larkin 0.2.70

package/dist/runtime/pi-provider-config.cjs

@@ -0,0 +1,252 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PI_PROVIDER_PRESETS = exports.BUNDLED_PI_VERSION = void 0;
+exports.validatePiBaseUrl = validatePiBaseUrl;
+exports.resolveBuiltinPiProviderSetupSelection = resolveBuiltinPiProviderSetupSelection;
+exports.validateBuiltinPiProviderSelection = validateBuiltinPiProviderSelection;
+exports.piAgentDirectory = piAgentDirectory;
+exports.assertBuiltinPiAgentDirectory = assertBuiltinPiAgentDirectory;
+exports.configureBuiltinPiProviderModel = configureBuiltinPiProviderModel;
+exports.stageBuiltinPiProvider = stageBuiltinPiProvider;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+exports.BUNDLED_PI_VERSION = "0.83.0";
+// These values mirror the catalog shipped by the pinned official Pi distribution.
+// Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
+exports.PI_PROVIDER_PRESETS = Object.freeze([
+    { id: "deepseek", name: "DeepSeek（推荐）", provider: "deepseek", baseUrl: "https://api.deepseek.com", defaultModel: "deepseek-v4-pro", api: "openai-completions" },
+    { id: "kimi", name: "Kimi / Moonshot（中国）", provider: "moonshotai-cn", baseUrl: "https://api.moonshot.cn/v1", defaultModel: "kimi-k2.7-code", api: "openai-completions" },
+    { id: "minimax", name: "MiniMax（中国）", provider: "minimax-cn", baseUrl: "https://api.minimaxi.com/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
+    { id: "zhipu", name: "智谱 / BigModel", provider: "zai-coding-cn", baseUrl: "https://open.bigmodel.cn/api/coding/paas/v4", defaultModel: "glm-5.2", api: "openai-completions" },
+]);
+const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
+function validatePiBaseUrl(raw) {
+    const input = raw.trim();
+    if (!input || /[\0\r\n\t]/.test(input))
+        throw new Error("Base URL 不能为空或包含控制字符");
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new Error("Base URL 不是合法 URL");
+    }
+    if (url.username || url.password)
+        throw new Error("Base URL 不允许包含用户名或凭证");
+    if (url.search || url.hash)
+        throw new Error("Base URL 不允许 query 或 fragment");
+    const local = ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
+        throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
+    }
+    if (/\/(?:chat\/completions|responses|models)\/?$/i.test(url.pathname)) {
+        throw new Error("Base URL 应填写 API 根路径，不要包含 chat/completions、responses 或 models");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+function resolveBuiltinPiProviderSetupSelection(input) {
+    if (input.distribution !== "builtin")
+        throw new Error("provider 凭证只能用于内置 Pi");
+    const model = input.model.trim();
+    if (!MODEL_ID.test(model))
+        throw new Error("模型 ID 格式不安全");
+    if (input.preset === "custom") {
+        const provider = "larkin-custom";
+        return {
+            ...input,
+            model: model.startsWith(`${provider}/`) ? model : `${provider}/${model}`,
+            provider,
+            baseUrl: validatePiBaseUrl(input.baseUrl || ""),
+            api: "openai-completions",
+        };
+    }
+    const preset = exports.PI_PROVIDER_PRESETS.find((candidate) => candidate.id === input.preset);
+    if (!preset)
+        throw new Error(`未知 Pi provider preset: ${String(input.preset)}`);
+    return { ...input, model: model.startsWith(`${preset.provider}/`) ? model : `${preset.provider}/${model}`,
+        provider: preset.provider, baseUrl: preset.baseUrl, api: preset.api };
+}
+function validateBuiltinPiProviderSelection(input) {
+    const key = input.apiKey.trim();
+    if (!key || key.length > 16_384 || /[\0\r\n]/.test(key))
+        throw new Error("API Key 不能为空或包含控制字符");
+    return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
+}
+function piAgentDirectory(configDir, agentId) {
+    if (!APP_ID.test(agentId))
+        throw new Error("Pi Agent ID 格式无效");
+    return node_path_1.default.join(node_path_1.default.resolve(configDir), "providers", "pi", agentId);
+}
+function assertPrivateDirectory(directory) {
+    const stat = node_fs_1.default.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (stat.mode & 0o777) !== 0o700) {
+        throw new Error("Pi provider 凭证目录必须是当前用户拥有、非 symlink、权限精确 0700 的目录");
+    }
+}
+function assertBuiltinPiAgentDirectory(directory) {
+    assertPrivateDirectory(directory);
+    const authFile = node_path_1.default.join(directory, "auth.json");
+    const auth = readSnapshot(authFile);
+    if (!auth)
+        throw new Error("内置 Pi 尚未配置 API Key");
+    try {
+        const value = JSON.parse(auth.toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length === 0)
+            throw new Error("empty");
+    }
+    catch {
+        throw new Error("内置 Pi auth.json 格式无效");
+    }
+}
+function ensurePrivateDirectory(directory) {
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(directory), { recursive: true, mode: 0o700 });
+    node_fs_1.default.chmodSync(node_path_1.default.dirname(directory), 0o700);
+    node_fs_1.default.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    node_fs_1.default.chmodSync(directory, 0o700);
+    assertPrivateDirectory(directory);
+}
+function readSnapshot(file) {
+    try {
+        const stat = node_fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()
+            || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            || (stat.mode & 0o777) !== 0o600)
+            throw new Error(`Pi provider 文件不安全: ${node_path_1.default.basename(file)}`);
+        return node_fs_1.default.readFileSync(file);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function atomicPrivateWrite(file, content) {
+    const directory = node_path_1.default.dirname(file);
+    assertPrivateDirectory(directory);
+    const temporary = node_path_1.default.join(directory, `.${node_path_1.default.basename(file)}.${process.pid}.${node_crypto_1.default.randomUUID()}.tmp`);
+    try {
+        node_fs_1.default.writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
+        node_fs_1.default.renameSync(temporary, file);
+        node_fs_1.default.chmodSync(file, 0o600);
+    }
+    finally {
+        try {
+            node_fs_1.default.unlinkSync(temporary);
+        }
+        catch { /* renamed or absent */ }
+    }
+}
+function restore(file, snapshot) {
+    if (snapshot === null) {
+        try {
+            node_fs_1.default.unlinkSync(file);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    else
+        atomicPrivateWrite(file, snapshot.toString("utf8"));
+}
+function configureBuiltinPiProviderModel(configDir, agentId, raw) {
+    const selection = resolveBuiltinPiProviderSetupSelection(raw);
+    const directory = piAgentDirectory(configDir, agentId);
+    ensurePrivateDirectory(directory);
+    if (selection.preset !== "custom")
+        return selection;
+    const modelsFile = node_path_1.default.join(directory, "models.json");
+    const beforeModels = readSnapshot(modelsFile);
+    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
+    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
+        throw new Error("现有 Pi models.json 格式无效");
+    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
+    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
+        throw new Error("现有 Pi models.json providers 格式无效");
+    const modelId = selection.model.slice(`${selection.provider}/`.length);
+    atomicPrivateWrite(modelsFile, `${JSON.stringify({
+        ...currentModels,
+        providers: {
+            ...currentProviders,
+            [selection.provider]: {
+                baseUrl: selection.baseUrl,
+                api: selection.api,
+                models: [{
+                        id: modelId, name: modelId, reasoning: false, input: ["text"], contextWindow: 131_072, maxTokens: 16_384,
+                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                    }],
+            },
+        },
+    }, null, 2)}\n`);
+    return selection;
+}
+function stageBuiltinPiProvider(configDir, agentId, raw) {
+    const selection = validateBuiltinPiProviderSelection(raw);
+    const directory = piAgentDirectory(configDir, agentId);
+    ensurePrivateDirectory(directory);
+    const authFile = node_path_1.default.join(directory, "auth.json");
+    const modelsFile = node_path_1.default.join(directory, "models.json");
+    const beforeAuth = readSnapshot(authFile);
+    const beforeModels = readSnapshot(modelsFile);
+    const currentAuth = beforeAuth ? JSON.parse(beforeAuth.toString("utf8")) : {};
+    if (!currentAuth || typeof currentAuth !== "object" || Array.isArray(currentAuth))
+        throw new Error("现有 Pi auth.json 格式无效");
+    const auth = { ...currentAuth, [selection.provider]: { type: "api_key", key: selection.apiKey } };
+    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
+    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
+        throw new Error("现有 Pi models.json 格式无效");
+    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
+    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
+        throw new Error("现有 Pi models.json providers 格式无效");
+    const customModels = selection.preset === "custom" ? {
+        ...currentModels,
+        providers: {
+            ...currentProviders,
+            [selection.provider]: {
+                baseUrl: selection.baseUrl,
+                api: selection.api,
+                models: [{
+                        id: selection.model.slice(`${selection.provider}/`.length),
+                        name: selection.model.slice(`${selection.provider}/`.length),
+                        reasoning: false,
+                        input: ["text"],
+                        contextWindow: 131_072,
+                        maxTokens: 16_384,
+                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                    }],
+            },
+        },
+    } : null;
+    let active = true;
+    try {
+        atomicPrivateWrite(authFile, `${JSON.stringify(auth, null, 2)}\n`);
+        if (customModels)
+            atomicPrivateWrite(modelsFile, `${JSON.stringify(customModels, null, 2)}\n`);
+    }
+    catch (error) {
+        try {
+            restore(authFile, beforeAuth);
+            restore(modelsFile, beforeModels);
+        }
+        catch { /* original error remains primary */ }
+        throw error;
+    }
+    return {
+        directory,
+        commit() { active = false; },
+        rollback() {
+            if (!active)
+                return;
+            restore(authFile, beforeAuth);
+            restore(modelsFile, beforeModels);
+            active = false;
+        },
+    };
+}

package/dist/runtime/pi-provider-config.mjs

@@ -0,0 +1,239 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+export const BUNDLED_PI_VERSION = "0.83.0";
+// These values mirror the catalog shipped by the pinned official Pi distribution.
+// Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
+export const PI_PROVIDER_PRESETS = Object.freeze([
+    { id: "deepseek", name: "DeepSeek（推荐）", provider: "deepseek", baseUrl: "https://api.deepseek.com", defaultModel: "deepseek-v4-pro", api: "openai-completions" },
+    { id: "kimi", name: "Kimi / Moonshot（中国）", provider: "moonshotai-cn", baseUrl: "https://api.moonshot.cn/v1", defaultModel: "kimi-k2.7-code", api: "openai-completions" },
+    { id: "minimax", name: "MiniMax（中国）", provider: "minimax-cn", baseUrl: "https://api.minimaxi.com/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
+    { id: "zhipu", name: "智谱 / BigModel", provider: "zai-coding-cn", baseUrl: "https://open.bigmodel.cn/api/coding/paas/v4", defaultModel: "glm-5.2", api: "openai-completions" },
+]);
+const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
+export function validatePiBaseUrl(raw) {
+    const input = raw.trim();
+    if (!input || /[\0\r\n\t]/.test(input))
+        throw new Error("Base URL 不能为空或包含控制字符");
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new Error("Base URL 不是合法 URL");
+    }
+    if (url.username || url.password)
+        throw new Error("Base URL 不允许包含用户名或凭证");
+    if (url.search || url.hash)
+        throw new Error("Base URL 不允许 query 或 fragment");
+    const local = ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
+        throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
+    }
+    if (/\/(?:chat\/completions|responses|models)\/?$/i.test(url.pathname)) {
+        throw new Error("Base URL 应填写 API 根路径，不要包含 chat/completions、responses 或 models");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+export function resolveBuiltinPiProviderSetupSelection(input) {
+    if (input.distribution !== "builtin")
+        throw new Error("provider 凭证只能用于内置 Pi");
+    const model = input.model.trim();
+    if (!MODEL_ID.test(model))
+        throw new Error("模型 ID 格式不安全");
+    if (input.preset === "custom") {
+        const provider = "larkin-custom";
+        return {
+            ...input,
+            model: model.startsWith(`${provider}/`) ? model : `${provider}/${model}`,
+            provider,
+            baseUrl: validatePiBaseUrl(input.baseUrl || ""),
+            api: "openai-completions",
+        };
+    }
+    const preset = PI_PROVIDER_PRESETS.find((candidate) => candidate.id === input.preset);
+    if (!preset)
+        throw new Error(`未知 Pi provider preset: ${String(input.preset)}`);
+    return { ...input, model: model.startsWith(`${preset.provider}/`) ? model : `${preset.provider}/${model}`,
+        provider: preset.provider, baseUrl: preset.baseUrl, api: preset.api };
+}
+export function validateBuiltinPiProviderSelection(input) {
+    const key = input.apiKey.trim();
+    if (!key || key.length > 16_384 || /[\0\r\n]/.test(key))
+        throw new Error("API Key 不能为空或包含控制字符");
+    return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
+}
+export function piAgentDirectory(configDir, agentId) {
+    if (!APP_ID.test(agentId))
+        throw new Error("Pi Agent ID 格式无效");
+    return path.join(path.resolve(configDir), "providers", "pi", agentId);
+}
+function assertPrivateDirectory(directory) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        || (stat.mode & 0o777) !== 0o700) {
+        throw new Error("Pi provider 凭证目录必须是当前用户拥有、非 symlink、权限精确 0700 的目录");
+    }
+}
+export function assertBuiltinPiAgentDirectory(directory) {
+    assertPrivateDirectory(directory);
+    const authFile = path.join(directory, "auth.json");
+    const auth = readSnapshot(authFile);
+    if (!auth)
+        throw new Error("内置 Pi 尚未配置 API Key");
+    try {
+        const value = JSON.parse(auth.toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length === 0)
+            throw new Error("empty");
+    }
+    catch {
+        throw new Error("内置 Pi auth.json 格式无效");
+    }
+}
+function ensurePrivateDirectory(directory) {
+    fs.mkdirSync(path.dirname(directory), { recursive: true, mode: 0o700 });
+    fs.chmodSync(path.dirname(directory), 0o700);
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    fs.chmodSync(directory, 0o700);
+    assertPrivateDirectory(directory);
+}
+function readSnapshot(file) {
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()
+            || (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            || (stat.mode & 0o777) !== 0o600)
+            throw new Error(`Pi provider 文件不安全: ${path.basename(file)}`);
+        return fs.readFileSync(file);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function atomicPrivateWrite(file, content) {
+    const directory = path.dirname(file);
+    assertPrivateDirectory(directory);
+    const temporary = path.join(directory, `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
+        fs.renameSync(temporary, file);
+        fs.chmodSync(file, 0o600);
+    }
+    finally {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* renamed or absent */ }
+    }
+}
+function restore(file, snapshot) {
+    if (snapshot === null) {
+        try {
+            fs.unlinkSync(file);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    else
+        atomicPrivateWrite(file, snapshot.toString("utf8"));
+}
+export function configureBuiltinPiProviderModel(configDir, agentId, raw) {
+    const selection = resolveBuiltinPiProviderSetupSelection(raw);
+    const directory = piAgentDirectory(configDir, agentId);
+    ensurePrivateDirectory(directory);
+    if (selection.preset !== "custom")
+        return selection;
+    const modelsFile = path.join(directory, "models.json");
+    const beforeModels = readSnapshot(modelsFile);
+    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
+    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
+        throw new Error("现有 Pi models.json 格式无效");
+    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
+    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
+        throw new Error("现有 Pi models.json providers 格式无效");
+    const modelId = selection.model.slice(`${selection.provider}/`.length);
+    atomicPrivateWrite(modelsFile, `${JSON.stringify({
+        ...currentModels,
+        providers: {
+            ...currentProviders,
+            [selection.provider]: {
+                baseUrl: selection.baseUrl,
+                api: selection.api,
+                models: [{
+                        id: modelId, name: modelId, reasoning: false, input: ["text"], contextWindow: 131_072, maxTokens: 16_384,
+                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                    }],
+            },
+        },
+    }, null, 2)}\n`);
+    return selection;
+}
+export function stageBuiltinPiProvider(configDir, agentId, raw) {
+    const selection = validateBuiltinPiProviderSelection(raw);
+    const directory = piAgentDirectory(configDir, agentId);
+    ensurePrivateDirectory(directory);
+    const authFile = path.join(directory, "auth.json");
+    const modelsFile = path.join(directory, "models.json");
+    const beforeAuth = readSnapshot(authFile);
+    const beforeModels = readSnapshot(modelsFile);
+    const currentAuth = beforeAuth ? JSON.parse(beforeAuth.toString("utf8")) : {};
+    if (!currentAuth || typeof currentAuth !== "object" || Array.isArray(currentAuth))
+        throw new Error("现有 Pi auth.json 格式无效");
+    const auth = { ...currentAuth, [selection.provider]: { type: "api_key", key: selection.apiKey } };
+    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
+    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
+        throw new Error("现有 Pi models.json 格式无效");
+    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
+    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
+        throw new Error("现有 Pi models.json providers 格式无效");
+    const customModels = selection.preset === "custom" ? {
+        ...currentModels,
+        providers: {
+            ...currentProviders,
+            [selection.provider]: {
+                baseUrl: selection.baseUrl,
+                api: selection.api,
+                models: [{
+                        id: selection.model.slice(`${selection.provider}/`.length),
+                        name: selection.model.slice(`${selection.provider}/`.length),
+                        reasoning: false,
+                        input: ["text"],
+                        contextWindow: 131_072,
+                        maxTokens: 16_384,
+                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+                    }],
+            },
+        },
+    } : null;
+    let active = true;
+    try {
+        atomicPrivateWrite(authFile, `${JSON.stringify(auth, null, 2)}\n`);
+        if (customModels)
+            atomicPrivateWrite(modelsFile, `${JSON.stringify(customModels, null, 2)}\n`);
+    }
+    catch (error) {
+        try {
+            restore(authFile, beforeAuth);
+            restore(modelsFile, beforeModels);
+        }
+        catch { /* original error remains primary */ }
+        throw error;
+    }
+    return {
+        directory,
+        commit() { active = false; },
+        rollback() {
+            if (!active)
+                return;
+            restore(authFile, beforeAuth);
+            restore(modelsFile, beforeModels);
+            active = false;
+        },
+    };
+}