opencandle 0.4.0 → 0.6.0

package/gui/server/model-setup.ts

@@ -1,4 +1,7 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
+import { persistProviderCredential } from "../../src/onboarding/connect.js";
+import { getCredentialSource, PROVIDERS, type ProviderId } from "../../src/onboarding/providers.js";
+import { validateCredential } from "../../src/onboarding/validation.js";
 
 export type ModelSetupRequirement = "ready" | "select_model" | "connect_auth";
 
@@ -24,6 +27,47 @@ export interface ModelSetupRegistry {
   hasConfiguredAuth(model: Model<Api>): boolean;
 }
 
+interface ModelSetupAuthStorage {
+  set(provider: string, credential: { type: "api_key"; key: string }): void;
+}
+
+interface MutableModelSetupRegistry extends ModelSetupRegistry {
+  authStorage: ModelSetupAuthStorage;
+  find(provider: string, modelId: string): Model<Api> | undefined;
+}
+
+interface ModelSetupSession {
+  modelRegistry: MutableModelSetupRegistry;
+  model?: Model<Api>;
+  setModel(model: Model<Api>): Promise<void>;
+  settingsManager: {
+    flush(): Promise<void>;
+  };
+}
+
+interface ModelSetupSessionManager {
+  appendCustomMessageEntry(
+    customType: string,
+    content: string,
+    isActive: boolean,
+    data: Record<string, unknown>,
+  ): void;
+}
+
+export interface ModelSetupController {
+  buildCurrentModelSetupState(): ModelSetupState;
+  handleSaveModelApiKey(providerId: string, apiKey: string): Promise<void>;
+  handleSaveProviderApiKey(providerId: string, apiKey: string): Promise<void>;
+  handleSelectModel(provider: string, modelId: string): Promise<void>;
+}
+
+export interface ModelSetupControllerOptions {
+  role: string;
+  getSession: () => ModelSetupSession;
+  getSessionManager: () => ModelSetupSessionManager;
+  broadcastState: () => void;
+}
+
 export const modelSetupProviders: ModelSetupProvider[] = [
   {
     id: "google",
@@ -83,8 +127,7 @@ export function findPreferredModel(
   const available = sortModels(registry.getAvailable(), provider.defaultProvider);
   return (
     available.find(
-      (model) =>
-        model.provider === provider.defaultProvider && model.id === provider.defaultModel,
+      (model) => model.provider === provider.defaultProvider && model.id === provider.defaultModel,
     ) ?? available.find((model) => model.provider === provider.defaultProvider)
   );
 }
@@ -98,3 +141,107 @@ export function sortModels(models: Model<Api>[], preferredProvider?: string): Mo
     return byProvider !== 0 ? byProvider : a.id.localeCompare(b.id);
   });
 }
+
+export function createModelSetupController({
+  role,
+  getSession,
+  getSessionManager,
+  broadcastState,
+}: ModelSetupControllerOptions): ModelSetupController {
+  function ensureWriter(): void {
+    if (role !== "writer") throw new Error("Read-only follower mode");
+  }
+
+  function buildCurrentModelSetupState(): ModelSetupState {
+    const session = getSession();
+    return buildModelSetupState(session.modelRegistry, session.model);
+  }
+
+  async function handleSaveModelApiKey(providerId: string, apiKey: string): Promise<void> {
+    ensureWriter();
+
+    const provider = modelSetupProviders.find((candidate) => candidate.id === providerId);
+    if (!provider) throw new Error(`Unknown model provider: ${providerId}`);
+
+    const trimmed = apiKey.trim();
+    if (!trimmed) throw new Error(`Paste a ${provider.label} API key first.`);
+
+    const session = getSession();
+    session.modelRegistry.authStorage.set(provider.id, { type: "api_key", key: trimmed });
+    session.modelRegistry.refresh();
+
+    const model = findPreferredModel(session.modelRegistry, provider);
+    if (!model) {
+      throw new Error(
+        `Saved the ${provider.label} key, but no ${provider.label} models are available yet.`,
+      );
+    }
+
+    await session.setModel(model);
+    await session.settingsManager.flush();
+    getSessionManager().appendCustomMessageEntry(
+      "opencandle-model-setup",
+      `Connected ${provider.label} and selected ${model.provider}/${model.id}.`,
+      true,
+      { source: "gui", provider: provider.id, model: `${model.provider}/${model.id}` },
+    );
+    broadcastState();
+  }
+
+  async function handleSaveProviderApiKey(providerId: string, apiKey: string): Promise<void> {
+    ensureWriter();
+
+    const descriptor = PROVIDERS.find((candidate) => candidate.id === providerId);
+    if (!descriptor) throw new Error(`Unknown provider: ${providerId}`);
+
+    if (getCredentialSource(descriptor.id) === "env") {
+      throw new Error(
+        `${descriptor.displayName} is set via the ${descriptor.envVar} environment variable. Unset it to override here.`,
+      );
+    }
+
+    const trimmed = apiKey.trim();
+    if (!trimmed) throw new Error(`Paste a ${descriptor.displayName} API key first.`);
+
+    const validation = await validateCredential(descriptor.id as ProviderId, trimmed);
+    if (validation.status === "invalid") {
+      const statusHint =
+        validation.httpStatus !== undefined ? ` (HTTP ${validation.httpStatus})` : "";
+      const messageHint = validation.message ? ` — ${validation.message}` : "";
+      throw new Error(
+        `${descriptor.displayName} rejected the key${statusHint}${messageHint}. The existing configuration was not changed.`,
+      );
+    }
+
+    persistProviderCredential(descriptor.id as ProviderId, trimmed);
+
+    const verifiedNote =
+      validation.status === "transient"
+        ? `Saved ${descriptor.displayName} key but couldn't verify it (${validation.reason}). The next request will surface any issue.`
+        : `Connected ${descriptor.displayName}. Key saved to ~/.opencandle/config.json.`;
+
+    getSessionManager().appendCustomMessageEntry("opencandle-provider-setup", verifiedNote, true, {
+      source: "gui",
+      provider: descriptor.id,
+      status: validation.status,
+    });
+    broadcastState();
+  }
+
+  async function handleSelectModel(provider: string, modelId: string): Promise<void> {
+    ensureWriter();
+    const session = getSession();
+    session.modelRegistry.refresh();
+    const model = session.modelRegistry.find(provider, modelId);
+    if (!model) throw new Error(`Unknown model: ${provider}/${modelId}`);
+    await session.setModel(model);
+    await session.settingsManager.flush();
+  }
+
+  return {
+    buildCurrentModelSetupState,
+    handleSaveModelApiKey,
+    handleSaveProviderApiKey,
+    handleSelectModel,
+  };
+}

package/gui/server/private-api-access.ts

@@ -0,0 +1,62 @@
+import type { IncomingHttpHeaders } from "node:http";
+
+const PRIVATE_API_COOKIE = "opencandle_gui_session";
+
+export function isLoopbackAddress(remoteAddress: string | undefined): boolean {
+  if (remoteAddress == null || remoteAddress === "") return false;
+  return (
+    remoteAddress === "::1" ||
+    remoteAddress === "localhost" ||
+    remoteAddress.startsWith("127.") ||
+    remoteAddress.startsWith("::ffff:127.")
+  );
+}
+
+export function isTrustedPrivateApiRequest(
+  headers: IncomingHttpHeaders,
+  sessionToken: string,
+  remoteAddress: string | undefined,
+  options: { allowRemote?: boolean } = {},
+): boolean {
+  if (!options.allowRemote && !isLoopbackAddress(remoteAddress)) return false;
+  if (cookieValue(headers.cookie, PRIVATE_API_COOKIE) !== sessionToken) return false;
+
+  const fetchSite = headerValue(headers["sec-fetch-site"]);
+  if (fetchSite != null && fetchSite !== "same-origin" && fetchSite !== "none") return false;
+
+  const origin = headerValue(headers.origin);
+  const host = headerValue(headers.host);
+  if (origin != null && host != null) {
+    try {
+      if (new URL(origin).host !== host) return false;
+    } catch {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+export function privateApiCookieHeader(sessionToken: string): string {
+  return `${PRIVATE_API_COOKIE}=${encodeURIComponent(sessionToken)}; Path=/; HttpOnly; SameSite=Strict`;
+}
+
+function cookieValue(header: string | string[] | undefined, name: string): string | undefined {
+  const value = Array.isArray(header) ? header.join("; ") : header;
+  if (value == null) return undefined;
+  for (const part of value.split(";")) {
+    const [rawKey, ...rawValue] = part.trim().split("=");
+    if (rawKey === name) {
+      try {
+        return decodeURIComponent(rawValue.join("="));
+      } catch {
+        return undefined;
+      }
+    }
+  }
+  return undefined;
+}
+
+function headerValue(value: string | string[] | undefined): string | undefined {
+  return Array.isArray(value) ? value[0] : value;
+}

package/gui/server/projector.ts

@@ -1,5 +1,5 @@
-import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 import type { Message, ToolResultMessage } from "@earendil-works/pi-ai";
+import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 
 export interface DashboardState {
   watchlist: Array<{
@@ -28,6 +28,16 @@ export interface DashboardState {
   };
 }
 
+const DIRECT_TOOL_GAP_PROVIDERS: Record<string, string> = {
+  get_company_overview: "alpha_vantage",
+  get_financials: "alpha_vantage",
+  get_earnings: "alpha_vantage",
+  compute_dcf: "alpha_vantage",
+  compare_companies: "alpha_vantage",
+  get_economic_data: "fred",
+  get_twitter_sentiment: "twitter",
+};
+
 export function createEmptyDashboardState(): DashboardState {
   return {
     watchlist: [],
@@ -71,15 +81,15 @@ export function projectDashboard(entries: SessionEntry[], sessionId = "local"):
       const annotation = stringValue(data.annotation);
       if (annotation) {
         for (const provider of parseSkippedProviders(annotation)) {
-          state.dataQuality.softGaps.push({ provider, lastSeen: entry.timestamp });
+          upsertProviderGap(state.dataQuality.softGaps, provider, entry.timestamp);
         }
       }
       for (const gap of asArray(data.softGaps)) {
         const provider = stringValue(asRecord(gap).provider);
-        if (provider) state.dataQuality.softGaps.push({ provider, lastSeen: entry.timestamp });
+        if (provider) upsertProviderGap(state.dataQuality.softGaps, provider, entry.timestamp);
       }
       const provider = stringValue(data.provider);
-      if (provider) state.dataQuality.softGaps.push({ provider, lastSeen: entry.timestamp });
+      if (provider) upsertProviderGap(state.dataQuality.softGaps, provider, entry.timestamp);
     }
 
     if (entry.type === "custom" && entry.customType === "opencandle-quote-refresh") {
@@ -137,8 +147,31 @@ function projectToolResult(
     .filter((part) => part.type === "text")
     .map((part) => part.text)
     .join("\n");
+  for (const provider of parseSoftGapProviders(text)) {
+    upsertProviderGap(state.dataQuality.softGaps, provider, timestamp);
+  }
   for (const provider of parseCredentialRequiredProviders(text)) {
-    state.dataQuality.hardSkips.push({ provider, lastSeen: timestamp });
+    upsertProviderGap(state.dataQuality.hardSkips, provider, timestamp);
+  }
+  const provider = inferDirectToolGapProvider(message.toolName, text);
+  if (provider) upsertProviderGap(state.dataQuality.softGaps, provider, timestamp);
+}
+
+function upsertProviderGap(
+  gaps: Array<{ provider: string; lastSeen: string }>,
+  provider: string,
+  lastSeen: string,
+): void {
+  const existing = gaps.find((gap) => gap.provider === provider);
+  if (!existing) {
+    gaps.push({ provider, lastSeen });
+    return;
+  }
+
+  const existingTime = Date.parse(existing.lastSeen);
+  const nextTime = Date.parse(lastSeen);
+  if (!Number.isFinite(existingTime) || (Number.isFinite(nextTime) && nextTime > existingTime)) {
+    existing.lastSeen = lastSeen;
   }
 }
 
@@ -166,23 +199,37 @@ function projectQuote(
 function parseCredentialRequiredProviders(text: string): string[] {
   const providers: string[] = [];
   const re = /\[OPENCANDLE_CREDENTIAL_REQUIRED[^\]]*provider=([a-z0-9_-]+)/gi;
-  let match: RegExpExecArray | null;
-  while ((match = re.exec(text)) !== null) {
+  while (true) {
+    const match = re.exec(text);
+    if (!match) break;
     providers.push(match[1]);
   }
   return providers;
 }
 
 function parseSkippedProviders(text: string): string[] {
+  return parseSoftGapProviders(text);
+}
+
+function parseSoftGapProviders(text: string): string[] {
   const providers: string[] = [];
-  const re = /\[OPENCANDLE_SKIPPED[^\]]*provider=([a-z0-9_-]+)/gi;
-  let match: RegExpExecArray | null;
-  while ((match = re.exec(text)) !== null) {
+  const re = /\[OPENCANDLE_(?:SKIPPED|SOFT_DEGRADED)[^\]]*provider=([a-z0-9_-]+)/gi;
+  while (true) {
+    const match = re.exec(text);
+    if (!match) break;
     providers.push(match[1]);
   }
   return providers;
 }
 
+function inferDirectToolGapProvider(
+  toolName: string | undefined,
+  text: string,
+): string | undefined {
+  if (!toolName || !/(?:⚠|unavailable|No .*data found|LOGIN_NEEDED)/i.test(text)) return undefined;
+  return DIRECT_TOOL_GAP_PROVIDERS[toolName];
+}
+
 function inferSymbolFromContent(content: ToolResultMessage["content"]): string | undefined {
   const text = content.find((part) => part.type === "text")?.text;
   const match = text?.match(/^([A-Z]{1,8})\b/);
@@ -191,7 +238,7 @@ function inferSymbolFromContent(content: ToolResultMessage["content"]): string |
 
 function asRecord(value: unknown): Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? value as Record<string, unknown>
+    ? (value as Record<string, unknown>)
     : {};
 }
 

package/gui/server/prompt-observation.ts

@@ -0,0 +1,58 @@
+import type { AgentSessionEvent } from "@earendil-works/pi-coding-agent";
+
+export interface PromptObservation {
+  userTexts: string[];
+  sawAssistantOrTool: boolean;
+}
+
+export function createPromptObservation(): PromptObservation {
+  return {
+    userTexts: [],
+    sawAssistantOrTool: false,
+  };
+}
+
+export function observePromptEvent(observation: PromptObservation, event: AgentSessionEvent): void {
+  if (event.type === "message_start") {
+    const message = event.message as { role?: unknown; content?: unknown };
+    if (message.role === "user") {
+      observation.userTexts.push(messageTextFromContent(message.content));
+      return;
+    }
+    if (message.role === "assistant") {
+      observation.sawAssistantOrTool = true;
+    }
+    return;
+  }
+
+  if (event.type === "tool_execution_start") {
+    observation.sawAssistantOrTool = true;
+  }
+}
+
+export function selectReplayPrompt(
+  observation: PromptObservation,
+  originalPrompt: string,
+): string | undefined {
+  if (observation.sawAssistantOrTool) return undefined;
+
+  const original = originalPrompt.trim();
+  const text = [...observation.userTexts]
+    .reverse()
+    .map((candidate) => candidate.trim())
+    .find((candidate) => candidate.length > 0 && candidate !== original);
+
+  return text || undefined;
+}
+
+function messageTextFromContent(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content
+    .map((part) =>
+      typeof part === "object" && part !== null && "text" in part && typeof part.text === "string"
+        ? part.text
+        : "",
+    )
+    .join("");
+}

package/gui/server/quote-snapshot-store.ts

@@ -0,0 +1,50 @@
+import type { MarketStateQuoteSnapshot } from "./market-state-api.js";
+
+export class QuoteSnapshotStore {
+  private snapshot: MarketStateQuoteSnapshot | null = null;
+  private fetchedAtMs = 0;
+  private inFlight: Promise<MarketStateQuoteSnapshot> | null = null;
+  private invalidationVersion = 0;
+
+  constructor(
+    private readonly build: () => Promise<MarketStateQuoteSnapshot>,
+    private readonly maxAgeMs = 60_000,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  async get(): Promise<MarketStateQuoteSnapshot> {
+    if (this.snapshot == null) return this.refresh();
+    if (this.now() - this.fetchedAtMs >= this.maxAgeMs) {
+      // Stale-while-revalidate: serve the old snapshot now, refresh in the background.
+      this.refresh().catch(() => {});
+    }
+    return this.snapshot;
+  }
+
+  invalidate(): void {
+    this.invalidationVersion += 1;
+    this.snapshot = null;
+    this.fetchedAtMs = 0;
+    this.inFlight = null;
+  }
+
+  private refresh(): Promise<MarketStateQuoteSnapshot> {
+    if (this.inFlight) return this.inFlight;
+    const version = this.invalidationVersion;
+    const inFlight = this.build()
+      .then((snapshot) => {
+        if (version === this.invalidationVersion) {
+          this.snapshot = snapshot;
+          this.fetchedAtMs = this.now();
+        }
+        return snapshot;
+      })
+      .finally(() => {
+        if (this.inFlight === inFlight) {
+          this.inFlight = null;
+        }
+      });
+    this.inFlight = inFlight;
+    return this.inFlight;
+  }
+}