dsh-newapi-provider 0.0.0-stage → 0.8.3

package/lib/model-test.js

@@ -0,0 +1,395 @@
+/** Single-model tests: one request, no automatic retries, bounded and redacted results. */
+import { upstreamModelOf } from './catalog.js';
+import { gatewayRoot, GatewayError, readCache, redact, writeCache } from './util.js';
+
+const RESULTS_FILE = 'model-tests.json';
+const CHAT_TIMEOUT_MS = 60_000;
+const STREAM_BYTE_LIMIT = 256 * 1024;
+const IMAGE_BYTE_LIMIT = 64 * 1024 * 1024;
+const IMAGE_TIMEOUT_MS = 11 * 60 * 1000;
+const PREVIEW_LIMIT = 3 * 1024 * 1024;
+const PER_CHANNEL_LIMIT = 3;
+const RESULTS_LIMIT = 1000;
+const PROMPT = 'Reply with OK.';
+const ENDPOINT_TO_PATH = { openai: 'openai', 'openai-response': 'responses', anthropic: 'anthropic', gemini: 'unsupported' };
+
+export function pickTestProtocol(endpointTypes, priority) {
+  const advertised = endpointTypes?.length ? endpointTypes : ['openai'];
+  for (const t of priority ?? []) if (advertised.includes(t) && Object.hasOwn(ENDPOINT_TO_PATH, t)) return ENDPOINT_TO_PATH[t];
+  for (const t of advertised) if (Object.hasOwn(ENDPOINT_TO_PATH, t)) return ENDPOINT_TO_PATH[t];
+  return 'unsupported';
+}
+
+export function classifyTestError(status, message) {
+  const text = String(message ?? '');
+  if (/no available channel|unknown provider|model_not_found|model not found|does not exist|无可用渠道/i.test(text)) return 'NO_CHANNEL';
+  if (status === 401 || status === 403) return 'AUTH';
+  if (status === 429) return 'RATE_LIMIT';
+  if (status === 503 && /channel/i.test(text)) return 'NO_CHANNEL';
+  return 'HTTP';
+}
+
+export function requestFor(protocol, root, model, apiKey, headers = {}) {
+  const auth = { authorization: `Bearer ${apiKey}`, ...headers };
+  if (protocol === 'anthropic') return {
+    url: `${root}/v1/messages`,
+    headers: { ...auth, 'x-api-key': apiKey, 'anthropic-version': '2023-06-01', 'content-type': 'application/json', accept: 'text/event-stream' },
+    body: { model, max_tokens: 16, stream: true, messages: [{ role: 'user', content: PROMPT }] },
+  };
+  if (protocol === 'responses') return {
+    url: `${root}/v1/responses`,
+    headers: { ...auth, 'content-type': 'application/json', accept: 'text/event-stream' },
+    body: { model, max_output_tokens: 16, stream: true, input: PROMPT },
+  };
+  if (protocol !== 'openai') throw new GatewayError('testing this protocol is not supported', 'UNSUPPORTED', { status: 400 });
+  return {
+    url: `${root}/v1/chat/completions`,
+    headers: { ...auth, 'content-type': 'application/json', accept: 'text/event-stream' },
+    body: { model, max_tokens: 16, stream: true, messages: [{ role: 'user', content: PROMPT }] },
+  };
+}
+
+function validateId(value, name, limit) {
+  if (typeof value !== 'string' || !value.trim() || value !== value.trim() || value.length > limit
+    || /[\u0000-\u001f\u007f]/.test(value) || ['__proto__', 'prototype', 'constructor'].includes(value)) {
+    throw new GatewayError(`invalid ${name}`, 'INVALID_REQUEST', { status: 400 });
+  }
+}
+
+function secretsFor(facts, apiKey) {
+  return [apiKey, ...Object.entries(facts?.headers ?? {}).filter(([k]) => /auth|key|token|secret|cookie/i.test(k))
+    .flatMap(([, v]) => [String(v), String(v).replace(/^Bearer\s+/i, '')])].filter(Boolean);
+}
+
+function cleanText(value, secrets = []) {
+  let text = String(value ?? '').replace(/https?:\/\/[^\s<>"']+/gi, (value) => {
+    try {
+      const url = new URL(value);
+      if (url.username || url.password || [...url.searchParams.keys()].some((key) => /token|key|auth|secret|signature|credential|googleaccessid/i.test(key))) return '<redacted-url>';
+    } catch { /* not a URL */ }
+    return value;
+  });
+  for (const secret of secrets) {
+    for (const variant of new Set([secret, encodeURIComponent(secret)])) text = text.split(variant).join('<redacted>');
+  }
+  return redact(text);
+}
+
+// Include nested usage, errors, text, and preview fields, not just error.message.
+function sanitize(value, secrets, depth = 0) {
+  if (typeof value === 'string') return cleanText(value, secrets);
+  if (value === null || typeof value !== 'object') return value;
+  if (depth > 16) return '<omitted>';
+  if (Array.isArray(value)) return value.slice(0, 1000).map((v) => sanitize(v, secrets, depth + 1));
+  return Object.fromEntries(Object.entries(value).slice(0, 1000).map(([k, v]) => [cleanText(k, secrets), sanitize(v, secrets, depth + 1)]));
+}
+
+function errorMessageOf(json, raw) {
+  const message = json?.error?.message ?? json?.message ?? json?.error ?? raw ?? '';
+  return typeof message === 'string' ? message : JSON.stringify(message);
+}
+
+async function consume(res, maxBytes, signal, onChunk) {
+  if (!res.body) throw new GatewayError('gateway returned no response body', 'BAD_RESPONSE');
+  const reader = res.body.getReader();
+  let bytes = 0;
+  try {
+    for (;;) {
+      signal?.throwIfAborted();
+      const { done, value } = await reader.read();
+      signal?.throwIfAborted();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > maxBytes) throw new GatewayError(`response larger than ${maxBytes} bytes`, 'TOO_LARGE');
+      onChunk(value);
+    }
+  } finally {
+    try { await reader.cancel(); } catch { /* preserve the original failure */ }
+    reader.releaseLock();
+  }
+}
+
+async function boundedText(res, limit, signal) {
+  const chunks = [];
+  await consume(res, limit, signal, (chunk) => chunks.push(Buffer.from(chunk)));
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+/** A first SSE data event measures first packet, never first generated token. */
+async function readStream(res, started, signal, protocol) {
+  const contentType = res.headers.get('content-type');
+  if (!contentType || !/^text\/event-stream(?:\s*;|$)/i.test(contentType)) {
+    try { await res.body?.cancel(); } catch { /* best effort */ }
+    throw new GatewayError('gateway did not return an SSE response', 'BAD_RESPONSE');
+  }
+  const decoder = new TextDecoder();
+  let buffer = '', event = '', data = [], text = '', firstByteMs, usage, streamError, terminal = false, validEvent = false;
+  function dispatch() {
+    if (!data.length) { event = ''; return; }
+    const raw = data.join('\n').trim();
+    data = [];
+    if (firstByteMs === undefined) firstByteMs = Date.now() - started;
+    // Some gateways translate all three protocols to the common DONE sentinel.
+    if (raw === '[DONE]') { terminal = true; event = ''; return; }
+    let json;
+    try { json = JSON.parse(raw); } catch { throw new GatewayError('invalid SSE JSON payload', 'BAD_RESPONSE'); }
+    if (!json || typeof json !== 'object' || Array.isArray(json)) throw new GatewayError('invalid SSE protocol payload', 'BAD_RESPONSE');
+    const type = json.type ?? event;
+    if (json?.error || type === 'error' || ['response.failed', 'response.incomplete'].includes(type)
+      || ['failed', 'incomplete'].includes(json?.response?.status)
+      || (type === 'response.completed' && json?.response?.status !== undefined && json.response.status !== 'completed')) {
+      streamError = errorMessageOf(json?.response ?? json, `gateway stream ended with ${type}`);
+    }
+    if (protocol === 'responses') {
+      if (type === 'response.completed' && (json?.response?.status === undefined || json.response.status === 'completed')) terminal = validEvent = true;
+      if (type === 'response.output_text.delta' && typeof json?.delta === 'string') validEvent = true;
+    }
+    if (protocol === 'anthropic') {
+      if (type === 'message_stop') terminal = validEvent = true;
+      if ((type === 'message_start' && json?.message?.role === 'assistant')
+        || (type === 'content_block_delta' && json?.delta?.type === 'text_delta' && typeof json.delta.text === 'string')) validEvent = true;
+    }
+    if (protocol === 'openai' && Array.isArray(json?.choices)) {
+      if (json.choices.some((c) => typeof c?.finish_reason === 'string' && c.finish_reason.trim())) terminal = validEvent = true;
+      if (json.choices.some((c) => c?.delta?.role === 'assistant' || typeof c?.delta?.content === 'string')) validEvent = true;
+    }
+    const delta = json?.choices?.[0]?.delta?.content ?? json?.delta?.text ?? (type === 'response.output_text.delta' ? json.delta : '');
+    if (typeof delta === 'string') text += delta;
+    usage = json?.usage ?? json?.message?.usage ?? json?.response?.usage ?? usage;
+    event = '';
+  }
+  await consume(res, STREAM_BYTE_LIMIT, signal, (chunk) => {
+    buffer += decoder.decode(chunk, { stream: true });
+    let nl;
+    while ((nl = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, nl).replace(/\r$/, '');
+      buffer = buffer.slice(nl + 1);
+      if (!line) dispatch();
+      else if (line.startsWith('event:')) event = line.slice(6).trim();
+      else if (line.startsWith('data:')) {
+        if (firstByteMs === undefined) firstByteMs = Date.now() - started;
+        data.push(line.slice(5).replace(/^ /, ''));
+      }
+    }
+  });
+  // DONE is framing, not evidence that the selected protocol produced a result.
+  if ((!terminal || !validEvent) && streamError === undefined) throw new GatewayError('gateway stream ended without a valid protocol result and terminal event', 'INCOMPLETE');
+  return { firstByteMs, text, streamError, usage };
+}
+
+function sniff(bytes) {
+  if (bytes[0] === 0x89 && bytes[1] === 0x50) return 'image/png';
+  if (bytes[0] === 0xff && bytes[1] === 0xd8) return 'image/jpeg';
+  if (bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[8] === 0x57) return 'image/webp';
+  if (bytes[0] === 0x47 && bytes[1] === 0x49) return 'image/gif';
+}
+
+function previewURL(value, secrets) {
+  if (typeof value !== 'string' || cleanText(value, secrets) !== value) return undefined;
+  try {
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) return undefined;
+    if ([...url.searchParams].some(([k, v]) => /token|key|auth|secret|signature|credential/i.test(k) || cleanText(v, secrets) !== v)) return undefined;
+    if (cleanText(decodeURIComponent(url.pathname + url.hash), secrets) !== decodeURIComponent(url.pathname + url.hash)) return undefined;
+    return url.href;
+  } catch { return undefined; }
+}
+
+// Signed object-storage URLs are results, but their credentials must never be
+// passed to the browser or persisted. Other private/token URLs remain rejected.
+function signedImageURL(value, secrets) {
+  if (typeof value !== 'string' || secrets.some((secret) => value.includes(secret) || value.includes(encodeURIComponent(secret)))) return false;
+  try {
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) return false;
+    const keys = new Map([...url.searchParams].map(([k, v]) => [k.toLowerCase(), v]));
+    const signed = keys.get('x-amz-signature') || keys.get('x-goog-signature')
+      || (keys.get('signature') && (keys.get('ossaccesskeyid') || keys.get('googleaccessid')))
+      || keys.get('x-oss-signature');
+    if (!signed) return false;
+    for (const key of [...url.searchParams.keys()]) {
+      if (/^(?:x-(?:amz|goog|oss)-[\w-]+|signature|ossaccesskeyid|googleaccessid|expires)$/i.test(key)) url.searchParams.delete(key);
+    }
+    return !!previewURL(url.href, secrets);
+  } catch { return false; }
+}
+
+function imageBase64(value) {
+  if (typeof value !== 'string') return undefined;
+  const normalized = value.replace(/[\t\n\r ]/g, '');
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized)) return undefined;
+  const bytes = Buffer.from(normalized, 'base64');
+  // Buffer.from silently accepts malformed padding and truncated input.
+  const canonical = bytes.toString('base64');
+  if (normalized !== canonical && normalized !== canonical.replace(/=+$/, '')) return undefined;
+  return { bytes, base64: canonical };
+}
+
+export class ModelTester {
+  /**
+   * host.channelFacts(channelId) -> immutable connection facts + apiKey()
+   * host.entryFor(channelId, modelId) -> catalog entry
+   * host.submitVideo?(channelId, modelId) -> { taskId }, acceptance only
+   * TODO host API: resolve facts+entry from ONE revisioned snapshot. Separate
+   * calls can observe different channel edits; video submission needs the same
+   * snapshot too. This cannot be fixed solely within this consumer.
+   */
+  constructor(host) {
+    this.host = host;
+    this.inflight = new Map();
+    this.paidInflight = new Set();
+    const saved = readCache(RESULTS_FILE);
+    this.results = new Map(Object.entries(saved?.results ?? {}).slice(-RESULTS_LIMIT).map(([k, v]) => {
+      const { preview, outputPreview, ...durable } = v && typeof v === 'object' ? v : {};
+      return [k, sanitize(durable, [])];
+    }));
+  }
+
+  key(channelId, modelId) { return `${channelId}\u0000${modelId}`; }
+  last(channelId, modelId) { return this.results.get(this.key(channelId, modelId)); }
+  forget(channelId) {
+    for (const k of this.results.keys()) if (k.startsWith(`${channelId}\u0000`)) this.results.delete(k);
+    this.persist();
+  }
+  persist() {
+    try { writeCache(RESULTS_FILE, { version: 1, results: Object.fromEntries(this.results) }); } catch { /* best effort */ }
+  }
+  record(channelId, modelId, result) {
+    const { preview, outputPreview, ...durable } = result;
+    const key = this.key(channelId, modelId);
+    this.results.delete(key);
+    this.results.set(key, durable);
+    while (this.results.size > RESULTS_LIMIT) this.results.delete(this.results.keys().next().value);
+    this.persist();
+    return result;
+  }
+
+  async run(input = {}) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) throw new GatewayError('invalid test request', 'INVALID_REQUEST', { status: 400 });
+    const { channelId, modelId, confirmPaid = false } = input;
+    validateId(channelId, 'channelId', 128);
+    validateId(modelId, 'modelId', 512);
+    if (typeof confirmPaid !== 'boolean') throw new GatewayError('confirmPaid must be boolean', 'INVALID_REQUEST', { status: 400 });
+    const running = this.inflight.get(channelId) ?? 0;
+    if (running >= PER_CHANNEL_LIMIT) throw new GatewayError('too many tests running on this channel', 'RATE_LIMIT', { status: 429 });
+    const key = this.key(channelId, modelId);
+    if (this.paidInflight.has(key)) throw new GatewayError('a paid test is already running for this channel and model', 'RATE_LIMIT', { status: 429 });
+    // Reserve synchronously, before discovery can make any network requests.
+    this.inflight.set(channelId, running + 1);
+    let paidReserved = confirmPaid;
+    if (paidReserved) this.paidInflight.add(key);
+    let kind, upstreamModel = modelId, secrets = [];
+    try {
+      const facts = await this.host.channelFacts(channelId);
+      secrets = secretsFor(facts);
+      const apiKey = await facts.apiKey();
+      secrets = secretsFor(facts, apiKey);
+      const entry = facts.entryFor ? await facts.entryFor(modelId) : await this.host.entryFor(channelId, modelId);
+      if (facts.entryFor && !entry) throw new GatewayError('model is not enabled on this channel', 'UNKNOWN_MODEL', { status: 400 });
+      upstreamModel = upstreamModelOf({ id: modelId, upstreamModel: entry?.upstreamModel });
+      kind = entry?.kind ?? 'chat';
+      if (!['chat', 'image', 'video'].includes(kind)) throw new GatewayError(`testing ${kind} models is not supported`, 'UNSUPPORTED', { status: 400 });
+      if (kind !== 'chat' && confirmPaid !== true) throw new GatewayError('paid test requires confirmation', 'CONFIRM_REQUIRED', { status: 400 });
+      let result;
+      if (kind === 'chat') result = await this.chat(facts, entry, modelId, apiKey);
+      else if (kind === 'image') result = await this.image(facts, upstreamModel, apiKey);
+      else result = await this.video(channelId, modelId, facts);
+      return this.record(channelId, modelId, sanitize({ channelId, modelId, upstreamModel, kind, phase: result.ok ? 'completed' : 'failed', ...result, testedAt: Date.now() }, secrets));
+    } catch (error) {
+      const message = cleanText(error?.message ?? error, secrets).slice(0, 1000);
+      if (error?.status === 400 || error?.status === 429) throw new GatewayError(message, cleanText(error.code, secrets), { status: error.status });
+      const status = error?.status;
+      return this.record(channelId, modelId, sanitize({
+        ok: false, phase: 'failed', channelId, modelId, upstreamModel, kind, testedAt: Date.now(),
+        code: error?.name === 'TimeoutError' ? 'TIMEOUT' : error?.code && error.code !== 'HTTP' ? error.code : classifyTestError(status, message),
+        ...(status ? { status } : {}), error: message,
+      }, secrets));
+    } finally {
+      if (paidReserved) this.paidInflight.delete(key);
+      const left = (this.inflight.get(channelId) ?? 1) - 1;
+      if (left > 0) this.inflight.set(channelId, left); else this.inflight.delete(channelId);
+    }
+  }
+
+  async chat(facts, entry, modelId, apiKey) {
+    const protocol = pickTestProtocol(entry?.endpointTypes, facts.endpointPriority);
+    if (protocol === 'unsupported') return { ok: false, protocol, code: 'UNSUPPORTED', error: 'testing the advertised protocol is not supported' };
+    const req = requestFor(protocol, gatewayRoot(facts.baseURL), upstreamModelOf({ id: modelId, upstreamModel: entry?.upstreamModel }), apiKey, facts.headers);
+    const started = Date.now();
+    const signal = AbortSignal.timeout(CHAT_TIMEOUT_MS);
+    const secrets = secretsFor(facts, apiKey);
+    try {
+      const res = await fetch(req.url, { method: 'POST', redirect: 'manual', signal, headers: req.headers, body: JSON.stringify(req.body) });
+      if (!res.ok) {
+        const raw = await boundedText(res, STREAM_BYTE_LIMIT, signal);
+        let json; try { json = JSON.parse(raw); } catch { /* non-JSON error */ }
+        const message = cleanText(errorMessageOf(json, raw), secrets).slice(0, 1000);
+        return { ok: false, protocol, status: res.status, code: classifyTestError(res.status, message), error: message, latencyMs: Date.now() - started };
+      }
+      const stream = await readStream(res, started, signal, protocol);
+      const latencyMs = Date.now() - started;
+      if (stream.streamError !== undefined) {
+        const message = cleanText(stream.streamError, secrets).slice(0, 1000);
+        return { ok: false, protocol, code: classifyTestError(res.status, message), error: message, latencyMs, firstByteMs: stream.firstByteMs };
+      }
+      return sanitize({ ok: true, phase: 'completed', status: 'completed', protocol, latencyMs, firstByteMs: stream.firstByteMs,
+        outputPreview: cleanText(stream.text, secrets).slice(0, 80), ...(stream.usage ? { usage: stream.usage } : {}) }, secrets);
+    } catch (error) {
+      return { ok: false, protocol, code: error?.name === 'TimeoutError' ? 'TIMEOUT' : error?.code ?? 'UNREACHABLE', error: cleanText(error?.message ?? error, secrets).slice(0, 1000), latencyMs: Date.now() - started };
+    }
+  }
+
+  async image(facts, modelId, apiKey) {
+    const started = Date.now();
+    const signal = AbortSignal.timeout(IMAGE_TIMEOUT_MS);
+    const secrets = secretsFor(facts, apiKey);
+    try {
+      const res = await fetch(`${gatewayRoot(facts.baseURL)}/v1/images/generations`, {
+        method: 'POST', redirect: 'manual', signal,
+        headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json', accept: 'application/json', ...facts.headers },
+        body: JSON.stringify({ model: modelId, prompt: 'A small red circle on white.', n: 1 }),
+      });
+      const raw = await boundedText(res, res.ok ? IMAGE_BYTE_LIMIT : STREAM_BYTE_LIMIT, signal);
+      let json; try { json = JSON.parse(raw); } catch { /* handled as missing image */ }
+      const latencyMs = Date.now() - started;
+      if (!res.ok || json?.error || ['failed', 'incomplete', 'cancelled'].includes(json?.status)) {
+        const message = cleanText(errorMessageOf(json, raw), secrets).slice(0, 1000);
+        return { ok: false, phase: 'failed', protocol: 'images', status: res.status, code: classifyTestError(res.status, message), error: message, latencyMs };
+      }
+      const item = json?.data?.[0];
+      let preview, hasImage = false, previewOmitted = false;
+      const decoded = imageBase64(item?.b64_json);
+      if (decoded) {
+        const mime = sniff(decoded.bytes);
+        hasImage = !!mime;
+        if (mime && decoded.bytes.byteLength < PREVIEW_LIMIT) preview = { type: 'image', src: `data:${mime};base64,${decoded.base64}` };
+      }
+      if (!hasImage && item?.url) {
+        const src = previewURL(item.url, secrets);
+        previewOmitted = !src && signedImageURL(item.url, secrets);
+        hasImage = !!src || previewOmitted;
+        if (src) preview = { type: 'image', src };
+      }
+      const status = String(json?.status ?? '').toLowerCase();
+      if (res.status === 202 || ['accepted', 'queued', 'pending', 'processing', 'in_progress', 'running'].includes(status)) {
+        return { ok: false, phase: 'accepted', status: status || 'accepted', protocol: 'images', latencyMs, code: 'PENDING', error: 'image request accepted; generation is not yet verified' };
+      }
+      if (!hasImage) return { ok: false, phase: 'failed', protocol: 'images', code: 'BAD_RESPONSE', error: 'the gateway returned no usable image', latencyMs };
+      return sanitize({ ok: true, phase: 'completed', status: 'completed', protocol: 'images', latencyMs,
+        ...(preview ? { preview } : {}), ...(previewOmitted ? { previewOmitted: true } : {}) }, secrets);
+    } catch (error) {
+      const timedOut = error?.name === 'TimeoutError';
+      return { ok: false, phase: 'failed', protocol: 'images', code: timedOut ? 'TIMEOUT' : error?.code ?? 'UNREACHABLE',
+        error: `${cleanText(error?.message ?? error, secrets).slice(0, 1000)}${timedOut ? ' (the gateway may still finish and bill this image)' : ''}`, latencyMs: Date.now() - started };
+    }
+  }
+
+  async video(channelId, modelId, facts) {
+    const submit = facts?.submitVideo ?? ((id) => this.host.submitVideo?.(channelId, id));
+    if (!facts?.submitVideo && !this.host.submitVideo) return { ok: false, protocol: 'videos', code: 'UNSUPPORTED', error: 'video testing is not available' };
+    const started = Date.now();
+    const result = await submit(modelId);
+    if (typeof result?.taskId !== 'string' || !result.taskId.trim() || result.taskId.length > 512) return { ok: false, phase: 'failed', protocol: 'videos', code: 'BAD_RESPONSE', error: 'video submission returned no task ID' };
+    return { ok: false, phase: 'accepted', status: 'accepted', protocol: 'videos', code: 'PENDING', error: 'video request accepted; generation is not yet verified', latencyMs: Date.now() - started, preview: { type: 'video-task', taskId: result.taskId } };
+  }
+}

package/lib/modelsdev.js

@@ -0,0 +1,138 @@
+/**
+ * models.dev capability lookup: context window, output cap, input/output
+ * modalities, reasoning. The index is trimmed and cached on disk so a cold
+ * start without network still has capability data.
+ */
+import { fetchJson, readCache, writeCache } from './util.js';
+
+const CACHE_FILE = 'models-dev-index.json';
+const CACHE_VERSION = 1;
+const DEFAULT_URL = 'https://models.dev/api.json';
+const TTL_MS = 24 * 60 * 60 * 1000;
+
+/** First-party provider per model family; used to break ties across resellers. */
+const FAMILY_PROVIDERS = [
+  [/^claude/, ['anthropic']],
+  [/^(gpt|o\d|chatgpt|codex|dall-e|gpt-image|sora|whisper|tts)/, ['openai']],
+  [/^gemini|^imagen|^veo/, ['google', 'google-vertex']],
+  [/^deepseek/, ['deepseek']],
+  [/^(glm|cogview|cogvideo)/, ['zai', 'zhipuai']],
+  [/^(qwen|qwq|wan)/, ['alibaba', 'alibaba-cn']],
+  [/^grok/, ['xai']],
+  [/^(kimi|moonshot)/, ['moonshotai', 'moonshotai-cn']],
+  [/^(minimax|abab|hailuo)/, ['minimax', 'minimax-cn']],
+  [/^(doubao|seed)/, ['volcengine', 'bytedance']],
+  [/^mistral|^codestral|^magistral/, ['mistral']],
+  [/^llama/, ['meta', 'meta-llama']],
+];
+
+function bare(id) {
+  return String(id).toLowerCase().split('/').pop();
+}
+
+/** Own-property read: a model literally named `constructor` must not hit Object.prototype. */
+function own(table, key) {
+  return table && Object.hasOwn(table, key) ? table[key] : undefined;
+}
+
+function compact(entry, provider) {
+  const m = entry;
+  return {
+    provider,
+    name: m.name,
+    context: m.limit?.context ?? 0,
+    output: m.limit?.output ?? 0,
+    input: m.modalities?.input ?? [],
+    outputModalities: m.modalities?.output ?? [],
+    reasoning: Boolean(m.reasoning),
+    toolCall: m.tool_call !== false,
+    release: m.release_date,
+  };
+}
+
+/** Build `{ bareId: [compact entries] }` from the raw models.dev document. */
+function buildIndex(doc) {
+  // Null prototype: gateway ids such as `__proto__` or `constructor` must stay data.
+  const index = Object.create(null);
+  for (const [provider, p] of Object.entries(doc ?? {})) {
+    for (const [id, m] of Object.entries(p?.models ?? {})) {
+      const key = bare(id);
+      (own(index, key) ?? (index[key] = [])).push(compact(m, provider));
+    }
+  }
+  return index;
+}
+
+export class ModelsDev {
+  constructor({ url = DEFAULT_URL, enabled = true, logger } = {}) {
+    this.url = url;
+    this.enabled = enabled;
+    this.logger = logger;
+    const cached = readCache(CACHE_FILE);
+    this.index = cached?.version === CACHE_VERSION ? cached.index : undefined;
+    this.fetchedAt = cached?.version === CACHE_VERSION ? cached.fetchedAt : 0;
+    this.inflight = undefined;
+    this.lastError = undefined;
+  }
+
+  /** Refresh in the background when stale; never throws. */
+  async refresh({ force = false } = {}) {
+    if (!this.enabled) return;
+    if (!force && this.index && Date.now() - this.fetchedAt < TTL_MS) return;
+    this.inflight ??= (async () => {
+      try {
+        const doc = await fetchJson(this.url, { timeoutMs: 30_000, maxBytes: 64 * 1024 * 1024 });
+        this.index = buildIndex(doc);
+        this.fetchedAt = Date.now();
+        this.lastError = undefined;
+        writeCache(CACHE_FILE, { version: CACHE_VERSION, fetchedAt: this.fetchedAt, index: this.index });
+        // Let the catalog drop entries built before this data was available.
+        this.onUpdated?.();
+      } catch (error) {
+        this.lastError = String(error?.message ?? error);
+        this.logger?.warn?.(`newapi-provider: models.dev refresh failed: ${this.lastError}`);
+      } finally {
+        this.inflight = undefined;
+      }
+    })();
+    return this.inflight;
+  }
+
+  /**
+   * Match one gateway model id. Exact bare-id match first; then progressively
+   * strip trailing `-segment`s (`claude-opus-5-5-high` → `claude-opus-5-5`).
+   * Ties across providers prefer the family's first-party provider, then the
+   * entry that actually carries a context window.
+   */
+  match(id) {
+    // A disabled switch means no capability data at all, including a previously cached copy.
+    if (!this.enabled || !this.index) return undefined;
+    const key = bare(id);
+    let candidates = own(this.index, key);
+    let kind = 'exact';
+    if (!candidates) {
+      const parts = key.split('-');
+      for (let n = parts.length - 1; n >= 2 && !candidates; n--) {
+        candidates = own(this.index, parts.slice(0, n).join('-'));
+      }
+      kind = 'prefix';
+    }
+    if (!candidates?.length) return undefined;
+    const preferred = FAMILY_PROVIDERS.find(([re]) => re.test(key))?.[1] ?? [];
+    const score = (c) => {
+      const p = preferred.indexOf(c.provider);
+      return (p >= 0 ? 100 - p : 0) + (c.context > 0 ? 10 : 0) + (c.input.length > 0 ? 1 : 0);
+    };
+    const best = [...candidates].sort((a, b) => score(b) - score(a))[0];
+    return { ...best, match: kind };
+  }
+
+  status() {
+    return {
+      enabled: this.enabled,
+      loaded: Boolean(this.index),
+      fetchedAt: this.fetchedAt || null,
+      models: this.index ? Object.keys(this.index).length : 0,      lastError: this.lastError ?? null,
+    };
+  }
+}

package/lib/util.js

@@ -0,0 +1,138 @@
+/**
+ * Shared helpers: gateway URLs, bounded HTTP, secret redaction, cache files.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+/** Gateway root without trailing slash or version segment (`http://host:3300`). */
+export function gatewayRoot(baseURL) {
+  return String(baseURL ?? '').trim().replace(/\/+$/, '').replace(/\/v\d+$/, '');
+}
+
+/** OpenAI SDK base for a gateway (`http://host:3300/v1`). */
+export function openaiBase(baseURL) {
+  return `${gatewayRoot(baseURL)}/v1`;
+}
+
+/** Replace every occurrence of a secret (and anything shaped like a key) in text. */
+export function redact(text, secret) {
+  let out = String(text ?? '');
+  if (secret) out = out.split(secret).join('<redacted>');
+  return out.replace(/sk-[A-Za-z0-9_-]{12,}/g, 'sk-<redacted>');
+}
+
+export class GatewayError extends Error {
+  constructor(message, code, details = {}) {
+    super(message);
+    this.name = 'GatewayError';
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+
+/**
+ * Fetch JSON from the gateway. Redirects are not followed: New API answers a
+ * missing trailing slash with 301, and following it can drop the auth header.
+ */
+export async function fetchJson(url, { apiKey, method = 'GET', body, headers = {}, timeoutMs = 15_000, signal, maxBytes = 8 * 1024 * 1024 } = {}) {
+  const secretValues = [apiKey, ...Object.entries(headers).filter(([key]) => /auth|token|key|secret|cookie/i.test(key)).map(([, value]) => value)].filter((v) => typeof v === 'string' && v);
+  const cleanError = (message) => secretValues.reduce((text, secret) => redact(text, secret), String(message));
+  const signals = [AbortSignal.timeout(timeoutMs)];
+  if (signal) signals.push(signal);
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      redirect: 'manual',
+      signal: AbortSignal.any(signals),
+      headers: {
+        accept: 'application/json',
+        ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
+        ...(body !== undefined && !(body instanceof FormData) ? { 'content-type': 'application/json' } : {}),
+        ...headers,
+      },
+      ...(body === undefined ? {} : { body: body instanceof FormData ? body : JSON.stringify(body) }),
+    });
+  } catch (error) {
+    const timedOut = error?.name === 'TimeoutError';
+    throw new GatewayError(cleanError(`${timedOut ? 'timed out' : 'network error'} calling ${url}: ${error?.message ?? error}`), timedOut ? 'TIMEOUT' : 'UNREACHABLE');
+  }
+  if (res.status >= 300 && res.status < 400) {
+    throw new GatewayError(cleanError(`gateway redirected ${url} to ${res.headers.get('location') ?? '?'}; check the base URL`), 'REDIRECT', { status: res.status });
+  }
+  let text;
+  try {
+    text = await readBounded(res, maxBytes);
+  } catch (error) {
+    const timedOut = signals.some((s) => s.aborted && s.reason?.name === 'TimeoutError') || error?.name === 'TimeoutError';
+    throw new GatewayError(cleanError(`response read failed from ${url}: ${error?.message ?? error}`),
+      timedOut ? 'TIMEOUT' : error instanceof GatewayError ? error.code : 'UNREACHABLE', { status: res.status });
+  }
+  let json;
+  try { json = text.length > 0 ? JSON.parse(text) : undefined; } catch { json = undefined; }
+  if (!res.ok) {
+    const message = json?.error?.message ?? json?.message ?? text.slice(0, 300);
+    const code = res.status === 401 || res.status === 403 ? 'AUTH' : res.status === 429 ? 'RATE_LIMIT' : res.status >= 500 ? 'SERVER' : 'HTTP';
+    const retryAfter = Number(res.headers.get('retry-after'));
+    throw new GatewayError(cleanError(`HTTP ${res.status} from ${url}: ${message}`), code, {
+      status: res.status,
+      ...(Number.isFinite(retryAfter) && retryAfter > 0 ? { retryAfterMs: retryAfter * 1000 } : {}),
+    });
+  }
+  if (json === undefined) {
+    const hint = /<html/i.test(text) ? ' (got HTML — the base URL may be missing /v1 or point at the web UI)' : '';
+    throw new GatewayError(`gateway returned non-JSON from ${url}${hint}`, 'BAD_RESPONSE', { status: res.status });
+  }
+  return json;
+}
+
+async function readBounded(res, maxBytes) {
+  if (!res.body) return '';
+  const reader = res.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel();
+      throw new GatewayError(`response larger than ${maxBytes} bytes`, 'TOO_LARGE');
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString('utf8');
+}
+
+/** Directory for this plugin's cache files under the DeepSeek Harness home. */
+export function dataDir() {
+  const home = process.env.DSH_HOME && path.isAbsolute(process.env.DSH_HOME)
+    ? process.env.DSH_HOME
+    : path.join(os.homedir(), '.dsh');
+  return path.join(home, 'plugin-data', 'dsh-newapi-provider');
+}
+
+export function readCache(name) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(dataDir(), name), 'utf8'));
+  } catch {
+    return undefined;
+  }
+}
+
+export function writeCache(name, value) {
+  const dir = dataDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, name);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value));
+  fs.renameSync(tmp, file);
+}
+
+/** Stable short fingerprint of a secret, for cache keys (never the secret itself). */
+export function fingerprint(secret) {
+  let h = 2166136261;
+  for (const ch of String(secret ?? '')) h = Math.imul(h ^ ch.codePointAt(0), 16777619);
+  return (h >>> 0).toString(36);
+}