co-maintainer 0.5.0 → 0.5.1-beta.2

package/dist/src/ai/openai.js

@@ -0,0 +1,206 @@
+import { getEnv } from "../util/runtime.js";
+import { CliError, EXIT_RUNTIME, EXIT_USAGE, networkFailure, } from "../cli/error.js";
+/** `CM_OPENAI_URL` points at a local fake in tests. Unset means the real
+ * endpoint, so production behavior is unchanged. */
+export function openAiBase() {
+    const endpoint = getEnv("CM_OPENAI_URL") ?? "https://api.openai.com/v1/responses";
+    return endpoint.replace(/\/responses\/?$/, "");
+}
+/** A failed response as actionable text. Only `error.message` is
+ * shown: the raw body can carry request ids that mean nothing in a terminal. */
+export function openAiError(model, status, body) {
+    let detail = "";
+    let code = "";
+    try {
+        const parsed = JSON.parse(body);
+        detail = String(parsed.error?.message ?? "");
+        code = String(parsed.error?.code ?? "");
+    }
+    catch {
+        detail = body.trim().slice(0, 200);
+    }
+    if (status === 401) {
+        return new CliError("openai_unauthorized", "OpenAI rejected the API key.", "Set a new one with co-maintainer set --token=...", EXIT_USAGE);
+    }
+    if (status === 400 && (code === "model_not_found" || /model/i.test(detail))) {
+        return new CliError("openai_unknown_model", `OpenAI does not know the model ${model}.`, "Pick one at https://platform.openai.com/docs/models and set it with co-maintainer set --high-model=...", EXIT_USAGE);
+    }
+    return new CliError("openai_failed", `OpenAI failed with ${status}${detail ? `: ${detail}` : "."}`, undefined, EXIT_RUNTIME);
+}
+/** The Chat-Completions-shaped message list every caller already builds
+ * (`chatBody` does the same fallback for OpenRouter). */
+function effectiveMessages(request) {
+    return (request.messages ?? [
+        ...(request.system
+            ? [{ role: "system", content: request.system }]
+            : []),
+        { role: "user", content: request.prompt },
+    ]);
+}
+/** `{type:"function",function:{name,parameters}}` (what `mermaid.ts` and the
+ * codegraph tools build) to Responses' flat shape. */
+function toResponsesTool(tool) {
+    const fn = (tool.function ?? {});
+    return {
+        type: "function",
+        name: String(fn.name ?? ""),
+        description: fn.description ? String(fn.description) : undefined,
+        parameters: fn.parameters,
+    };
+}
+/** A tool call and its result do not live inside a message the way Chat
+ * Completions nests them; each is its own item in `input`. */
+function toResponsesInput(messages) {
+    const input = [];
+    let instructions;
+    for (const message of messages) {
+        if (message.role === "system") {
+            instructions = instructions
+                ? `${instructions}\n\n${message.content ?? ""}`
+                : String(message.content ?? "");
+            continue;
+        }
+        if (message.role === "tool") {
+            input.push({
+                type: "function_call_output",
+                call_id: message.tool_call_id,
+                output: message.content ?? "",
+            });
+            continue;
+        }
+        if (message.tool_calls?.length) {
+            if (message.content) {
+                input.push({ role: "assistant", content: message.content });
+            }
+            for (const call of message.tool_calls) {
+                input.push({
+                    type: "function_call",
+                    call_id: call.id,
+                    name: call.function.name,
+                    arguments: call.function.arguments,
+                });
+            }
+            continue;
+        }
+        input.push({ role: message.role, content: message.content ?? "" });
+    }
+    return { instructions, input };
+}
+function responsesBody(model, request) {
+    const { instructions, input } = toResponsesInput(effectiveMessages(request));
+    const schema = request.responseFormat?.json_schema;
+    return {
+        model,
+        ...(instructions ? { instructions } : {}),
+        input,
+        max_output_tokens: request.maxTokens,
+        ...(request.reasoningEffort
+            ? { reasoning: { effort: request.reasoningEffort } }
+            : {}),
+        ...(request.tools?.length
+            ? {
+                tools: request.tools.map(toResponsesTool),
+                tool_choice: "auto",
+            }
+            : {}),
+        ...(schema
+            ? {
+                text: {
+                    format: {
+                        type: "json_schema",
+                        name: schema.name,
+                        schema: schema.schema,
+                        strict: schema.strict ?? false,
+                    },
+                },
+            }
+            : {}),
+    };
+}
+function parseResponsesBody(json, model) {
+    const output = Array.isArray(json.output)
+        ? json.output
+        : [];
+    const texts = [];
+    const toolCalls = [];
+    for (const item of output) {
+        if (item.type === "function_call" && item.call_id && item.name) {
+            toolCalls.push({
+                id: item.call_id,
+                type: "function",
+                function: { name: item.name, arguments: item.arguments ?? "{}" },
+            });
+            continue;
+        }
+        if (item.type !== "message")
+            continue;
+        for (const part of item.content ?? []) {
+            if (part.type === "refusal") {
+                throw new CliError("openai_refusal", `OpenAI refused to answer: ${part.refusal ?? "no reason given"}`, undefined, EXIT_RUNTIME);
+            }
+            if (part.type === "output_text" && part.text)
+                texts.push(part.text);
+        }
+    }
+    const usage = json.usage;
+    return {
+        text: texts.join(""),
+        ...(toolCalls.length ? { toolCalls } : {}),
+        tokensIn: Number(usage?.input_tokens ?? 0),
+        tokensOut: Number(usage?.output_tokens ?? 0),
+        // OpenAI's Responses API reports no dollar cost, so this is always
+        // unknown (`costReasonText`'s "provider_did_not_report").
+        cost: undefined,
+        model,
+        provider: "openai",
+    };
+}
+export class OpenAiProvider {
+    supportsTools = true;
+    endpoint = `${openAiBase()}/responses`;
+    apiKey;
+    model;
+    constructor(apiKey, model) {
+        if (!apiKey)
+            throw new Error("OpenAI requires an API key");
+        this.apiKey = apiKey;
+        this.model = model;
+    }
+    async post(body) {
+        try {
+            return await fetch(this.endpoint, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(body),
+            });
+        }
+        catch (error) {
+            throw networkFailure(this.endpoint, error);
+        }
+    }
+    async complete(request) {
+        let response = await this.post(responsesBody(this.model, request));
+        // A model may reject `text.format` next to tools. The schema is only a
+        // hint (the prompt also asks for a fenced JSON block), so one retry
+        // without it beats failing the review outright.
+        if (response.status === 400 && request.responseFormat) {
+            const detail = await response.text();
+            if (/text\.format|json_schema|structured/i.test(detail)) {
+                const { responseFormat: _dropped, ...withoutSchema } = request;
+                response = await this.post(responsesBody(this.model, withoutSchema));
+                if (response.ok) {
+                    return parseResponsesBody((await response.json()), this.model);
+                }
+                throw openAiError(this.model, response.status, await response.text());
+            }
+            throw openAiError(this.model, response.status, detail);
+        }
+        if (!response.ok) {
+            throw openAiError(this.model, response.status, await response.text());
+        }
+        return parseResponsesBody((await response.json()), this.model);
+    }
+}

package/dist/src/ai/opencode.d.ts

@@ -0,0 +1,10 @@
+import type { ChatHost } from "./openrouter.ts";
+import type { VerifyResult } from "./verify.ts";
+export type OpenCodeVariant = "opencode-zen" | "opencode-go";
+/** `CM_OPENCODE_URL` replaces the origin in tests. Zen and Go differ only in
+ * the path under it. */
+export declare function openCodeBase(variant: OpenCodeVariant): string;
+export declare function openCodeHost(variant: OpenCodeVariant): ChatHost;
+/** `/models` is public, so it proves nothing about the key. Only the model is
+ * checked here, and a bad key shows up on the first real call. */
+export declare function verifyOpenCode(variant: OpenCodeVariant, _apiKey: string, model?: string): Promise<VerifyResult>;

package/dist/src/ai/opencode.js

@@ -0,0 +1,76 @@
+/** OpenCode Zen and OpenCode Go, two gateways run by the OpenCode team.
+ *
+ * Both route each model to its own wire format (Responses, Messages, Chat
+ * Completions, Google), and the model list does not say which. Every model is
+ * called over Chat Completions instead of keeping a model to format table
+ * that goes stale with each new model. A model that refuses it fails with a
+ * hint that says so. */
+import { randomUUID } from "node:crypto";
+import { CliError, EXIT_USAGE } from "../cli/error.js";
+import { getEnv } from "../util/runtime.js";
+import { VERSION } from "../version.js";
+/** Go asks every client for one session id that stays the same for the run,
+ * so one per process. */
+const SESSION_ID = randomUUID();
+/** `CM_OPENCODE_URL` replaces the origin in tests. Zen and Go differ only in
+ * the path under it. */
+export function openCodeBase(variant) {
+    const origin = (getEnv("CM_OPENCODE_URL") ?? "https://opencode.ai").replace(/\/$/, "");
+    return `${origin}${variant === "opencode-go" ? "/zen/go/v1" : "/zen/v1"}`;
+}
+function displayName(variant) {
+    return variant === "opencode-go" ? "OpenCode Go" : "OpenCode Zen";
+}
+export function openCodeHost(variant) {
+    return {
+        provider: variant,
+        name: displayName(variant),
+        code: "opencode",
+        endpoint: `${openCodeBase(variant)}/chat/completions`,
+        // Go wants its own user agent and a stable session id from every client.
+        // Zen does not ask, and sending the same pair costs nothing.
+        headers: {
+            "User-Agent": `co-maintainer/${VERSION}`,
+            "x-opencode-session": SESSION_ID,
+        },
+        modelHint: "co-maintainer calls every OpenCode model over Chat Completions. Pick one that supports it from https://opencode.ai/docs/zen and set it with co-maintainer set --high-model=...",
+    };
+}
+/** `/models` is public, so it proves nothing about the key. Only the model is
+ * checked here, and a bad key shows up on the first real call. */
+export async function verifyOpenCode(variant, _apiKey, model) {
+    if (!model)
+        return { status: "ok" };
+    const name = displayName(variant);
+    let response;
+    try {
+        response = await fetch(`${openCodeBase(variant)}/models`);
+    }
+    catch (error) {
+        const code = error.cause?.code;
+        return { status: "unreachable", reason: code ?? "network error" };
+    }
+    if (!response.ok) {
+        return {
+            status: "unreachable",
+            reason: `${name} returned ${response.status}`,
+        };
+    }
+    let rows;
+    try {
+        rows = (await response.json()).data;
+    }
+    catch {
+        rows = undefined;
+    }
+    if (!Array.isArray(rows)) {
+        return { status: "unreachable", reason: `${name} returned no model list` };
+    }
+    if (!rows.some((row) => row?.id === model)) {
+        return {
+            status: "rejected",
+            error: new CliError("opencode_unknown_model", `${name} does not know the model ${model}.`, "Pick one from https://opencode.ai/docs/zen and set it with co-maintainer set --high-model=...", EXIT_USAGE),
+        };
+    }
+    return { status: "ok" };
+}

package/dist/src/ai/openrouter.d.ts

@@ -1,22 +1,38 @@
 import type { AiProvider, AiRequest, AiResponse } from "../types.ts";
 import { CliError } from "../cli/error.ts";
-/** Provider failures as actionable text (CORE-12, F24/F28). A 401 and a 400 for
+/** A service that speaks OpenAI-compatible Chat Completions. OpenRouter is
+ * one, OpenCode Zen and OpenCode Go are the others, so they share this client
+ * and differ only in where they live and how they name themselves. */
+export type ChatHost = {
+    provider: AiResponse["provider"];
+    /** Shown in every message, e.g. `OpenCode Zen rejected the API key.` */
+    name: string;
+    /** Prefix of the error codes, e.g. `openrouter_unauthorized`. */
+    code: string;
+    endpoint: string;
+    headers: Record<string, string>;
+    /** The hint for a model the host refuses. */
+    modelHint: string;
+};
+/** `CM_OPENROUTER_URL` points the provider at a local fake in tests. It is
+ * only a default override: with the env unset the real endpoint is used, so
+ * nothing changes for users. */
+export declare function openRouterHost(): ChatHost;
+/** Provider failures as actionable text. A 401 and a 400 for
  * an unknown model are preconditions the user can fix, so they are usage
  * errors; anything else is a runtime failure. Only the provider's own
  * `error.message` is surfaced: the raw body can carry account metadata
  * (`user_id`) that has no business in a terminal. */
-export declare function openRouterError(model: string, status: number, body: string): CliError;
+export declare function openRouterError(model: string, status: number, body: string, host?: ChatHost): CliError;
 export declare class OpenRouterProvider implements AiProvider {
     readonly supportsTools = true;
-    /** `CM_OPENROUTER_URL` points the provider at a local fake in tests. It is
-     * only a default override: with the env unset the real endpoint is used, so
-     * nothing changes for users. */
-    private readonly endpoint;
+    private readonly host;
     private readonly apiKey;
     private readonly model;
-    constructor(apiKey: string, model: string);
+    constructor(apiKey: string, model: string, host?: ChatHost);
     /** One POST. Returns the raw response so `complete` can decide whether the
      * failure is worth a retry without the schema. */
     private post;
+    private fail;
     complete(request: AiRequest): Promise<AiResponse>;
 }

package/dist/src/ai/openrouter.js

@@ -1,12 +1,29 @@
 import { chatBody, parseChatResponse } from "./provider.js";
 import { getEnv } from "../util/runtime.js";
 import { CliError, EXIT_RUNTIME, EXIT_USAGE, networkFailure, } from "../cli/error.js";
-/** Provider failures as actionable text (CORE-12, F24/F28). A 401 and a 400 for
+/** `CM_OPENROUTER_URL` points the provider at a local fake in tests. It is
+ * only a default override: with the env unset the real endpoint is used, so
+ * nothing changes for users. */
+export function openRouterHost() {
+    return {
+        provider: "openrouter",
+        name: "OpenRouter",
+        code: "openrouter",
+        endpoint: getEnv("CM_OPENROUTER_URL") ??
+            "https://openrouter.ai/api/v1/chat/completions",
+        headers: {
+            "HTTP-Referer": "https://github.com/GroophyLifefor/co-maintainer",
+            "X-Title": "co-maintainer",
+        },
+        modelHint: "Pick one at https://openrouter.ai/models and set it with co-maintainer set --high-model=...",
+    };
+}
+/** Provider failures as actionable text. A 401 and a 400 for
  * an unknown model are preconditions the user can fix, so they are usage
  * errors; anything else is a runtime failure. Only the provider's own
  * `error.message` is surfaced: the raw body can carry account metadata
  * (`user_id`) that has no business in a terminal. */
-export function openRouterError(model, status, body) {
+export function openRouterError(model, status, body, host = openRouterHost()) {
     let detail = "";
     try {
         const parsed = JSON.parse(body);
@@ -16,25 +33,22 @@ export function openRouterError(model, status, body) {
         detail = body.trim().slice(0, 200);
     }
     if (status === 401 || status === 403) {
-        return new CliError("openrouter_unauthorized", "OpenRouter rejected the API key.", "Set a new one with co-maintainer set --token=...", EXIT_USAGE);
+        return new CliError(`${host.code}_unauthorized`, `${host.name} rejected the API key.`, "Set a new one with co-maintainer set --token=...", EXIT_USAGE);
     }
     if (status === 400 && /model/i.test(detail)) {
-        return new CliError("openrouter_unknown_model", `OpenRouter does not know the model ${model}.`, `Pick one at https://openrouter.ai/models and set it with co-maintainer set --high-model=...`, EXIT_USAGE);
+        return new CliError(`${host.code}_unknown_model`, `${host.name} does not know the model ${model}.`, host.modelHint, EXIT_USAGE);
     }
-    return new CliError("openrouter_failed", `OpenRouter failed with ${status}${detail ? `: ${detail}` : "."}`, undefined, EXIT_RUNTIME);
+    return new CliError(`${host.code}_failed`, `${host.name} failed with ${status}${detail ? `: ${detail}` : "."}`, undefined, EXIT_RUNTIME);
 }
 export class OpenRouterProvider {
     supportsTools = true;
-    /** `CM_OPENROUTER_URL` points the provider at a local fake in tests. It is
-     * only a default override: with the env unset the real endpoint is used, so
-     * nothing changes for users. */
-    endpoint = getEnv("CM_OPENROUTER_URL") ??
-        "https://openrouter.ai/api/v1/chat/completions";
+    host;
     apiKey;
     model;
-    constructor(apiKey, model) {
+    constructor(apiKey, model, host = openRouterHost()) {
         if (!apiKey)
-            throw new Error("OpenRouter requires OPENROUTER_API_KEY");
+            throw new Error(`${host.name} requires an API key`);
+        this.host = host;
         this.apiKey = apiKey;
         this.model = model;
     }
@@ -42,42 +56,44 @@ export class OpenRouterProvider {
      * failure is worth a retry without the schema. */
     async post(body) {
         try {
-            return await fetch(this.endpoint, {
+            return await fetch(this.host.endpoint, {
                 method: "POST",
                 headers: {
                     Authorization: `Bearer ${this.apiKey}`,
                     "Content-Type": "application/json",
-                    "HTTP-Referer": "https://github.com/GroophyLifefor/co-maintainer",
-                    "X-Title": "co-maintainer",
+                    ...this.host.headers,
                 },
                 body: JSON.stringify(body),
             });
         }
         catch (error) {
-            // `fetch failed` alone names neither the host nor the cause (CORE-12).
-            throw networkFailure(this.endpoint, error);
+            // `fetch failed` alone names neither the host nor the cause.
+            throw networkFailure(this.host.endpoint, error);
         }
     }
+    fail(status, body) {
+        return openRouterError(this.model, status, body, this.host);
+    }
     async complete(request) {
         let response = await this.post(chatBody(this.model, request));
         // A provider may refuse `response_format` next to `tools`. The schema is
         // only a hint — the prompt also asks for a fenced JSON block — so one
-        // retry without it is better than failing the review (CORE-40).
+        // retry without it is better than failing the review.
         if (response.status === 400 && request.responseFormat) {
             const detail = await response.text();
             if (/response_format|json_schema|structured/i.test(detail)) {
                 const { responseFormat: _dropped, ...withoutSchema } = request;
                 response = await this.post(chatBody(this.model, withoutSchema));
                 if (response.ok) {
-                    return parseChatResponse((await response.json()), "openrouter", this.model);
+                    return parseChatResponse((await response.json()), this.host.provider, this.model);
                 }
-                throw openRouterError(this.model, response.status, await response.text());
+                throw this.fail(response.status, await response.text());
             }
-            throw openRouterError(this.model, response.status, detail);
+            throw this.fail(response.status, detail);
         }
         if (!response.ok) {
-            throw openRouterError(this.model, response.status, await response.text());
+            throw this.fail(response.status, await response.text());
         }
-        return parseChatResponse((await response.json()), "openrouter", this.model);
+        return parseChatResponse((await response.json()), this.host.provider, this.model);
     }
 }

package/dist/src/ai/pricing.js

@@ -1,4 +1,4 @@
-/** OpenRouter model prices for the probe estimate (CORE-24).
+/** OpenRouter model prices for the probe estimate.
  *
  * `/api/v1/models` is public: no key needed. The list is large and changes
  * slowly, so it is cached for 24 hours in cache.db. A network failure is not

package/dist/src/ai/provider.d.ts

@@ -1,4 +1,13 @@
 import type { AiProvider, AiRequest, AiResponse, Json, Options } from "../types.ts";
+/** The one list of accepted `--ai` values, so a new or retired provider is
+ * added or removed in a single place instead of the half dozen copies
+ * Hetzner's removal had to chase down. */
+export declare const AI_PROVIDERS: readonly ["none", "openrouter", "openai", "anthropic", "opencode-zen", "opencode-go"];
+/** The provider's own key variable. It is read only when that provider runs,
+ * so a key meant for one provider is never sent to another. */
+export declare function providerKeyEnv(ai: string, env: (name: string) => string | undefined): string | undefined;
+/** Hetzner was dropped in 0.5.1. Naming it beats a generic "must be one of". */
+export declare function rejectRetiredProvider(value: string | undefined): void;
 export declare function createAiProvider(options: Options, model: string): AiProvider | undefined;
 export declare function parseChatResponse(json: Json, provider: AiResponse["provider"], model: string): AiResponse;
 export declare function chatBody(model: string, request: AiRequest): Json;

package/dist/src/ai/provider.js

@@ -1,12 +1,51 @@
-import { HetznerProvider } from "./hetzner.js";
 import { OpenRouterProvider } from "./openrouter.js";
+import { OpenAiProvider } from "./openai.js";
+import { AnthropicProvider } from "./anthropic.js";
+import { openCodeHost } from "./opencode.js";
+import { die } from "../cli/error.js";
+/** The one list of accepted `--ai` values, so a new or retired provider is
+ * added or removed in a single place instead of the half dozen copies
+ * Hetzner's removal had to chase down. */
+export const AI_PROVIDERS = [
+    "none",
+    "openrouter",
+    "openai",
+    "anthropic",
+    "opencode-zen",
+    "opencode-go",
+];
+/** The provider's own key variable. It is read only when that provider runs,
+ * so a key meant for one provider is never sent to another. */
+export function providerKeyEnv(ai, env) {
+    if (ai === "openrouter")
+        return env("OPENROUTER_API_KEY");
+    if (ai === "opencode-zen" || ai === "opencode-go") {
+        return env("OPENCODE_API_KEY");
+    }
+    return undefined;
+}
+/** Hetzner was dropped in 0.5.1. Naming it beats a generic "must be one of". */
+export function rejectRetiredProvider(value) {
+    if (value === "hetzner") {
+        die("Hetzner is no longer supported. Use openrouter or none.");
+    }
+}
 export function createAiProvider(options, model) {
     if (options.ai === "none")
         return undefined;
     if (options.ai === "openrouter") {
         return new OpenRouterProvider(options.aiToken ?? "", model);
     }
-    return new HetznerProvider(options.aiToken ?? "", model);
+    if (options.ai === "openai") {
+        return new OpenAiProvider(options.aiToken ?? "", model);
+    }
+    if (options.ai === "anthropic") {
+        return new AnthropicProvider(options.aiToken ?? "", model);
+    }
+    if (options.ai === "opencode-zen" || options.ai === "opencode-go") {
+        return new OpenRouterProvider(options.aiToken ?? "", model, openCodeHost(options.ai));
+    }
+    die(`${options.ai} support is not finished yet. Use openrouter or none.`);
 }
 export function parseChatResponse(json, provider, model) {
     const choice = Array.isArray(json.choices)
@@ -59,7 +98,7 @@ export function chatBody(model, request) {
         ...(request.tools?.length
             ? { tools: request.tools, tool_choice: "auto" }
             : {}),
-        // A review asks for structured output (CORE-40). The schema is sent even
+        // A review asks for structured output. The schema is sent even
         // when tools are present, because most providers accept the pair; one that
         // rejects it gets a single retry without the schema (see
         // `OpenRouterProvider.complete`), and the prompt also asks for a fenced

package/dist/src/ai/verify.d.ts

@@ -1,4 +1,4 @@
-/** Pre-flight checks for `config set` (CORE-22, F35).
+/** Pre-flight checks for `config set`.
  *
  * A wrong API key or an unknown model used to be accepted by `set` and only
  * surfaced during a review, after the pull request had been fetched and
@@ -23,3 +23,11 @@ export type VerifyResult = {
  * lists it. The first failure decides: a bad key is reported before a model
  * question, since the model check would fail on the key too. */
 export declare function verifyOpenRouter(apiKey: string, model?: string): Promise<VerifyResult>;
+/** Same shape as {@link verifyOpenRouter}: `/models` both authenticates the
+ * key and, when `model` is given, confirms OpenAI actually has it. */
+export declare function verifyOpenAi(apiKey: string, model?: string): Promise<VerifyResult>;
+/** Anthropic authenticates the key and lists models at `/models`, but with its
+ * own headers (`x-api-key` + `anthropic-version`) instead of a Bearer token.
+ * Without a model the call only proves the key; with one it also confirms
+ * Anthropic serves it. */
+export declare function verifyAnthropic(apiKey: string, model?: string): Promise<VerifyResult>;