codeshark-cli 0.1.1 → 0.1.4

package/dist/models.js

@@ -5,31 +5,31 @@ export const MODELS = [
         provider: "unorouter",
         model: "gpt-5.6-sol:free",
         context: "400K",
-        notes: "OpenAI's frontier reasoning model.",
+        notes: "Frontier reasoning model when available.",
     },
     {
         id: "unorouter/deepseek-v4-flash",
         label: "DeepSeek-V4 Flash",
         provider: "unorouter",
-        model: "deepseek-v4-flash-0731:free",
+        model: "deepseek-v4-flash:free",
         context: "256K",
-        notes: "DeepSeek's fast flash model, strong at code.",
+        notes: "Fast coding model when available.",
     },
     {
-        id: "unorouter/glm-5.3-flash-thinking",
-        label: "GLM 5.3 Flash Thinking",
+        id: "unorouter/minimax-m3",
+        label: "MiniMax M3",
         provider: "unorouter",
-        model: "glm-5.3-flash-thinking:free",
-        context: "1M",
-        notes: "Zhipu's reasoning coder with 1M context — the default.",
+        model: "minimax-m3:free",
+        context: "128K",
+        notes: "Fast general-purpose coding and reasoning.",
     },
     {
-        id: "unorouter/kimi-k3",
-        label: "Kimi-K3",
+        id: "unorouter/glm-5.3-flash-think-search",
+        label: "GLM 5.3 Flash Think Search",
         provider: "unorouter",
-        model: "kimi-k3:free",
-        context: "256K",
-        notes: "Moonshot's flagship coding model.",
+        model: "glm-5.3-flash-think-search:free",
+        context: "1M",
+        notes: "Reasoning model with search-oriented thinking.",
     },
     {
         id: "unorouter/gemini-3.6-flash",
@@ -37,16 +37,49 @@ export const MODELS = [
         provider: "unorouter",
         model: "gemini-3.6-flash:free",
         context: "1M",
-        notes: "Google's fast flash model with a huge 1M context.",
+        notes: "Fast long-context model for large codebases.",
+    },
+    {
+        id: "unorouter/sarvam-30b",
+        label: "Sarvam 30B",
+        provider: "unorouter",
+        model: "sarvam-30b:free",
+        context: "128K",
+        notes: "Open coding model from Sarvam AI.",
+    },
+    {
+        id: "unorouter/gpt-oss-120b",
+        label: "GPT-OSS 120B",
+        provider: "unorouter",
+        model: "gpt-oss-120b:free",
+        context: "128K",
+        notes: "Large open-weight model for demanding coding tasks.",
+    },
+    {
+        id: "unorouter/nemotron-3-ultra-550b-a55b",
+        label: "Nemotron 3 Ultra 550B A55B",
+        provider: "unorouter",
+        model: "nemotron-3-ultra-550b-a55b:free",
+        context: "256K",
+        notes: "Large-scale open model for deep reasoning.",
     },
 ];
-export const DEFAULT_MODEL_ID = "unorouter/glm-5.3-flash-thinking";
+export const RETIRED_MODELS = [
+    { id: "gemini/gemini-3.8-flash", label: "Gemini 3.8 Flash", provider: "gemini", model: "gemini-3.8-flash", context: "-", notes: "Removed from the catalog.", available: false },
+    { id: "unorouter/glm-5.3-flash-thinking", label: "GLM 5.3 Flash Thinking", provider: "unorouter", model: "glm-5.3-flash-thinking:free", context: "-", notes: "Removed from UnoRouter.", available: false },
+    { id: "unorouter/kimi-k3", label: "Kimi-K3", provider: "unorouter", model: "kimi-k3:free", context: "-", notes: "Removed from UnoRouter.", available: false },
+];
+export const DEFAULT_MODEL_ID = "unorouter/glm-5.3-flash-think-search";
 export function listModels() {
     return [...MODELS];
 }
+export function isRetiredModel(idOrSlug) {
+    const s = idOrSlug.trim();
+    return RETIRED_MODELS.some((m) => m.id === s || m.model === s);
+}
 export function findModel(idOrSlug) {
     const s = idOrSlug.trim();
-    return MODELS.find((m) => m.id === s || m.model === s);
+    return [...MODELS, ...RETIRED_MODELS].find((m) => m.id === s || m.model === s);
 }
 /** Map a catalog id (or raw slug) to the raw slug the provider API expects. */
 export function toApiSlug(idOrSlug) {

package/dist/project.js

@@ -1,5 +1,5 @@
-import { statSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { statSync, lstatSync, realpathSync } from "node:fs";
+import { isAbsolute, dirname, relative, resolve, sep } from "node:path";
 export class ProjectFolderError extends Error {
     constructor(message) {
         super(message);
@@ -22,10 +22,24 @@ export function requireProjectFolder(folder = process.cwd()) {
 export function resolveProjectPath(input, cwd) {
     const root = resolve(cwd);
     const target = isAbsolute(input) ? resolve(input) : resolve(root, input);
-    const rel = relative(root, target);
-    if (rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel)))
-        return target;
-    throw new ProjectFolderError(`Path escapes the project folder: ${input}`);
+    const inside = (base, candidate) => {
+        const path = relative(base, candidate);
+        return path === "" || (path !== ".." && !path.startsWith(".." + sep) && !isAbsolute(path));
+    };
+    if (!inside(root, target))
+        throw new ProjectFolderError("Path escapes the project folder: " + input);
+    // Validate existing ancestors so links cannot redirect new writes outside the project.
+    let ancestor = target;
+    while (!lstatSync(ancestor, { throwIfNoEntry: false })) {
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            throw new ProjectFolderError("Cannot resolve project path: " + input);
+        ancestor = parent;
+    }
+    if (!inside(realpathSync(root), realpathSync(ancestor))) {
+        throw new ProjectFolderError("Path escapes the project folder through a link: " + input);
+    }
+    return target;
 }
 /** Change into an explicitly selected project folder before starting CodeShark. */
 export function openProjectFolder(folder) {

package/dist/provider/index.js

@@ -1,10 +1,11 @@
-import { activeProvider, envApiKey } from "../config.js";
+import { activeModelId, activeProvider, envApiKey } from "../config.js";
 import { createGatewayClient } from "./gateway.js";
 import { createGeminiClient } from "./gemini.js";
 import { createNvidiaClient } from "./nvidia.js";
 import { createOllamaClient } from "./ollama.js";
 import { createOpenRouterClient } from "./openrouter.js";
 import { createUnoRouterClient } from "./unorouter.js";
+import { findModel } from "../models.js";
 /**
  * Build the ordered list of ChatClients for this machine:
  * the active model's provider first, then automatic free fallbacks
@@ -18,6 +19,7 @@ export function resolveClients(cfg, debug) {
     };
     const has = (provider) => clients.some((c) => c.provider === provider);
     const primary = activeProvider(cfg);
+    const selectedModel = activeModelId(cfg);
     switch (primary) {
         case "openrouter": {
             const key = cfg.openrouterApiKey ?? envApiKey("openrouter");
@@ -63,6 +65,10 @@ export function resolveClients(cfg, debug) {
             add(createGatewayClient(cfg));
             break;
     }
+    // UnoRouter catalog selections must not silently become a different model
+    // through another provider's fallback chain.
+    if (selectedModel.startsWith("unorouter/") || findModel(selectedModel))
+        return clients;
     // Automatic free fallbacks, deduped: any other provider you have a key for.
     if (!has("openrouter")) {
         const key = cfg.openrouterApiKey ?? envApiKey("openrouter");

package/dist/provider/nvidia.js

@@ -3,7 +3,7 @@ import { effectiveModel } from "../config.js";
 import { toApiSlug } from "../models.js";
 export const DEFAULT_NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
 /**
- * NVIDIA NIM hosts open models (DeepSeek, Kimi, GLM, Nemotron, …) behind a
+ * NVIDIA NIM hosts open models behind a
  * free, OpenAI-compatible API. Get a key at https://build.nvidia.com —
  * no credit card, keys start with `nvapi-`.
  */

package/dist/provider/openaiCompat.js

@@ -1,3 +1,4 @@
+import { setTimeout as delay } from "node:timers/promises";
 import { ProviderError, classifyStatus, errorMessage, } from "./types.js";
 function toOpenAIMessages(messages) {
     const out = [];
@@ -37,7 +38,7 @@ function safeParseArgs(raw) {
         return {};
     try {
         const parsed = JSON.parse(raw);
-        return parsed && typeof parsed === "object" ? parsed : {};
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
     }
     catch {
         return {};
@@ -52,57 +53,78 @@ export function createOpenAICompatClient(opts) {
         model: opts.model,
         isFree: opts.isFree ?? true,
         async chat(messages, tools, events, signal) {
-            const body = {
-                model: opts.model,
-                messages: toOpenAIMessages(messages),
-                stream: true,
-                temperature: 0.3,
-            };
-            if (tools.length)
-                body.tools = toOpenAITools(tools);
-            const headers = {
-                "content-type": "application/json",
-                ...(opts.apiKey ? { authorization: `Bearer ${opts.apiKey}` } : {}),
-                ...opts.extraHeaders,
-            };
-            // Wait out rate limits with backoff before surfacing a 429 — the
-            // queue lives client-side too, so shared gateway lanes feel smooth.
-            const retryDelays = opts.rateLimitRetryDelays ?? [800, 1600];
-            let res;
-            for (let attempt = 0;; attempt++) {
-                let candidate;
-                try {
-                    candidate = await fetchImpl(endpoint, {
-                        method: "POST",
-                        headers,
-                        body: JSON.stringify(body),
-                        signal,
-                    });
+            signal?.throwIfAborted();
+            const controller = new AbortController();
+            const abort = () => controller.abort(signal?.reason);
+            signal?.addEventListener("abort", abort, { once: true });
+            const timeout = setTimeout(() => controller.abort(new Error("Provider request timed out.")), opts.timeoutMs ?? 120_000);
+            try {
+                const body = {
+                    model: opts.model,
+                    messages: toOpenAIMessages(messages),
+                    stream: true,
+                    temperature: 0.3,
+                };
+                if (tools.length)
+                    body.tools = toOpenAITools(tools);
+                const headers = {
+                    "content-type": "application/json",
+                    ...(opts.apiKey ? { authorization: `Bearer ${opts.apiKey}` } : {}),
+                    ...opts.extraHeaders,
+                };
+                // Wait out rate limits with backoff before surfacing a 429 — the
+                // queue lives client-side too, so shared gateway lanes feel smooth.
+                const retryDelays = opts.rateLimitRetryDelays ?? [800, 1600];
+                let res;
+                for (let attempt = 0;; attempt++) {
+                    let candidate;
+                    try {
+                        candidate = await fetchImpl(endpoint, {
+                            method: "POST",
+                            headers,
+                            body: JSON.stringify(body),
+                            signal: controller.signal,
+                        });
+                    }
+                    catch (e) {
+                        throw new ProviderError(`Cannot reach ${opts.provider} at ${base}: ${errorMessage(e)}`, "network");
+                    }
+                    if (candidate.status !== 429 || attempt >= retryDelays.length) {
+                        res = candidate;
+                        break;
+                    }
+                    await candidate.body?.cancel();
+                    const retryAfter = candidate.headers.get("retry-after");
+                    const seconds = retryAfter === null ? NaN : Number(retryAfter);
+                    const suggested = Number.isFinite(seconds) ? seconds * 1000 : retryAfter ? Date.parse(retryAfter) - Date.now() : NaN;
+                    const wait = Number.isFinite(suggested) ? Math.min(30_000, Math.max(0, suggested)) : retryDelays[attempt];
+                    await delay(wait, undefined, { signal: controller.signal });
                 }
-                catch (e) {
-                    throw new ProviderError(`Cannot reach ${opts.provider} at ${base}: ${errorMessage(e)}`, "network");
+                if (!res.ok) {
+                    const raw = await res.text();
+                    let detail = raw.slice(0, 300);
+                    try {
+                        const data = JSON.parse(raw);
+                        if (typeof data?.error?.message === "string")
+                            detail = data.error.message.slice(0, 300);
+                    }
+                    catch { /* Preserve plain-text errors from proxies. */ }
+                    throw classifyStatus(res.status, opts.provider, detail);
                 }
-                if (candidate.status !== 429 || attempt >= retryDelays.length) {
-                    res = candidate;
-                    break;
+                if (!res.body) {
+                    throw new ProviderError(`${opts.provider}: empty response body`, "unknown");
                 }
-                await new Promise((r) => setTimeout(r, retryDelays[attempt]));
+                return await parseOpenAIStream(res.body, opts.provider, events);
             }
-            if (!res.ok) {
-                let detail = "";
-                try {
-                    const j = (await res.json());
-                    detail = j.error?.message ?? JSON.stringify(j).slice(0, 300);
-                }
-                catch {
-                    detail = (await res.text().catch(() => "")).slice(0, 300);
-                }
-                throw classifyStatus(res.status, opts.provider, detail);
+            catch (error) {
+                if (controller.signal.aborted)
+                    throw controller.signal.reason;
+                throw error;
             }
-            if (!res.body) {
-                throw new ProviderError(`${opts.provider}: empty response body`, "unknown");
+            finally {
+                clearTimeout(timeout);
+                signal?.removeEventListener("abort", abort);
             }
-            return parseOpenAIStream(res.body, opts.provider, events);
         },
     };
 }
@@ -111,17 +133,24 @@ async function parseOpenAIStream(body, provider, events) {
     const decoder = new TextDecoder();
     let buffer = "";
     let content = "";
+    let completed = false;
+    let doneMarker = false;
     const pending = new Map();
     const finalized = new Map();
     const handleData = (data) => {
-        if (!data || data === "[DONE]")
+        if (!data)
             return;
+        if (data === "[DONE]") {
+            doneMarker = true;
+            completed = true;
+            return;
+        }
         let json;
         try {
             json = JSON.parse(data);
         }
         catch {
-            return;
+            throw new ProviderError(provider + ": malformed stream event", "network");
         }
         if (json.error) {
             const err = json.error;
@@ -151,6 +180,9 @@ async function parseOpenAIStream(body, provider, events) {
             }
         }
         if (choice.finish_reason) {
+            completed = true;
+            if (choice.finish_reason === "length")
+                throw new ProviderError(provider + ": response exceeded the token limit; narrow the task.", "model");
             for (const [idx, tc] of pending)
                 finalized.set(idx, tc);
             pending.clear();
@@ -165,12 +197,17 @@ async function parseOpenAIStream(body, provider, events) {
             const lines = buffer.split("\n");
             buffer = lines.pop() ?? "";
             for (const line of lines) {
+                if (doneMarker)
+                    break;
                 const trimmed = line.trim();
                 if (trimmed.startsWith("data:"))
                     handleData(trimmed.slice(5).trim());
             }
+            if (doneMarker)
+                break;
         }
-        if (buffer.trim()) {
+        buffer += decoder.decode();
+        if (!doneMarker && buffer.trim()) {
             const trimmed = buffer.trim();
             if (trimmed.startsWith("data:"))
                 handleData(trimmed.slice(5).trim());
@@ -181,12 +218,20 @@ async function parseOpenAIStream(body, provider, events) {
             throw e;
         throw new ProviderError(`${provider}: stream interrupted: ${errorMessage(e)}`, "network");
     }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+    if (!completed)
+        throw new ProviderError(provider + ": stream ended before completion; please retry.", "network");
+    for (const [index, call] of pending)
+        finalized.set(index, call);
     const toolCalls = [...finalized.values()]
         .filter((c) => c.name)
         .map((c) => ({
         id: c.id || `call_${Math.random().toString(36).slice(2, 10)}`,
         name: c.name,
-        args: safeParseArgs(c.args),
+        args: parseToolArgs(c.args, provider),
     }));
     return {
         role: "assistant",
@@ -194,5 +239,14 @@ async function parseOpenAIStream(body, provider, events) {
         toolCalls: toolCalls.length ? toolCalls : undefined,
     };
 }
+function parseToolArgs(raw, provider) {
+    try {
+        const parsed = JSON.parse(raw || "{}");
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+            return parsed;
+    }
+    catch { /* Reject partial tool arguments instead of executing an empty object. */ }
+    throw new ProviderError(provider + ": invalid tool arguments; no action was executed.", "model");
+}
 /** Exported for tests. */
 export { toOpenAIMessages, toOpenAITools, safeParseArgs };