pi-leo-bridge 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project will be documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.1] - 2026-09-03
+
+### Changed
+
+- Reframed the README around bringing Pi models and authentication into Brave Leo, with protocol details kept in the implementation section.
+
+## [0.1.0] - 2026-09-03
+
+### Added
+
+- Authenticated, IPv4-loopback-only OpenAI Chat Completions endpoint for Brave Leo BYOM.
+- Isolated, tool-free Pi SDK session per request.
+- Streaming and non-streaming responses, conversation history, embedded images, assistant prefixes, and stop sequences.
+- Configurable Pi provider, model, context guardrail, and thinking-level picker profiles.
+- macOS LaunchAgent installation with verified Brave Preferences backups.
+- `pi-leo` install, uninstall, status, restart, doctor, model-listing, default-selection, log, and smoke-test commands.
+- Request cancellation, concurrency and body-size limits, output filtering, and redacted metadata-only logs.
+
+[Unreleased]: https://github.com/omaclaren/pi-leo-bridge/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/omaclaren/pi-leo-bridge/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/omaclaren/pi-leo-bridge/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -0,0 +1,16 @@
+# Contributing
+
+Issues and pull requests are welcome. Please keep the default security boundary intact: loopback-only binding, authenticated chat routes, tools disabled, no request-content logging, and verified browser backups.
+
+## Development
+
+```bash
+npm ci
+npm run check
+```
+
+Use a disposable Brave profile for installer testing. Never commit real Preferences files, endpoint capabilities, Pi authentication files, logs, or page content.
+
+Changes to Pi dependencies must use deliberate exact version updates and include a real installed smoke test. Changes to the Brave protocol adapter should add fixture-based tests for both streaming and non-streaming requests.
+
+See [`docs/RELEASING.md`](docs/RELEASING.md) for the release checklist.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Oliver Maclaren
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,195 @@
+# Pi Leo Bridge
+
+**Pi Leo Bridge brings [Pi](https://github.com/earendil-works/pi) into [Brave Leo](https://support.brave.app/hc/en-us/articles/34070140231821-How-do-I-use-the-Bring-Your-Own-Model-BYOM-with-Brave-Leo).** It adds a Pi-configured model to Leo's model picker and uses Pi's existing provider authentication. Each request runs in a fresh, isolated Pi SDK session.
+
+```text
+Brave Leo -> authenticated local bridge -> isolated Pi SDK session -> selected provider/model
+```
+
+The bridge runs locally on macOS and starts automatically with `launchd`. It supports streaming conversations, page context, images, titles, and rewrites through Leo's BYOM interface.
+
+## Features
+
+- Uses Pi's model catalogue and existing provider authentication.
+- Adds separate Leo picker entries for configurable Pi thinking levels.
+- Supports Leo's BYOM chat flow, including streaming, history, embedded images, titles, rewrites, assistant prefixes, and stop sequences.
+- Binds only to IPv4 loopback and authenticates a random capability URL.
+- Runs every request in a fresh in-memory Pi session with a minimal, conversation-only runtime.
+- Makes and verifies a timestamped backup before every Brave Preferences change.
+- Installs an automatic per-user macOS LaunchAgent.
+
+## Requirements
+
+- macOS
+- Brave with Leo BYOM support
+- Node.js 22.19 or newer
+- Pi authentication configured for the provider you want to use
+- Python 3.10 or newer
+
+## Installation
+
+Install from npm:
+
+```bash
+npm install --global pi-leo-bridge
+pi-leo install
+```
+
+For a source checkout:
+
+```bash
+git clone https://github.com/omaclaren/pi-leo-bridge.git
+cd pi-leo-bridge
+./scripts/install.sh
+```
+
+The source installer performs a locked dependency install, type check, and full test run before changing Brave.
+
+A fresh interactive installation asks for the Pi provider, model, display name, and thinking levels. Defaults are:
+
+- provider: `openai-codex`
+- model: `gpt-5.6-sol`
+- profiles: `low`, `medium`, and `high`
+- primary profile: `medium`
+- context cap advertised to Leo: 100,000 tokens
+
+To install non-interactively or choose another model:
+
+```bash
+pi-leo install \
+  --provider openai-codex \
+  --model gpt-5.6-sol \
+  --name "GPT-5.6 Sol" \
+  --levels low,medium,high \
+  --primary-level medium \
+  --yes
+```
+
+List models available through configured Pi authentication:
+
+```bash
+pi-leo models
+pi-leo models openai-codex
+```
+
+If validation reports missing or expired authentication, open Pi, sign in to that provider again, and rerun `pi-leo install` or `pi-leo configure`. Model and authentication validation happens before the installer changes Brave.
+
+On a fresh installation, the installer uses Brave's most recently used profile. Select another channel or profile explicitly when needed:
+
+```bash
+pi-leo install --channel beta --profile "Profile 1"
+```
+
+Supported channel names are `stable`, `beta`, and `nightly`. To move an existing bridge to another Brave profile, uninstall it first, ensuring the authenticated entries are removed from the old profile, then install it against the new target.
+
+## Daily use
+
+1. Open Leo.
+2. Select one of the **Pi — … (Low/Medium/High)** entries in the model picker.
+3. Attach current-page context when you want Pi to read the page.
+4. Chat normally.
+
+No terminal is required during normal use. Operational commands can be run from any terminal directory:
+
+```bash
+pi-leo status
+pi-leo restart
+pi-leo doctor
+pi-leo logs
+pi-leo smoke-test
+pi-leo smoke-test low
+pi-leo default medium
+```
+
+`logs` follows both service logs until you press **Ctrl-C**. `smoke-test` makes one small real model request; the other commands do not invoke a model.
+
+Re-run configuration at any time:
+
+```bash
+pi-leo configure --model OTHER_MODEL --name "Display name"
+```
+
+Set a managed profile—or the recorded pre-installation model—as the default for new Leo conversations:
+
+```bash
+pi-leo default medium
+pi-leo default restore
+```
+
+Rotate the local capability if its endpoint may have been exposed:
+
+```bash
+pi-leo configure --rotate-token
+```
+
+## Upgrade
+
+Upgrade the npm package, re-run its idempotent configuration migration, and verify the result:
+
+```bash
+npm install --global pi-leo-bridge@latest
+pi-leo configure --yes
+pi-leo doctor
+```
+
+Run `pi-leo uninstall` before removing the npm package itself; otherwise the LaunchAgent would retain a path into the removed package.
+
+## Uninstall
+
+```bash
+pi-leo uninstall
+```
+
+This stops and removes the LaunchAgent and removes only the Brave model entries managed by the bridge, after another Preferences backup. Workspace and logs are retained by default:
+
+```bash
+pi-leo uninstall --purge
+```
+
+Uninstall the npm package separately if it was installed globally:
+
+```bash
+npm uninstall --global pi-leo-bridge
+```
+
+## Security model
+
+- The HTTP server rejects any configured host other than `127.0.0.1`.
+- The endpoint contains a random 256-bit capability; only its SHA-256 hash is stored in bridge configuration.
+- The unauthenticated health endpoint reports only service availability; detailed health checks require the capability.
+- Request bodies, page content, and model output are never written to bridge logs.
+- Remote image URLs are not fetched. Embedded PNG, JPEG, WebP, and GIF data images are accepted.
+- Incoming tool definitions are rejected, and the Pi session is checked at runtime to contain zero tools.
+- Webpage and document text is explicitly treated as untrusted reference material.
+
+The capability URL is stored in the selected Brave profile's Preferences file. That file is protected by the user's macOS account; do not paste or publish the endpoint. See [SECURITY.md](SECURITY.md) for the full boundary and reporting guidance.
+
+### Data flow
+
+Only the Brave-to-bridge hop is local. Pi then sends the supplied conversation, page context, and images to the configured model provider. Provider retention policies, subscription limits, and charges apply. Brave's hosted-model proxy protections do not apply to BYOM.
+
+## Scope
+
+The initial release focuses on conversation. Leo sends text, page context, and images; the bridge returns responses from the selected Pi model.
+
+### Protocol compatibility
+
+Leo sends BYOM requests through an OpenAI-compatible Chat Completions interface. The bridge implements the fields Leo uses and translates them into Pi SDK calls. It ignores Brave's sampling field because Pi controls generation through the selected model and thinking level.
+
+## Development
+
+```bash
+npm ci
+npm run check
+npm pack --dry-run
+```
+
+The test suite includes protocol normalization, assistant-prefix and streaming stop filtering, authentication behavior, health metadata, SSE responses, tool rejection, and model allowlisting. Installer tests should always use a temporary home directory and fixture Preferences file.
+
+Runtime dependencies on Pi are exact-pinned so SDK drift is caught before release. Update them deliberately, run the full test suite, and perform an installed smoke test before changing the pin.
+
+## License
+
+[MIT](LICENSE)
+
+Pi Leo Bridge is an independent companion project maintained separately from Brave Software, OpenAI, and the Pi project.

package/SECURITY.md

@@ -0,0 +1,23 @@
+# Security
+
+## Reporting a vulnerability
+
+Please use [GitHub's private vulnerability reporting form](https://github.com/omaclaren/pi-leo-bridge/security/advisories/new). Do not include capability URLs, API keys, OAuth credentials, browser Preferences files, or private page content in a public issue.
+
+## Security boundary
+
+Pi Leo Bridge is intended for a single-user macOS account. It binds only to IPv4 loopback and authenticates chat requests with a random capability embedded in the Brave model endpoint. Only the capability's SHA-256 hash is stored in the bridge configuration.
+
+Leo-facing Pi sessions intentionally have no tools, extensions, skills, project instructions, or persistent session state. Text and images supplied by webpages are treated as untrusted reference material. The bridge does not provide browser control or communication with other Pi sessions.
+
+The capability URL is stored in the selected Brave profile's local Preferences file. Anyone able to read files as the same macOS user should be considered inside the local trust boundary. The public health route reports only availability; configuration details require the same capability. Installation also verifies that the listening process belongs to the installed LaunchAgent before accepting its health response.
+
+## Data flow
+
+The HTTP hop from Brave to the bridge stays on the local machine. Prompts, attached page content, and images are then sent by Pi to the configured model provider. Provider policies, retention, subscription limits, and charges still apply. Brave's hosted-model proxy protections do not apply to BYOM endpoints.
+
+Request bodies and page contents are not written to bridge logs. Operational logs contain timestamps, generated request identifiers, selected public profile names, message counts, character counts, durations, and redacted error summaries.
+
+## Supported versions
+
+Until a later release is published, only the latest tagged release will receive security fixes. The initial release is macOS-only and requires Node.js 22.19 or newer.

package/bin/pi-leo

@@ -0,0 +1,229 @@
+#!/bin/bash
+set -euo pipefail
+
+SELF="$(node -e 'console.log(require("node:fs").realpathSync(process.argv[1]))' "$0")"
+ROOT="$(cd "$(dirname "$SELF")/.." && pwd)"
+LABEL="com.ojm.pi-leo-bridge"
+DOMAIN="gui/${UID}/${LABEL}"
+CONFIG="${HOME}/.config/pi-leo-bridge/config.json"
+OUT_LOG="${HOME}/Library/Logs/pi-leo-bridge.log"
+ERR_LOG="${HOME}/Library/Logs/pi-leo-bridge.error.log"
+
+usage() {
+  cat <<'EOF'
+Usage: pi-leo <command> [options]
+
+Setup:
+  install       Configure Brave and install/start the macOS LaunchAgent
+  configure     Re-run installation with new model/profile options
+  uninstall     Remove the service and its managed Brave models
+  models        List models available through configured Pi authentication
+  default LEVEL Set the default for new Leo chats; LEVEL may also be restore
+
+Operation:
+  status        Show LaunchAgent and bridge health
+  restart       Restart the bridge and wait for health
+  doctor        Verify installation, security settings, and Brave configuration
+  logs [LINES]  Follow service logs (default initial lines: 100)
+  smoke-test [PROFILE]
+                Make one real request; PROFILE is a level or public model id
+  version       Show package version
+  help          Show this help
+
+Run `pi-leo install --help` for installation options.
+EOF
+}
+
+require_config() {
+  if [[ ! -f "$CONFIG" ]]; then
+    echo "Pi Leo bridge is not configured. Run: pi-leo install" >&2
+    exit 1
+  fi
+}
+
+config_value() {
+  python3 - "$CONFIG" "$1" <<'PY'
+import json,sys
+value=json.load(open(sys.argv[1])).get(sys.argv[2],"")
+print(value if isinstance(value,(str,int)) else "")
+PY
+}
+
+health_url() {
+  require_config
+  printf 'http://127.0.0.1:%s/healthz\n' "$(config_value port)"
+}
+
+status() {
+  require_config
+  if launchctl print "$DOMAIN" >/dev/null 2>&1; then
+    echo "LaunchAgent: loaded"
+  else
+    echo "LaunchAgent: not loaded"
+  fi
+
+  if payload="$(curl --fail --silent --max-time 3 "$(health_url)")" \
+    && printf '%s' "$payload" | python3 -c 'import json,sys; p=json.load(sys.stdin); assert p.get("service")=="pi-leo-bridge"' 2>/dev/null; then
+    echo "Bridge: healthy"
+    printf '%s' "$payload" | python3 -m json.tool
+  else
+    echo "Bridge: unavailable"
+    return 1
+  fi
+}
+
+restart() {
+  require_config
+  PLIST="${HOME}/Library/LaunchAgents/${LABEL}.plist"
+  if launchctl print "$DOMAIN" >/dev/null 2>&1; then
+    launchctl kickstart -k "$DOMAIN"
+  elif [[ -f "$PLIST" ]]; then
+    launchctl bootstrap "gui/${UID}" "$PLIST"
+  else
+    echo "LaunchAgent is not installed. Run: pi-leo install" >&2
+    return 1
+  fi
+  URL="$(health_url)"
+  for _ in $(seq 1 60); do
+    if payload="$(curl --fail --silent --max-time 2 "$URL" 2>/dev/null)" \
+      && printf '%s' "$payload" | python3 -c 'import json,sys; p=json.load(sys.stdin); assert p.get("service")=="pi-leo-bridge" and p.get("status")=="ok"' 2>/dev/null; then
+      echo "Bridge restarted and healthy."
+      return 0
+    fi
+    sleep 1
+  done
+  echo "Bridge did not become healthy; run: pi-leo logs" >&2
+  return 1
+}
+
+logs() {
+  local lines="${1:-100}"
+  if [[ ! "$lines" =~ ^[0-9]+$ ]]; then
+    echo "Log line count must be a non-negative integer." >&2
+    return 2
+  fi
+  touch "$OUT_LOG" "$ERR_LOG"
+  echo "Following logs; press Ctrl-C to stop."
+  tail -n "$lines" -F "$OUT_LOG" "$ERR_LOG"
+}
+
+set_default() {
+  require_config
+  local selector="${1:-}"
+  if [[ -z "$selector" ]]; then
+    echo "Usage: pi-leo default {THINKING_LEVEL|restore}" >&2
+    return 2
+  fi
+  local app_name
+  app_name="$(config_value braveApplicationName)"
+  case "$app_name" in
+    "Brave Browser"|"Brave Browser Beta"|"Brave Browser Nightly") ;;
+    *) echo "Unsupported Brave application name: $app_name" >&2; return 1 ;;
+  esac
+
+  local was_running=false
+  local relaunched=false
+  if pgrep -x "$app_name" >/dev/null 2>&1; then
+    was_running=true
+  fi
+  reopen_brave() {
+    if [[ "$was_running" == true && "$relaunched" == false ]]; then
+      open -a "$app_name" >/dev/null 2>&1 || true
+    fi
+  }
+  trap reopen_brave EXIT
+
+  if [[ "$was_running" == true ]]; then
+    echo "Quitting $app_name briefly to update its default model..."
+    for _ in 1 2 3; do
+      osascript -e "tell application \"$app_name\" to quit" >/dev/null 2>&1 || true
+      for _ in $(seq 1 20); do
+        pgrep -x "$app_name" >/dev/null 2>&1 || break
+        sleep 0.5
+      done
+      pgrep -x "$app_name" >/dev/null 2>&1 || break
+    done
+    if pgrep -x "$app_name" >/dev/null 2>&1; then
+      echo "$app_name did not quit; no preferences were changed." >&2
+      return 1
+    fi
+  fi
+
+  python3 "$ROOT/scripts/set-brave-default.py" --config "$CONFIG" "$selector"
+  if [[ "$was_running" == true ]]; then
+    open -a "$app_name"
+    relaunched=true
+  fi
+  trap - EXIT
+}
+
+smoke_test() {
+  require_config
+  python3 - "$CONFIG" "${1:-}" <<'PY'
+import hashlib
+import json
+import re
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+config=json.loads(Path(sys.argv[1]).read_text())
+selector=sys.argv[2]
+profiles=config.get('profiles',[])
+if selector:
+    profile=next((p for p in profiles if p.get('thinkingLevel')==selector or p.get('publicModelId')==selector),None)
+else:
+    profile=next((p for p in profiles if p.get('publicModelId')==config.get('publicModelId')),None)
+if not profile:
+    choices=', '.join(str(p.get('thinkingLevel')) for p in profiles)
+    raise SystemExit(f"Unknown profile '{selector}'. Available levels: {choices}")
+preferences_path=Path(config.get('bravePreferencesPath',Path.home()/"Library/Application Support/BraveSoftware/Brave-Browser/Default/Preferences"))
+preferences=json.loads(preferences_path.read_text())
+models=preferences.get('brave',{}).get('ai_chat',{}).get('custom_models',[])
+model=next((m for m in models if m.get('model_request_name')==profile.get('publicModelId')),None)
+if not model:
+    raise SystemExit('Selected Pi model is not configured in Brave')
+endpoint=model.get('endpoint_url')
+match=re.fullmatch(r'http://127\.0\.0\.1:\d+/auth/([^/]+)/v1/chat/completions',str(endpoint))
+if not match or hashlib.sha256(match.group(1).encode()).hexdigest()!=config.get('tokenSha256'):
+    raise SystemExit('Pi model endpoint failed capability validation')
+payload={
+    'model':profile['publicModelId'],
+    'messages':[{'role':'user','content':'Reply with exactly: Pi bridge OK'}],
+    'temperature':0.7,
+    'stream':False,
+}
+request=urllib.request.Request(endpoint,data=json.dumps(payload).encode(),headers={'Content-Type':'application/json'})
+try:
+    with urllib.request.urlopen(request,timeout=300) as response:
+        body=json.load(response)
+except urllib.error.HTTPError as error:
+    try: detail=json.load(error).get('error',{}).get('message','request failed')
+    except Exception: detail='request failed'
+    raise SystemExit(f"Bridge smoke test failed (HTTP {error.code}): {detail}")
+except Exception as error:
+    raise SystemExit(f"Bridge smoke test failed: {type(error).__name__}")
+text=body['choices'][0]['message']['content']
+print(text)
+print('profile:',profile['thinkingLevel'])
+print('usage:',body.get('usage',{}))
+PY
+}
+
+case "${1:-status}" in
+  install|configure) shift; exec "$ROOT/scripts/install.sh" "$@" ;;
+  uninstall) shift; exec "$ROOT/scripts/uninstall.sh" "$@" ;;
+  models) shift; exec node "$ROOT/dist/src/list-models.js" "$@" ;;
+  default) set_default "${2:-}" ;;
+  doctor) shift; exec python3 "$ROOT/scripts/doctor.py" "$@" ;;
+  status) status ;;
+  restart) restart ;;
+  logs) logs "${2:-100}" ;;
+  smoke-test|test) smoke_test "${2:-}" ;;
+  version)
+    node -e 'const fs=require("fs"),path=require("path"); console.log(JSON.parse(fs.readFileSync(path.join(process.argv[1],"package.json"),"utf8")).version)' "$ROOT"
+    ;;
+  help|-h|--help) usage ;;
+  *) echo "Unknown command: $1" >&2; usage >&2; exit 2 ;;
+esac

package/dist/src/check-model.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/check-model.js

@@ -0,0 +1,47 @@
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+class ModelValidationError extends Error {
+}
+async function main() {
+    const [, , provider, modelId] = process.argv;
+    if (!provider || !modelId) {
+        console.error("Usage: check-model PROVIDER MODEL");
+        process.exitCode = 2;
+        return;
+    }
+    const runtime = await ModelRuntime.create({
+        allowModelNetwork: false,
+        refreshOnCreate: true,
+        signal: AbortSignal.timeout(30_000),
+    });
+    const model = runtime.getModel(provider, modelId);
+    if (!model) {
+        throw new ModelValidationError(`Pi model is not registered: ${provider}/${modelId}`);
+    }
+    if (!runtime.hasConfiguredAuth(provider)) {
+        throw new ModelValidationError(`Pi authentication is not configured for provider: ${provider}`);
+    }
+    const available = await runtime.getAvailable(provider, {
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!available.some((candidate) => candidate.id === modelId)) {
+        throw new ModelValidationError(`Pi model is not currently available: ${provider}/${modelId}`);
+    }
+    process.stdout.write(`${JSON.stringify({
+        provider,
+        modelId,
+        name: model.name,
+        contextWindow: model.contextWindow,
+        reasoning: model.reasoning,
+        vision: model.input.includes("image"),
+    })}\n`);
+}
+main().catch((error) => {
+    if (error instanceof ModelValidationError) {
+        console.error(error.message.replace(/[\r\n]+/g, " ").slice(0, 300));
+    }
+    else {
+        console.error("Pi model validation failed. Check provider authentication and network access.");
+    }
+    process.exitCode = 1;
+});
+//# sourceMappingURL=check-model.js.map

package/dist/src/check-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-model.js","sourceRoot":"","sources":["../../src/check-model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,MAAM,oBAAqB,SAAQ,KAAK;CAAG;AAE3C,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QACxC,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,oBAAoB,CAC5B,qDAAqD,QAAQ,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE;QACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,oBAAoB,CAC5B,wCAAwC,QAAQ,IAAI,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,QAAQ;QACR,OAAO;QACP,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;KACtC,CAAC,IAAI,CACP,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CACX,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/src/config.d.ts

@@ -0,0 +1,23 @@
+export declare const thinkingLevels: readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+export type ThinkingLevel = (typeof thinkingLevels)[number];
+export interface BridgeProfile {
+    publicModelId: string;
+    thinkingLevel: ThinkingLevel;
+}
+export interface BridgeConfig {
+    version: 1;
+    host: "127.0.0.1";
+    port: number;
+    tokenSha256: string;
+    publicModelId: string;
+    provider: string;
+    modelId: string;
+    thinkingLevel: ThinkingLevel;
+    profiles: BridgeProfile[];
+    workspace: string;
+    agentDir: string;
+    maxBodyBytes: number;
+    maxConcurrentRequests: number;
+}
+export declare function defaultConfigPath(): string;
+export declare function loadConfig(path: string): Promise<BridgeConfig>;

package/dist/src/config.js

@@ -0,0 +1,81 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+export const thinkingLevels = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+function requireString(value, name) {
+    if (typeof value !== "string" || value.trim() === "") {
+        throw new Error(`Invalid configuration field: ${name}`);
+    }
+    return value;
+}
+function requireInteger(value, name, minimum, maximum) {
+    if (!Number.isInteger(value) || value < minimum || value > maximum) {
+        throw new Error(`Invalid configuration field: ${name}`);
+    }
+    return value;
+}
+export function defaultConfigPath() {
+    return resolve(homedir(), ".config", "pi-leo-bridge", "config.json");
+}
+function loadProfiles(value, fallbackModelId, fallbackThinkingLevel) {
+    if (value === undefined) {
+        return [{ publicModelId: fallbackModelId, thinkingLevel: fallbackThinkingLevel }];
+    }
+    if (!Array.isArray(value) || value.length === 0 || value.length > 16) {
+        throw new Error("Invalid configuration field: profiles");
+    }
+    const profiles = value.map((item, index) => {
+        if (typeof item !== "object" || item === null || Array.isArray(item)) {
+            throw new Error(`Invalid configuration profile at index ${index}`);
+        }
+        const profile = item;
+        const publicModelId = requireString(profile.publicModelId, `profiles[${index}].publicModelId`);
+        const level = requireString(profile.thinkingLevel, `profiles[${index}].thinkingLevel`);
+        if (!thinkingLevels.includes(level)) {
+            throw new Error(`Invalid configuration profile thinking level at index ${index}`);
+        }
+        return { publicModelId, thinkingLevel: level };
+    });
+    if (new Set(profiles.map((profile) => profile.publicModelId)).size !== profiles.length) {
+        throw new Error("Configuration profile model names must be unique");
+    }
+    return profiles;
+}
+export async function loadConfig(path) {
+    const raw = JSON.parse(await readFile(path, "utf8"));
+    if (raw.version !== 1) {
+        throw new Error("Unsupported bridge configuration version");
+    }
+    if (raw.host !== "127.0.0.1") {
+        throw new Error("The bridge must bind to 127.0.0.1");
+    }
+    const tokenSha256 = requireString(raw.tokenSha256, "tokenSha256").toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(tokenSha256)) {
+        throw new Error("Invalid configuration field: tokenSha256");
+    }
+    const thinkingLevel = requireString(raw.thinkingLevel, "thinkingLevel");
+    if (!thinkingLevels.includes(thinkingLevel)) {
+        throw new Error("Invalid configuration field: thinkingLevel");
+    }
+    const publicModelId = requireString(raw.publicModelId, "publicModelId");
+    const profiles = loadProfiles(raw.profiles, publicModelId, thinkingLevel);
+    if (!profiles.some((profile) => profile.publicModelId === publicModelId)) {
+        throw new Error("The primary publicModelId must appear in profiles");
+    }
+    return {
+        version: 1,
+        host: "127.0.0.1",
+        port: requireInteger(raw.port, "port", 1024, 65535),
+        tokenSha256,
+        publicModelId,
+        provider: requireString(raw.provider, "provider"),
+        modelId: requireString(raw.modelId, "modelId"),
+        thinkingLevel: thinkingLevel,
+        profiles,
+        workspace: resolve(requireString(raw.workspace, "workspace")),
+        agentDir: resolve(requireString(raw.agentDir, "agentDir")),
+        maxBodyBytes: requireInteger(raw.maxBodyBytes, "maxBodyBytes", 1024, 64 * 1024 * 1024),
+        maxConcurrentRequests: requireInteger(raw.maxConcurrentRequests, "maxConcurrentRequests", 1, 16),
+    };
+}
+//# sourceMappingURL=config.js.map