dsh-connect-agnes-token-plan 0.5.0

package/lib/llm-adapter-qvvVg7Gb.js

@@ -0,0 +1,168 @@
+import { a as name } from "./host-config-BNGgm_j7.js";
+import { i as buildDescriptors, n as LLM_DISPLAY_NAME, r as LLM_PROVIDER_ID, t as DEFAULT_REASONING_EFFORT } from "./llm-models-CRYZmwHg.js";
+import { n as buildRetryPolicyConfig, t as reclassifyStream } from "./llm-error-fix-DQUng8AL.js";
+import { createProvider } from "@earendil-works/pi-ai";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+
+//#region src/host/llm-adapter.ts
+/**
+* The peer-dependent half of the directly-registered Agnes provider.
+*
+* Everything here runs against Host-shipped peers (`pi-ai`, `dsh-llm`,
+* `dsh-llm-pi-ai`), which is exactly why the descriptor mapping lives in the
+* peer-free `llm-models.ts` instead: this module cannot be imported by the
+* offline unit suite, so it holds only assembly against the runtime and is
+* exercised in wiring/e2e checks.
+*
+* The shape mirrors the qoder adapter that is known to work:
+*
+* - ONE `PiAiAdapter` carrying one profile (this provider has one region —
+*   `https://api.agnes-ai.cn/v1`);
+* - an INERT pi-ai auth plane — the key is resolved per request from the
+*   plugin's own store, pi-ai must never manufacture a credential;
+* - both IMAGE hooks wired, or an image-accepting model answers
+*   `UNSUPPORTED_CONTENT` the moment a message carries an image;
+* - no API key baked into the profile: the picker advertises models without
+*   one and a request fails at resolve time, where the panel status is visible.
+*
+* @module dsh-connect-agnes-token-plan/llm-adapter
+*/
+/** Idle ceiling while one stream read is outstanding (dsh-llm-pi-ai default). */
+const STREAM_IDLE_TIMEOUT_MS = 3e5;
+/**
+* Image budgets at the `dsh-llm-pi-ai` defaults. They bound requests to models
+* whose catalog descriptor declares image input; text-only models never see
+* images.
+*/
+const REQUEST_IMAGE_BUDGETS = {
+	maxRequestImageBytes: 20971520,
+	requestImagePixelBudget: 4194304,
+	requestImageMaxBytes: 1048576
+};
+/**
+* Inert pi-ai auth plane.
+*
+* Authentication goes through `resolveApiKey` (the stored `AGNES_TOKEN_PLAN_API_KEY`
+* reference) per request. pi-ai's own credential lifecycle must never
+* manufacture a credential for this route, so every ambient question answers
+* "nothing stored, nothing set".
+*/
+const INERT_AUTH = {
+	credentials: {
+		async read() {},
+		async list() {
+			return [];
+		},
+		async modify() {},
+		async delete() {}
+	},
+	authContext: {
+		async env() {},
+		async fileExists() {
+			return false;
+		}
+	}
+};
+/**
+* The `fs` service face the image hook reads — a single host-path mapper, and
+* only that. Resolved lazily through `get("fs")` because the service may be
+* registered after this adapter is built.
+* @typedef {object} FsService
+* @property {(hostPath: string) => unknown} [processPathFromHostPath]
+*/
+/**
+* Assemble the adapter instance for one catalog snapshot.
+*
+* A fresh instance per rebuild is deliberate: `PiAiAdapter` memoizes the
+* profiles snapshot internally (`if (this.snapshot?.profiles === profiles)`),
+* so the caller REPLACES the registered adapter when the catalog or key changes
+* and emits `llm/adapters-updated`, exactly as the qoder route refreshes its
+* own registration.
+* @param {object} options - wiring.
+* @param {object[]} options.entries - the normalized catalog entries.
+* @param {string[]} [options.enabledIds] - the curated allow-list; empty means
+*   every catalog model is offered.
+* @param {string} options.baseUrl - the OpenAI-compatible base URL.
+* @param {() => Promise<string>} options.resolveApiKey - resolves the live
+*   `sk-` key per request.
+* @param {(service: string) => unknown} [options.get] - service resolver for
+*   the image hooks (`attachments`, `fs`).
+* @param {string[]} [options.unavailableModelIds] - model ids whose quota pool
+*   is exhausted; excluded from the offer so no doomed `429` request is sent.
+* @returns {{adapter: object, providerIds: string[]}} the adapter and the ids
+*   it owns.
+*/
+function createAgnesAdapter({ entries, enabledIds = [], baseUrl, resolveApiKey, get, unavailableModelIds = [] }) {
+	const models = buildDescriptors(entries, {
+		providerId: LLM_PROVIDER_ID,
+		baseUrl,
+		enabledIds,
+		unavailableModelIds
+	});
+	const provider = {
+		...createProvider({
+			id: LLM_PROVIDER_ID,
+			name: LLM_DISPLAY_NAME,
+			auth: { apiKey: {
+				name: "Agnes API key",
+				/**
+				* pi-ai hands the credential it resolved; this route stores none, so
+				* the parameter is typed only to name what is read off it.
+				* @param {{credential?: {key?: string}}} [options]
+				*/
+				async resolve({ credential } = {}) {
+					const apiKey = credential?.key;
+					return apiKey === void 0 || apiKey.length === 0 ? void 0 : {
+						auth: { apiKey },
+						source: LLM_DISPLAY_NAME
+					};
+				}
+			} },
+			models,
+			api: openAICompletionsApi()
+		}),
+		getModels: () => models
+	};
+	const profiles = /* @__PURE__ */ new Map([[LLM_PROVIDER_ID, {
+		provider: LLM_PROVIDER_ID,
+		displayName: LLM_DISPLAY_NAME,
+		streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+		retryPolicy: resolveRetryPolicy(buildRetryPolicyConfig(), `${name}.${LLM_PROVIDER_ID}.retryPolicy`),
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
+		reasoning: DEFAULT_REASONING_EFFORT,
+		...REQUEST_IMAGE_BUDGETS,
+		piProvider: provider
+	}]]);
+	const inner = new PiAiAdapter({
+		profiles: () => profiles,
+		auth: INERT_AUTH,
+		resolveApiKey: async () => resolveApiKey(),
+		resolveAttachments: () => get?.("attachments"),
+		resolveImageAccess: (attachments, ref) => resolveImageAttachmentAccess(attachments, (hostPath) => (get?.("fs"))?.processPathFromHostPath?.(hostPath), ref)
+	});
+	return {
+		adapter: new Proxy(inner, { get(target, prop, receiver) {
+			const value = Reflect.get(target, prop, receiver);
+			if (prop === "stream") return (options) => reclassifyStream(target.stream(options));
+			if (typeof value === "function" && prop === "prepareCall") return (...args) => {
+				const prepared = value.apply(target, args);
+				if (prepared && typeof prepared.then === "function") return prepared.then((p) => p && typeof p.stream === "function" ? {
+					...p,
+					stream: (o) => reclassifyStream(p.stream(o))
+				} : p);
+				return prepared && typeof prepared.stream === "function" ? {
+					...prepared,
+					stream: (o) => reclassifyStream(prepared.stream(o))
+				} : prepared;
+			};
+			return value;
+		} }),
+		providerIds: [LLM_PROVIDER_ID]
+	};
+}
+
+//#endregion
+export { createAgnesAdapter };

package/lib/llm-error-fix-DQUng8AL.js

@@ -0,0 +1,247 @@
+//#region src/host/llm-retry.ts
+/**
+* The directly-registered Agnes provider's request-retry policy — the
+* peer-FREE half of the 429 self-healing work.
+*
+* Why a separate, peer-free module: the policy is handed to the Host's
+* `resolveRetryPolicy` (a peer import) inside `llm-adapter.ts`, but the
+* *decision* — which failure classes this shared-pool provider should retry,
+* and how gently — is pure and must stay unit-testable on a clean checkout
+* where the peer is not resolvable. Keeping the config here means
+* `test/retry.test.mjs` can pin its shape without importing `@deepseek-ai/dsh-llm`.
+*
+* The peer already classifies a Agnes 429 into two codes (verified in the
+* 429 spike, `dsh-llm-pi-ai/lib/indexts` `classifyPiAiError`):
+*
+*   - `QUOTA` / `ACCOUNT_QUOTA` — the Token Plan pool is depleted. Retrying
+*     cannot refill it, and because the pool is SHARED across every model on
+*     this key, hammering it only extends the cool-down window (the same
+*     lesson `st-rotator` bakes into its AIMD limiter). So we deliberately do
+*     NOT retry quota exhaustion — fast-fail and let the panel say why.
+*   - `RATE_LIMIT` — a transient throttle that clears on its own. The peer
+*     retries this by default, and we keep doing so, with a backoff biased
+*     longer than default so an immediate re-hit against the one shared pool
+*     is less likely. Agnes's daytime rate ceiling (rpm/tpm) is aggressive
+*     (see `llm-error-fix.ts`: its `quota_exceeded_error` code 8 is actually a
+*     per-minute rate cap), so we ride it out with more attempts and a gentler
+*     initial step than the peer default.
+*
+* @module dsh-connect-agnes-token-plan/llm-retry
+*/
+/**
+* The failure-class codes this provider reasons about, in peer-canonical
+* spelling.
+*
+* The strings mirror the `@deepseek-ai/dsh-llm` peer's error-code constants
+* (`QUOTA_EXCEEDED_CODE = "QUOTA"`, `ACCOUNT_QUOTA_EXCEEDED_CODE =
+* "ACCOUNT_QUOTA"`, `EMPTY_RESPONSE_CODE = "EMPTY_RESPONSE"`). They are stable
+* protocol codes, not implementation details, so pinning them here is what the
+* qoder route does too; `llm-adapter.ts` still imports the live constants from
+* the peer and passes them through `resolveRetryPolicy`, so a peer rename would
+* surface at the adapter, not silently drift here.
+*/
+const QUOTA_CODES = Object.freeze({
+	/** Depleted Token Plan pool (per-pool quota). Not retried. */
+	quota: "QUOTA",
+	/** Depleted account-level quota. Not retried. */
+	accountQuota: "ACCOUNT_QUOTA",
+	/** Empty/truncated response. Retried. */
+	emptyResponse: "EMPTY_RESPONSE",
+	/** Transient throttle (429 rate). Retried with backoff. */
+	rateLimit: "RATE_LIMIT",
+	/** Upstream 5xx. Retried. */
+	server: "SERVER",
+	/** Request deadline exceeded. Retried. */
+	timeout: "TIMEOUT",
+	/** Connection-level failure. Retried. */
+	transport: "TRANSPORT"
+});
+/**
+* The failure classes this provider retries, in peer-canonical order.
+*
+* Excludes both quota codes on purpose: a depleted pool cannot be retried into
+* health, and retrying it against a shared credit pool only prolongs the
+* cool-down. `RATE_LIMIT` stays — transient throttles self-clear.
+* @returns {string[]} the retryable code list (no duplicates, non-empty).
+*/
+function retryableCodes() {
+	return [
+		QUOTA_CODES.emptyResponse,
+		QUOTA_CODES.rateLimit,
+		QUOTA_CODES.server,
+		QUOTA_CODES.timeout,
+		QUOTA_CODES.transport
+	];
+}
+/**
+* Build the provider's retry-policy config.
+*
+* The shape is exactly what `@deepseek-ai/dsh-llm`'s `resolveRetryPolicy`
+* accepts (`mode: "normal"` → `{ mode, maxRetries, retryableCodes, backoff }`).
+* We pin it explicitly rather than passing `undefined` so a future change to
+* the peer's default policy cannot silently alter this provider's behaviour.
+*
+* Tuned for Agnes's daytime rate ceiling (rpm/tpm), which the peer mislabels
+* as `QUOTA` — `llm-error-fix.ts` pulls those back to `RATE_LIMIT` so they
+* reach this policy. The numbers: more attempts (8) and a gentler, longer
+* backoff than the peer default (initial 1.5s → cap 20s, jitter 0.25) so a
+* single shared credit pool is not stampeded while the rate window refills.
+* Still bounded: a genuine outage fails after ~90s of backed-off retries rather
+* than spinning forever. QUOTA stays excluded (a depleted pool cannot be retried
+* into health; retrying it only prolongs the cool-down — ROADMAP §1).
+* @returns {{mode: "normal", maxRetries: number, retryableCodes: string[], backoff: {initialDelayMs: number, maxDelayMs: number, jitterRatio: number}}}
+*/
+function buildRetryPolicyConfig() {
+	return {
+		mode: "normal",
+		maxRetries: 8,
+		retryableCodes: retryableCodes(),
+		backoff: {
+			initialDelayMs: 1500,
+			maxDelayMs: 2e4,
+			jitterRatio: .25
+		}
+	};
+}
+
+//#endregion
+//#region src/host/llm-error-fix.ts
+/**
+* 429 误判纠正层 —— host 侧对 peer 分类器的安全覆盖。
+*
+* 根因（见 dsh-llm-pi-ai/lib/index.js:1376 与 dsh-llm/lib/index.js:181）：
+*   `classifyPiAiError` 先跑 `isQuotaExceededError`，其命中面极宽
+*  （`out of ... budget`、`balance/credits exhausted`），凡是商汤 429 体里
+*   带上一两个 "budget/credits/limit" 字眼，就被抢判成 `QUOTA`；于是
+*   `llm-retry.ts` 的 `retryableCodes()`（刻意排除 QUOTA）对这类 429 不重试，
+*   面板又把模型按 `exhaustedModelIds` 静默下线，对用户呈现"额度耗尽"。
+*   而纯 `RATE_LIMIT` 分支（`/\b429\b|rate.?limit/`）是**死代码**——
+*   任何带 429 的体若能进 `isQuotaExceededError` 就被上一行吃了。
+*
+* 本模块在 host 侧把"看似限频却被误判为 QUOTA 的 429"纠正回 `RATE_LIMIT`，
+* 让退避重试真正生效；真配额耗尽（明确余额/积分耗尽的硬额度措辞）保留 `QUOTA`。
+*
+* 设计约束（对应 AGENTS.md 红线与并行纪律）：
+*   - 不动 vendor peer：peer 不在此插件 git 内，也不可被改。
+*   - 零 peer 依赖：纯函数 + 稳定协议字符串；peer 缺席（干净 checkout）时
+*     模块仍加载、测试仍跑，不破坏 `npm test` 离线门禁。
+*   - 只重写 `finish` chunk 的 `failure.code`，保留原始 `message` 以便排查，
+*     不触碰任何正常数据流，幂等（已是 RATE_LIMIT / 非 QUOTA 原样放行）。
+*
+* @module dsh-connect-agnes-token-plan/llm-error-fix
+*/
+/**
+* 与 peer 协议对齐的失败类（稳定字符串，不 import peer 也成立）。
+* `QUOTA` 来自 `@deepseek-ai/dsh-llm` 的 `QUOTA_EXCEEDED_CODE`，`RATE_LIMIT`
+* 来自 `classifyPiAiError` 的返回字面量。
+*/
+const CODE = Object.freeze({
+	/** 共享 Token Plan 池耗尽（peer 不重试，本层默认也不纠正）。 */
+	QUOTA: "QUOTA",
+	/** 账户级配额耗尽（peer 基本不产生，本层不纠正，保守）。 */
+	ACCOUNT_QUOTA: "ACCOUNT_QUOTA",
+	/** 瞬时限频（peer retryPolicy 默认重试，本层把误判体拉回这里）。 */
+	RATE_LIMIT: "RATE_LIMIT"
+});
+/**
+* 一个 429 体是否"更可能是限频而非真配额耗尽"。
+*
+* 判据：消息里出现显式限频信号（429 状态码、rate limit、too many requests、
+* throttl、或中文"请求过于频繁/限流/频率"），且**没有**命中硬额度措辞
+* （balance/credits exhausted、out of credits/budget、"额度 用尽/耗尽/不足"、
+* quota exceeded/exhausted/reached）。
+*
+* 关键区分："out of **rate** budget" / "rate limit budget" 是限频体，不在硬额度
+* 措辞里，所以仍判为限频——这正是本次误判的核心。
+* @param {string} message - 平台错误文本（可能含状态码与 JSON）。
+* @returns {boolean} true 表示应纠正为 RATE_LIMIT。
+*/
+function looksLikeRateLimit(message) {
+	if (typeof message !== "string" || message.length === 0) return false;
+	const m = message.toLowerCase();
+	if (!(/\b429\b/.test(m) || /rate[_\s-]?limit/i.test(m) || /too many requests?/i.test(m) || /requests?\s+(?:per|rate|freq)/i.test(m) || /\b(?:rpm|tpm)\b/.test(m) || /throttl/i.test(m) || /请求过于频繁|限流|频率/.test(m))) return false;
+	return !(/\b(?:balance|credits?)\s+(?:exhausted|depleted)\b/i.test(m) || /\bout[\s_-]+of[\s_-]+(?:credits?|budget)\b/i.test(m) || /额度\s*(?:已)?\s*(?:用尽|耗尽|不足)/.test(m) || /quota\s*(?:exceeded|exhausted|reached)/i.test(m));
+}
+/**
+* 从错误文本里抽出商汤结构化 `type` 字段（如 `"type":"quota_exceeded_error"`）。
+*
+* peer 把整条错误 JSON 拼进 `failure.message`，所以这里能从文本回捞结构信号，
+* 而不依赖 peer 是否单独透传了 `type`。抓不到返回 null。
+* @param {string} message
+* @returns {string|null}
+*/
+function extractStructuredType(message) {
+	if (typeof message !== "string" || message.length === 0) return null;
+	const match = /"type"\s*:\s*"([^"]+)"/i.exec(message);
+	return match ? match[1] : null;
+}
+/**
+* 一个被 peer 判为 QUOTA 的失败，是否其实是限频、应纠正为 RATE_LIMIT。
+*
+* 这是修正 v1（纯文本启发）漏判的核心：`{"message":"rpm exhausted",
+* "type":"quota_exceeded_error","code":"8"}` 这种体——商汤把**请求速率上限**
+* 复用 `quota_exceeded_error` 这个名字，纯文本里没有 "rate limit" 字样，v1 的
+* `looksLikeRateLimit` 既没命中限频信号也没命中硬额度，于是留在 QUOTA、不重试、
+* 直接失败。本函数改读结构化 `type`：
+*
+*   - `type` 含 `rate_limit` → 本就是限频（peer 多数已判 RATE_LIMIT，这里是防御）。
+*   - `type` 含 `quota` 但仍带 rpm/tpm/rate-limit/per-minute/限流/频率 字样 →
+*     是"被错命名为 quota 的速率上限"，纠正为 RATE_LIMIT。
+*   - `type` 含 `quota` 且无任何速率字样（token/credit/balance 真耗尽）→ 保留 QUOTA。
+*   - 无结构化 `type` → 退回 v1 的纯文本启发 `looksLikeRateLimit`。
+*
+* 不纠正真配额耗尽：那是共享 Token Plan 池的硬耗尽，重试只会延长冷却窗口
+* （ROADMAP §1 纪律），所以宁可快失败。
+* @param {{code?: string, message?: string}} failure
+* @returns {boolean} true 表示应纠正为 RATE_LIMIT。
+*/
+function shouldReclassifyQuotaToRate(failure) {
+	if (!failure || failure.code !== CODE.QUOTA) return false;
+	const message = typeof failure.message === "string" ? failure.message : "";
+	const type = extractStructuredType(message);
+	if (type !== null) {
+		const t = type.toLowerCase();
+		if (/rate[_\s-]?limit/.test(t)) return true;
+		if (/quota/.test(t)) return /\brpm\b|\btpm\b|rate[_\s-]?limit|per[\s_-]?(?:min|minute|sec|second)|too many|限流|频率|请求过于频繁/i.test(message);
+		return false;
+	}
+	return looksLikeRateLimit(message);
+}
+/**
+* 把单个流 chunk 里的失败码在误判时纠正。
+*
+* 非 finish、非 error 终止、非 QUOTA，或已判为限频的，一律原样返回（新对象
+* 仅在确有纠正时创建，保持调用方对引用相等的预期）。
+* @param {object} chunk - harness 流协议 chunk。
+* @returns {object} 原 chunk 或 code 被纠正后的新 chunk。
+*/
+function reclassifyFinish(chunk) {
+	if (chunk === null || typeof chunk !== "object") return chunk;
+	if (chunk.type !== "finish") return chunk;
+	const reason = chunk.reason;
+	if (reason === null || typeof reason !== "object" || reason.kind !== "error" || !reason.failure) return chunk;
+	const failure = reason.failure;
+	if (failure.code !== CODE.QUOTA) return chunk;
+	if (!shouldReclassifyQuotaToRate(failure)) return chunk;
+	return {
+		...chunk,
+		reason: {
+			...reason,
+			failure: {
+				...failure,
+				code: CODE.RATE_LIMIT
+			}
+		}
+	};
+}
+/**
+* 包裹一个 adapter 的 async iterator 流：对每个 finish chunk 做重判。
+* @param {AsyncIterableIterator<object>} source - 内层 adapter 的流。
+* @returns {AsyncGenerator<object>} 纠正后的流。
+*/
+async function* reclassifyStream(source) {
+	for await (const chunk of source) yield reclassifyFinish(chunk);
+}
+
+//#endregion
+export { buildRetryPolicyConfig as n, reclassifyStream as t };