create-walle 0.10.2 → 0.10.3

package/template/wall-e/http/model-delegate-pref-admin.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Delegate model preferences (lead-and-delegate-model-picker-ux-2026-10-08.html §6.4):
-//   GET    /api/models/delegate-prefs?ctm_session_id=&agent=claude|codex
+//   GET    /api/models/delegate-prefs?ctm_session_id=&agent=claude|codex|opencode
 //            -> { effective:{lane,model,route_id,identity_id,display,effort,source}, ladder:[...] }
 //   PUT    /api/models/delegate-prefs { scope_key, lane, model, identity_id, route_id, display, effort } -> { row }
 //   DELETE /api/models/delegate-prefs/:scope_key -> { ok, deleted }
@@ -30,14 +30,14 @@ async function handleDelegatePrefAdminRoute({ req, res, p, m, url, brainApi } =
     const db = brainApi.getDb();
     if (m === 'GET') {
       const agent = url && url.searchParams ? url.searchParams.get('agent') : '';
-      if (!store.AGENTS.includes(agent)) return invalid(res, 'agent: must be claude or codex');
+      if (!store.AGENTS.includes(agent)) return invalid(res, 'agent: must be claude, codex or opencode');
       const ctmSessionId = (url.searchParams.get('ctm_session_id') || '').trim();
       if (ctmSessionId && !store.isValidScopeKey(`session:${ctmSessionId}`)) return invalid(res, 'ctm_session_id: not a valid session id');
       return jsonResponse(res, 200, store.effectiveDelegatePref(db, { ctmSessionId, agent }));
     }
     if (m === 'DELETE') {
       const scopeKey = decodeOnce(item[1]);
-      if (!store.isValidScopeKey(scopeKey)) return invalid(res, 'scope_key: must be session:<ctm_session_id>, default:claude or default:codex');
+      if (!store.isValidScopeKey(scopeKey)) return invalid(res, 'scope_key: must be session:<ctm_session_id>, default:claude, default:codex or default:opencode');
       return jsonResponse(res, 200, store.deleteDelegatePref(db, scopeKey));
     }
     let body;

package/template/wall-e/http/model-proxy-providers.js

@@ -85,4 +85,177 @@ function handleModelProxyProvidersFeed(req, res, url, {
   return true;
 }
 
-module.exports = { handleModelProxyProvidersFeed };
+// WP-1 (docs/remote-box-model-access-2026-10-26.html §6.1, §9): `GET /api/wall-e/internal/
+// delegate-defaults` — the box's own /delegate picks, for the hub that is asking what the box can
+// serve. Loopback-only under the SAME guard as the provider feed above (the values are not secrets —
+// CTM asks for them over its own loopback Wall-E client — but a row here names a route on this
+// machine, and the feed's rule is that this surface is never reachable from off-box).
+//
+// It answers ONLY the two `default:*` rows (§6.1: "the two default:* rows of delegate_model_prefs
+// and nothing for session:*"): a `session:<ctm_session_id>` row is another user's in-flight pick and
+// is never part of "what can this box serve".
+const DELEGATE_DEFAULT_AGENTS = Object.freeze(['claude', 'codex']);
+
+/** The two default rows, in `{ agent, lane, model, routeId }` shape. Absent rows are omitted. */
+function _readDelegateDefaults() {
+  const store = require('../brain/delegate-model-prefs-store');
+  const db = require('../brain').getDb();
+  const rows = [];
+  for (const agent of DELEGATE_DEFAULT_AGENTS) {
+    const row = store.getDelegatePref(db, `default:${agent}`);
+    if (!row) continue;
+    rows.push({
+      agent,
+      lane: String(row.lane || ''),
+      model: String(row.model || ''),
+      routeId: String(row.route_id || ''),
+    });
+  }
+  return rows;
+}
+
+function handleDelegateDefaultsFeed(req, res, url, {
+  isLoopbackRequest,
+  brainAvailable,
+  readDefaults,
+  errorStatus,
+} = {}) {
+  if (url.pathname !== '/api/wall-e/internal/delegate-defaults' || req.method !== 'GET') return false;
+  if (typeof isLoopbackRequest !== 'function' || !isLoopbackRequest(req)) {
+    jsonResponse(res, { error: 'loopback_only' }, 403);
+    return true;
+  }
+  if (!brainAvailable) {
+    jsonResponse(res, { error: 'Brain not available' }, 503);
+    return true;
+  }
+  try {
+    const defaults = (typeof readDefaults === 'function' ? readDefaults : _readDelegateDefaults)();
+    jsonResponse(res, { ok: true, defaults: Array.isArray(defaults) ? defaults : [] }, 200);
+  } catch (error) {
+    errorSink.report('api-walle', 'delegate_defaults_feed', new Error('Delegate default read failed'));
+    jsonResponse(res, { error: 'Failed to read delegate defaults' }, typeof errorStatus === 'function' ? errorStatus(error) : 500);
+  }
+  return true;
+}
+
+// ---------------------------------------------------------------------------------------------
+// WP-5 (docs/remote-box-model-access-2026-10-26.html §5.1 R-5/R-6, §6.4): the ONE place a
+// provider credential leaves Wall-E, and only to loopback.
+//
+// "Use on <box>" copies ONE hub route (with its key) onto a machine the user paired, on an explicit
+// click. The key lives only in `model_providers.api_key_encrypted`, and the hub's CTM reads it
+// through this leaf — never through a browser-facing route — then hands it to the box over the
+// hub's own peer credential. R-5/R-6: the copy is per-route and user-initiated, never a bulk
+// export, never a sync.
+//
+// The row is an ALLOWLIST, not a copy of the DB row: exactly the fields the raw upsert route
+// accepts (http/model-admin.js's `POST /api/models/providers` → brain/models.js's
+// `upsertModelProvider`, whose destructuring is id/name/type/baseUrl/apiKeyEncrypted/customHeaders/
+// enabled/caCertPem/maxOutputTokens/reasoningField/reasoningEffortDefault, with the route accepting
+// the snake_case aliases for the three config columns and `caCert` for the PEM). Custom headers,
+// usage/health counters and every derived column stay behind. Nothing here is logged: the error
+// paths write fixed strings, and the response is the only carrier of the key, to a loopback socket.
+// ---------------------------------------------------------------------------------------------
+
+const PROVIDER_EXPORT_PATH = '/api/wall-e/internal/provider-export';
+/** Longest accepted `id` query value. A longer one cannot name a row, so it is the same 404. */
+const MAX_EXPORT_ID_CHARS = 200;
+/** Per-field bound for the exported strings — mirrors the shapes the admin routes accept. */
+const EXPORT_FIELD_CHARS = Object.freeze({
+  id: 200, name: 200, type: 60, base_url: 500, auth_method: 60, api_key: 512, ca_cert_pem: 70000,
+});
+
+/** `value` as a bounded string, or null when absent/not a string. Never throws, never logs. */
+function _exportString(value, max) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return trimmed.slice(0, max);
+}
+
+/**
+ * The exported row for `id`: an allowlist of the raw upsert's own field names (the snake_case
+ * spellings `POST /api/models/providers` maps explicitly), plus the credential under `api_key` — the
+ * §6.4 wire name the box's `POST /api/models/import` validates and maps onto its own upsert call.
+ * The key is the ONLY secret here; `ca_cert_pem` is trust material the route's sibling write also
+ * carries, and it is omitted when the row has none.
+ *
+ * @returns {object|null} null when the row does not exist
+ */
+function _exportRowFor(row) {
+  if (!row || typeof row !== 'object') return null;
+  const id = _exportString(row.id, EXPORT_FIELD_CHARS.id);
+  if (!id) return null;
+  const exported = { id };
+  for (const [key, column] of [
+    ['name', 'name'],
+    ['type', 'type'],
+    ['base_url', 'base_url'],
+    ['auth_method', 'auth_method'],
+  ]) {
+    const value = _exportString(row[column], EXPORT_FIELD_CHARS[key]);
+    if (value !== null) exported[key] = value;
+  }
+  const apiKey = _exportString(row.api_key_encrypted, EXPORT_FIELD_CHARS.api_key);
+  if (apiKey !== null) exported.api_key = apiKey;
+  // `enabled` is an INTEGER column (0/1) in the brain; the import row speaks the same boolean the
+  // upsert takes, so a 0 is forwarded as false rather than as a truthy number.
+  exported.enabled = !(row.enabled === 0 || row.enabled === false);
+  if (Number.isInteger(row.max_output_tokens) && row.max_output_tokens > 0) {
+    exported.max_output_tokens = row.max_output_tokens;
+  }
+  const reasoningField = _exportString(row.reasoning_field, 60);
+  if (reasoningField !== null) exported.reasoning_field = reasoningField;
+  const reasoningEffort = _exportString(row.reasoning_effort_default, 40);
+  if (reasoningEffort !== null) exported.reasoning_effort_default = reasoningEffort;
+  const caCertPem = _exportString(row.ca_cert_pem, EXPORT_FIELD_CHARS.ca_cert_pem);
+  if (caCertPem !== null) exported.ca_cert_pem = caCertPem;
+  return exported;
+}
+
+/**
+ * §6.4: `GET /api/wall-e/internal/provider-export?id=<id>` — the hub's CTM reads ONE row WITH its
+ * key through this leaf, so the copy leg never has to reach into the brain itself. Loopback only,
+ * with the same guard and the same refusals as the two leaves above; an unknown id is a 404 that
+ * carries no row, and every failure reply is a constant (a DB error must not become a message or a
+ * leaked row).
+ */
+function handleProviderExport(req, res, url, {
+  readBrain,
+  isLoopbackRequest,
+  brainAvailable,
+  errorStatus,
+} = {}) {
+  if (url.pathname !== PROVIDER_EXPORT_PATH || req.method !== 'GET') return false;
+  if (typeof isLoopbackRequest !== 'function' || !isLoopbackRequest(req)) {
+    jsonResponse(res, { error: 'loopback_only' }, 403);
+    return true;
+  }
+  if (!brainAvailable) {
+    jsonResponse(res, { error: 'Brain not available' }, 503);
+    return true;
+  }
+  const id = String(url.searchParams.get('id') || '');
+  if (!id || id.length > MAX_EXPORT_ID_CHARS) {
+    jsonResponse(res, { error: 'Provider not found' }, 404);
+    return true;
+  }
+  void (async () => {
+    try {
+      const row = await readBrain('getModelProviderWithKey', [id]);
+      const exported = _exportRowFor(row);
+      if (!exported) {
+        jsonResponse(res, { error: 'Provider not found' }, 404);
+        return;
+      }
+      jsonResponse(res, { ok: true, row: exported }, 200);
+    } catch (error) {
+      errorSink.report('api-walle', 'provider_export', new Error('Provider export read failed'));
+      jsonResponse(res, { error: 'Failed to read provider' }, typeof errorStatus === 'function' ? errorStatus(error) : 500);
+    }
+  })();
+  return true;
+}
+
+module.exports = { handleModelProxyProvidersFeed, handleDelegateDefaultsFeed, handleProviderExport };

package/template/wall-e/http/model-route-health.js

@@ -0,0 +1,157 @@
+'use strict';
+
+// WP-2 (lead-route-model-invocability-preflight, D-3/D-4/D-6): CTM probes a
+// (route, model) pair before it parks a routed Lead and POSTs the verdict here.
+// The verdict is written into the EXISTING per-route+model circuit breaker
+// (`provider_model_circuit_breakers`, key `${route_id}:${model}` lower-cased —
+// llm/provider-health-state.js's providerModelKey) and then read back by
+// `GET /api/models/coding-catalog`, which annotates every route with the
+// circuit. No new state, no new constant, no new flag: D-8's "nothing else
+// changes" rule.
+const { jsonResponse, readSmallJsonBody } = require('./model-admin-shared');
+const errorSink = require('../lib/error-sink');
+// Read off the module object (not destructured) so the catalog annotation's
+// one-build-per-call property stays observable to callers/tests that spy on the
+// factory; the lookup itself is built once per annotateCatalogRouteCircuits call.
+const providerHealthState = require('../llm/provider-health-state');
+
+const ROUTE_HEALTH_PATH = '/api/models/route-health';
+
+// D-2: only the non-retryable, pair-class outcomes are recorded. A retryable
+// condition (rate limit, overload, 5xx) or an unknown/absent outcome is a
+// property of the moment, not of the pair — CTM refuses to spend a circuit on
+// it, and so does this endpoint (400, nothing written).
+const NON_RETRYABLE_OUTCOMES = new Set([
+  'model_not_invocable',
+  'model_access_denied',
+  // §12a rule 4: the route does not serve this model id at all. Recorded like the other pair-class
+  // outcomes (error_type `model_unavailable`), and only ever sent for a single-wire route.
+  'model_not_found',
+  'invalid_prompt',
+  'context_length_exceeded',
+  'insufficient_quota',
+]);
+
+function isNonEmptyString(value, maxLength) {
+  if (typeof value !== 'string') return false;
+  const trimmed = value.trim();
+  return trimmed.length >= 1 && trimmed.length <= maxLength;
+}
+
+function isValidOptionalHttpStatus(value) {
+  if (value == null) return true;
+  return Number.isInteger(value) && value >= 100 && value <= 599;
+}
+
+function isValidOutcome(body) {
+  if (body.ok === true) return body.outcome == null;
+  return typeof body.outcome === 'string' && NON_RETRYABLE_OUTCOMES.has(body.outcome);
+}
+
+// Validates CTM's probe verdict; null means "acceptable", otherwise the reason
+// is unused today but kept for the 400 body and future diagnostics.
+function invalidRouteHealthReason(body) {
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return 'body';
+  if (!isNonEmptyString(body.route_id, 120)) return 'route_id';
+  if (!isNonEmptyString(body.model, 200)) return 'model';
+  if (typeof body.ok !== 'boolean') return 'ok';
+  if (!isValidOutcome(body)) return 'outcome';
+  if (!isValidOptionalHttpStatus(body.http_status)) return 'http_status';
+  return null;
+}
+
+function routeHealthStatusFor(row, body) {
+  const routeId = body.route_id.trim();
+  const model = body.model.trim();
+  const ok = body.ok === true;
+  return {
+    provider: row.type,
+    provider_id: routeId,
+    provider_type: row.type,
+    runtime_type: row.type,
+    model,
+    ok,
+    source: 'ctm-lead-preflight',
+    error_type: ok ? '' : (body.outcome === 'model_access_denied' ? 'auth_error' : 'model_unavailable'),
+    error: ok ? '' : body.outcome,
+    checked_at: new Date().toISOString(),
+  };
+}
+
+// POST /api/models/route-health — see §5 D-3/D-4 and §6.3. Returns a truthy
+// response value when it handled the request, null otherwise (the caller's
+// one-line dispatch convention).
+async function handleModelRouteHealthRoute({ req, res, p, m, brainApi, deps = {} } = {}) {
+  if (p !== ROUTE_HEALTH_PATH || m !== 'POST') return null;
+  let body;
+  try {
+    body = await readSmallJsonBody(req);
+  } catch {
+    // an unparseable / oversized body is a caller error, not a brain error
+    return jsonResponse(res, 400, { error: 'invalid_route_health' });
+  }
+  try {
+    if (invalidRouteHealthReason(body)) return jsonResponse(res, 400, { error: 'invalid_route_health' });
+    if (!brainApi) return jsonResponse(res, 500, { error: 'Wall-E brain not available' });
+    const routeId = body.route_id.trim();
+    const model = body.model.trim();
+    const row = (brainApi.listModelProviders() || []).find((r) => r && r.id === routeId);
+    if (!row) return jsonResponse(res, 404, { error: 'route_not_found' });
+    const brain = deps.brain || require('../lib/brain-events').getBrainCapabilities();
+    providerHealthState.recordProviderHealthStatus(routeHealthStatusFor(row, body), { brain, recoverySuccesses: 1 });
+    const circuit = providerHealthState.getProviderModelCircuit(routeId, model, { brain });
+    return jsonResponse(res, 200, { recorded: true, circuit });
+  } catch (e) {
+    return jsonResponse(res, 500, { error: e.message });
+  }
+}
+
+// D-6: annotate every OPEN route of a coding-catalog page with the pair's
+// circuit; absent = closed (keeps the page byte-identical when nothing is
+// open). The catalog payload is a PINNED SNAPSHOT reused across pages, so this
+// never mutates its input — it returns a fresh body. The lookup is built ONCE
+// per call (one parse/prune of the circuit KV map for the whole page), never
+// per route; model-identity-routes.js uses the same lookup call shape.
+function annotateCatalogRouteCircuits(body, { lookup } = {}) {
+  if (!body || typeof body !== 'object' || Array.isArray(body) || !Array.isArray(body.models)) {
+    return { ...body };
+  }
+  let lookupFn = lookup;
+  if (typeof lookupFn !== 'function') {
+    try {
+      const brain = require('../lib/brain-events').getBrainCapabilities();
+      lookupFn = providerHealthState.buildProviderModelCircuitLookup({ brain });
+    } catch (e) {
+      // expected: the catalog is a read path — a brain/circuit read failure must
+      // never fail the page; it ships without the circuit fields (the clients
+      // treat a missing circuit as 'closed', AC-3d).
+      errorSink.report('model-route-health', 'catalog-circuit-lookup', e);
+      return { ...body };
+    }
+  }
+  return {
+    ...body,
+    models: body.models.map((item) => {
+      if (!item || typeof item !== 'object') return item;
+      if (!Array.isArray(item.routes)) return { ...item };
+      return {
+        ...item,
+        routes: item.routes.map((route) => {
+          if (!route || typeof route !== 'object') return route;
+          const circuit = lookupFn([route.provider_id], route.model_id);
+          // A closed pair carries NO circuit fields at all: the page stays
+          // byte-identical when nothing is open (clients read absent as closed).
+          if (!circuit) return { ...route };
+          return {
+            ...route,
+            circuit: 'open',
+            circuit_retry_after_ms: Number.isFinite(circuit.next_probe_in_ms) ? circuit.next_probe_in_ms : 0,
+            circuit_error_type: circuit.error_type || null,
+          };
+        }),
+      };
+    }),
+  };
+}
+
+module.exports = { handleModelRouteHealthRoute, annotateCatalogRouteCircuits };