flint-agent 1.14.0

package/src/providers/adapters/anthropic.js

@@ -0,0 +1,270 @@
+// Anthropic Messages API adapter
+// Transforms OpenAI-format messages ↔ Anthropic format
+
+export function buildHeaders(provider, apiKey) {
+  return {
+    "Content-Type": "application/json",
+    "x-api-key": apiKey,
+    "anthropic-version": "2023-06-01",
+    ...provider.headers,
+  };
+}
+
+export function getChatUrl(provider) {
+  return `${provider.baseUrl}/messages`;
+}
+
+// Convert OpenAI-style messages to Anthropic format
+function convertMessages(messages) {
+  let systemPrompt = "";
+  const converted = [];
+
+  for (const msg of messages) {
+    if (msg.role === "system") {
+      // System messages → top-level system param
+      systemPrompt += (systemPrompt ? "\n\n" : "") + (typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content));
+      continue;
+    }
+
+    if (msg.role === "assistant") {
+      if (msg.tool_calls?.length) {
+        // Assistant with tool_calls → content blocks with tool_use
+        const content = [];
+        if (msg.content) {
+          content.push({ type: "text", text: msg.content });
+        }
+        for (const tc of msg.tool_calls) {
+          let args = tc.function.arguments;
+          if (typeof args === "string") {
+            try { args = JSON.parse(args); } catch { args = {}; }
+          }
+          content.push({
+            type: "tool_use",
+            id: tc.id,
+            name: tc.function.name,
+            input: args,
+          });
+        }
+        converted.push({ role: "assistant", content });
+      } else {
+        converted.push({ role: "assistant", content: msg.content || "" });
+      }
+      continue;
+    }
+
+    if (msg.role === "tool") {
+      // Tool result → content block with tool_result
+      converted.push({
+        role: "user",
+        content: [{
+          type: "tool_result",
+          tool_use_id: msg.tool_call_id,
+          content: typeof msg.content === "string" ? msg.content : JSON.stringify(msg.content),
+        }],
+      });
+      continue;
+    }
+
+    if (msg.role === "user") {
+      // User messages — handle multimodal content
+      if (Array.isArray(msg.content)) {
+        const content = msg.content.map((part) => {
+          if (part.type === "text") return { type: "text", text: part.text };
+          if (part.type === "image_url") {
+            const url = part.image_url?.url || "";
+            if (url.startsWith("data:")) {
+              const match = url.match(/^data:(image\/\w+);base64,(.+)$/);
+              if (match) {
+                return {
+                  type: "image",
+                  source: { type: "base64", media_type: match[1], data: match[2] },
+                };
+              }
+            }
+            return { type: "text", text: `[Image: ${url}]` };
+          }
+          return part;
+        });
+        converted.push({ role: "user", content });
+      } else {
+        converted.push({ role: "user", content: msg.content });
+      }
+      continue;
+    }
+  }
+
+  // Anthropic requires alternating user/assistant. Merge consecutive same-role messages.
+  const merged = [];
+  for (const msg of converted) {
+    const prev = merged[merged.length - 1];
+    if (prev && prev.role === msg.role) {
+      // Merge content
+      const prevContent = Array.isArray(prev.content)
+        ? prev.content
+        : [{ type: "text", text: prev.content }];
+      const newContent = Array.isArray(msg.content)
+        ? msg.content
+        : [{ type: "text", text: msg.content }];
+      prev.content = [...prevContent, ...newContent];
+    } else {
+      merged.push({ ...msg });
+    }
+  }
+
+  return { system: systemPrompt || undefined, messages: merged };
+}
+
+// Convert OpenAI tool definitions to Anthropic format
+function convertTools(tools) {
+  if (!tools?.length) return undefined;
+  return tools.map((t) => ({
+    name: t.function.name,
+    description: t.function.description || "",
+    input_schema: t.function.parameters || { type: "object", properties: {} },
+  }));
+}
+
+// `extra`: see the openai adapter. Anthropic has no `seed` and no
+// `response_format`, so a caller that asked for JSON gets ordinary text here
+// and has to find the JSON in it. Every caller that asks already does — models
+// ignored the flag often enough to make that necessary anyway.
+export function buildBody(messages, model, tools, maxTokens, stream, extra = {}) {
+  const { system, messages: converted } = convertMessages(messages);
+  const body = {
+    model,
+    messages: converted,
+    max_tokens: maxTokens || 4096,
+    stream,
+  };
+  if (extra.temperature != null) body.temperature = extra.temperature;
+  if (system) body.system = system;
+  const convertedTools = convertTools(tools);
+  if (convertedTools) body.tools = convertedTools;
+  return body;
+}
+
+// Parse non-streaming response
+export function parseResponse(data, onToken) {
+  const content = data.content || [];
+  let text = "";
+  const toolCalls = [];
+
+  for (const block of content) {
+    if (block.type === "text") {
+      text += block.text;
+    } else if (block.type === "tool_use") {
+      toolCalls.push({
+        id: block.id,
+        type: "function",
+        function: {
+          name: block.name,
+          arguments: JSON.stringify(block.input || {}),
+        },
+      });
+    }
+  }
+
+  if (text) onToken?.(text);
+
+  const message = { role: "assistant", content: text };
+  if (toolCalls.length) message.tool_calls = toolCalls;
+
+  const usage = data.usage ? {
+    prompt_tokens: data.usage.input_tokens,
+    completion_tokens: data.usage.output_tokens,
+    total_tokens: (data.usage.input_tokens || 0) + (data.usage.output_tokens || 0),
+  } : null;
+
+  return { message, usage, generationId: data.id || null };
+}
+
+// Parse streaming response (Anthropic SSE format)
+export async function parseStreamResponse(response, onToken) {
+  let text = "";
+  const toolCalls = new Map(); // index → { id, name, arguments }
+  let currentToolIndex = -1;
+  let generationId = null;
+  let usage = null;
+
+  for await (const event of parseAnthropicSSE(response.body)) {
+    if (event.type === "message_start") {
+      generationId = event.message?.id || null;
+      if (event.message?.usage) {
+        usage = {
+          prompt_tokens: event.message.usage.input_tokens || 0,
+          completion_tokens: 0,
+          total_tokens: 0,
+        };
+      }
+    } else if (event.type === "content_block_start") {
+      if (event.content_block?.type === "tool_use") {
+        currentToolIndex++;
+        toolCalls.set(currentToolIndex, {
+          id: event.content_block.id,
+          type: "function",
+          function: {
+            name: event.content_block.name,
+            arguments: "",
+          },
+        });
+      }
+    } else if (event.type === "content_block_delta") {
+      const delta = event.delta;
+      if (delta?.type === "text_delta") {
+        text += delta.text;
+        onToken?.(delta.text);
+      } else if (delta?.type === "input_json_delta") {
+        if (toolCalls.has(currentToolIndex)) {
+          toolCalls.get(currentToolIndex).function.arguments += delta.partial_json;
+        }
+      }
+    } else if (event.type === "message_delta") {
+      if (event.usage) {
+        const outTokens = event.usage.output_tokens || 0;
+        if (usage) {
+          usage.completion_tokens = outTokens;
+          usage.total_tokens = usage.prompt_tokens + outTokens;
+        }
+      }
+    }
+  }
+
+  const message = { role: "assistant", content: text };
+  if (toolCalls.size > 0) {
+    message.tool_calls = [...toolCalls.values()];
+  }
+  return { message, usage, generationId };
+}
+
+async function* parseAnthropicSSE(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop();
+
+    let eventType = null;
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("event:")) {
+        eventType = trimmed.slice(6).trim();
+      } else if (trimmed.startsWith("data:")) {
+        const data = trimmed.slice(5).trim();
+        try {
+          const parsed = JSON.parse(data);
+          if (eventType) parsed.type = eventType;
+          yield parsed;
+        } catch {}
+        eventType = null;
+      } else if (!trimmed) {
+        eventType = null;
+      }
+    }
+  }
+}

package/src/providers/adapters/openai.js

@@ -0,0 +1,120 @@
+// OpenAI-compatible adapter — passthrough for OpenRouter, OpenAI, Groq, Together, Ollama
+// This is the current format used by client.js, extracted as an adapter.
+
+export function buildHeaders(provider, apiKey) {
+  const headers = {
+    "Content-Type": "application/json",
+    ...provider.headers,
+  };
+  if (provider.authType === "bearer" && apiKey) {
+    headers["Authorization"] = `Bearer ${apiKey}`;
+  }
+  return headers;
+}
+
+// `extra` carries what a particular caller needs and the main loop does not:
+// a pinned seed and json_object for the classifier, temperature 0 for anything
+// that parses its own answer. It arrives here rather than in a second fetch
+// somewhere because there is one door now.
+export function buildBody(messages, model, tools, maxTokens, stream, extra = {}) {
+  const body = { model, messages, stream };
+  if (maxTokens) body.max_tokens = maxTokens;
+  if (tools?.length) body.tools = tools;
+  if (extra.temperature != null) body.temperature = extra.temperature;
+  if (extra.seed != null) body.seed = extra.seed;
+  if (extra.responseFormat) body.response_format = extra.responseFormat;
+  return body;
+}
+
+export function getChatUrl(provider) {
+  if (provider.ollamaCompat) {
+    return `${provider.baseUrl}/v1/chat/completions`;
+  }
+  return `${provider.baseUrl}/chat/completions`;
+}
+
+// Parse streaming response — same as current client.js logic
+export async function parseStreamResponse(response, onToken) {
+  let content = "";
+  const toolCalls = new Map();
+  let generationId = null;
+  let usage = null;
+  // Which model answered: with a fallback list (free mode) it may not be the
+  // one asked for.
+  let servedModel = null;
+
+  for await (const chunk of parseSSE(response.body)) {
+    if (chunk.id && !generationId) generationId = chunk.id;
+    if (chunk.model && !servedModel) servedModel = chunk.model;
+    if (chunk.usage) usage = chunk.usage;
+
+    const delta = chunk.choices?.[0]?.delta;
+    if (!delta) continue;
+
+    if (delta.content) {
+      content += delta.content;
+      onToken?.(delta.content);
+    }
+
+    if (delta.tool_calls) {
+      for (const tc of delta.tool_calls) {
+        const idx = tc.index;
+        if (!toolCalls.has(idx)) {
+          toolCalls.set(idx, { id: "", type: "function", function: { name: "", arguments: "" } });
+        }
+        const existing = toolCalls.get(idx);
+        if (tc.id) existing.id = tc.id;
+        if (tc.function?.name) existing.function.name += tc.function.name;
+        if (tc.function?.arguments) existing.function.arguments += tc.function.arguments;
+        // Gemini 3 (OpenAI-compat) attaches a per-call thought signature as
+        // extra_content; the next request 400s (missing thought_signature)
+        // unless it is echoed back verbatim. Preserve every non-standard field
+        // of the delta call instead of rebuilding a minimal object.
+        for (const k of Object.keys(tc)) {
+          if (!["index", "id", "type", "function"].includes(k)) existing[k] = tc[k];
+        }
+      }
+    }
+  }
+
+  const message = { role: "assistant", content: content || "" };
+  if (toolCalls.size > 0) {
+    message.tool_calls = [...toolCalls.values()];
+  }
+  return { message, usage, generationId, servedModel };
+}
+
+// Parse non-streaming response
+export function parseResponse(data, onToken) {
+  const choice = data.choices?.[0];
+  const message = choice?.message || { role: "assistant", content: "" };
+  if (message.content) onToken?.(message.content);
+  return { message, usage: data.usage || null, generationId: data.id || null, servedModel: data.model || null };
+}
+
+async function* parseSSE(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const parts = buffer.split("\n");
+    buffer = parts.pop();
+
+    for (const line of parts) {
+      const trimmed = line.trim();
+      if (!trimmed.startsWith("data:")) continue;
+      const data = trimmed.slice(5).trim();
+      if (data === "[DONE]") return;
+      try {
+        yield JSON.parse(data);
+      } catch {
+        // skip malformed chunks
+      }
+    }
+  }
+}

package/src/providers/keys-dpapi.js

@@ -0,0 +1,41 @@
+// Windows DPAPI helper — protects/unprotects data using Windows Data Protection API
+
+import { execFileSync } from "node:child_process";
+
+export function protectData(plaintext) {
+  const script = `
+    Add-Type -AssemblyName System.Security
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($input)
+    $encrypted = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+    [Convert]::ToBase64String($encrypted)
+  `;
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  const result = execFileSync("powershell", [
+    "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded,
+  ], {
+    input: plaintext,
+    encoding: "utf-8",
+    timeout: 10000,
+    stdio: ["pipe", "pipe", "ignore"],
+  }).trim();
+  return result;
+}
+
+export function unprotectData(base64) {
+  const script = `
+    Add-Type -AssemblyName System.Security
+    $encrypted = [Convert]::FromBase64String($input)
+    $bytes = [System.Security.Cryptography.ProtectedData]::Unprotect($encrypted, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)
+    [System.Text.Encoding]::UTF8.GetString($bytes)
+  `;
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  const result = execFileSync("powershell", [
+    "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded,
+  ], {
+    input: base64,
+    encoding: "utf-8",
+    timeout: 10000,
+    stdio: ["pipe", "pipe", "ignore"],
+  }).trim();
+  return result;
+}

package/src/providers/keys-fallback.js

@@ -0,0 +1,31 @@
+// Linux/Mac fallback — PBKDF2 key derivation with random seed + random salt
+
+import { randomBytes, pbkdf2Sync } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+const FLINT_DIR = path.join(homedir(), ".flint");
+const SEED_FILE = path.join(FLINT_DIR, ".seed");
+const SALT_FILE = path.join(FLINT_DIR, ".salt");
+const ITERATIONS = 600000; // NIST SP 800-132 minimum for SHA-256
+
+function ensureDir() {
+  mkdirSync(FLINT_DIR, { recursive: true, mode: 0o700 });
+}
+
+function getOrCreateFile(filePath) {
+  ensureDir();
+  if (existsSync(filePath)) {
+    return readFileSync(filePath, "utf-8").trim();
+  }
+  const value = randomBytes(32).toString("hex");
+  writeFileSync(filePath, value, { encoding: "utf-8", mode: 0o600 });
+  return value;
+}
+
+export function deriveKey() {
+  const seed = getOrCreateFile(SEED_FILE);
+  const salt = getOrCreateFile(SALT_FILE);
+  return pbkdf2Sync(seed, salt, ITERATIONS, 32, "sha256");
+}

package/src/providers/keys.js

@@ -0,0 +1,132 @@
+// Encrypted API key storage — per-provider keys in ~/.flint/keys.enc
+// Windows: DPAPI-protected seed → AES-256-GCM
+// Linux/Mac: PBKDF2 from ~/.flint/.seed + hostname + username → AES-256-GCM
+
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+const FLINT_DIR = path.join(homedir(), ".flint");
+const KEYS_FILE = path.join(FLINT_DIR, "keys.enc");
+
+// PBKDF2 iterations for key derivation (NIST-recommended minimum).
+const PBKDF2_ITERATIONS = 200000;
+
+let _encryptionKey = null;
+
+async function getEncryptionKey() {
+  if (_encryptionKey) return _encryptionKey;
+
+  if (process.platform === "win32") {
+    // Windows: DPAPI-protected seed → derived AES key
+    const seedFile = path.join(FLINT_DIR, ".seed.dpapi");
+    mkdirSync(FLINT_DIR, { recursive: true });
+
+    if (existsSync(seedFile)) {
+      try {
+        const { unprotectData } = await import("./keys-dpapi.js");
+        const protected64 = readFileSync(seedFile, "utf-8").trim();
+        const seed = unprotectData(protected64);
+        _encryptionKey = pbkdf2Sync(seed, "flint-aes-key", PBKDF2_ITERATIONS, 32, "sha256");
+        return _encryptionKey;
+      } catch {
+        // DPAPI unprotect failed — drop through to regenerate seed
+      }
+    }
+
+    // Create new DPAPI-protected seed
+    try {
+      const { protectData } = await import("./keys-dpapi.js");
+      const seed = randomBytes(32).toString("hex");
+      const protected64 = protectData(seed);
+      writeFileSync(seedFile, protected64, { encoding: "utf-8" });
+      _encryptionKey = pbkdf2Sync(seed, "flint-aes-key", PBKDF2_ITERATIONS, 32, "sha256");
+      return _encryptionKey;
+    } catch {
+      // DPAPI not available — fall through to cross-platform fallback
+    }
+  }
+
+  // Linux/Mac (or Windows without DPAPI): PBKDF2 from local seed+salt files
+  const { deriveKey } = await import("./keys-fallback.js");
+  _encryptionKey = deriveKey();
+  return _encryptionKey;
+}
+
+function encrypt(plaintext, key) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return iv.toString("hex") + ":" + Buffer.concat([encrypted, tag]).toString("hex");
+}
+
+function decrypt(stored, key) {
+  const [ivHex, dataHex] = stored.split(":");
+  const iv = Buffer.from(ivHex, "hex");
+  const data = Buffer.from(dataHex, "hex");
+  const tag = data.subarray(data.length - 16);
+  const encrypted = data.subarray(0, data.length - 16);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(encrypted) + decipher.final("utf-8");
+}
+
+function loadKeysFile() {
+  if (!existsSync(KEYS_FILE)) return {};
+  try {
+    return JSON.parse(readFileSync(KEYS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+function saveKeysFile(keys) {
+  mkdirSync(FLINT_DIR, { recursive: true });
+  writeFileSync(KEYS_FILE, JSON.stringify(keys, null, 2), { encoding: "utf-8" });
+}
+
+export async function getKey(providerId) {
+  const keys = loadKeysFile();
+  const stored = keys[providerId];
+  if (!stored) return null;
+  try {
+    const key = await getEncryptionKey();
+    return decrypt(stored, key);
+  } catch {
+    return null;
+  }
+}
+
+export async function setKey(providerId, plaintext) {
+  const key = await getEncryptionKey();
+  const keys = loadKeysFile();
+  keys[providerId] = encrypt(plaintext, key);
+  saveKeysFile(keys);
+}
+
+export async function deleteKey(providerId) {
+  const keys = loadKeysFile();
+  delete keys[providerId];
+  saveKeysFile(keys);
+}
+
+export function hasKey(providerId) {
+  const keys = loadKeysFile();
+  return !!keys[providerId];
+}
+
+export function listConfiguredProviders() {
+  const keys = loadKeysFile();
+  return Object.keys(keys);
+}
+
+/** Import a key from an env var into encrypted storage. Used during startup migration. */
+export async function migrateEnvKey(envVarName, providerId) {
+  const envKey = process.env[envVarName];
+  if (!envKey) return false;
+  if (hasKey(providerId)) return false; // already stored
+  await setKey(providerId, envKey);
+  return true;
+}