llm-cli-gateway 2.13.1 → 2.14.0-rc.1

package/dist/job-store.d.ts

@@ -214,18 +214,56 @@ export declare class MemoryJobStore implements JobStore {
     evictExpired(): number;
     close(): void;
 }
-export declare class PostgresJobStore implements JobStore {
-    constructor(_dsn: string, _logger?: Logger);
-    recordStart(): void;
-    recordOutput(): void;
-    recordComplete(): void;
-    getById(): JobRecord | null;
-    findByRequestKey(): JobRecord | null;
+export declare class PostgresJobStore implements JobStore, ValidationRunStore {
+    private logger;
+    private worker;
+    private tmpDir;
+    private nextRequestId;
+    private closed;
+    constructor(dsn: string, logger?: Logger, options?: {
+        retentionMs?: number;
+        dedupWindowMs?: number;
+    });
+    private syncCall;
+    recordStart(input: {
+        id: string;
+        correlationId: string;
+        requestKey: string;
+        cli: string;
+        args: string[];
+        outputFormat?: string;
+        startedAt: string;
+        pid: number | null;
+        ownerPrincipal?: string | null;
+        transport?: JobTransport;
+        payloadJson?: string | null;
+    }): void;
+    recordOutput(id: string, stdout: string, stderr: string, outputTruncated: boolean): void;
+    recordComplete(input: {
+        id: string;
+        status: Exclude<JobStoreStatus, "running">;
+        exitCode: number | null;
+        stdout: string;
+        stderr: string;
+        outputTruncated: boolean;
+        error: string | null;
+        finishedAt: string;
+        httpStatus?: number | null;
+    }): void;
+    getById(id: string): JobRecord | null;
+    findByRequestKey(requestKey: string): JobRecord | null;
     markOrphanedOnStartup(): {
         count: number;
         orphaned: Array<OrphanedJobSnapshot>;
     };
     evictExpired(): number;
+    recordValidationRun(run: ValidationRunRecord): void;
+    getValidationRun(validationId: string): ValidationRunRecord | null;
+    setValidationJudgeLink(validationId: string, judgeLink: ValidationRunLink): void;
+    setValidationRunStatus(validationId: string, status: ValidationRunRecord["status"]): void;
+    getValidationRunIdByJobId(jobId: string): string | null;
+    recordValidationReceipt(receipt: ValidationReceiptRecord): void;
+    getValidationReceipt(validationId: string): ValidationReceiptRecord | null;
     close(): void;
 }
 export declare function createJobStore(config: PersistenceConfig, logger?: Logger): JobStore | null;

package/dist/job-store.js

@@ -1,7 +1,9 @@
-import { chmodSync } from "fs";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync } from "fs";
 import os from "os";
 import path from "path";
 import { createHash } from "crypto";
+import { Worker } from "worker_threads";
+import { fileURLToPath } from "url";
 import { openDatabase } from "./sqlite-driver.js";
 import { noopLogger } from "./logger.js";
 export function resolveJobStoreDbPath() {
@@ -550,34 +552,153 @@ export class MemoryJobStore {
     }
 }
 export class PostgresJobStore {
-    constructor(_dsn, _logger = noopLogger) {
-        throw new Error("PostgresJobStore is not yet implemented. Use backend = 'sqlite' (single-instance) or " +
-            "backend = 'memory' (ephemeral) until the Postgres backend ships.");
+    logger;
+    worker;
+    tmpDir;
+    nextRequestId = 0;
+    closed = false;
+    constructor(dsn, logger = noopLogger, options = {}) {
+        this.logger = logger;
+        if (!dsn) {
+            throw new Error("PostgresJobStore requires a non-empty DSN");
+        }
+        this.tmpDir = mkdtempSync(path.join(os.tmpdir(), "llm-gateway-pg-job-store-"));
+        this.worker = new Worker(resolvePostgresWorkerUrl(), {
+            execArgv: [],
+            workerData: {
+                dsn,
+                retentionMs: options.retentionMs ?? resolveJobRetentionMs(),
+                dedupWindowMs: options.dedupWindowMs ?? resolveDedupWindowMs(),
+                farFutureIso: FAR_FUTURE_ISO,
+                connectionTimeoutMillis: 5000,
+            },
+        });
+        try {
+            this.syncCall("init");
+        }
+        catch (err) {
+            this.closed = true;
+            void this.worker.terminate();
+            rmSync(this.tmpDir, { recursive: true, force: true });
+            throw err;
+        }
     }
-    recordStart() {
-        throw new Error("not implemented");
+    syncCall(method, ...args) {
+        if (this.closed && method !== "close") {
+            throw new Error("PostgresJobStore is closed");
+        }
+        const shared = new SharedArrayBuffer(4);
+        const state = new Int32Array(shared);
+        const resultPath = path.join(this.tmpDir, `result-${process.pid}-${++this.nextRequestId}.json`);
+        this.worker.postMessage({ method, args, resultPath, shared });
+        const wait = Atomics.wait(state, 0, 0, method === "init" ? 10_000 : 30_000);
+        if (wait !== "ok" && wait !== "not-equal") {
+            throw new Error(`PostgresJobStore ${method} wait failed: ${wait}`);
+        }
+        if (Atomics.load(state, 0) === 2) {
+            throw new Error(`PostgresJobStore ${method} worker could not write its result`);
+        }
+        let payload;
+        try {
+            payload = JSON.parse(readFileSync(resultPath, "utf8"));
+        }
+        finally {
+            rmSync(resultPath, { force: true });
+        }
+        if (!payload.ok) {
+            const err = new Error(payload.error.message);
+            if (payload.error.stack)
+                err.stack = payload.error.stack;
+            throw err;
+        }
+        return payload.value;
     }
-    recordOutput() {
-        throw new Error("not implemented");
+    recordStart(input) {
+        this.syncCall("recordStart", input);
     }
-    recordComplete() {
-        throw new Error("not implemented");
+    recordOutput(id, stdout, stderr, outputTruncated) {
+        this.syncCall("recordOutput", id, stdout, stderr, outputTruncated);
     }
-    getById() {
-        throw new Error("not implemented");
+    recordComplete(input) {
+        this.syncCall("recordComplete", input);
     }
-    findByRequestKey() {
-        throw new Error("not implemented");
+    getById(id) {
+        const row = this.syncCall("getById", id);
+        return row ? rowToRecord(row) : null;
+    }
+    findByRequestKey(requestKey) {
+        const row = this.syncCall("findByRequestKey", requestKey);
+        return row ? rowToRecord(row) : null;
     }
     markOrphanedOnStartup() {
-        throw new Error("not implemented");
+        const result = this.syncCall("markOrphanedOnStartup");
+        return {
+            count: result.count,
+            orphaned: result.orphaned.map(row => ({
+                id: row.id,
+                correlationId: row.correlation_id,
+                startedAt: row.started_at,
+                stdout: row.stdout ?? "",
+                stderr: row.stderr ?? "",
+                exitCode: row.exit_code,
+                transport: row.transport ?? "process",
+                httpStatus: row.http_status ?? null,
+            })),
+        };
     }
     evictExpired() {
-        throw new Error("not implemented");
+        return this.syncCall("evictExpired");
+    }
+    recordValidationRun(run) {
+        this.syncCall("recordValidationRun", run);
+    }
+    getValidationRun(validationId) {
+        const row = this.syncCall("getValidationRun", validationId);
+        return row ? rowToValidationRunRecord(row) : null;
+    }
+    setValidationJudgeLink(validationId, judgeLink) {
+        this.syncCall("setValidationJudgeLink", validationId, judgeLink);
+    }
+    setValidationRunStatus(validationId, status) {
+        this.syncCall("setValidationRunStatus", validationId, status);
+    }
+    getValidationRunIdByJobId(jobId) {
+        return this.syncCall("getValidationRunIdByJobId", jobId);
+    }
+    recordValidationReceipt(receipt) {
+        this.syncCall("recordValidationReceipt", receipt);
+    }
+    getValidationReceipt(validationId) {
+        const row = this.syncCall("getValidationReceipt", validationId);
+        return row ? rowToValidationReceiptRecord(row) : null;
     }
     close() {
+        if (this.closed)
+            return;
+        try {
+            this.syncCall("close");
+        }
+        catch (err) {
+            this.logger.error("PostgresJobStore close failed", err);
+        }
+        finally {
+            this.closed = true;
+            void this.worker.terminate();
+            rmSync(this.tmpDir, { recursive: true, force: true });
+        }
     }
 }
+function resolvePostgresWorkerUrl() {
+    const sibling = new URL("./postgres-job-store-worker.js", import.meta.url);
+    if (existsSync(fileURLToPath(sibling)))
+        return sibling;
+    if (import.meta.url.endsWith("/src/job-store.ts")) {
+        const built = new URL("../dist/postgres-job-store-worker.js", import.meta.url);
+        if (existsSync(fileURLToPath(built)))
+            return built;
+    }
+    throw new Error("PostgresJobStore worker module is missing. Run `npm run build` before using backend = 'postgres'.");
+}
 export function createJobStore(config, logger = noopLogger) {
     const opts = {
         retentionMs: config.retentionDays * 24 * 60 * 60 * 1000,
@@ -589,7 +710,7 @@ export function createJobStore(config, logger = noopLogger) {
         case "memory":
             return new MemoryJobStore(opts);
         case "postgres":
-            return new PostgresJobStore(config.dsn ?? "", logger);
+            return new PostgresJobStore(config.dsn ?? "", logger, opts);
         case "sqlite":
         default:
             if (!config.path) {

package/dist/model-registry.d.ts

@@ -17,6 +17,7 @@ export interface CliInfo {
     aliases?: Record<string, string>;
     modelMetadata?: Record<string, ModelMetadata>;
     warnings?: string[];
+    defaultAgent?: string;
 }
 export type CliInfoMap = Record<CliType, CliInfo>;
 export declare function getCliInfo(forceRefresh?: boolean): CliInfoMap;

package/dist/model-registry.js

@@ -139,6 +139,7 @@ function cloneInfo(source) {
         aliases: source.aliases ? { ...source.aliases } : undefined,
         modelMetadata: source.modelMetadata ? { ...source.modelMetadata } : {},
         warnings: source.warnings ? [...source.warnings] : [],
+        defaultAgent: source.defaultAgent,
     };
     Object.keys(cloned.models).forEach(model => {
         cloned.modelMetadata[model] = cloned.modelMetadata[model] ?? {
@@ -373,6 +374,7 @@ function applyGeminiOverrides(info) {
 }
 function applyGrokOverrides(info) {
     const envDefault = process.env.GROK_DEFAULT_MODEL;
+    applyGrokConfig(info);
     addEnvModels(info, "GROK_MODELS");
     addEnvAliases(info, "grok", "GROK_MODEL_ALIASES");
     addGlobalEnvAliases(info, "grok");
@@ -381,8 +383,48 @@ function applyGrokOverrides(info) {
     }
     info.modelOrder = buildOrder(info, info.defaultModel);
 }
+function applyGrokConfig(info) {
+    const configPath = process.env.GROK_CONFIG_PATH || path.join(homedir(), ".grok", "config.toml");
+    if (!existsSync(configPath)) {
+        return;
+    }
+    try {
+        const parsed = parseToml(readFileSync(configPath, "utf-8"));
+        const models = readRecordProperty(parsed, "models");
+        Object.entries(models).forEach(([key, value]) => {
+            if (typeof value !== "string") {
+                return;
+            }
+            if (key === "default") {
+                setDefaultModel(info, value, `${configPath} [models].default`, "config");
+                return;
+            }
+            addModel(info, value, `Custom Grok model from config.toml [models].${key}`, {
+                source: "config",
+                sourceDetail: `${configPath} [models].${key}`,
+                confidence: "medium",
+            });
+        });
+        const ui = readRecordProperty(parsed, "ui");
+        const forkModel = readStringProperty(ui, "fork_secondary_model");
+        if (forkModel) {
+            addModel(info, forkModel, "Configured Grok fork/secondary model", {
+                source: "config",
+                sourceDetail: `${configPath} [ui].fork_secondary_model`,
+                confidence: "medium",
+            });
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        addWarning(info, `Could not parse Grok config ${configPath}: ${message}`);
+    }
+}
 function applyMistralOverrides(info) {
     const vibeConfig = readVibeConfig(info);
+    if (vibeConfig.defaultAgent) {
+        info.defaultAgent = vibeConfig.defaultAgent;
+    }
     addVibeModelEntries(info, parseVibeModels(process.env.VIBE_MODELS, "VIBE_MODELS"), "env");
     addVibeModelEntries(info, vibeConfig.models, "config");
     addEnvModels(info, "MISTRAL_MODELS");
@@ -426,6 +468,10 @@ function readVibeConfig(info) {
         if (activeModel) {
             result.activeModel = activeModel.trim();
         }
+        const defaultAgent = readStringProperty(parsed, "default_agent");
+        if (defaultAgent) {
+            result.defaultAgent = defaultAgent.trim();
+        }
         result.models = parseVibeModelArray(readRecordOrArrayProperty(parsed, "models"), configPath);
     }
     catch (error) {

package/dist/oauth.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID, scryptSync, timingSafeEqual } from
 import { URLSearchParams } from "node:url";
 import { readCappedRawBody, maxOAuthBodyBytes } from "./request-limits.js";
 import { issueOAuthAccessToken, timingSafeStringEqual, } from "./auth.js";
+import { joinBaseAndPath, OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, OAUTH_PROTECTED_RESOURCE_METADATA_PATH, OAUTH_AUTHORIZATION_SERVER_METADATA_PATH, OPENID_CONFIGURATION_PATH, } from "./remote-url.js";
 export const OAUTH_CODE_TTL_MS = 5 * 60 * 1000;
 const GENERATED_SECRET_BYTES = 32;
 const SCRYPT_N = 32768;
@@ -227,17 +228,17 @@ export class OAuthServer {
         }
     }
     resourceMetadataUrl(baseUrl) {
-        return `${baseUrl}/.well-known/oauth-protected-resource`;
+        return joinBaseAndPath(baseUrl, OAUTH_PROTECTED_RESOURCE_METADATA_PATH);
     }
     isOAuthPath(pathname) {
-        return (pathname.startsWith("/.well-known/oauth-protected-resource") ||
-            pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            pathname === "/.well-known/openid-configuration" ||
+        return (pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH) ||
+            pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            pathname === OPENID_CONFIGURATION_PATH ||
             pathname.startsWith("/oauth/"));
     }
     async handle(ctx) {
         const { req, res, url, baseUrl } = ctx;
-        if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
+        if (url.pathname.startsWith(OAUTH_PROTECTED_RESOURCE_METADATA_PATH)) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -245,8 +246,8 @@ export class OAuthServer {
             jsonResponse(res, 200, this.protectedResourceMetadata(baseUrl));
             return true;
         }
-        if (url.pathname.startsWith("/.well-known/oauth-authorization-server") ||
-            url.pathname === "/.well-known/openid-configuration") {
+        if (url.pathname.startsWith(OAUTH_AUTHORIZATION_SERVER_METADATA_PATH) ||
+            url.pathname === OPENID_CONFIGURATION_PATH) {
             if (req.method !== "GET") {
                 methodNotAllowed(res);
                 return true;
@@ -254,15 +255,15 @@ export class OAuthServer {
             jsonResponse(res, 200, this.authorizationServerMetadata(baseUrl));
             return true;
         }
-        if (url.pathname === "/oauth/register") {
+        if (url.pathname === OAUTH_REGISTER_PATH) {
             await this.handleRegister(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/authorize") {
+        if (url.pathname === OAUTH_AUTHORIZE_PATH) {
             await this.handleAuthorize(req, res);
             return true;
         }
-        if (url.pathname === "/oauth/token") {
+        if (url.pathname === OAUTH_TOKEN_PATH) {
             await this.handleToken(req, res);
             return true;
         }
@@ -270,18 +271,18 @@ export class OAuthServer {
     }
     protectedResourceMetadata(baseUrl) {
         return {
-            resource: `${baseUrl}${this.opts.protectedPath}`,
+            resource: joinBaseAndPath(baseUrl, this.opts.protectedPath),
             authorization_servers: [baseUrl],
-            scopes_supported: ["mcp", "workspace:admin"],
+            scopes_supported: ["mcp", "workspace:admin", "cli:admin"],
             bearer_methods_supported: ["header"],
         };
     }
     authorizationServerMetadata(baseUrl) {
         return {
             issuer: baseUrl,
-            authorization_endpoint: `${baseUrl}/oauth/authorize`,
-            token_endpoint: `${baseUrl}/oauth/token`,
-            registration_endpoint: `${baseUrl}/oauth/register`,
+            authorization_endpoint: joinBaseAndPath(baseUrl, OAUTH_AUTHORIZE_PATH),
+            token_endpoint: joinBaseAndPath(baseUrl, OAUTH_TOKEN_PATH),
+            registration_endpoint: joinBaseAndPath(baseUrl, OAUTH_REGISTER_PATH),
             response_types_supported: ["code"],
             grant_types_supported: ["authorization_code"],
             token_endpoint_auth_methods_supported: this.opts.config.allowPublicClients
@@ -290,7 +291,7 @@ export class OAuthServer {
             code_challenge_methods_supported: this.opts.config.allowPlainPkce
                 ? ["S256", "plain"]
                 : ["S256"],
-            scopes_supported: ["mcp", "workspace:admin"],
+            scopes_supported: ["mcp", "workspace:admin", "cli:admin"],
         };
     }
     registrationAllowedByPolicy(req, params) {

package/dist/postgres-job-store-worker.d.ts

@@ -0,0 +1 @@
+export {};