larkin 0.4.27 → 0.4.29

package/dist/runtime/pi-provider-config.cjs

@@ -3,7 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PI_PROVIDER_PRESETS = exports.BUNDLED_PI_VERSION = exports.piDistributionLabel = void 0;
+exports.PI_PROVIDER_PRESETS = exports.MAX_BUILTIN_PI_API_KEY_LENGTH = exports.BUNDLED_PI_VERSION = exports.piDistributionLabel = void 0;
+exports.isPiLoopbackHostname = isPiLoopbackHostname;
+exports.presetIdForOfficialProvider = presetIdForOfficialProvider;
+exports.builtinPiProviderRecoveryNextAction = builtinPiProviderRecoveryNextAction;
 exports.validatePiBaseUrl = validatePiBaseUrl;
 exports.listProviderModels = listProviderModels;
 exports.resolveBuiltinPiProviderSetupSelection = resolveBuiltinPiProviderSetupSelection;
@@ -22,6 +25,8 @@ const secure_metadata_js_1 = require("../platform/secure-metadata.cjs");
 var pi_distribution_label_js_1 = require("./pi-distribution-label.cjs");
 Object.defineProperty(exports, "piDistributionLabel", { enumerable: true, get: function () { return pi_distribution_label_js_1.piDistributionLabel; } });
 exports.BUNDLED_PI_VERSION = "0.84.2";
+/** API Key 字符上限；stdin 必须在读入任意多余输入前按同一上限截断。 */
+exports.MAX_BUILTIN_PI_API_KEY_LENGTH = 16_384;
 // These values mirror the catalog shipped by the pinned official Pi distribution.
 // Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
 exports.PI_PROVIDER_PRESETS = Object.freeze([
@@ -58,6 +63,24 @@ exports.PI_PROVIDER_PRESETS = Object.freeze([
 ]);
 const APP_ID = /^cli_[A-Za-z0-9]+$/;
 const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
+/** Node 的 URL.hostname 对 IPv6 是 [::1]，不是 ::1。 */
+function isPiLoopbackHostname(hostname) {
+    const host = hostname.trim().replace(/^\[|\]$/g, "").toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+/** 官方 provider ID（如 zai-coding-cn）映射到 CLI/Dashboard 接受的 preset ID（如 zhipu）。 */
+function presetIdForOfficialProvider(providerId) {
+    const id = providerId.trim();
+    if (id === "larkin-custom")
+        return "custom";
+    return exports.PI_PROVIDER_PRESETS.find((preset) => preset.provider === id)?.id ?? null;
+}
+/** Agent 范围的缺凭证恢复路径：只用 preset，不指向 setup / import / 全局 ~/.pi。 */
+function builtinPiProviderRecoveryNextAction(options = {}) {
+    const preset = options.providerId ? presetIdForOfficialProvider(options.providerId) ?? "<preset|custom>" : "<preset|custom>";
+    const agent = options.agentId && /^cli_[A-Za-z0-9]+$/.test(options.agentId) ? options.agentId : "<App ID>";
+    return `在 Dashboard 的 Provider Credentials 中为该 Agent 配置 Provider 与 API Key，或运行 larkin pi-auth login ${preset} --agent ${agent}。`;
+}
 function validatePiBaseUrl(raw) {
     const input = raw.trim();
     if (!input || /[\0\r\n\t]/.test(input))
@@ -73,7 +96,7 @@ function validatePiBaseUrl(raw) {
         throw new Error("Base URL 不允许包含用户名或凭证");
     if (url.search || url.hash)
         throw new Error("Base URL 不允许 query 或 fragment");
-    const local = ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+    const local = isPiLoopbackHostname(url.hostname);
     if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
         throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
     }
@@ -133,7 +156,7 @@ function resolveBuiltinPiProviderSetupSelection(input) {
 }
 function validateBuiltinPiProviderSelection(input) {
     const key = input.apiKey.trim();
-    if (!key || key.length > 16_384 || /[\0\r\n]/.test(key))
+    if (!key || key.length > exports.MAX_BUILTIN_PI_API_KEY_LENGTH || /[\0\r\n]/.test(key))
         throw new Error("API Key 不能为空或包含控制字符");
     return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
 }

package/dist/runtime/pi-provider-config.mjs

@@ -5,6 +5,8 @@ import { internalCommandSpec } from "../app/internal-command.mjs";
 import { isWindows, secureWindowsDirectoryAcl } from "../platform/secure-metadata.mjs";
 export { piDistributionLabel } from "./pi-distribution-label.mjs";
 export const BUNDLED_PI_VERSION = "0.84.2";
+/** API Key 字符上限；stdin 必须在读入任意多余输入前按同一上限截断。 */
+export const MAX_BUILTIN_PI_API_KEY_LENGTH = 16_384;
 // These values mirror the catalog shipped by the pinned official Pi distribution.
 // Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
 export const PI_PROVIDER_PRESETS = Object.freeze([
@@ -41,6 +43,24 @@ export const PI_PROVIDER_PRESETS = Object.freeze([
 ]);
 const APP_ID = /^cli_[A-Za-z0-9]+$/;
 const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
+/** Node 的 URL.hostname 对 IPv6 是 [::1]，不是 ::1。 */
+export function isPiLoopbackHostname(hostname) {
+    const host = hostname.trim().replace(/^\[|\]$/g, "").toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+/** 官方 provider ID（如 zai-coding-cn）映射到 CLI/Dashboard 接受的 preset ID（如 zhipu）。 */
+export function presetIdForOfficialProvider(providerId) {
+    const id = providerId.trim();
+    if (id === "larkin-custom")
+        return "custom";
+    return PI_PROVIDER_PRESETS.find((preset) => preset.provider === id)?.id ?? null;
+}
+/** Agent 范围的缺凭证恢复路径：只用 preset，不指向 setup / import / 全局 ~/.pi。 */
+export function builtinPiProviderRecoveryNextAction(options = {}) {
+    const preset = options.providerId ? presetIdForOfficialProvider(options.providerId) ?? "<preset|custom>" : "<preset|custom>";
+    const agent = options.agentId && /^cli_[A-Za-z0-9]+$/.test(options.agentId) ? options.agentId : "<App ID>";
+    return `在 Dashboard 的 Provider Credentials 中为该 Agent 配置 Provider 与 API Key，或运行 larkin pi-auth login ${preset} --agent ${agent}。`;
+}
 export function validatePiBaseUrl(raw) {
     const input = raw.trim();
     if (!input || /[\0\r\n\t]/.test(input))
@@ -56,7 +76,7 @@ export function validatePiBaseUrl(raw) {
         throw new Error("Base URL 不允许包含用户名或凭证");
     if (url.search || url.hash)
         throw new Error("Base URL 不允许 query 或 fragment");
-    const local = ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+    const local = isPiLoopbackHostname(url.hostname);
     if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
         throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
     }
@@ -116,7 +136,7 @@ export function resolveBuiltinPiProviderSetupSelection(input) {
 }
 export function validateBuiltinPiProviderSelection(input) {
     const key = input.apiKey.trim();
-    if (!key || key.length > 16_384 || /[\0\r\n]/.test(key))
+    if (!key || key.length > MAX_BUILTIN_PI_API_KEY_LENGTH || /[\0\r\n]/.test(key))
         throw new Error("API Key 不能为空或包含控制字符");
     return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
 }

package/dist/runtime/pi-provider-login.mjs

@@ -0,0 +1,240 @@
+import { PI_PROVIDER_PRESETS, configureBuiltinPiProviderModel, validateBuiltinPiProviderSelection, } from "./pi-provider-config.mjs";
+import { beginBuiltinPiCredentialTransaction, createOfficialPiAuthInteraction, createOfficialPiLogoutRuntime, createOfficialPiModelRuntime, logoutOfficialPiProvider, runOfficialPiLogin, } from "./pi-official-auth.mjs";
+import { loadConfig, markConfigApplied, mutateConfig, runtimeConfigSignature, } from "../platform/config.mjs";
+import { requestAgentUpsert } from "../app/local-control.mjs";
+import { readProcessState } from "../platform/process-state.mjs";
+const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const PRESET_IDS = new Set([...PI_PROVIDER_PRESETS.map((preset) => preset.id), "custom"]);
+/** 用户可见 catalog：已知 preset + 自定义 OpenAI 兼容端点，不含 Base URL / secret。 */
+export function listBuiltinPiProviderCatalog() {
+    return [
+        ...PI_PROVIDER_PRESETS.map((preset) => ({
+            id: preset.id,
+            name: preset.name,
+            provider: preset.provider,
+            defaultModel: `${preset.provider}/${preset.defaultModel}`,
+            custom: false,
+            openaiCompatible: preset.api === "openai-completions",
+        })),
+        {
+            id: "custom",
+            name: "Custom OpenAI-compatible",
+            provider: "larkin-custom",
+            defaultModel: null,
+            custom: true,
+            openaiCompatible: true,
+        },
+    ];
+}
+export function sanitizeProviderLoginError(error, secret) {
+    let text = error instanceof Error ? error.message : String(error);
+    if (secret) {
+        let from = 0;
+        while (from < text.length) {
+            const at = text.indexOf(secret, from);
+            if (at < 0)
+                break;
+            text = `${text.slice(0, at)}[redacted]${text.slice(at + secret.length)}`;
+            from = at + 10;
+        }
+    }
+    return text
+        .replace(/\b(?:authorization|proxy-authorization|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|secret|password)\s*[:=]\s*\S+/gi, (match) => `${match.split(/[:=]/, 1)[0]}=[redacted]`)
+        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+        .replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[redacted]")
+        .replace(/https?:\/\/[^\s]+/gi, (url) => {
+        try {
+            const parsed = new URL(url);
+            parsed.username = "";
+            parsed.password = "";
+            parsed.search = "";
+            parsed.hash = "";
+            return parsed.toString();
+        }
+        catch {
+            return "(url)";
+        }
+    })
+        .replace(/[\0\r\n\t]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, 240) || "builtin Pi provider configuration failed";
+}
+export function resolveBuiltinPiLoginSelection(input) {
+    if (!PRESET_IDS.has(input.preset))
+        throw new Error(`未知 Pi provider preset: ${input.preset}`);
+    const preset = input.preset;
+    if (preset === "custom") {
+        if (!input.baseUrl?.trim())
+            throw new Error("custom OpenAI-compatible endpoint 需要 Base URL");
+        if (!input.model?.trim())
+            throw new Error("custom OpenAI-compatible endpoint 需要 model");
+        return validateBuiltinPiProviderSelection({
+            distribution: "builtin",
+            preset,
+            apiKey: input.apiKey,
+            model: input.model,
+            baseUrl: input.baseUrl,
+        });
+    }
+    if (input.baseUrl?.trim())
+        throw new Error("已知 provider 不接受 --base-url；自定义端点请使用 custom");
+    const known = PI_PROVIDER_PRESETS.find((candidate) => candidate.id === preset);
+    if (!known)
+        throw new Error(`未知 Pi provider preset: ${input.preset}`);
+    return validateBuiltinPiProviderSelection({
+        distribution: "builtin",
+        preset,
+        apiKey: input.apiKey,
+        model: input.model?.trim() || known.defaultModel,
+    });
+}
+export function createApiKeyOnlyInteraction(apiKey, options = {}) {
+    const questioner = {
+        ask: async () => {
+            throw new Error("API-key login does not accept interactive text prompts");
+        },
+        secret: async () => apiKey,
+    };
+    return createOfficialPiAuthInteraction({
+        questioner,
+        report: options.report ?? (() => { }),
+        signal: options.signal,
+    });
+}
+function assertTargetBuiltinPi(env, agentId, load) {
+    if (!APP_ID.test(agentId))
+        throw new Error("请用 --agent <App ID> 选择 Agent");
+    const loaded = load(env);
+    const agent = loaded.config.agents[agentId];
+    if (!agent)
+        throw new Error(`Agent ${agentId} 不存在`);
+    if (agent.runtime !== "pi" || agent.piDistribution !== "builtin") {
+        throw new Error(`Agent ${agentId} 不是内置 Pi`);
+    }
+    return { configDir: loaded.configDir };
+}
+async function applyTargetModel(env, agentId, model, mutate, inspect, upsert, markApplied, secret) {
+    let mutated;
+    try {
+        mutated = mutate(env, { kind: "set-agent-model", agentId, model, requireBuiltinPi: true }, { kind: "user" });
+    }
+    catch (error) {
+        throw new Error(sanitizeProviderLoginError(error, secret));
+    }
+    const stillBuiltin = mutated.config.agents[agentId]?.runtime === "pi"
+        && mutated.config.agents[agentId]?.piDistribution === "builtin";
+    if (!stillBuiltin) {
+        return { applyState: "pending", applyError: sanitizeProviderLoginError(new Error(`Agent ${agentId} 不是内置 Pi`), secret) };
+    }
+    const expectedSignature = runtimeConfigSignature(mutated.config, agentId);
+    const state = inspect(mutated.config.larkinHome);
+    if (state.daemon.state !== "owned" || state.supervisor.state !== "owned") {
+        return { applyState: "saved_not_applied" };
+    }
+    try {
+        const result = await upsert({
+            larkinHome: mutated.config.larkinHome,
+            agentId,
+            expectedSignature,
+        });
+        if (!result.ok) {
+            return {
+                applyState: "pending",
+                applyError: sanitizeProviderLoginError(result.error || "targeted apply failed", secret),
+            };
+        }
+        markApplied(env, agentId, expectedSignature);
+        return { applyState: "applied" };
+    }
+    catch (error) {
+        return { applyState: "pending", applyError: sanitizeProviderLoginError(error, secret) };
+    }
+}
+/**
+ * 为已有 builtin Pi Agent 配置已知 preset 或自定义 OpenAI 兼容端点。
+ * 凭证事务覆盖 auth.json / models.json / models-store.json；模型写入走独立 CAS。
+ * 不读取 host ~/.pi，也不验证真实 provider。
+ */
+export async function configureBuiltinPiProvider(input, deps = {}) {
+    const env = input.env ?? process.env;
+    const load = deps.loadConfig ?? loadConfig;
+    const beginTransaction = deps.beginTransaction ?? beginBuiltinPiCredentialTransaction;
+    const configureModel = deps.configureModel ?? configureBuiltinPiProviderModel;
+    const createRuntime = deps.createRuntime ?? createOfficialPiModelRuntime;
+    const runLogin = deps.runLogin ?? runOfficialPiLogin;
+    const createInteraction = deps.createInteraction ?? createApiKeyOnlyInteraction;
+    const mutate = deps.mutateConfig ?? mutateConfig;
+    const inspect = deps.readProcessState ?? readProcessState;
+    const upsert = deps.requestUpsert ?? requestAgentUpsert;
+    const markApplied = deps.markApplied ?? markConfigApplied;
+    let selection;
+    try {
+        selection = resolveBuiltinPiLoginSelection({
+            preset: input.preset,
+            apiKey: input.apiKey,
+            model: input.model,
+            baseUrl: input.baseUrl,
+        });
+    }
+    catch (error) {
+        throw new Error(sanitizeProviderLoginError(error, input.apiKey));
+    }
+    const { configDir } = assertTargetBuiltinPi(env, input.agentId, load);
+    const transaction = beginTransaction(configDir, input.agentId);
+    try {
+        if (selection.preset === "custom") {
+            configureModel(configDir, input.agentId, {
+                distribution: "builtin",
+                preset: "custom",
+                model: selection.model,
+                baseUrl: selection.baseUrl,
+            });
+        }
+        const runtime = await createRuntime(configDir, input.agentId);
+        await runLogin(runtime, selection.provider, "api_key", createInteraction(selection.apiKey));
+        const applied = await applyTargetModel(env, input.agentId, selection.model, mutate, inspect, upsert, markApplied, input.apiKey);
+        transaction.commit();
+        return {
+            agentId: input.agentId,
+            provider: selection.provider,
+            preset: selection.preset,
+            model: selection.model,
+            credentialType: "api_key",
+            applyState: applied.applyState,
+            ...(applied.applyError ? { applyError: applied.applyError } : {}),
+        };
+    }
+    catch (error) {
+        try {
+            transaction.rollback();
+        }
+        catch { /* 原始错误优先 */ }
+        throw new Error(sanitizeProviderLoginError(error, input.apiKey));
+    }
+}
+export async function logoutBuiltinPiProvider(input, deps = {}) {
+    const env = input.env ?? process.env;
+    const load = deps.loadConfig ?? loadConfig;
+    if (!PROVIDER_ID.test(input.providerId))
+        throw new Error("logout 需要安全的 provider ID");
+    const { configDir } = assertTargetBuiltinPi(env, input.agentId, load);
+    const beginTransaction = deps.beginTransaction ?? beginBuiltinPiCredentialTransaction;
+    const createLogoutRuntime = deps.createLogoutRuntime ?? createOfficialPiLogoutRuntime;
+    const logout = deps.logout ?? logoutOfficialPiProvider;
+    const transaction = beginTransaction(configDir, input.agentId);
+    try {
+        const runtime = await createLogoutRuntime(configDir, input.agentId);
+        await logout(runtime, input.providerId);
+        transaction.commit();
+        return { agentId: input.agentId, provider: input.providerId };
+    }
+    catch (error) {
+        try {
+            transaction.rollback();
+        }
+        catch { /* 原始错误优先 */ }
+        throw new Error(sanitizeProviderLoginError(error));
+    }
+}

package/dist/runtime/runtime-adapters.mjs

@@ -15,7 +15,7 @@ import { extractCanonicalPiSubagentNotification, ledgerStatusFromPiNotificationS
 import { resolvePiSubagentRecordWatchdogExtensionArg } from "./pi-subagent-record-watchdog-injection.mjs";
 import { effectivePiStateDir, extractBackgroundPiSubagentDispatch } from "./pi-subagent-ledger.mjs";
 import { resolvePiBashTimeoutExtensionArg } from "./pi-bash-timeout-injection.mjs";
-import { classifyRuntimePrerequisite, probeNativeRuntimeReadiness, providerAuthenticationFailureReadiness, RuntimePrerequisiteError, } from "./runtime-readiness.mjs";
+import { classifyPiMissingCredentialRejection, classifyRuntimePrerequisite, isBuiltinPiDistribution, missingProviderCredentialReadiness, probeNativeRuntimeReadiness, providerAuthenticationFailureReadiness, RuntimePrerequisiteError, } from "./runtime-readiness.mjs";
 import { buildStrictProviderErrorInput, classifyStrictProviderError, INTERNAL_CONTEXT_WINDOW_PROJECTION_REASON, } from "./provider-error-classifier.mjs";
 import { assertEffectivePiCompactionSettings, assertNoProjectPiCompactionOverride, calculatePiCompactionSettings, parsePiExecutableVersion, prepareOwnedPiDirectory, readOwnedPiSettings, verifyPiCapabilities, writeOwnedPiSettings, } from "./pi-compaction-recovery.mjs";
 class EventSession {
@@ -537,7 +537,20 @@ class PiSession extends EventSession {
             this.awaitingAcknowledgement.delete(input.inputId);
             this.ownedInputIds.delete(input.inputId);
             this.inputEpochs.delete(input.inputId);
-            return { status: "rejected", inputId: input.inputId, retryable: true, reason: error.message };
+            const rawReason = error instanceof Error ? error.message : String(error);
+            const missing = isBuiltinPiDistribution(this.distribution)
+                ? classifyPiMissingCredentialRejection(rawReason)
+                : null;
+            if (missing) {
+                const classified = classifyPiProviderError({ provider: missing.provider, message: missing.diagnostic }, { distribution: this.distribution });
+                this.emit({
+                    type: "input-error", inputId: input.inputId, retryable: false, willRetry: false,
+                    message: classified.reason, errorCategory: classified.category, nextAction: classified.nextAction,
+                    upstream: { provider: missing.provider, message: missing.diagnostic },
+                });
+                return { status: "rejected", inputId: input.inputId, retryable: false, reason: classified.reason };
+            }
+            return { status: "rejected", inputId: input.inputId, retryable: true, reason: rawReason };
         }
     }
     onEvent(raw) {
@@ -664,7 +677,7 @@ class PiSession extends EventSession {
             this.emitObservation("settled");
             const owned = [...this.ownedInputIds].filter((inputId) => this.inputEpochs.get(inputId) === epoch);
             if (error) {
-                const classified = classifyPiProviderError(error);
+                const classified = classifyPiProviderError(error, { distribution: this.distribution });
                 const retryable = classified.category === "rate_limit" || isRetryablePiProviderError(error.upstream.message);
                 for (const inputId of owned)
                     this.emit({
@@ -794,7 +807,7 @@ function piAssistantProviderError(message) {
         ...(typeof bodyError.type === "string" ? { type: bodyError.type } : {}),
     };
 }
-export function classifyPiProviderError(error) {
+export function classifyPiProviderError(error, scope) {
     const upstream = "upstream" in error ? error.upstream : error;
     const errorType = "type" in error ? error.type : undefined;
     const reason = safeProviderText(upstream.message, "Pi provider request failed");
@@ -818,6 +831,13 @@ export function classifyPiProviderError(error) {
         return {
             category: "rate_limit", reason, nextAction: "Wait for the provider rate-limit window, then retry.",
         };
+    const missing = isBuiltinPiDistribution(scope?.distribution)
+        ? classifyPiMissingCredentialRejection(reason)
+        : null;
+    if (missing) {
+        const readiness = missingProviderCredentialReadiness("pi", missing.provider);
+        return { category: "auth", reason: readiness.reason, nextAction: readiness.nextAction };
+    }
     if (upstream.status === 401
         || [...signal].some((value) => ["authentication_error", "invalid_api_key", "invalid_token", "token_expired", "unauthorized", "provider_auth_error"].includes(value))
         || /\bAPI key auth failed\b|\bFailed to resolve API key\b/i.test(reason)) {