` path would double the
- * segment and 404 every request. These specs therefore declare the path below
- * the version root — the provider stating the truth about its own wire, not a
- * correction applied to it.
- */
-function apiKeySpec(
-  providerId: ProviderId,
-  paths: Readonly<Partial<Record<"chat" | "responses", string>>>,
-): ApiKeyProviderSpec {
-  return {
-    provider_id: providerId,
-    endpoint_paths_by_wire_family: paths,
-  };
-}
-
-const BEARER_PATHS = { chat: "/chat/completions", responses: "/responses" } as const;
-
-/**
- * Builtin providers whose entire adapter contract is "bearer auth against the
- * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
- * responses, with endpoint paths declared below the base's version root". They
- * carry no catalog, no OAuth, and no provider-specific payload hook, so they
- * share one spec shape rather than one module each.
- *
- * `base_url` is resolved per provider by `providerBaseUrl(provider_id)`.
- *
- * These providers list their models through live `/v1/models` discovery rather
- * than a static catalog: every one of them republishes an aggregator's whole
- * roster, which changes faster than a committed array can. Each registry row
- * pairs this spec with `openAIModelDiscovery`.
- *
- * The id list is derived from the spec record so the two cannot drift apart.
- */
-export const GENERIC_API_KEY_SPECS = {
-  larprouter: apiKeySpec("larprouter", BEARER_PATHS),
-  mistral: apiKeySpec("mistral", BEARER_PATHS),
-  fireworks: apiKeySpec("fireworks", BEARER_PATHS),
-  nvidia: apiKeySpec("nvidia", BEARER_PATHS),
-  gmi: apiKeySpec("gmi", BEARER_PATHS),
-  ollamacloud: apiKeySpec("ollamacloud", BEARER_PATHS),
-  together: apiKeySpec("together", BEARER_PATHS),
-  siliconflow: apiKeySpec("siliconflow", BEARER_PATHS),
-  siliconflowcn: apiKeySpec("siliconflowcn", BEARER_PATHS),
-  nanogpt: apiKeySpec("nanogpt", BEARER_PATHS),
-  baseten: apiKeySpec("baseten", BEARER_PATHS),
-  synthetic: apiKeySpec("synthetic", BEARER_PATHS),
-  stepfun: apiKeySpec("stepfun", BEARER_PATHS),
-  sakana: apiKeySpec("sakana", BEARER_PATHS),
-  helmcode: apiKeySpec("helmcode", BEARER_PATHS),
-  coralbricks: apiKeySpec("coralbricks", BEARER_PATHS),
-  aiand: apiKeySpec("aiand", BEARER_PATHS),
-  wafer: apiKeySpec("wafer", BEARER_PATHS),
-  coreweave: apiKeySpec("coreweave", BEARER_PATHS),
-  dashscope: apiKeySpec("dashscope", BEARER_PATHS),
-  "qwen-portal": apiKeySpec("qwen-portal", BEARER_PATHS),
-  // `deepseek` is intentionally absent: it dispatches on the Anthropic Messages
-  // wire at its `/anthropic` root, not the OpenAI chat/responses wires, so it
-  // carries a dedicated entry in `default-registry.ts` instead.
-  //
-  // The aggregators below are absent for a different reason: their base URL is
-  // already rooted at a version segment that the `/v1`-prefixed path this shape
-  // pins would duplicate (`/openai/v1`, `/v1/openai`, `/v3/openai`, `/api/v1`,
-  // `/v2`, and `/inference/v1`), so `joinUrl` would produce
-  // `…/v1/v1/chat/completions`. They use the versioned-root spec instead,
-  // which pins the path below the version root — the same reason `cerebras`
-  // declares `/chat/completions` explicitly.
-} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
-
-/**
- * One id that has both a generic spec and a registry row.
- *
- * Exported so the registry can be checked against the spec list rather than
- * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
- * row naming a provider with no spec is a compile error instead of an
- * `undefined` adapter at first dispatch.
- */
-export type GenericApiKeyProviderId = keyof typeof GENERIC_API_KEY_SPECS;
-
-export const GENERIC_API_KEY_PROVIDER_IDS = Object.keys(
-  GENERIC_API_KEY_SPECS,
-) as readonly GenericApiKeyProviderId[];
-
-/**
- * Ids whose base URL already ends at a version segment.
- *
- * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
- * base already rooted at a version plus a `/v1/…` path doubles the segment and
- * every request 404s. These specs therefore declare the path *below* the
- * version root. That is the provider stating the truth about its own wire, not
- * a correction applied to it: a wrong path now reaches the operator as the
- * wrong URL instead of being quietly rewritten into a different address.
- *
- * The id list is derived from the spec record so the two cannot drift apart.
- */
-export const VERSIONED_ROOT_API_KEY_SPECS = {
-  groq: apiKeySpec("groq", BEARER_PATHS),
-  deepinfra: apiKeySpec("deepinfra", BEARER_PATHS),
-  novita: apiKeySpec("novita", BEARER_PATHS),
-  venice: apiKeySpec("venice", BEARER_PATHS),
-  qianfan: apiKeySpec("qianfan", BEARER_PATHS),
-  zhipucoding: apiKeySpec("zhipucoding", BEARER_PATHS),
-  firepass: apiKeySpec("firepass", BEARER_PATHS),
-} satisfies Readonly<Record<string, ApiKeyProviderSpec>>;
-
-export type VersionedRootApiKeyProviderId =
-  keyof typeof VERSIONED_ROOT_API_KEY_SPECS;
-
-export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = Object.keys(
-  VERSIONED_ROOT_API_KEY_SPECS,
-) as readonly VersionedRootApiKeyProviderId[];

package/src/providers/integrations/buddy/turing-device-token.ts

@@ -1,262 +0,0 @@
-/**
- * TuringShield device-token integration for the buddy providers.
- *
- * WorkBuddy/CodeBuddy desktop clients derive `X-Device-Token` from Tencent's
- * TuringShield SDK (native addon + DLL, channel 400111). The upstream risk
- * control expects that header on chat traffic, and the official desktop app
- * always presents either a real token or an `X-Device-Token-Error` — never
- * neither.
- *
- * The SDK is a proprietary native binary shipped inside this repository under
- * `vendor/turing-sdk/` (extracted from the WorkBuddy desktop app, channel
- * 400111). `CARTETHYIA_TURING_SDK_PATH` remains as an optional override for
- * deployments that bring their own copy. When neither is present the service
- * falls back to the same "sdk_not_initialized" failure state the desktop app
- * emits when the SDK cannot run.
- *
- * Loading and calling the SDK is safe: `configure()` is local-only, and
- * `fetchDeviceToken()` performs the SDK's normal network exchange with the
- * Turing endpoint (the same call the desktop client makes). On platforms
- * without native support (non-win32/darwin) the service degrades to the
- * fallback.
- */
-import { existsSync } from "node:fs";
-import path from "node:path";
-import { createHash } from "node:crypto";
-import { log } from "../../../observability/logger";
-import { resolvePackagePath } from "../../../config/package-paths";
-
-/** Channel assigned to the WorkBuddy desktop product (see cli/product.json). */
-export const TURING_CHANNEL_ID = 400111;
-
-/** Per-provider SDK configuration (payload identity sent to Turing). */
-export interface TuringSdkConfig {
-  readonly channelId: number;
-  readonly productName: string;
-  readonly productVersion: string;
-}
-
-/** Canonical config for the WorkBuddy profile. */
-export const WORKBUDDY_TURING_CONFIG: TuringSdkConfig = {
-  channelId: TURING_CHANNEL_ID,
-  productName: "WorkBuddy AI",
-  productVersion: "5.8.4",
-};
-
-/** Canonical config for the CodeBuddy profile (same SDK, distinct payload). */
-export const CODEBUDDY_TURING_CONFIG: TuringSdkConfig = {
-  channelId: TURING_CHANNEL_ID,
-  productName: "CodeBuddy",
-  productVersion: "4.12.1",
-};
-
-/** Mirror the desktop client's service defaults (main-bootstrap.js). */
-const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
-const DEFAULT_REFRESH_INTERVAL_MS = 5 * 60_000;
-const DEFAULT_RETRY_BASE_DELAY_MS = 30_000;
-const DEFAULT_RETRY_MAX_DELAY_MS = 5 * 60_000;
-const MAX_BACKOFF_LEVEL = 20;
-
-/**
- * Resolve the directory holding the Turing SDK native files, or null.
- *
- * Priority: `CARTETHYIA_TURING_SDK_PATH` override → bundled copy in
- * `vendor/turing-sdk/build/Release/` under the package root (works both in
- * source and in the compiled binary, where `CARTETHYIA_PACKAGE_ROOT` points at
- * `/app`).
- */
-export function resolveTuringSdkRoot(): string | null {
-  const env = process.env["CARTETHYIA_TURING_SDK_PATH"];
-  if (env !== undefined && env.trim().length > 0) return env.trim();
-  // Bundled SDK (committed in vendor/).
-  const bundled = resolvePackagePath("vendor", "turing-sdk", "build", "Release");
-  if (existsSync(path.join(bundled, "turing_sdk.node"))) return bundled;
-  return null;
-}
-
-/** Pure header decision, matching the desktop app's `token || error` contract. */
-export function turingHeadersForRequest(args: {
-  token?: string;
-  error?: string;
-  cliIdentity?: boolean;
-}): Record<string, string> {
-  if (args.cliIdentity) return {};
-  const token = args.token?.trim();
-  if (token !== undefined && token.length > 0) return { "x-device-token": token };
-  const error = args.error?.trim();
-  if (error !== undefined && error.length > 0) return { "x-device-token-error": error };
-  return { "x-device-token-error": "sdk_not_initialized" };
-}
-
-/** Stable identifier for logs (never the token itself). */
-function logDeviceFingerprint(): string {
-  const parts = [process.platform, process.arch, process.env["COMPUTERNAME"] ?? process.env["HOSTNAME"] ?? ""];
-  return createHash("sha256").update(parts.join("|")).digest("hex").slice(0, 12);
-}
-
-export class TuringDeviceTokenService {
-  private binding: { configure(...a: unknown[]): unknown; fetchDeviceToken(o: unknown): unknown } | null = null;
-  private loadAttempted = false;
-  private configured = false;
-
-  private cachedToken: string | undefined;
-  private cachedError: string | undefined;
-  private cachedAt = 0;
-  private consecutiveFailures = 0;
-  private nextRetryAt = 0;
-  private inflight: Promise<string> | undefined;
-
-  constructor(private readonly config: TuringSdkConfig = WORKBUDDY_TURING_CONFIG) {}
-
-  private ensureLoaded(): boolean {
-    if (this.loadAttempted) return this.configured;
-    this.loadAttempted = true;
-    const root = resolveTuringSdkRoot();
-    if (root === null) {
-      log.warn("[turing-sdk] no SDK root (env unset & vendor missing); device token fallback active");
-      return false;
-    }
-    const nodePath = path.join(root, "turing_sdk.node");
-    if (!existsSync(nodePath)) {
-      log.warn("[turing-sdk] turing_sdk.node not found at " + nodePath);
-      return false;
-    }
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-var-requires
-      const loaded: unknown = require(nodePath);
-      if (loaded === null || typeof loaded !== "object" || typeof (loaded as Record<string, unknown>)["configure"] !== "function") {
-        log.warn("[turing-sdk] native addon loaded but exposes no configure()");
-        return false;
-      }
-      const binding = loaded as NonNullable<TuringDeviceTokenService["binding"]>;
-      binding.configure(this.config.channelId, this.config.productName, this.config.productVersion);
-      this.binding = binding;
-      this.configured = true;
-      log.info(
-        "[turing-sdk] native SDK configured (channel " + this.config.channelId +
-        ", product " + this.config.productName + " " + this.config.productVersion +
-        ", " + logDeviceFingerprint() + ")",
-      );
-    } catch (error) {
-      log.warn("[turing-sdk] failed to load/configure native SDK: " + (error instanceof Error ? error.message : String(error)));
-      this.binding = null;
-    }
-    return this.configured;
-  }
-
-  /** Returns a real token when the SDK can produce one; undefined otherwise. */
-  async fetchDeviceToken(): Promise<string | undefined> {
-    if (!this.ensureLoaded()) return undefined;
-    const now = Date.now();
-    if (this.inflight) return this.inflight;
-    const task = this.performFetch().finally(() => {
-      this.inflight = undefined;
-    });
-    this.inflight = task;
-    try {
-      const token = await task;
-      this.cachedToken = token;
-      this.cachedError = undefined;
-      this.cachedAt = now;
-      this.consecutiveFailures = 0;
-      this.nextRetryAt = 0;
-      return token;
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      this.cachedError = message.replace(/[^\x20-\x7E]/g, "").slice(0, 64);
-      this.consecutiveFailures += 1;
-      const level = Math.min(Math.max(0, this.consecutiveFailures - 1), MAX_BACKOFF_LEVEL);
-      const delay = Math.min(DEFAULT_RETRY_BASE_DELAY_MS * 2 ** level, DEFAULT_RETRY_MAX_DELAY_MS);
-      this.nextRetryAt = Date.now() + delay;
-      return undefined;
-    }
-  }
-
-  private async performFetch(): Promise<string> {
-    const binding = this.binding;
-    if (!binding) throw new Error("sdk_not_initialized");
-    const timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS;
-    const promise = binding.fetchDeviceToken({
-      usingCachedMessage: true,
-      includesOutdatedMessage: false,
-      includesDeviceInfo: true,
-      timeoutMs,
-    });
-    const token = await this.withTimeout(Promise.resolve(promise) as Promise<string>, timeoutMs);
-    const text = typeof token === "string" ? token : String(token ?? "");
-    if (text.trim().length === 0) throw new Error("Turing SDK returned an empty device token");
-    return text.trim();
-  }
-
-  private async withTimeout(promise: Promise<string>, ms: number): Promise<string> {
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    try {
-      return await Promise.race([
-        promise,
-        new Promise<string>((_, reject) => {
-          timer = setTimeout(() => reject(new Error("Turing SDK device token request timed out after " + ms + "ms")), ms);
-          timer.unref?.();
-        }),
-      ]);
-    } finally {
-      if (timer !== undefined) clearTimeout(timer);
-    }
-  }
-
-  /**
-   * Headers for one buddy request. Ensures a cached token exists (refreshing
-   * in the background when stale), then returns the desktop `token || error`
-   * contract.
-   */
-  async headersForRequest(cliIdentity?: boolean, requested?: TuringSdkConfig): Promise<Record<string, string>> {
-    // The Turing SDK rejects a channelId change after initialization. Keep the
-    // first config that actually configures the binding; later conflicting
-    // requests are warned once and keep serving the active token.
-    if (requested !== undefined) {
-      const activeOrMine = this.configured ? this.config : requested;
-      if (this.configured && (requested.channelId !== this.config.channelId || requested.productName !== this.config.productName)) {
-        log.warn("[turing-sdk] ignoring conflicting SDK config (channel " + requested.channelId + ", " + requested.productName + "); active is channel " + this.config.channelId + ", " + this.config.productName);
-      } else {
-        void activeOrMine;
-      }
-    }
-    let token: string | undefined = this.cachedToken;
-    let error: string | undefined = this.cachedError;
-    const now = Date.now();
-    if (token === undefined) {
-      if (now < this.nextRetryAt) {
-        // Keep whatever we had; still within backoff.
-      } else {
-        token = await this.fetchDeviceToken();
-        if (token === undefined) error = this.cachedError;
-      }
-    } else if (now - this.cachedAt >= DEFAULT_REFRESH_INTERVAL_MS) {
-      // Stale: refresh opportunistically but keep serving the cached token.
-      void this.fetchDeviceToken();
-    }
-    return turingHeadersForRequest({
-      ...(token === undefined ? {} : { token }),
-      ...(error === undefined ? {} : { error }),
-      ...(cliIdentity === undefined ? {} : { cliIdentity }),
-    });
-  }
-}
-
-/**
- * Process-wide services keyed by their SDK config (channel/product). Each
- * provider identity gets its own service so its payload (productName,
- * productVersion) is used when the SDK is first configured. The underlying
- * native addon is shared, but configure() runs per instance.
- */
-const servicesByConfig = new Map<string, TuringDeviceTokenService>();
-export function getTuringDeviceTokenService(
-  config: TuringSdkConfig = WORKBUDDY_TURING_CONFIG,
-): TuringDeviceTokenService {
-  const key = `${config.channelId}:${config.productName}`;
-  let service = servicesByConfig.get(key);
-  if (service === undefined) {
-    service = new TuringDeviceTokenService(config);
-    servicesByConfig.set(key, service);
-  }
-  return service;
-}

package/src/providers/integrations/buddy/workbuddy/cn-oauth.ts

@@ -1,30 +0,0 @@
-// WorkBuddy CN device login shares WorkBuddy's contract on its China domain.
-import {
-  buildWorkBuddyUserAgent,
-  getWorkBuddyCnClientVersion,
-  getWorkBuddyCliVersion,
-} from "../../../operations/client-versions";
-import { providerBaseUrl } from "../../../provider-metadata";
-import {
-  BuddyOAuthClient,
-  coercingResponseCode,
-  type BuddyOAuthVariant,
-} from "../buddy-oauth-shared";
-import { WORKBUDDY_CN_DOMAIN } from "./cn-provider";
-
-const baseUrl = providerBaseUrl("workbuddycn");
-
-export const WORKBUDDY_CN_OAUTH_VARIANT: BuddyOAuthVariant = {
-  providerId: "workbuddycn",
-  providerLabel: "WorkBuddy CN",
-  domain: WORKBUDDY_CN_DOMAIN,
-  platform: "CLI",
-  userAgent: async () =>
-    buildWorkBuddyUserAgent(getWorkBuddyCnClientVersion(), getWorkBuddyCliVersion()),
-  deviceStartUrl: `${baseUrl}/v2/plugin/auth/state`,
-  devicePollUrl: `${baseUrl}/v2/plugin/auth/token`,
-  refreshUrl: `${baseUrl}/v2/plugin/auth/token/refresh`,
-  responseCode: coercingResponseCode,
-};
-
-export const workBuddyCnOAuthClient = new BuddyOAuthClient(WORKBUDDY_CN_OAUTH_VARIANT);

package/src/providers/integrations/buddy/workbuddy/cn-provider.ts

@@ -1,58 +0,0 @@
-// WorkBuddy CN uses the WorkBuddy contract on its China domain.
-import { BuddyMediaAdapter } from "../buddy-media";
-import type { ProviderAdapter } from "../../../provider-contracts";
-import type { DiscoveryInput } from "../../../discovery/discovery-types";
-import type { ModelDefinition } from "../../../provider-model-definition";
-import { providerBaseUrl } from "../../../provider-metadata";
-import { getWorkBuddyCnClientVersion } from "../../../operations/client-versions";
-import { BUDDY_CN_MODELS_PATH, fetchBuddyDirectoryModels } from "../buddy-discovery-shared";
-import { CODEBUDDY_CN_MODELS } from "../codebuddy/cn-provider";
-import { workbuddyPrePayload, WORKBUDDY_SYSTEM_PROMPT } from "./provider";
-import { workbuddyAdapterConfig, workbuddyHeaders, WORKBUDDY_CHAT_PATH } from "./shared";
-
-export const WORKBUDDY_CN_PROVIDER_ID = "workbuddycn" as const;
-export const WORKBUDDY_CN_DOMAIN = "www.workbuddy.cn" as const;
-export const WORKBUDDY_CN_BASE_URL = providerBaseUrl(WORKBUDDY_CN_PROVIDER_ID);
-
-export const WORKBUDDY_CN_MODELS: readonly ModelDefinition[] = [
-  ...CODEBUDDY_CN_MODELS.map((model) => ({
-    ...model,
-    endpointPath: WORKBUDDY_CHAT_PATH,
-  })),
-];
-
-export async function discoverWorkBuddyCnModels(
-  input: DiscoveryInput,
-): Promise<readonly ModelDefinition[] | null> {
-  return fetchBuddyDirectoryModels({
-    siteUrl: WORKBUDDY_CN_BASE_URL,
-    providerId: WORKBUDDY_CN_PROVIDER_ID,
-    credential: input.credential,
-    // The CN host answers the `/console/…` directory, exactly like the CodeBuddy
-    // CN host does; the international path was inherited from the intl provider
-    // and the CN edge answers it with a 500 rather than a 404.
-    modelsPath: BUDDY_CN_MODELS_PATH,
-    endpoint: WORKBUDDY_CHAT_PATH,
-    ...(input.signal ? { signal: input.signal } : {}),
-    ...(input.fetcher ? { fetcher: input.fetcher } : {}),
-  });
-}
-
-export function createWorkBuddyCnAdapter(fetchImpl?: typeof fetch): ProviderAdapter {
-  return new BuddyMediaAdapter(
-    workbuddyAdapterConfig({
-      providerId: WORKBUDDY_CN_PROVIDER_ID,
-      baseUrl: WORKBUDDY_CN_BASE_URL,
-      domain: WORKBUDDY_CN_DOMAIN,
-      prePayload: workbuddyPrePayload,
-      ...(fetchImpl ? { fetchImpl } : {}),
-    }),
-    {
-      variant: "IDE",
-      systemPrompt: WORKBUDDY_SYSTEM_PROMPT,
-      baseUrl: WORKBUDDY_CN_BASE_URL,
-      buildHeaders: (context) =>
-        workbuddyHeaders(context, undefined, WORKBUDDY_CN_DOMAIN, getWorkBuddyCnClientVersion()),
-    },
-  );
-}

package/src/providers/integrations/buddy/workbuddy/oauth.ts

@@ -1,31 +0,0 @@
-// WorkBuddy OAuth — browser-assisted state polling (non-PKCE) plus refresh.
-// Canonical provider ID: workbuddy (international / WorkBuddy AI).
-import { providerBaseUrl } from "../../../provider-metadata";
-import { buildWorkBuddyUserAgent } from "../../../operations/client-versions";
-import {
-  BuddyOAuthClient,
-  coercingResponseCode,
-  type BuddyOAuthVariant,
-} from "../buddy-oauth-shared";
-import { WORKBUDDY_DOMAIN } from "./shared";
-
-export const WORKBUDDY_DEVICE_START_URL = `${providerBaseUrl("workbuddy")}/v2/plugin/auth/state`;
-export const WORKBUDDY_DEVICE_POLL_URL = `${providerBaseUrl("workbuddy")}/v2/plugin/auth/token`;
-export const WORKBUDDY_REFRESH_URL = `${providerBaseUrl("workbuddy")}/v2/plugin/auth/token/refresh`;
-
-/** The international WorkBuddy gateway: `CLI` platform, `WorkBuddy AI` identity. */
-export const WORKBUDDY_OAUTH_VARIANT: BuddyOAuthVariant = {
-  providerId: "workbuddy",
-  providerLabel: "WorkBuddy",
-  domain: WORKBUDDY_DOMAIN,
-  platform: "CLI",
-  userAgent: async () => {
-    return buildWorkBuddyUserAgent();
-  },
-  deviceStartUrl: WORKBUDDY_DEVICE_START_URL,
-  devicePollUrl: WORKBUDDY_DEVICE_POLL_URL,
-  refreshUrl: WORKBUDDY_REFRESH_URL,
-  responseCode: coercingResponseCode,
-};
-
-export const workBuddyOAuthClient = new BuddyOAuthClient(WORKBUDDY_OAUTH_VARIANT);