mohdel 0.117.2 → 0.118.0

package/js/session/adapters/_images.js

@@ -11,10 +11,16 @@
  * provider. Errors are surfaced — file IO failures bubble up so the
  * adapter can emit a typed error rather than silently skipping.
  *
+ * Local paths are resolved through `_media.js`, which owns symlink
+ * resolution, the `MOHDEL_MEDIA_ROOTS` confinement check and the read
+ * cap.
+ *
  * @module session/adapters/_images
  */
 
-import { readFile } from 'node:fs/promises'
+import { dataUriPayload, mediaError, mediaScheme, readLocalMedia } from './_media.js'
+
+const IMAGE_ERROR = 'SESSION_INVALID_IMAGE'
 
 /**
  * @typedef {object} LoadedImage
@@ -25,36 +31,39 @@ import { readFile } from 'node:fs/promises'
 
 /**
  * @param {Array<{fileUri: string, mimeType: string}>} images
+ * @param {{trusted?: boolean}} [opts]
  * @returns {Promise<LoadedImage[]>}
  */
-export async function loadImages (images) {
+export async function loadImages (images, opts = {}) {
   if (!images || !Array.isArray(images)) return []
   const out = []
   for (const img of images) {
     if (!img?.fileUri || !img?.mimeType) continue
-    out.push(await loadImage(img))
+    out.push(await loadImage(img, opts))
   }
   return out
 }
 
 /**
  * @param {{fileUri: string, mimeType: string}} image
+ * @param {{trusted?: boolean}} [opts]
  * @returns {Promise<LoadedImage>}
  */
-export async function loadImage (image) {
+export async function loadImage (image, opts = {}) {
   const { fileUri, mimeType } = image
-  if (fileUri.startsWith('file://')) {
-    const path = fileUri.replace(/^file:\/\//, '')
-    const buf = await readFile(path)
-    return { mimeType, base64: buf.toString('base64') }
-  }
-  if (fileUri.startsWith('data:')) {
-    const parts = fileUri.split(',')
-    if (parts.length > 1) return { mimeType, base64: parts[1] }
-    throw new Error(`malformed data URI: ${fileUri.slice(0, 32)}…`)
-  }
-  if (fileUri.startsWith('https://') || fileUri.startsWith('http://')) {
-    return { mimeType, url: fileUri }
+  switch (mediaScheme(fileUri)) {
+    case 'file': {
+      const { bytes } = await readLocalMedia(fileUri, { type: IMAGE_ERROR, trusted: opts.trusted })
+      return { mimeType, base64: bytes.toString('base64') }
+    }
+    case 'data':
+      return { mimeType, base64: dataUriPayload(fileUri, IMAGE_ERROR) }
+    case 'remote':
+      return { mimeType, url: fileUri }
+    default:
+      throw mediaError(
+        `unsupported image URI scheme: ${fileUri.slice(0, 32)}…`,
+        IMAGE_ERROR
+      )
   }
-  throw new Error(`unsupported image URI scheme: ${fileUri.slice(0, 32)}…`)
 }

package/js/session/adapters/_lazy_json_cache.js

@@ -1,8 +1,7 @@
 /**
  * Shared lazy-load-once JSON cache for config files under
  * `~/.config/mohdel/`. `_catalog.js` and `_providers.js` both had
- * byte-similar implementations before F62; this helper owns the
- * pattern.
+ * byte-similar implementations; this helper owns the pattern.
  *
  * Contract:
  *   - `loadSync(path?)` — synchronous read; used as the lazy

package/js/session/adapters/_media.js

@@ -0,0 +1,207 @@
+/**
+ * Local-media resolution for envelope `fileUri` references.
+ *
+ * Under thin-gate a `fileUri` comes from whoever can reach the data
+ * socket, while the session process holds the gate host's filesystem
+ * privileges. `MOHDEL_MEDIA_ROOTS` (PATH-style) confines local reads
+ * to the listed directories; unset means unconfined.
+ *
+ * @module session/adapters/_media
+ */
+
+import { readFile as fsReadFile, realpath as fsRealpath, stat as fsStat } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { delimiter, isAbsolute, relative } from 'node:path'
+
+export const MEDIA_MAX_BYTES = 64 * 1024 * 1024
+
+/**
+ * A symbol key cannot survive `JSON.parse`, so an envelope arriving
+ * over the wire can never carry this mark however it is crafted. Only
+ * an in-process caller holding the symbol can set it.
+ */
+const TRUSTED_MEDIA = Symbol('mohdel.trustedMedia')
+
+/**
+ * @template {object} T
+ * @param {T} envelope
+ * @returns {T}
+ */
+export function markTrustedMedia (envelope) {
+  return Object.assign(envelope, { [TRUSTED_MEDIA]: true })
+}
+
+/**
+ * @param {any} envelope
+ * @returns {boolean}
+ */
+export function isTrustedMedia (envelope) {
+  return envelope?.[TRUSTED_MEDIA] === true
+}
+
+/**
+ * @param {string} uri
+ * @returns {'remote' | 'data' | 'file' | 'unknown'}
+ */
+export function mediaScheme (uri) {
+  if (typeof uri !== 'string' || !uri) return 'unknown'
+  if (/^https?:\/\//i.test(uri)) return 'remote'
+  if (uri.startsWith('data:')) return 'data'
+  if (uri.startsWith('file://')) return 'file'
+  return 'unknown'
+}
+
+/**
+ * @param {string} message
+ * @param {string} type    Canonical TypedError tag supplied by the caller.
+ * @param {string} [detail]
+ * @returns {Error & {typed: import('#core/errors.js').TypedError}}
+ */
+export function mediaError (message, type, detail) {
+  const err = new Error(message)
+  /** @type {import('#core/errors.js').TypedError} */
+  const typed = { message, severity: 'error', retryable: false, type }
+  if (detail) typed.detail = detail
+  return Object.assign(err, { typed })
+}
+
+/**
+ * @param {string} uri
+ * @param {string} type
+ * @returns {string}  Raw base64 payload, no `data:` prefix.
+ */
+export function dataUriPayload (uri, type) {
+  const comma = uri.indexOf(',')
+  if (comma < 0) {
+    throw mediaError('malformed data URI', type, 'expected data:<mime>;base64,<payload>')
+  }
+  return uri.slice(comma + 1)
+}
+
+/**
+ * A character device such as `/dev/zero` reports `size: 0` and reads
+ * without end, so the regular-file check — not the size check — is
+ * what bounds the read.
+ *
+ * `MOHDEL_MEDIA_ROOTS`, when set, confines reads for every caller.
+ * When unset, `trusted` decides: an in-process caller reads its own
+ * disk freely, an envelope off the wire reads nothing.
+ *
+ * @param {string} fileUri
+ * @param {{
+ *   type: string,
+ *   trusted?: boolean,
+ *   maxBytes?: number,
+ *   stat?: (path: string) => Promise<any>,
+ *   realpath?: (path: string) => Promise<string>
+ * }} opts
+ * @returns {Promise<{path: string, size: number}>}
+ */
+export async function resolveLocalMedia (fileUri, opts) {
+  const { type, trusted = false, maxBytes = MEDIA_MAX_BYTES } = opts
+  const stat = opts.stat ?? fsStat
+  const realpath = opts.realpath ?? fsRealpath
+
+  let requested
+  try {
+    requested = fileURLToPath(new URL(fileUri))
+  } catch {
+    throw mediaError('media path is not a valid file URI', type, fileUri.slice(0, 64))
+  }
+
+  let path
+  try {
+    path = await realpath(requested)
+  } catch (e) {
+    throw mediaError('media file is unreadable', type, messageOf(e))
+  }
+
+  const roots = await mediaRoots(realpath)
+  if (roots.length) {
+    if (!roots.some(root => contains(root, path))) {
+      throw mediaError(
+        'media path is outside the permitted directories',
+        type,
+        `${path} is not under any MOHDEL_MEDIA_ROOTS entry`
+      )
+    }
+  } else if (!trusted) {
+    throw mediaError(
+      'reading local files is not permitted for this caller',
+      type,
+      'set MOHDEL_MEDIA_ROOTS to the directories this deployment may read media from, or send the media as a data: URI'
+    )
+  }
+
+  let stats
+  try {
+    stats = await stat(path)
+  } catch (e) {
+    throw mediaError('media file is unreadable', type, messageOf(e))
+  }
+
+  if (!stats.isFile()) {
+    throw mediaError('media path is not a regular file', type, path)
+  }
+  if (stats.size > maxBytes) {
+    throw mediaError(
+      'media file exceeds the size limit',
+      type,
+      `${stats.size} bytes exceeds the ${maxBytes} byte limit`
+    )
+  }
+
+  return { path, size: stats.size }
+}
+
+/**
+ * @param {string} fileUri
+ * @param {{
+ *   type: string,
+ *   trusted?: boolean,
+ *   maxBytes?: number,
+ *   stat?: (path: string) => Promise<any>,
+ *   realpath?: (path: string) => Promise<string>,
+ *   readFile?: (path: string) => Promise<Buffer>
+ * }} opts
+ * @returns {Promise<{path: string, bytes: Buffer}>}
+ */
+export async function readLocalMedia (fileUri, opts) {
+  const { path } = await resolveLocalMedia(fileUri, opts)
+  const readFile = opts.readFile ?? fsReadFile
+  try {
+    return { path, bytes: await readFile(path) }
+  } catch (e) {
+    throw mediaError('media file is unreadable', opts.type, messageOf(e))
+  }
+}
+
+/**
+ * @param {(path: string) => Promise<string>} realpath
+ * @returns {Promise<string[]>}
+ */
+async function mediaRoots (realpath) {
+  const raw = process.env.MOHDEL_MEDIA_ROOTS
+  if (!raw) return []
+  const entries = raw.split(delimiter).map(s => s.trim()).filter(Boolean)
+  return Promise.all(entries.map(entry => realpath(entry).catch(() => entry)))
+}
+
+/**
+ * `startsWith` would accept `/srv/media-evil` for root `/srv/media`;
+ * the relative path never does.
+ *
+ * @param {string} root
+ * @param {string} path
+ * @returns {boolean}
+ */
+function contains (root, path) {
+  if (path === root) return true
+  const rel = relative(root, path)
+  return !!rel && !rel.startsWith('..') && !isAbsolute(rel)
+}
+
+/** @param {unknown} e */
+function messageOf (e) {
+  return e instanceof Error ? e.message : String(e)
+}

package/js/session/adapters/_providers.js

@@ -28,14 +28,6 @@ const cache = createLazyJsonFileCache(
   () => `${envPaths('mohdel', { suffix: null }).config}/providers.json`
 )
 
-/**
- * @param {string} path
- * @returns {Record<string, ProviderLimits>}
- */
-export function loadProviders (path) {
-  return cache.loadSync(path)
-}
-
 /**
  * Eager async initialization from the default providers path. Called
  * from `bin.js::main` before `drive()` so `getProviderLimits` doesn't

package/js/session/adapters/_videos.js

@@ -4,16 +4,20 @@
  * shape).
  *
  * Three code paths per envelope video ref:
- *   1. `file://` / local path, ≤20MB, no cache flag → read + base64
- *      inline as `inlineData`.
- *   2. `file://` / local path, >20MB or `cache: true` → upload via
- *      the provider SDK (Gemini `ai.files.upload`), poll until the
- *      file is ACTIVE, return a `fileData` part. Content-hash +
- *      mtime-keyed cache at `~/.cache/mohdel/uploaded-files.json`
- *      short-circuits repeat uploads.
+ *   1. `file://`, ≤20MB, no cache flag → read + base64 inline as
+ *      `inlineData`.
+ *   2. `file://`, >20MB or `cache: true` → upload via the provider
+ *      SDK (Gemini `ai.files.upload`), poll until the file is ACTIVE,
+ *      return a `fileData` part. Content-hash + mtime-keyed cache at
+ *      `~/.cache/mohdel/uploaded-files.json` short-circuits repeat
+ *      uploads.
  *   3. `https://` → passthrough as `fileData.fileUri` (Gemini fetches
  *      it directly).
  *
+ * Local paths resolve through `_media.js`. Bare filesystem paths are
+ * not accepted — the scheme is required, matching `_images.js` and the
+ * transcription loader.
+ *
  * @module session/adapters/_videos
  */
 
@@ -24,9 +28,12 @@ import { join } from 'node:path'
 
 import envPaths from 'env-paths'
 
+import { dataUriPayload, mediaError, mediaScheme, resolveLocalMedia } from './_media.js'
+
 const CACHE_DIR = envPaths('mohdel', { suffix: null }).cache
 const CACHE_PATH = join(CACHE_DIR, 'uploaded-files.json')
 
+const VIDEO_ERROR = 'SESSION_INVALID_VIDEO'
 const INLINE_MAX_BYTES = 20 * 1024 * 1024
 const VIDEO_UPLOAD_POLL_INTERVAL_MS = 5_000
 /** Hard deadline on the PROCESSING → ACTIVE wait. Videos occasionally
@@ -144,7 +151,8 @@ export async function setCachedFile (filePath, data, provider = 'gemini') {
  *   readFile?: (path: string) => Promise<Buffer>,
  *   stat?: (path: string) => Promise<{size: number}>,
  *   signal?: AbortSignal,
- *   provider?: string
+ *   provider?: string,
+ *   trusted?: boolean
  * }} deps
  * @returns {Promise<VideoPart[]>}
  */
@@ -159,7 +167,8 @@ export async function loadVideos (videos, deps) {
     readFileFn: deps.readFile ?? fs.readFile,
     statFn: deps.stat ?? fs.stat,
     signal: deps.signal,
-    provider: deps.provider ?? 'gemini'
+    provider: deps.provider ?? 'gemini',
+    trusted: !!deps.trusted
   }
 
   for (const v of videos) {
@@ -174,28 +183,30 @@ export async function loadVideos (videos, deps) {
 async function toPart (ref, ctx) {
   const { fileUri, mimeType } = ref
 
-  // https:// → Gemini fetches it directly
-  if (/^https?:\/\//i.test(fileUri)) {
+  const scheme = mediaScheme(fileUri)
+  if (scheme === 'remote') {
     return { fileData: { fileUri, mimeType } }
   }
-
-  // data: URI → inline the base64 payload
-  if (fileUri.startsWith('data:')) {
-    const comma = fileUri.indexOf(',')
-    if (comma < 0) return null
-    return { inlineData: { data: fileUri.slice(comma + 1), mimeType } }
+  if (scheme === 'data') {
+    return { inlineData: { data: dataUriPayload(fileUri, VIDEO_ERROR), mimeType } }
   }
-
-  // file:// or local path
-  const filePath = fileUri.replace(/^file:\/\//, '')
-  let stats
-  try {
-    stats = await ctx.statFn(filePath)
-  } catch {
-    return null
+  if (scheme !== 'file') {
+    throw mediaError(
+      `unsupported video URI scheme: ${fileUri.slice(0, 32)}…`,
+      VIDEO_ERROR
+    )
   }
 
-  if (stats.size > INLINE_MAX_BYTES || ctx.useCache) {
+  // The upload path streams from the path rather than buffering, so
+  // only the inline branch is bounded here — by INLINE_MAX_BYTES.
+  const { path: filePath, size } = await resolveLocalMedia(fileUri, {
+    type: VIDEO_ERROR,
+    trusted: ctx.trusted,
+    maxBytes: Number.POSITIVE_INFINITY,
+    stat: ctx.statFn
+  })
+
+  if (size > INLINE_MAX_BYTES || ctx.useCache) {
     const uri = await uploadFile(filePath, mimeType, ctx)
     return { fileData: { fileUri: uri, mimeType } }
   }

package/js/session/adapters/anthropic.js

@@ -27,6 +27,7 @@ import { cancelledDone } from './_cancelled.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { loadImages } from './_images.js'
+import { isTrustedMedia } from './_media.js'
 import { costFor } from './_pricing.js'
 import { catalogKey, bareOf } from '#core/model-id.js'
 import {
@@ -95,19 +96,20 @@ export async function * anthropic (envelope, deps = {}) {
   // Attach images to the last user message before building the request.
   if (envelope.images?.length) {
     try {
-      const loaded = await loadImages(envelope.images)
+      const loaded = await loadImages(envelope.images, { trusted: isTrustedMedia(envelope) })
       const blocks = loaded.map(toAnthropicImageBlock).filter(Boolean)
       if (blocks.length) injectImageBlocks(conversation, blocks)
     } catch (e) {
       log?.warn({ err: e }, '[mohdel:anthropic] image load failed')
-      yield { type: 'error', error: classifyProviderError(e, envelope.auth?.key, { provider: 'anthropic' }) }
+      const typed = /** @type {any} */(e).typed
+      yield { type: 'error', error: typed || classifyProviderError(e, envelope.auth?.key, { provider: 'anthropic' }) }
       return
     }
   }
 
   const request = buildRequest(envelope, conversation, system, conversationCacheTtl)
 
-  // F53: accumulate via array + join to avoid per-delta V8 cons-string
+  // Accumulate via array + join to avoid per-delta V8 cons-string
   // churn. Materialized at each exit point.
   const outputParts = []
   const currentOutput = () => outputParts.join('')

package/js/session/adapters/gemini.js

@@ -28,6 +28,7 @@ import { cancelledDone } from './_cancelled.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { loadImages } from './_images.js'
+import { isTrustedMedia } from './_media.js'
 import { loadVideos } from './_videos.js'
 import { costFor } from './_pricing.js'
 import { catalogKey, bareOf } from '#core/model-id.js'
@@ -53,12 +54,13 @@ export async function * gemini (envelope, deps = {}) {
 
   if (envelope.images?.length) {
     try {
-      const loaded = await loadImages(envelope.images)
+      const loaded = await loadImages(envelope.images, { trusted: isTrustedMedia(envelope) })
       const parts = loaded.map(toGeminiImagePart).filter(Boolean)
       if (parts.length) injectParts(contents, parts)
     } catch (e) {
       log?.warn({ err: e }, '[mohdel:gemini] image load failed')
-      yield { type: 'error', error: classifyProviderError(e, envelope.auth?.key, { provider: 'gemini' }) }
+      const typed = /** @type {any} */(e).typed
+      yield { type: 'error', error: typed || classifyProviderError(e, envelope.auth?.key, { provider: 'gemini' }) }
       return
     }
   }
@@ -68,6 +70,7 @@ export async function * gemini (envelope, deps = {}) {
       const parts = await loadVideos(envelope.videos, {
         client,
         useCache: !!envelope.cache,
+        trusted: isTrustedMedia(envelope),
         signal
       })
       if (parts.length) injectParts(contents, parts)
@@ -97,7 +100,7 @@ export async function * gemini (envelope, deps = {}) {
     request.config = { ...(request.config ?? {}), abortSignal: signal }
   }
 
-  // F53: accumulate via array + join to avoid per-delta V8 cons-string
+  // Accumulate via array + join to avoid per-delta V8 cons-string
   // churn. Materialized at each exit point.
   const outputParts = []
   const currentOutput = () => outputParts.join('')

package/js/session/adapters/image/novita.js

@@ -122,8 +122,8 @@ async function pollTaskResult (fetchFn, sleep, now, taskId, apiKey) {
 function fromHttpStatus (status, message, detail) {
   const typed = classifyProviderError({ status })
   // Keep the classifier's message (stable/machine-readable); put the
-  // caller's context + any response-body snippet into `detail`. F45:
-  // never echo provider response bodies into `TypedError.message`.
+  // caller's context + any response-body snippet into `detail`. Never
+  // echo provider response bodies into `TypedError.message`.
   return typedError(typed.message, typed.type, typed.retryable, detail ? `${message}: ${detail}` : message)
 }
 

package/js/session/adapters/openai.js

@@ -28,6 +28,7 @@ import { cancelledDone } from './_cancelled.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { loadImages } from './_images.js'
+import { isTrustedMedia } from './_media.js'
 import { costFor } from './_pricing.js'
 import { catalogKey, providerOf, bareOf } from '#core/model-id.js'
 import {
@@ -57,19 +58,20 @@ export async function * openai (envelope, deps = {}) {
 
   if (envelope.images?.length) {
     try {
-      const loaded = await loadImages(envelope.images)
+      const loaded = await loadImages(envelope.images, { trusted: isTrustedMedia(envelope) })
       const parts = loaded.map(toOpenAIImagePart).filter(Boolean)
       if (parts.length) injectImageParts(input, parts)
     } catch (e) {
       log?.warn({ err: e }, '[mohdel:openai] image load failed')
-      yield { type: 'error', error: classifyProviderError(e, envelope.auth?.key, { provider: 'openai' }) }
+      const typed = /** @type {any} */(e).typed
+      yield { type: 'error', error: typed || classifyProviderError(e, envelope.auth?.key, { provider: 'openai' }) }
       return
     }
   }
 
   const request = buildRequest(envelope, input, instructions)
 
-  // F53: accumulate via array + join to avoid per-delta V8 cons-string
+  // Accumulate via array + join to avoid per-delta V8 cons-string
   // churn. Materialized at each exit point.
   const outputParts = []
   const currentOutput = () => outputParts.join('')

package/js/session/adapters/transcription/index.js

@@ -47,12 +47,3 @@ export function getTranscriptionAdapter (provider) {
   if (!adapter) throw new Error(`no transcription adapter for provider: ${provider}`)
   return adapter
 }
-
-/**
- * Whether the provider has a transcription adapter registered.
- *
- * @param {string} provider
- */
-export function isTranscriptionProvider (provider) {
-  return Object.prototype.hasOwnProperty.call(TRANSCRIPTION_ADAPTERS, provider)
-}

package/js/session/adapters/transcription/openai_compatible.js

@@ -18,11 +18,11 @@
  * @module session/adapters/transcription/openai_compatible
  */
 
-import { readFile } from 'node:fs/promises'
 import { basename } from 'node:path'
 
 import { getSpec } from '../_catalog.js'
 import { classifyProviderError } from '../_errors.js'
+import { dataUriPayload, isTrustedMedia, mediaScheme, readLocalMedia } from '../_media.js'
 import { computeTranscriptionCost } from '../_pricing.js'
 import { catalogKey, bareOf } from '#core/model-id.js'
 
@@ -39,7 +39,7 @@ export function createTranscriptionAdapter ({ baseURL, responseFormat }) {
     const spec = deps.spec ?? getSpec(catalogKey(envelope.model)) ?? {}
     const start = String(process.hrtime.bigint())
 
-    const audio = await loadAudio(envelope.audio)
+    const audio = await loadAudio(envelope.audio, { trusted: isTrustedMedia(envelope) })
 
     const form = new FormData()
     form.append('model', spec.model ?? bareOf(envelope.model))
@@ -124,30 +124,25 @@ const EXT_BY_MIME = {
  * downloading arbitrary URLs; the caller owns that step.
  *
  * @param {import('#core/transcription.js').AudioRef} audio
+ * @param {{trusted?: boolean}} [opts]
  * @returns {Promise<{bytes: Buffer, mimeType: string, filename: string}>}
  */
-export async function loadAudio (audio) {
+export async function loadAudio (audio, opts = {}) {
   if (!audio?.fileUri || !audio?.mimeType) {
     throw typedError('transcription requires audio {fileUri, mimeType}', 'SESSION_INVALID_AUDIO', false)
   }
   const { fileUri, mimeType } = audio
-  if (fileUri.startsWith('file://')) {
-    const path = fileUri.replace(/^file:\/\//, '')
-    let bytes
-    try {
-      bytes = await readFile(path)
-    } catch (e) {
-      throw typedError('audio file unreadable', 'SESSION_INVALID_AUDIO', false, messageOf(e))
-    }
+  if (mediaScheme(fileUri) === 'file') {
+    const { path, bytes } = await readLocalMedia(fileUri, {
+      type: 'SESSION_INVALID_AUDIO',
+      trusted: opts.trusted
+    })
     return { bytes, mimeType, filename: basename(path) }
   }
-  if (fileUri.startsWith('data:')) {
-    const parts = fileUri.split(',')
-    if (parts.length < 2) {
-      throw typedError('malformed audio data URI', 'SESSION_INVALID_AUDIO', false)
-    }
+  if (mediaScheme(fileUri) === 'data') {
     const ext = EXT_BY_MIME[mimeType] || mimeType.split('/').pop() || 'bin'
-    return { bytes: Buffer.from(parts[1], 'base64'), mimeType, filename: `audio.${ext}` }
+    const payload = dataUriPayload(fileUri, 'SESSION_INVALID_AUDIO')
+    return { bytes: Buffer.from(payload, 'base64'), mimeType, filename: `audio.${ext}` }
   }
   throw typedError(
     `unsupported audio URI scheme: ${fileUri.slice(0, 32)}…`,
@@ -159,7 +154,7 @@ export async function loadAudio (audio) {
 function fromHttpStatus (status, message, detail) {
   const typed = classifyProviderError({ status })
   // Keep the classifier's message (stable/machine-readable); response
-  // body snippets go to `detail` only (F45).
+  // body snippets go to `detail` only.
   return typedError(typed.message, typed.type, typed.retryable, detail ? `${message}: ${detail}` : message)
 }
 
@@ -170,8 +165,3 @@ function typedError (message, type, retryable, detail) {
   err.typed = typed
   return err
 }
-
-/** @param {unknown} e */
-function messageOf (e) {
-  return e instanceof Error ? e.message : String(e)
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mohdel",
-  "version": "0.117.2",
+  "version": "0.118.0",
   "license": "MIT",
   "author": {
     "name": "Christophe Le Bars",
@@ -25,7 +25,7 @@
     "./providers": "./src/lib/providers.js",
     "./creators": "./src/lib/creators.js",
     "./utils": "./src/lib/utils.js",
-    "./errors": "./src/lib/errors.js",
+    "./errors": "./js/core/errors.js",
     "./client": "./js/client/index.js",
     "./session": "./js/session/index.js",
     "./session/bin": "./js/session/bin.js"
@@ -87,16 +87,16 @@
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.221.0",
     "@opentelemetry/sdk-node": "^0.221.0",
     "chalk": "^5.4.0",
-    "mohdel-thin-gate-linux-x64-gnu": "0.117.2"
+    "mohdel-thin-gate-linux-x64-gnu": "0.118.0"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.112.5",
+    "@anthropic-ai/sdk": "^0.115.0",
     "@cerebras/cerebras_cloud_sdk": "^1.91.0",
     "@google/genai": "^2.13.0",
     "@opentelemetry/api": "^1.9.1",
     "env-paths": "^4.0.0",
-    "groq-sdk": "^1.3.0",
-    "openai": "^6.48.0",
+    "groq-sdk": "^1.4.0",
+    "openai": "^6.49.0",
     "undici": "^7.24.5"
   },
   "lint-staged": {
@@ -104,7 +104,7 @@
   },
   "devDependencies": {
     "gpt-tokenizer": "^3.4.0",
-    "lint-staged": "^17.1.1",
+    "lint-staged": "^17.2.0",
     "release-it": "^20.2.1",
     "standard": "^17.1.2",
     "vitest": "^4.1.10"