opencandle 0.5.0 → 0.6.0

package/gui/server/model-setup.ts

@@ -1,4 +1,7 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
+import { persistProviderCredential } from "../../src/onboarding/connect.js";
+import { getCredentialSource, PROVIDERS, type ProviderId } from "../../src/onboarding/providers.js";
+import { validateCredential } from "../../src/onboarding/validation.js";
 
 export type ModelSetupRequirement = "ready" | "select_model" | "connect_auth";
 
@@ -24,6 +27,47 @@ export interface ModelSetupRegistry {
   hasConfiguredAuth(model: Model<Api>): boolean;
 }
 
+interface ModelSetupAuthStorage {
+  set(provider: string, credential: { type: "api_key"; key: string }): void;
+}
+
+interface MutableModelSetupRegistry extends ModelSetupRegistry {
+  authStorage: ModelSetupAuthStorage;
+  find(provider: string, modelId: string): Model<Api> | undefined;
+}
+
+interface ModelSetupSession {
+  modelRegistry: MutableModelSetupRegistry;
+  model?: Model<Api>;
+  setModel(model: Model<Api>): Promise<void>;
+  settingsManager: {
+    flush(): Promise<void>;
+  };
+}
+
+interface ModelSetupSessionManager {
+  appendCustomMessageEntry(
+    customType: string,
+    content: string,
+    isActive: boolean,
+    data: Record<string, unknown>,
+  ): void;
+}
+
+export interface ModelSetupController {
+  buildCurrentModelSetupState(): ModelSetupState;
+  handleSaveModelApiKey(providerId: string, apiKey: string): Promise<void>;
+  handleSaveProviderApiKey(providerId: string, apiKey: string): Promise<void>;
+  handleSelectModel(provider: string, modelId: string): Promise<void>;
+}
+
+export interface ModelSetupControllerOptions {
+  role: string;
+  getSession: () => ModelSetupSession;
+  getSessionManager: () => ModelSetupSessionManager;
+  broadcastState: () => void;
+}
+
 export const modelSetupProviders: ModelSetupProvider[] = [
   {
     id: "google",
@@ -83,8 +127,7 @@ export function findPreferredModel(
   const available = sortModels(registry.getAvailable(), provider.defaultProvider);
   return (
     available.find(
-      (model) =>
-        model.provider === provider.defaultProvider && model.id === provider.defaultModel,
+      (model) => model.provider === provider.defaultProvider && model.id === provider.defaultModel,
     ) ?? available.find((model) => model.provider === provider.defaultProvider)
   );
 }
@@ -98,3 +141,107 @@ export function sortModels(models: Model<Api>[], preferredProvider?: string): Mo
     return byProvider !== 0 ? byProvider : a.id.localeCompare(b.id);
   });
 }
+
+export function createModelSetupController({
+  role,
+  getSession,
+  getSessionManager,
+  broadcastState,
+}: ModelSetupControllerOptions): ModelSetupController {
+  function ensureWriter(): void {
+    if (role !== "writer") throw new Error("Read-only follower mode");
+  }
+
+  function buildCurrentModelSetupState(): ModelSetupState {
+    const session = getSession();
+    return buildModelSetupState(session.modelRegistry, session.model);
+  }
+
+  async function handleSaveModelApiKey(providerId: string, apiKey: string): Promise<void> {
+    ensureWriter();
+
+    const provider = modelSetupProviders.find((candidate) => candidate.id === providerId);
+    if (!provider) throw new Error(`Unknown model provider: ${providerId}`);
+
+    const trimmed = apiKey.trim();
+    if (!trimmed) throw new Error(`Paste a ${provider.label} API key first.`);
+
+    const session = getSession();
+    session.modelRegistry.authStorage.set(provider.id, { type: "api_key", key: trimmed });
+    session.modelRegistry.refresh();
+
+    const model = findPreferredModel(session.modelRegistry, provider);
+    if (!model) {
+      throw new Error(
+        `Saved the ${provider.label} key, but no ${provider.label} models are available yet.`,
+      );
+    }
+
+    await session.setModel(model);
+    await session.settingsManager.flush();
+    getSessionManager().appendCustomMessageEntry(
+      "opencandle-model-setup",
+      `Connected ${provider.label} and selected ${model.provider}/${model.id}.`,
+      true,
+      { source: "gui", provider: provider.id, model: `${model.provider}/${model.id}` },
+    );
+    broadcastState();
+  }
+
+  async function handleSaveProviderApiKey(providerId: string, apiKey: string): Promise<void> {
+    ensureWriter();
+
+    const descriptor = PROVIDERS.find((candidate) => candidate.id === providerId);
+    if (!descriptor) throw new Error(`Unknown provider: ${providerId}`);
+
+    if (getCredentialSource(descriptor.id) === "env") {
+      throw new Error(
+        `${descriptor.displayName} is set via the ${descriptor.envVar} environment variable. Unset it to override here.`,
+      );
+    }
+
+    const trimmed = apiKey.trim();
+    if (!trimmed) throw new Error(`Paste a ${descriptor.displayName} API key first.`);
+
+    const validation = await validateCredential(descriptor.id as ProviderId, trimmed);
+    if (validation.status === "invalid") {
+      const statusHint =
+        validation.httpStatus !== undefined ? ` (HTTP ${validation.httpStatus})` : "";
+      const messageHint = validation.message ? ` — ${validation.message}` : "";
+      throw new Error(
+        `${descriptor.displayName} rejected the key${statusHint}${messageHint}. The existing configuration was not changed.`,
+      );
+    }
+
+    persistProviderCredential(descriptor.id as ProviderId, trimmed);
+
+    const verifiedNote =
+      validation.status === "transient"
+        ? `Saved ${descriptor.displayName} key but couldn't verify it (${validation.reason}). The next request will surface any issue.`
+        : `Connected ${descriptor.displayName}. Key saved to ~/.opencandle/config.json.`;
+
+    getSessionManager().appendCustomMessageEntry("opencandle-provider-setup", verifiedNote, true, {
+      source: "gui",
+      provider: descriptor.id,
+      status: validation.status,
+    });
+    broadcastState();
+  }
+
+  async function handleSelectModel(provider: string, modelId: string): Promise<void> {
+    ensureWriter();
+    const session = getSession();
+    session.modelRegistry.refresh();
+    const model = session.modelRegistry.find(provider, modelId);
+    if (!model) throw new Error(`Unknown model: ${provider}/${modelId}`);
+    await session.setModel(model);
+    await session.settingsManager.flush();
+  }
+
+  return {
+    buildCurrentModelSetupState,
+    handleSaveModelApiKey,
+    handleSaveProviderApiKey,
+    handleSelectModel,
+  };
+}

package/gui/server/private-api-access.ts

@@ -0,0 +1,62 @@
+import type { IncomingHttpHeaders } from "node:http";
+
+const PRIVATE_API_COOKIE = "opencandle_gui_session";
+
+export function isLoopbackAddress(remoteAddress: string | undefined): boolean {
+  if (remoteAddress == null || remoteAddress === "") return false;
+  return (
+    remoteAddress === "::1" ||
+    remoteAddress === "localhost" ||
+    remoteAddress.startsWith("127.") ||
+    remoteAddress.startsWith("::ffff:127.")
+  );
+}
+
+export function isTrustedPrivateApiRequest(
+  headers: IncomingHttpHeaders,
+  sessionToken: string,
+  remoteAddress: string | undefined,
+  options: { allowRemote?: boolean } = {},
+): boolean {
+  if (!options.allowRemote && !isLoopbackAddress(remoteAddress)) return false;
+  if (cookieValue(headers.cookie, PRIVATE_API_COOKIE) !== sessionToken) return false;
+
+  const fetchSite = headerValue(headers["sec-fetch-site"]);
+  if (fetchSite != null && fetchSite !== "same-origin" && fetchSite !== "none") return false;
+
+  const origin = headerValue(headers.origin);
+  const host = headerValue(headers.host);
+  if (origin != null && host != null) {
+    try {
+      if (new URL(origin).host !== host) return false;
+    } catch {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+export function privateApiCookieHeader(sessionToken: string): string {
+  return `${PRIVATE_API_COOKIE}=${encodeURIComponent(sessionToken)}; Path=/; HttpOnly; SameSite=Strict`;
+}
+
+function cookieValue(header: string | string[] | undefined, name: string): string | undefined {
+  const value = Array.isArray(header) ? header.join("; ") : header;
+  if (value == null) return undefined;
+  for (const part of value.split(";")) {
+    const [rawKey, ...rawValue] = part.trim().split("=");
+    if (rawKey === name) {
+      try {
+        return decodeURIComponent(rawValue.join("="));
+      } catch {
+        return undefined;
+      }
+    }
+  }
+  return undefined;
+}
+
+function headerValue(value: string | string[] | undefined): string | undefined {
+  return Array.isArray(value) ? value[0] : value;
+}

package/gui/server/projector.ts

@@ -1,5 +1,5 @@
-import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 import type { Message, ToolResultMessage } from "@earendil-works/pi-ai";
+import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 
 export interface DashboardState {
   watchlist: Array<{
@@ -199,8 +199,9 @@ function projectQuote(
 function parseCredentialRequiredProviders(text: string): string[] {
   const providers: string[] = [];
   const re = /\[OPENCANDLE_CREDENTIAL_REQUIRED[^\]]*provider=([a-z0-9_-]+)/gi;
-  let match: RegExpExecArray | null;
-  while ((match = re.exec(text)) !== null) {
+  while (true) {
+    const match = re.exec(text);
+    if (!match) break;
     providers.push(match[1]);
   }
   return providers;
@@ -213,14 +214,18 @@ function parseSkippedProviders(text: string): string[] {
 function parseSoftGapProviders(text: string): string[] {
   const providers: string[] = [];
   const re = /\[OPENCANDLE_(?:SKIPPED|SOFT_DEGRADED)[^\]]*provider=([a-z0-9_-]+)/gi;
-  let match: RegExpExecArray | null;
-  while ((match = re.exec(text)) !== null) {
+  while (true) {
+    const match = re.exec(text);
+    if (!match) break;
     providers.push(match[1]);
   }
   return providers;
 }
 
-function inferDirectToolGapProvider(toolName: string | undefined, text: string): string | undefined {
+function inferDirectToolGapProvider(
+  toolName: string | undefined,
+  text: string,
+): string | undefined {
   if (!toolName || !/(?:⚠|unavailable|No .*data found|LOGIN_NEEDED)/i.test(text)) return undefined;
   return DIRECT_TOOL_GAP_PROVIDERS[toolName];
 }
@@ -233,7 +238,7 @@ function inferSymbolFromContent(content: ToolResultMessage["content"]): string |
 
 function asRecord(value: unknown): Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value)
-    ? value as Record<string, unknown>
+    ? (value as Record<string, unknown>)
     : {};
 }
 

package/gui/server/prompt-observation.ts

@@ -49,13 +49,10 @@ function messageTextFromContent(content: unknown): string {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
   return content
-    .map((part) => (
-      typeof part === "object" &&
-        part !== null &&
-        "text" in part &&
-        typeof part.text === "string"
+    .map((part) =>
+      typeof part === "object" && part !== null && "text" in part && typeof part.text === "string"
         ? part.text
-        : ""
-    ))
+        : "",
+    )
     .join("");
 }

package/gui/server/quote-snapshot-store.ts

@@ -0,0 +1,50 @@
+import type { MarketStateQuoteSnapshot } from "./market-state-api.js";
+
+export class QuoteSnapshotStore {
+  private snapshot: MarketStateQuoteSnapshot | null = null;
+  private fetchedAtMs = 0;
+  private inFlight: Promise<MarketStateQuoteSnapshot> | null = null;
+  private invalidationVersion = 0;
+
+  constructor(
+    private readonly build: () => Promise<MarketStateQuoteSnapshot>,
+    private readonly maxAgeMs = 60_000,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  async get(): Promise<MarketStateQuoteSnapshot> {
+    if (this.snapshot == null) return this.refresh();
+    if (this.now() - this.fetchedAtMs >= this.maxAgeMs) {
+      // Stale-while-revalidate: serve the old snapshot now, refresh in the background.
+      this.refresh().catch(() => {});
+    }
+    return this.snapshot;
+  }
+
+  invalidate(): void {
+    this.invalidationVersion += 1;
+    this.snapshot = null;
+    this.fetchedAtMs = 0;
+    this.inFlight = null;
+  }
+
+  private refresh(): Promise<MarketStateQuoteSnapshot> {
+    if (this.inFlight) return this.inFlight;
+    const version = this.invalidationVersion;
+    const inFlight = this.build()
+      .then((snapshot) => {
+        if (version === this.invalidationVersion) {
+          this.snapshot = snapshot;
+          this.fetchedAtMs = this.now();
+        }
+        return snapshot;
+      })
+      .finally(() => {
+        if (this.inFlight === inFlight) {
+          this.inFlight = null;
+        }
+      });
+    this.inFlight = inFlight;
+    return this.inFlight;
+  }
+}