muonroi-cli 1.4.0 → 1.4.1

package/src/providers/errors.test.ts

@@ -1,76 +0,0 @@
-/**
- * Tests for src/providers/errors.ts
- * Verifies normalizeError maps various error shapes to the 5 NormalizedErrorKind values.
- */
-import { describe, expect, it } from "vitest";
-import { normalizeError } from "./errors.js";
-
-describe("normalizeError", () => {
-  it("maps RateLimitError name to rate_limit", () => {
-    const err = Object.assign(new Error("Rate limit exceeded"), { name: "RateLimitError", status: 429 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("rate_limit");
-    expect(n.status).toBe(429);
-  });
-
-  it("maps status 429 to rate_limit even without name", () => {
-    const err = Object.assign(new Error("Too many requests"), { status: 429 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("rate_limit");
-  });
-
-  it("maps AuthenticationError name to auth", () => {
-    const err = Object.assign(new Error("Invalid API key"), { name: "AuthenticationError", status: 401 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("auth");
-    expect(n.status).toBe(401);
-  });
-
-  it("maps status 403 to auth", () => {
-    const err = Object.assign(new Error("Forbidden"), { status: 403 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("auth");
-  });
-
-  it("maps content filter message to content_filter", () => {
-    const err = new Error("Content blocked by safety filter");
-    const n = normalizeError(err);
-    expect(n.kind).toBe("content_filter");
-  });
-
-  it("maps policy violation to content_filter", () => {
-    const err = new Error("This request violates our usage policy");
-    const n = normalizeError(err);
-    expect(n.kind).toBe("content_filter");
-  });
-
-  it("maps status 500 to server_error", () => {
-    const err = Object.assign(new Error("Internal server error"), { status: 500 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("server_error");
-  });
-
-  it("maps status 502 to server_error", () => {
-    const err = Object.assign(new Error("Bad gateway"), { status: 502 });
-    const n = normalizeError(err);
-    expect(n.kind).toBe("server_error");
-  });
-
-  it("maps unknown error to unknown", () => {
-    const err = new Error("Something weird happened");
-    const n = normalizeError(err);
-    expect(n.kind).toBe("unknown");
-  });
-
-  it("handles non-Error input", () => {
-    const n = normalizeError("string error");
-    expect(n.kind).toBe("unknown");
-    expect(n.message).toBe("string error");
-  });
-
-  it("preserves provider_message", () => {
-    const err = new Error("Quota exceeded");
-    const n = normalizeError(err);
-    expect(n.provider_message).toBe("Quota exceeded");
-  });
-});

package/src/providers/errors.ts

@@ -1,46 +0,0 @@
-/**
- * src/providers/errors.ts
- *
- * Normalized error mapping for multi-provider streams.
- * Maps AI SDK errors to one of 5 kinds: rate_limit | auth | content_filter | server_error | unknown.
- * PROV-05 requirement.
- */
-
-export type NormalizedErrorKind = "rate_limit" | "auth" | "content_filter" | "server_error" | "unknown";
-
-export interface NormalizedError extends Error {
-  kind: NormalizedErrorKind;
-  status?: number;
-  provider_message?: string;
-}
-
-/**
- * Normalize any thrown error into a NormalizedError with a consistent `kind`.
- * Uses error name, HTTP status, and message pattern matching.
- */
-export function normalizeError(err: unknown): NormalizedError {
-  const e = err instanceof Error ? err : new Error(String(err));
-  const name = e.name ?? "";
-  const msg = e.message ?? "";
-  const status = (err as any)?.status ?? (err as any)?.statusCode;
-
-  let kind: NormalizedErrorKind = "unknown";
-
-  if (name === "RateLimitError" || status === 429 || /rate.?limit/i.test(msg)) {
-    kind = "rate_limit";
-  } else if (
-    name === "AuthenticationError" ||
-    status === 401 ||
-    status === 403 ||
-    /auth|unauthor|forbidden/i.test(msg)
-  ) {
-    kind = "auth";
-  } else if (/content.?filter|safety|policy|blocked/i.test(msg)) {
-    kind = "content_filter";
-  } else if (typeof status === "number" && status >= 500) {
-    kind = "server_error";
-  }
-
-  const out = Object.assign(e, { kind, status, provider_message: msg });
-  return out as NormalizedError;
-}

package/src/providers/gemini.test.ts

@@ -1,46 +0,0 @@
-/**
- * Tests for src/providers/gemini.ts
- * Uses recorded JSONL fixtures replayed via mocked streamText.
- */
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { createMockFullStream, loadFixtureChunks } from "./__test-utils__/load-fixture.js";
-import type { StreamChunk } from "./types.js";
-
-vi.mock("ai", () => ({
-  streamText: vi.fn(),
-}));
-
-vi.mock("@ai-sdk/google", () => ({
-  createGoogleGenerativeAI: vi.fn(() => vi.fn((model: string) => ({ modelId: model }))),
-}));
-
-import { streamText } from "ai";
-import { createGeminiAdapter } from "./gemini.js";
-
-const mockStreamText = vi.mocked(streamText);
-
-describe("createGeminiAdapter", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it('has id "google"', () => {
-    const adapter = createGeminiAdapter({ model: "gemini-2.5-flash", apiKey: "test-key-xxxxxxxxxxxxxxxxxxxx" });
-    expect(adapter.id).toBe("google");
-  });
-
-  it("handles single-tool fixture emitting exactly one tool-call", async () => {
-    const chunks = loadFixtureChunks("gemini", "single-tool");
-    mockStreamText.mockReturnValue({ fullStream: createMockFullStream(chunks) } as any);
-
-    const adapter = createGeminiAdapter({ model: "gemini-2.5-flash", apiKey: "test-key-xxxxxxxxxxxxxxxxxxxx" });
-    const collected: StreamChunk[] = [];
-    for await (const chunk of adapter.stream({ messages: [{ role: "user", content: "search" }] })) {
-      collected.push(chunk);
-    }
-
-    const toolCalls = collected.filter((c) => c.kind === "tool-call");
-    expect(toolCalls.length).toBe(1);
-    expect((toolCalls[0] as any).toolName).toBe("search");
-  });
-});

package/src/providers/gemini.ts

@@ -1,42 +0,0 @@
-/**
- * src/providers/gemini.ts
- *
- * Gemini adapter implementation behind the Adapter interface.
- * Uses @ai-sdk/google + AI SDK v6 streamText/fullStream.
- */
-
-import { createGoogleGenerativeAI } from "@ai-sdk/google";
-import { streamText } from "ai";
-import { redactor } from "../utils/redactor.js";
-import { streamFromFullStream } from "./stream-loop.js";
-import type { Adapter, AdapterRequest, ProviderConfig, ProviderStream } from "./types.js";
-
-/**
- * Create a Gemini (Google) adapter.
- */
-export function createGeminiAdapter(config: ProviderConfig): Adapter {
-  if (config.apiKey && !config.oauthHeaders) {
-    redactor.enrollSecret(config.apiKey);
-  }
-
-  // When OAuth headers are present, route auth through extraHeaders. The Gemini
-  // SDK still wants a non-empty apiKey for config validation; the Authorization
-  // header takes precedence on the wire.
-  const provider = config.oauthHeaders
-    ? createGoogleGenerativeAI({ apiKey: "oauth", headers: config.oauthHeaders })
-    : createGoogleGenerativeAI({ apiKey: config.apiKey });
-
-  return {
-    id: "google",
-    async *stream(req: AdapterRequest): ProviderStream {
-      const result = streamText({
-        model: provider(config.model),
-        messages: req.messages,
-        tools: req.tools as any,
-        toolChoice: req.toolChoice as any,
-        abortSignal: req.abortSignal,
-      });
-      yield* streamFromFullStream(result.fullStream);
-    },
-  };
-}

package/src/providers/index.ts

@@ -1,28 +0,0 @@
-/**
- * src/providers/index.ts
- *
- * Barrel export for the providers module.
- * Multi-provider support via shared runtime + adapter factories.
- */
-
-// Adapter factory
-export { ALL_PROVIDER_IDS, createAdapter } from "./adapter.js";
-// Back-compat Phase 0 exports (still used by some callers)
-export {
-  AnthropicKeyMissingError,
-  loadAnthropicKey,
-  streamAnthropicMessage,
-} from "./anthropic.js";
-// Keychain
-export { firstAvailableProvider, loadKeyForProvider, ProviderKeyMissingError } from "./keychain.js";
-// Multi-provider runtime
-export {
-  createProviderFactory,
-  detectProviderForModel,
-  type ProviderFactory,
-  type ProviderFactoryResult,
-  type ResolvedModelRuntime,
-  resolveModelRuntime,
-} from "./runtime.js";
-// Provider types
-export type { ProviderId, ProviderRequest, ProviderStream, StreamChunk } from "./types.js";

package/src/providers/keychain.test.ts

@@ -1,100 +0,0 @@
-/**
- * Tests for src/providers/keychain.ts
- * Mocks keytar and env vars to verify loadKeyForProvider + firstAvailableProvider.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// We'll mock keytar at the module level
-vi.mock("keytar", () => ({
-  getPassword: vi.fn().mockResolvedValue(null),
-}));
-
-// Mock settings so the settings.json providers fallback doesn't interfere
-vi.mock("../utils/settings.js", () => ({
-  loadUserSettings: () => ({ providers: {} }),
-}));
-
-import { firstAvailableProvider, loadKeyForProvider, ProviderKeyMissingError } from "./keychain.js";
-
-describe("loadKeyForProvider", () => {
-  const originalEnv = { ...process.env };
-
-  beforeEach(() => {
-    // Clear env vars
-    delete process.env.ANTHROPIC_API_KEY;
-    delete process.env.OPENAI_API_KEY;
-    delete process.env.GOOGLE_API_KEY;
-    delete process.env.DEEPSEEK_API_KEY;
-    delete process.env.SILICONFLOW_API_KEY;
-    delete process.env.OLLAMA_API_KEY;
-  });
-
-  afterEach(() => {
-    // Restore
-    Object.assign(process.env, originalEnv);
-    vi.restoreAllMocks();
-  });
-
-  it("returns key from env var when keytar returns null", async () => {
-    process.env.OPENAI_API_KEY = "sk-test-openai-key-longer-than-20-chars";
-    const key = await loadKeyForProvider("openai");
-    expect(key).toBe("sk-test-openai-key-longer-than-20-chars");
-  });
-
-  it("throws ProviderKeyMissingError when no key found for non-ollama provider", async () => {
-    await expect(loadKeyForProvider("openai")).rejects.toThrow(ProviderKeyMissingError);
-  });
-
-  it("returns empty string for ollama when no key set (keyless)", async () => {
-    const key = await loadKeyForProvider("ollama");
-    expect(key).toBe("");
-  });
-
-  it("reads from ANTHROPIC_API_KEY env var", async () => {
-    process.env.ANTHROPIC_API_KEY = "sk-ant-test-key-long-enough-for-validation";
-    const key = await loadKeyForProvider("anthropic");
-    expect(key).toBe("sk-ant-test-key-long-enough-for-validation");
-  });
-
-  it("reads from GOOGLE_API_KEY env var", async () => {
-    process.env.GOOGLE_API_KEY = "AIzaSyB_test_key_longer_than_twenty";
-    const key = await loadKeyForProvider("google");
-    expect(key).toBe("AIzaSyB_test_key_longer_than_twenty");
-  });
-});
-
-describe("firstAvailableProvider", () => {
-  const originalEnv = { ...process.env };
-
-  beforeEach(() => {
-    delete process.env.ANTHROPIC_API_KEY;
-    delete process.env.OPENAI_API_KEY;
-    delete process.env.GOOGLE_API_KEY;
-    delete process.env.DEEPSEEK_API_KEY;
-    delete process.env.SILICONFLOW_API_KEY;
-    delete process.env.OLLAMA_API_KEY;
-  });
-
-  afterEach(() => {
-    Object.assign(process.env, originalEnv);
-    vi.restoreAllMocks();
-  });
-
-  it("returns anthropic when ANTHROPIC_API_KEY is set", async () => {
-    process.env.ANTHROPIC_API_KEY = "sk-ant-test-key-long-enough-for-validation";
-    const p = await firstAvailableProvider();
-    expect(p).toBe("anthropic");
-  });
-
-  it("returns openai when only OPENAI_API_KEY is set", async () => {
-    process.env.OPENAI_API_KEY = "sk-test-openai-key-longer-than-20-chars";
-    const p = await firstAvailableProvider();
-    expect(p).toBe("openai");
-  });
-
-  it("returns ollama as fallback (keyless)", async () => {
-    // No keys set — ollama is keyless so it should be found
-    const p = await firstAvailableProvider();
-    expect(p).toBe("ollama");
-  });
-});

package/src/providers/keychain.ts

@@ -1,278 +0,0 @@
-/**
- * src/providers/keychain.ts
- *
- * Per-provider keychain loader with env-var fallback.
- * Extends the Phase 0 loadAnthropicKey pattern to all 6 providers.
- * PROV-02 / PROV-03 requirements.
- *
- * Priority: OS keychain (keytar) > environment variable > settings.json > ProviderKeyMissingError.
- * Exception: ollama is keyless by default.
- */
-
-import { redactor } from "../utils/redactor.js";
-import type { ProviderId } from "./types.js";
-import { ALL_PROVIDER_IDS } from "./types.js";
-
-const SETTINGS_KEY_MAP: Partial<Record<ProviderId, string>> = {
-  anthropic: "anthropic",
-  openai: "openai",
-  google: "google",
-  deepseek: "deepseek",
-  siliconflow: "siliconflow",
-  xai: "xai",
-};
-
-const KEYCHAIN_SERVICE = "muonroi-cli";
-
-const ACCOUNT_BY_PROVIDER: Record<ProviderId, string> = {
-  anthropic: "anthropic",
-  openai: "openai",
-  google: "google",
-  deepseek: "deepseek",
-  siliconflow: "siliconflow",
-  xai: "xai",
-  ollama: "ollama",
-};
-
-const ENV_BY_PROVIDER: Record<ProviderId, string> = {
-  anthropic: "ANTHROPIC_API_KEY",
-  openai: "OPENAI_API_KEY",
-  google: "GOOGLE_API_KEY",
-  deepseek: "DEEPSEEK_API_KEY",
-  siliconflow: "SILICONFLOW_API_KEY",
-  xai: "XAI_API_KEY",
-  ollama: "OLLAMA_API_KEY",
-};
-
-/**
- * Thrown when no API key can be found for a provider.
- */
-export class ProviderKeyMissingError extends Error {
-  constructor(public readonly provider: ProviderId) {
-    super(`No API key found for provider '${provider}'.`);
-    this.name = "ProviderKeyMissingError";
-  }
-}
-
-/**
- * Dynamic keytar loader — B-2 mitigation.
- * Missing/broken keytar never crashes the process.
- */
-interface KeytarLike {
-  getPassword(service: string, account: string): Promise<string | null>;
-  setPassword?(service: string, account: string, password: string): Promise<void>;
-  deletePassword?(service: string, account: string): Promise<boolean>;
-  findCredentials?(service: string): Promise<Array<{ account: string; password: string }>>;
-}
-
-async function loadKeytar(): Promise<KeytarLike | null> {
-  try {
-    return (await import("keytar")) as KeytarLike;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Providers that store an API key in the OS keychain.
- * Phase 12.2-G5: derived from `ALL_PROVIDER_IDS` by excluding ollama
- * (keyless local server). Preserves the original ordering.
- */
-export const KEYCHAIN_PROVIDER_IDS: readonly ProviderId[] = ALL_PROVIDER_IDS.filter((p) => p !== "ollama");
-
-/**
- * Store a provider API key in the OS keychain. Returns true on success.
- * Falls back to false (silent) if keytar is unavailable on this platform.
- */
-export async function setKeyForProvider(provider: ProviderId, key: string): Promise<boolean> {
-  if (!key || key.length < 20) {
-    throw new Error(`Key for '${provider}' is too short (< 20 chars).`);
-  }
-  const kt = await loadKeytar();
-  if (!kt?.setPassword) return false;
-  redactor.enrollSecret(key);
-  try {
-    await kt.setPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider], key);
-    return true;
-  } catch (err: any) {
-    // Runtime backend failure is common on Linux when libsecret / secret service
-    // (gnome-keyring, kwallet/ksecretd, etc.) is not installed, the collection is
-    // locked, or no D-Bus session/keyring is active for this user.
-    // The caller (e.g. keys import-bw / keys set) will print the friendly message.
-    if (process.env.DEBUG || process.env.MUONROI_DEBUG_KEYCHAIN) {
-      console.error(`[keychain] setPassword backend error for ${provider}:`, err?.message || err);
-    }
-    return false;
-  }
-}
-
-/**
- * Delete a stored key. Returns true if a key was deleted, false if none was
- * present or keytar is unavailable.
- */
-export async function deleteKeyForProvider(provider: ProviderId): Promise<boolean> {
-  const kt = await loadKeytar();
-  if (!kt?.deletePassword) return false;
-  return await kt.deletePassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider]);
-}
-
-/**
- * List provider IDs that currently have a key stored in the keychain.
- * Empty array if keytar is unavailable.
- */
-export async function listStoredProviders(): Promise<ProviderId[]> {
-  const kt = await loadKeytar();
-  if (!kt?.findCredentials) return [];
-  try {
-    const creds = await kt.findCredentials(KEYCHAIN_SERVICE);
-    const validAccounts = new Set(Object.values(ACCOUNT_BY_PROVIDER));
-    return creds.filter((c) => validAccounts.has(c.account)).map((c) => c.account as ProviderId);
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Load the API key for a given provider.
- * Priority: OS keychain (keytar) > environment variable.
- * Ollama returns '' when no key is found (keyless).
- *
- * @throws {ProviderKeyMissingError} when no key found for non-ollama providers.
- */
-export async function loadKeyForProvider(provider: ProviderId): Promise<string> {
-  const kt = await loadKeytar();
-  if (kt) {
-    try {
-      const k = await kt.getPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider]);
-      if (k && k.length >= 20) {
-        redactor.enrollSecret(k);
-        return k;
-      }
-    } catch {
-      /* ignore keytar backend failures */
-    }
-  }
-
-  const envKey = process.env[ENV_BY_PROVIDER[provider]];
-  if (envKey && envKey.length >= 20) {
-    redactor.enrollSecret(envKey);
-    return envKey;
-  }
-
-  // Fallback: check user-settings.json providers config (lazy import to avoid circular deps)
-  const settingsField = SETTINGS_KEY_MAP[provider];
-  if (settingsField) {
-    try {
-      const { loadUserSettings } = await import("../utils/settings.js");
-      const providers = loadUserSettings().providers as Record<string, { apiKey?: string }> | undefined;
-      const settingsKey = providers?.[settingsField]?.apiKey;
-      if (settingsKey && settingsKey.length >= 20) {
-        redactor.enrollSecret(settingsKey);
-        return settingsKey;
-      }
-    } catch {
-      /* settings load failed — continue to error */
-    }
-  }
-
-  // Ollama may be keyless
-  if (provider === "ollama") return "";
-
-  throw new ProviderKeyMissingError(provider);
-}
-
-/**
- * Return the list of providers that currently have credentials available — checked across
- * OS keychain, environment variables, and user-settings.json. `ollama` is always included
- * because it is keyless. Order is stable for UI rendering.
- */
-export async function getConfiguredProviders(): Promise<ProviderId[]> {
-  const order: readonly ProviderId[] = ALL_PROVIDER_IDS;
-  const stored = new Set(await listStoredProviders());
-
-  let settingsProviders: Record<string, { apiKey?: string }> = {};
-  try {
-    const { loadUserSettings } = await import("../utils/settings.js");
-    settingsProviders = (loadUserSettings().providers ?? {}) as Record<string, { apiKey?: string }>;
-  } catch {
-    /* settings unreadable — keychain + env still work */
-  }
-
-  // OAuth-authenticated providers (no API key, but tokens stored via `keys
-  // login`) need to count as configured — otherwise the model picker silently
-  // hides them. Source the eligible provider list from the OAuth registry so
-  // adding a new OAuth provider in registry.ts automatically wires it up here.
-  const oauthAuthenticated = new Set<ProviderId>();
-  try {
-    const { listOAuthProviderIds } = await import("./auth/registry.js");
-    const { loadTokens } = await import("./auth/token-store.js");
-    for (const p of await listOAuthProviderIds()) {
-      const t = await loadTokens(p).catch(() => null);
-      if (t?.accessToken) oauthAuthenticated.add(p);
-    }
-  } catch {
-    /* registry/token-store unreadable — fall through */
-  }
-
-  const configured: ProviderId[] = [];
-  for (const p of order) {
-    if (p === "ollama") {
-      configured.push(p);
-      continue;
-    }
-    if (stored.has(p) || oauthAuthenticated.has(p)) {
-      configured.push(p);
-      continue;
-    }
-    const envKey = process.env[ENV_BY_PROVIDER[p]];
-    if (envKey && envKey.length >= 20) {
-      configured.push(p);
-      continue;
-    }
-    const settingsField = SETTINGS_KEY_MAP[p];
-    if (settingsField) {
-      const k = settingsProviders[settingsField]?.apiKey;
-      if (k && k.length >= 20) {
-        configured.push(p);
-      }
-    }
-  }
-  return configured;
-}
-
-/**
- * Load OAuth tokens for a provider with auto-refresh.
- * Returns null if no OAuth tokens are stored for that provider.
- * This is a thin helper over token-store + openai-oauth; exported here so
- * higher-level code (CLI, adapter) has a single import point.
- */
-export async function getOAuthTokens(provider: ProviderId): Promise<import("./auth/types.js").OAuthTokens | null> {
-  if (provider !== "openai") return null; // only openai supported in Phase 18
-  try {
-    const { loadTokensWithRefresh } = await import("./auth/openai-oauth.js");
-    return await loadTokensWithRefresh("openai");
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Find the first provider with an available API key.
- * Checks in priority order: anthropic, openai, google, deepseek, siliconflow, ollama.
- * Returns null if no provider has a key (unlikely — ollama is keyless fallback).
- */
-export async function firstAvailableProvider(): Promise<ProviderId | null> {
-  // firstAvailableProvider intentionally excludes xai: priority list for legacy
-  // fallback paths that pre-date xai integration. Derived from ALL_PROVIDER_IDS
-  // to keep ordering in sync if new providers are added.
-  const order: readonly ProviderId[] = ALL_PROVIDER_IDS.filter((p) => p !== "xai");
-  for (const p of order) {
-    try {
-      await loadKeyForProvider(p);
-      return p;
-    } catch {
-      /* try next */
-    }
-  }
-  return null;
-}