larkin 0.4.29 → 0.5.1

package/dist/runtime/pi-provider-config.cjs

@@ -1,354 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PI_PROVIDER_PRESETS = exports.MAX_BUILTIN_PI_API_KEY_LENGTH = exports.BUNDLED_PI_VERSION = exports.piDistributionLabel = void 0;
-exports.isPiLoopbackHostname = isPiLoopbackHostname;
-exports.presetIdForOfficialProvider = presetIdForOfficialProvider;
-exports.builtinPiProviderRecoveryNextAction = builtinPiProviderRecoveryNextAction;
-exports.validatePiBaseUrl = validatePiBaseUrl;
-exports.listProviderModels = listProviderModels;
-exports.resolveBuiltinPiProviderSetupSelection = resolveBuiltinPiProviderSetupSelection;
-exports.validateBuiltinPiProviderSelection = validateBuiltinPiProviderSelection;
-exports.piAgentDirectory = piAgentDirectory;
-exports.ownedPiCatalogAgentDir = ownedPiCatalogAgentDir;
-exports.piCatalogCommandSpec = piCatalogCommandSpec;
-exports.assertBuiltinPiAgentDirectory = assertBuiltinPiAgentDirectory;
-exports.configureBuiltinPiProviderModel = configureBuiltinPiProviderModel;
-exports.stageBuiltinPiProvider = stageBuiltinPiProvider;
-const node_crypto_1 = __importDefault(require("node:crypto"));
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const internal_command_js_1 = require("../app/internal-command.cjs");
-const secure_metadata_js_1 = require("../platform/secure-metadata.cjs");
-var pi_distribution_label_js_1 = require("./pi-distribution-label.cjs");
-Object.defineProperty(exports, "piDistributionLabel", { enumerable: true, get: function () { return pi_distribution_label_js_1.piDistributionLabel; } });
-exports.BUNDLED_PI_VERSION = "0.84.2";
-/** API Key 字符上限；stdin 必须在读入任意多余输入前按同一上限截断。 */
-exports.MAX_BUILTIN_PI_API_KEY_LENGTH = 16_384;
-// These values mirror the catalog shipped by the pinned official Pi distribution.
-// Keeping the user-facing defaults here makes endpoint changes reviewable in Larkin.
-exports.PI_PROVIDER_PRESETS = Object.freeze([
-    { id: "deepseek", name: "DeepSeek（推荐）", provider: "deepseek", baseUrl: "https://api.deepseek.com", defaultModel: "deepseek-v4-pro", api: "openai-completions" },
-    { id: "kimi", name: "Kimi / Moonshot（中国）", provider: "moonshotai-cn", baseUrl: "https://api.moonshot.cn/v1", defaultModel: "kimi-k2.6", api: "openai-completions" },
-    { id: "minimax", name: "MiniMax（中国）", provider: "minimax-cn", baseUrl: "https://api.minimaxi.com/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
-    { id: "zhipu", name: "智谱 / BigModel", provider: "zai-coding-cn", baseUrl: "https://open.bigmodel.cn/api/coding/paas/v4", defaultModel: "glm-5.2", api: "openai-completions" },
-    { id: "openai", name: "OpenAI", provider: "openai", baseUrl: "https://api.openai.com/v1", defaultModel: "gpt-5.5", api: "openai-completions" },
-    { id: "anthropic", name: "Anthropic Claude", provider: "anthropic", baseUrl: "https://api.anthropic.com", defaultModel: "claude-opus-4-8", api: "anthropic-messages" },
-    { id: "gemini", name: "Google Gemini", provider: "google", baseUrl: "https://generativelanguage.googleapis.com/v1beta", defaultModel: "gemini-3.1-pro-preview", api: "openai-completions" },
-    { id: "groq", name: "Groq", provider: "groq", baseUrl: "https://api.groq.com/openai/v1", defaultModel: "openai/gpt-oss-120b", api: "openai-completions" },
-    { id: "cerebras", name: "Cerebras", provider: "cerebras", baseUrl: "https://api.cerebras.ai/v1", defaultModel: "zai-glm-4.7", api: "openai-completions" },
-    { id: "xai", name: "xAI Grok", provider: "xai", baseUrl: "https://api.x.ai/v1", defaultModel: "grok-4.5", api: "openai-completions" },
-    { id: "fireworks", name: "Fireworks AI", provider: "fireworks", baseUrl: "https://api.fireworks.ai/inference", defaultModel: "accounts/fireworks/models/kimi-k2p6", api: "openai-completions" },
-    { id: "together", name: "Together AI", provider: "together", baseUrl: "https://api.together.ai/v1", defaultModel: "moonshotai/Kimi-K2.6", api: "openai-completions" },
-    { id: "mistral", name: "Mistral", provider: "mistral", baseUrl: "https://api.mistral.ai", defaultModel: "devstral-medium-latest", api: "openai-completions" },
-    { id: "openrouter", name: "OpenRouter", provider: "openrouter", baseUrl: "https://openrouter.ai/api/v1", defaultModel: "moonshotai/kimi-k2.6", api: "openai-completions" },
-    { id: "kimi-coding", name: "Kimi For Coding", provider: "kimi-coding", baseUrl: "https://api.kimi.com/coding", defaultModel: "kimi-for-coding", api: "openai-completions" },
-    { id: "qwen-cn", name: "通义千问 Token Plan（中国）", provider: "qwen-token-plan-cn", baseUrl: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1", defaultModel: "qwen3.7-max", api: "openai-completions" },
-    { id: "opencode-go", name: "OpenCode Go", provider: "opencode-go", baseUrl: "https://opencode.ai/zen/go/v1", defaultModel: "kimi-k2.6", api: "openai-completions" },
-    { id: "ant-ling", name: "Ant Ling", provider: "ant-ling", baseUrl: "https://api.ant-ling.com/v1", defaultModel: "Ring-2.6-1T", api: "openai-completions" },
-    { id: "nvidia", name: "NVIDIA NIM", provider: "nvidia", baseUrl: "https://integrate.api.nvidia.com/v1", defaultModel: "google/gemma-3-12b-it", api: "openai-completions" },
-    { id: "huggingface", name: "Hugging Face", provider: "huggingface", baseUrl: "https://router.huggingface.co/v1", defaultModel: "MiniMaxAI/MiniMax-M2", api: "openai-completions" },
-    { id: "minimax-global", name: "MiniMax（全球）", provider: "minimax", baseUrl: "https://api.minimax.io/anthropic", defaultModel: "MiniMax-M2.7", api: "anthropic-messages" },
-    { id: "moonshotai", name: "Moonshot（全球）", provider: "moonshotai", baseUrl: "https://api.moonshot.ai/v1", defaultModel: "kimi-k2-0711-preview", api: "openai-completions" },
-    { id: "opencode", name: "OpenCode Zen", provider: "opencode", baseUrl: "https://opencode.ai/zen", defaultModel: "claude-fable-5", api: "openai-completions" },
-    { id: "qwen-token-plan", name: "通义千问 Token Plan（全球）", provider: "qwen-token-plan", baseUrl: "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1", defaultModel: "qwen3.7-max", api: "openai-completions" },
-    { id: "vercel-ai-gateway", name: "Vercel AI Gateway", provider: "vercel-ai-gateway", baseUrl: "https://ai-gateway.vercel.sh", defaultModel: "zai/glm-5.1", api: "anthropic-messages" },
-    { id: "xiaomi", name: "Xiaomi MiMo", provider: "xiaomi", baseUrl: "https://api.xiaomimimo.com/v1", defaultModel: "mimo-v2-flash", api: "openai-completions" },
-    { id: "xiaomi-token-plan-cn", name: "Xiaomi MiMo Token Plan（中国）", provider: "xiaomi-token-plan-cn", baseUrl: "https://token-plan-cn.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "xiaomi-token-plan-ams", name: "Xiaomi MiMo Token Plan（阿姆斯特丹）", provider: "xiaomi-token-plan-ams", baseUrl: "https://token-plan-ams.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "xiaomi-token-plan-sgp", name: "Xiaomi MiMo Token Plan（新加坡）", provider: "xiaomi-token-plan-sgp", baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1", defaultModel: "mimo-v2.5-pro", api: "openai-completions" },
-    { id: "zai", name: "ZAI Coding Plan（全球）", provider: "zai", baseUrl: "https://api.z.ai/api/coding/paas/v4", defaultModel: "glm-4.5-air", api: "openai-completions" },
-]);
-const APP_ID = /^cli_[A-Za-z0-9]+$/;
-const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:@+\/-]{0,255}$/;
-/** Node 的 URL.hostname 对 IPv6 是 [::1]，不是 ::1。 */
-function isPiLoopbackHostname(hostname) {
-    const host = hostname.trim().replace(/^\[|\]$/g, "").toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "::1";
-}
-/** 官方 provider ID（如 zai-coding-cn）映射到 CLI/Dashboard 接受的 preset ID（如 zhipu）。 */
-function presetIdForOfficialProvider(providerId) {
-    const id = providerId.trim();
-    if (id === "larkin-custom")
-        return "custom";
-    return exports.PI_PROVIDER_PRESETS.find((preset) => preset.provider === id)?.id ?? null;
-}
-/** Agent 范围的缺凭证恢复路径：只用 preset，不指向 setup / import / 全局 ~/.pi。 */
-function builtinPiProviderRecoveryNextAction(options = {}) {
-    const preset = options.providerId ? presetIdForOfficialProvider(options.providerId) ?? "<preset|custom>" : "<preset|custom>";
-    const agent = options.agentId && /^cli_[A-Za-z0-9]+$/.test(options.agentId) ? options.agentId : "<App ID>";
-    return `在 Dashboard 的 Provider Credentials 中为该 Agent 配置 Provider 与 API Key，或运行 larkin pi-auth login ${preset} --agent ${agent}。`;
-}
-function validatePiBaseUrl(raw) {
-    const input = raw.trim();
-    if (!input || /[\0\r\n\t]/.test(input))
-        throw new Error("Base URL 不能为空或包含控制字符");
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw new Error("Base URL 不是合法 URL");
-    }
-    if (url.username || url.password)
-        throw new Error("Base URL 不允许包含用户名或凭证");
-    if (url.search || url.hash)
-        throw new Error("Base URL 不允许 query 或 fragment");
-    const local = isPiLoopbackHostname(url.hostname);
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
-        throw new Error("Base URL 必须使用 https；仅 localhost/loopback 开发端点允许 http");
-    }
-    if (/\/(?:chat\/completions|responses|models)\/?$/i.test(url.pathname)) {
-        throw new Error("Base URL 应填写 API 根路径，不要包含 chat/completions、responses 或 models");
-    }
-    return url.toString().replace(/\/$/, "");
-}
-/**
- * 查询 OpenAI 兼容 provider 的 /models 列表（setup 时校验 --model 是否真实可用）。
- * 网络超时/不可达返回 null（不阻塞 setup——运行时对账会严格兜底）；
- * 列表拿到但模型不在其中时抛错。
- */
-async function listProviderModels(baseUrl, apiKey, fetchImpl = fetch) {
-    try {
-        const url = `${validatePiBaseUrl(baseUrl)}/models`;
-        const response = await fetchImpl(url, {
-            headers: { Authorization: `Bearer ${apiKey}` },
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (!response.ok)
-            throw new Error(`provider /models 查询失败：HTTP ${response.status}`);
-        const payload = await response.json();
-        if (!payload || !Array.isArray(payload.data))
-            throw new Error("provider /models 响应格式非法");
-        return payload.data.map((entry) => String(entry.id ?? "")).filter(Boolean);
-    }
-    catch (error) {
-        if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError"
-            || /fetch failed|network|ETIMEDOUT|ECONNREFUSED|ConnectionRefused|Unable to connect/i.test(error.message))) {
-            return null;
-        }
-        throw error;
-    }
-}
-function resolveBuiltinPiProviderSetupSelection(input) {
-    if (input.distribution !== "builtin")
-        throw new Error("provider 凭证只能用于内置 Pi");
-    const model = input.model.trim();
-    if (!MODEL_ID.test(model))
-        throw new Error("模型 ID 格式不安全");
-    if (input.preset === "custom") {
-        const provider = "larkin-custom";
-        return {
-            ...input,
-            model: model.startsWith(`${provider}/`) ? model : `${provider}/${model}`,
-            provider,
-            baseUrl: validatePiBaseUrl(input.baseUrl || ""),
-            api: "openai-completions",
-        };
-    }
-    const preset = exports.PI_PROVIDER_PRESETS.find((candidate) => candidate.id === input.preset);
-    if (!preset)
-        throw new Error(`未知 Pi provider preset: ${String(input.preset)}`);
-    return { ...input, model: model.startsWith(`${preset.provider}/`) ? model : `${preset.provider}/${model}`,
-        provider: preset.provider, baseUrl: preset.baseUrl, api: preset.api };
-}
-function validateBuiltinPiProviderSelection(input) {
-    const key = input.apiKey.trim();
-    if (!key || key.length > exports.MAX_BUILTIN_PI_API_KEY_LENGTH || /[\0\r\n]/.test(key))
-        throw new Error("API Key 不能为空或包含控制字符");
-    return { ...resolveBuiltinPiProviderSetupSelection(input), apiKey: key };
-}
-function piAgentDirectory(configDir, agentId) {
-    if (!APP_ID.test(agentId))
-        throw new Error("Pi Agent ID 格式无效");
-    return node_path_1.default.join(node_path_1.default.resolve(configDir), "providers", "pi", agentId);
-}
-/** Catalog/CLI/dashboard must use the Agent-owned provider dir, never host ~/.pi. */
-function ownedPiCatalogAgentDir(configDir, agentId) {
-    return piAgentDirectory(configDir, agentId);
-}
-function piCatalogCommandSpec(distribution, env = process.env) {
-    if (distribution === "builtin") {
-        const spec = (0, internal_command_js_1.internalCommandSpec)("pi-rpc", [], env);
-        return { command: spec.command, commandArgs: spec.args };
-    }
-    return {
-        command: env.LARKIN_PI_COMMAND ?? process.env.LARKIN_PI_COMMAND ?? "pi",
-        commandArgs: [],
-    };
-}
-function assertPrivateDirectory(directory) {
-    if (secure_metadata_js_1.isWindows) {
-        // Windows 无 POSIX 权限位：icacls 收紧为「当前用户 + SYSTEM」并回读校验。
-        (0, secure_metadata_js_1.secureWindowsDirectoryAcl)(directory, { label: "Pi provider 凭证目录" });
-        return;
-    }
-    const stat = node_fs_1.default.lstatSync(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()
-        || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-        || (stat.mode & 0o777) !== 0o700) {
-        throw new Error("Pi provider 凭证目录必须是当前用户拥有、非 symlink、权限精确 0700 的目录");
-    }
-}
-function assertBuiltinPiAgentDirectory(directory) {
-    assertPrivateDirectory(directory);
-    const authFile = node_path_1.default.join(directory, "auth.json");
-    const auth = readSnapshot(authFile);
-    if (!auth)
-        throw new Error("内置 Pi 尚未配置 API Key");
-    try {
-        const value = JSON.parse(auth.toString("utf8"));
-        if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length === 0)
-            throw new Error("empty");
-    }
-    catch {
-        throw new Error("内置 Pi auth.json 格式无效");
-    }
-}
-function ensurePrivateDirectory(directory) {
-    node_fs_1.default.mkdirSync(node_path_1.default.dirname(directory), { recursive: true, mode: 0o700 });
-    node_fs_1.default.chmodSync(node_path_1.default.dirname(directory), 0o700);
-    node_fs_1.default.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    node_fs_1.default.chmodSync(directory, 0o700);
-    assertPrivateDirectory(directory);
-}
-function readSnapshot(file) {
-    try {
-        const stat = node_fs_1.default.lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink()
-            || (typeof process.getuid === "function" && stat.uid !== process.getuid())
-            || (!secure_metadata_js_1.isWindows && (stat.mode & 0o777) !== 0o600))
-            throw new Error(`Pi provider 文件不安全: ${node_path_1.default.basename(file)}`);
-        return node_fs_1.default.readFileSync(file);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return null;
-        throw error;
-    }
-}
-function atomicPrivateWrite(file, content) {
-    const directory = node_path_1.default.dirname(file);
-    assertPrivateDirectory(directory);
-    const temporary = node_path_1.default.join(directory, `.${node_path_1.default.basename(file)}.${process.pid}.${node_crypto_1.default.randomUUID()}.tmp`);
-    try {
-        node_fs_1.default.writeFileSync(temporary, content, { mode: 0o600, flag: "wx" });
-        node_fs_1.default.renameSync(temporary, file);
-        node_fs_1.default.chmodSync(file, 0o600);
-    }
-    finally {
-        try {
-            node_fs_1.default.unlinkSync(temporary);
-        }
-        catch { /* renamed or absent */ }
-    }
-}
-function restore(file, snapshot) {
-    if (snapshot === null) {
-        try {
-            node_fs_1.default.unlinkSync(file);
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-    }
-    else
-        atomicPrivateWrite(file, snapshot.toString("utf8"));
-}
-function configureBuiltinPiProviderModel(configDir, agentId, raw) {
-    const selection = resolveBuiltinPiProviderSetupSelection(raw);
-    const directory = piAgentDirectory(configDir, agentId);
-    ensurePrivateDirectory(directory);
-    if (selection.preset !== "custom")
-        return selection;
-    const modelsFile = node_path_1.default.join(directory, "models.json");
-    const beforeModels = readSnapshot(modelsFile);
-    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
-    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
-        throw new Error("现有 Pi models.json 格式无效");
-    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
-    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
-        throw new Error("现有 Pi models.json providers 格式无效");
-    const modelId = selection.model.slice(`${selection.provider}/`.length);
-    atomicPrivateWrite(modelsFile, `${JSON.stringify({
-        ...currentModels,
-        providers: {
-            ...currentProviders,
-            [selection.provider]: {
-                baseUrl: selection.baseUrl,
-                api: selection.api,
-                models: [{
-                        id: modelId, name: modelId, reasoning: false, input: ["text"], contextWindow: 272_000, maxTokens: 16_384,
-                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-                    }],
-            },
-        },
-    }, null, 2)}\n`);
-    return selection;
-}
-function stageBuiltinPiProvider(configDir, agentId, raw) {
-    const selection = validateBuiltinPiProviderSelection(raw);
-    const directory = piAgentDirectory(configDir, agentId);
-    ensurePrivateDirectory(directory);
-    const authFile = node_path_1.default.join(directory, "auth.json");
-    const modelsFile = node_path_1.default.join(directory, "models.json");
-    const beforeAuth = readSnapshot(authFile);
-    const beforeModels = readSnapshot(modelsFile);
-    const currentAuth = beforeAuth ? JSON.parse(beforeAuth.toString("utf8")) : {};
-    if (!currentAuth || typeof currentAuth !== "object" || Array.isArray(currentAuth))
-        throw new Error("现有 Pi auth.json 格式无效");
-    const auth = { ...currentAuth, [selection.provider]: { type: "api_key", key: selection.apiKey } };
-    const currentModels = beforeModels ? JSON.parse(beforeModels.toString("utf8")) : {};
-    if (!currentModels || typeof currentModels !== "object" || Array.isArray(currentModels))
-        throw new Error("现有 Pi models.json 格式无效");
-    const currentProviders = currentModels.providers === undefined ? {} : currentModels.providers;
-    if (!currentProviders || typeof currentProviders !== "object" || Array.isArray(currentProviders))
-        throw new Error("现有 Pi models.json providers 格式无效");
-    const customModels = selection.preset === "custom" ? {
-        ...currentModels,
-        providers: {
-            ...currentProviders,
-            [selection.provider]: {
-                baseUrl: selection.baseUrl,
-                api: selection.api,
-                models: [{
-                        id: selection.model.slice(`${selection.provider}/`.length),
-                        name: selection.model.slice(`${selection.provider}/`.length),
-                        reasoning: false,
-                        input: ["text"],
-                        contextWindow: 272_000,
-                        maxTokens: 16_384,
-                        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-                    }],
-            },
-        },
-    } : null;
-    let active = true;
-    try {
-        atomicPrivateWrite(authFile, `${JSON.stringify(auth, null, 2)}\n`);
-        if (customModels)
-            atomicPrivateWrite(modelsFile, `${JSON.stringify(customModels, null, 2)}\n`);
-    }
-    catch (error) {
-        try {
-            restore(authFile, beforeAuth);
-            restore(modelsFile, beforeModels);
-        }
-        catch { /* original error remains primary */ }
-        throw error;
-    }
-    return {
-        directory,
-        commit() { active = false; },
-        rollback() {
-            if (!active)
-                return;
-            restore(authFile, beforeAuth);
-            restore(modelsFile, beforeModels);
-            active = false;
-        },
-    };
-}