pi-devin-auth 0.1.0

package/src/cloud-direct/catalog.ts

@@ -0,0 +1,246 @@
+/**
+ * Per-account model catalog from Cognition's `GetCascadeModelConfigs`.
+ *
+ * Why this exists — issue #14:
+ *   The cloud's `GetChatMessage` returns a single Connect-streaming EOS frame
+ *   containing `{"error":{"code":"permission_denied","message":"an internal
+ *   error occurred (trace ID: <hex>)"}}` whenever the caller's account tier
+ *   does not include the requested `model_uid`. Reproduced byte-identical on a
+ *   `TEAMS_TIER_DEVIN_FREE` account for every Anthropic/Gemini/Premium UID
+ *   (only `swe-1-6-slow` streamed a real reply). The user-facing message is
+ *   indistinguishable from a transient server fault — issue #14's reporter
+ *   spent multiple sessions guessing.
+ *
+ *   The pre-flight here checks the per-account catalog (`disabled` flag on
+ *   `ClientModelConfig` field #4) BEFORE we spend a roundtrip on a request
+ *   the cloud will refuse. When the lookup fails (network, auth, schema
+ *   drift) we silently fall back to the chat path so a transient catalog
+ *   outage can't take chat down with it.
+ *
+ * Schema (verified against the bundled `extension.js`,
+ * `exa.codeium_common_pb.ClientModelConfig`):
+ *
+ *   GetCascadeModelConfigsResponse {
+ *     #1 client_model_configs: repeated ClientModelConfig
+ *   }
+ *   ClientModelConfig {
+ *     #1  label                string
+ *     #4  disabled             bool   ← the gate this module reads
+ *     #22 model_uid            string ← what `GetChatMessage` accepts
+ *   }
+ *
+ *   Disabled semantics: TRUE means "this UID exists in the catalog but the
+ *   caller's account/tier cannot run inference against it." BYOK models
+ *   surface as `disabled: false` so users with their own provider keys still
+ *   pass through — the only way they fail at chat time is a missing key,
+ *   which surfaces with a different message.
+ *
+ * Cache: per (apiServerUrl, apiKey) for {@link CATALOG_TTL_MS}. Cognition
+ * doesn't bump catalog entries mid-session in normal operation, so a 10-min
+ * TTL trades one extra roundtrip per ~10 min for clear errors on every chat.
+ */
+
+import * as crypto from 'crypto';
+import { buildMetadata } from './metadata.js';
+import { getCachedUserJwt } from './auth.js';
+import { encodeMessage, iterFields } from './wire.js';
+
+/** 10 minutes — see header. */
+const CATALOG_TTL_MS = 10 * 60 * 1000;
+
+/** Catalog endpoint inactivity timeout. Cognition responds in <500ms steady-state. */
+const CATALOG_FETCH_TIMEOUT_MS = 10_000;
+
+export interface ModelCatalogEntry {
+  /** Cloud-side `model_uid` (e.g. `claude-opus-4-7-medium`). */
+  modelUid: string;
+  /** Human label (e.g. `Claude Opus 4.7 Medium`) — used in error messages. */
+  label: string;
+  /** True when the caller's account tier cannot use this UID for chat. */
+  disabled: boolean;
+}
+
+interface CacheEntry {
+  /** Lookup keyed by `model_uid`. */
+  byUid: Map<string, ModelCatalogEntry>;
+  fetchedAt: number;
+  /** Cache key components, captured for invalidation/log purposes. */
+  apiKey: string;
+  host: string;
+}
+
+let cached: CacheEntry | null = null;
+let inFlight: Promise<CacheEntry> | null = null;
+let inFlightKey: string | null = null;
+
+function flightKey(apiKey: string, host: string): string {
+  return `${host}\x1f${apiKey}`;
+}
+
+/**
+ * Fetch the cascade model catalog for `(apiKey, host)` and parse the
+ * subset of `ClientModelConfig` we care about into a UID-keyed map.
+ *
+ * Throws on transport/auth failure so the caller can decide whether to fall
+ * back to "skip pre-flight". Does NOT throw on an unexpected response body —
+ * a malformed catalog returns an empty map, treated the same as "model not
+ * listed" by the chat pre-flight.
+ */
+async function fetchCatalog(apiKey: string, host: string, signal?: AbortSignal): Promise<CacheEntry> {
+  const userJwt = await getCachedUserJwt(apiKey, host, signal);
+
+  const metadata = buildMetadata({
+    apiKey,
+    userJwt,
+    sessionId: crypto.randomUUID(),
+    requestId: BigInt(Date.now()),
+    triggerId: crypto.randomUUID(),
+  });
+  // GetCascadeModelConfigsRequest { metadata: Metadata }  — Metadata is #1.
+  const reqBody = encodeMessage(1, metadata);
+
+  // Internal 10s timeout so a stalled catalog endpoint can't deadlock chat.
+  // The caller's signal still takes precedence — when they cancel, we cancel.
+  const ac = new AbortController();
+  const timer = setTimeout(
+    () => ac.abort(new Error(`catalog: fetch timeout (${CATALOG_FETCH_TIMEOUT_MS}ms)`)),
+    CATALOG_FETCH_TIMEOUT_MS,
+  );
+  const cleanupOnAbort = signal
+    ? (() => {
+        if (signal.aborted) ac.abort(signal.reason);
+        const fwd = (): void => ac.abort(signal.reason);
+        signal.addEventListener('abort', fwd, { once: true });
+        return () => signal.removeEventListener('abort', fwd);
+      })()
+    : (): void => { /* no caller signal */ };
+
+  let resp: Response;
+  try {
+    resp = await fetch(`${host}/exa.api_server_pb.ApiServerService/GetCascadeModelConfigs`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/proto', 'Connect-Protocol-Version': '1' },
+      body: reqBody,
+      signal: ac.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+    cleanupOnAbort();
+  }
+
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`GetCascadeModelConfigs HTTP ${resp.status}: ${text.slice(0, 200)}`);
+  }
+  const buf = Buffer.from(await resp.arrayBuffer());
+
+  // GetCascadeModelConfigsResponse #1 (repeated ClientModelConfig)
+  const byUid = new Map<string, ModelCatalogEntry>();
+  for (const f of iterFields(buf)) {
+    if (f.num !== 1 || f.wire !== 2 || !Buffer.isBuffer(f.value)) continue;
+    let label = '';
+    let modelUid = '';
+    let disabled = false;
+    for (const sf of iterFields(f.value as Buffer)) {
+      if (sf.num === 1 && sf.wire === 2 && Buffer.isBuffer(sf.value)) {
+        label = (sf.value as Buffer).toString('utf8');
+      } else if (sf.num === 4 && sf.wire === 0) {
+        // #4 = disabled (bool, varint 0/1)
+        disabled = sf.value === 1n;
+      } else if (sf.num === 22 && sf.wire === 2 && Buffer.isBuffer(sf.value)) {
+        modelUid = (sf.value as Buffer).toString('utf8');
+      }
+    }
+    if (modelUid.length > 0) {
+      byUid.set(modelUid, { modelUid, label: label || modelUid, disabled });
+    }
+  }
+
+  return { byUid, fetchedAt: Date.now(), apiKey, host };
+}
+
+/**
+ * Get the cached catalog for `(apiKey, host)`, fetching when missing or stale.
+ *
+ * Concurrent callers for the SAME (apiKey, host) share one in-flight fetch
+ * (no thundering herd on startup). Concurrent callers for DIFFERENT keys
+ * serialise the in-flight slot but only one of them holds it at a time —
+ * good enough for opencode's single-account-at-a-time usage pattern.
+ *
+ * Returns `null` on fetch failure (network, transient 5xx, auth issue). The
+ * caller treats `null` as "skip pre-flight and let the chat path surface the
+ * server-side error itself."
+ */
+export async function getCachedCatalog(
+  apiKey: string,
+  host: string,
+  signal?: AbortSignal,
+): Promise<CacheEntry | null> {
+  if (cached && cached.apiKey === apiKey && cached.host === host) {
+    if (Date.now() - cached.fetchedAt < CATALOG_TTL_MS) {
+      return cached;
+    }
+  }
+
+  const key = flightKey(apiKey, host);
+  if (inFlight && inFlightKey === key) {
+    try {
+      return await inFlight;
+    } catch {
+      return null;
+    }
+  }
+
+  const promise = fetchCatalog(apiKey, host, signal);
+  inFlight = promise;
+  inFlightKey = key;
+  try {
+    const result = await promise;
+    cached = result;
+    return result;
+  } catch {
+    return null;
+  } finally {
+    if (inFlight === promise) {
+      inFlight = null;
+      inFlightKey = null;
+    }
+  }
+}
+
+/**
+ * Drop the cached catalog. Call after logout/account switch so a fresh
+ * sign-in doesn't see a previous account's allow-list.
+ */
+export function clearCachedCatalog(): void {
+  cached = null;
+  inFlight = null;
+  inFlightKey = null;
+}
+
+/**
+ * Tier-disabled error — thrown by the chat pre-flight when the catalog lists
+ * a model as `disabled: true` for this account. The message names the model
+ * and points at the plan page, replacing Cognition's opaque
+ * "an internal error occurred" trailer.
+ */
+export class ModelNotAvailableError extends Error {
+  constructor(
+    public readonly modelUid: string,
+    public readonly label: string,
+    public readonly reason: 'disabled' | 'not_listed',
+  ) {
+    super(
+      reason === 'disabled'
+        ? `Model "${label}" (uid=${modelUid}) is not enabled for your Cognition account. ` +
+          `The Cognition catalog returned it with disabled=true — meaning your current plan/tier ` +
+          `does not include this model. ` +
+          `Check the model picker on https://codeium.com/account, or pick a different model. ` +
+          `(This message replaces Cognition's "an internal error occurred" — same root cause.)`
+        : `Model uid "${modelUid}" is not listed in the Cognition catalog for your account. ` +
+          `Either the UID has been retired upstream or your account/region doesn't serve it. ` +
+          `Run \`curl http://127.0.0.1:42100/v1/models\` to see the canonical names your plan accepts.`,
+    );
+    this.name = 'ModelNotAvailableError';
+  }
+}