praxis-agent 0.43.1 → 0.45.0

package/dist/providers/provider-auth.d.ts

@@ -0,0 +1,71 @@
+import type { ProviderTarget } from './provider-settings.js';
+interface ProviderCredentialKey {
+    providerId: string;
+    profileId: string;
+}
+type ProviderCredentialRecord = {
+    type: 'api-key';
+    secret: string;
+} | {
+    type: 'oauth';
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    accountId?: string;
+};
+export interface ProviderCredentialReader {
+    read(key: ProviderCredentialKey): Promise<ProviderCredentialRecord | undefined>;
+}
+export type ProviderAuthenticationErrorCode = 'missing_credential' | 'invalid_credential' | 'command_failed';
+export declare class ProviderAuthenticationError extends Error {
+    readonly code: ProviderAuthenticationErrorCode;
+    constructor(code: ProviderAuthenticationErrorCode, message: string);
+}
+export type ProviderCredentialSourceMetadata = {
+    source: 'explicit';
+} | {
+    source: 'legacy-env';
+    name: 'PRAXIS_API_KEY';
+} | {
+    source: 'env';
+    name: string;
+} | {
+    source: 'command';
+    command: readonly string[];
+} | {
+    source: 'vault';
+    providerId: string;
+    profileId: string;
+};
+export type ResolvedApiKeyCredential = {
+    type: 'api-key';
+    secret: string;
+    source: ProviderCredentialSourceMetadata;
+};
+export type ResolvedOAuthCredential = {
+    type: 'oauth';
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    accountId?: string;
+    source: ProviderCredentialSourceMetadata;
+};
+export type ResolvedProviderCredential = ResolvedApiKeyCredential | ResolvedOAuthCredential;
+export interface ProviderCommandResult {
+    stdout: string;
+    exitCode: number;
+}
+export type ProviderCommandRunner = (argv: readonly string[], options: {
+    timeoutMs: number;
+    maxOutputBytes: number;
+}) => Promise<ProviderCommandResult>;
+export interface ResolveProviderCredentialOptions {
+    target: ProviderTarget;
+    environment?: Readonly<Record<string, string | undefined>>;
+    vault: ProviderCredentialReader;
+    apiKey?: string;
+    commandRunner?: ProviderCommandRunner;
+}
+export declare function resolveProviderCredential(options: ResolveProviderCredentialOptions): Promise<ResolvedProviderCredential>;
+export {};
+//# sourceMappingURL=provider-auth.d.ts.map

package/dist/providers/provider-auth.js

@@ -0,0 +1,149 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+export class ProviderAuthenticationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ProviderAuthenticationError';
+        this.code = code;
+    }
+}
+const execFileAsync = promisify(execFile);
+const COMMAND_TIMEOUT_MS = 10_000;
+const MAX_COMMAND_OUTPUT = 64 * 1024;
+function missing(message) {
+    throw new ProviderAuthenticationError('missing_credential', `Provider authentication failed: ${message}`);
+}
+function secretValue(value, label) {
+    if (typeof value !== 'string' || value.trim().length === 0)
+        missing(`${label} is missing or blank`);
+    return value;
+}
+const defaultCommandRunner = async (argv, options) => {
+    const executable = argv[0];
+    if (executable === undefined || executable.length === 0)
+        missing('credential command is empty');
+    try {
+        const result = await execFileAsync(executable, argv.slice(1), {
+            shell: false,
+            timeout: options.timeoutMs,
+            maxBuffer: options.maxOutputBytes,
+        });
+        return { stdout: result.stdout, exitCode: 0 };
+    }
+    catch (error) {
+        const stdout = typeof error.stdout === 'string'
+            ? error.stdout
+            : '';
+        const exitCode = typeof error.code === 'number'
+            ? error.code
+            : 1;
+        return { stdout, exitCode };
+    }
+};
+function keyFor(target, profileId = target.profileId) {
+    return { providerId: target.providerId, profileId };
+}
+async function vaultApiKey(target, vault, profileId) {
+    let record;
+    try {
+        record = await vault.read(keyFor(target, profileId));
+    }
+    catch {
+        missing(`vault credential for ${target.providerId}/${profileId} is unavailable`);
+    }
+    if (!record || record.type !== 'api-key')
+        missing(`vault API key for ${target.providerId}/${profileId} is unavailable`);
+    return {
+        type: 'api-key',
+        secret: record.secret,
+        source: { source: 'vault', providerId: target.providerId, profileId },
+    };
+}
+export async function resolveProviderCredential(options) {
+    const { target } = options;
+    const environment = options.environment ?? process.env;
+    const explicitProvided = options.apiKey !== undefined;
+    const legacyProvided = environment.PRAXIS_API_KEY !== undefined;
+    if (target.protocol === 'codex-subscription') {
+        if (explicitProvided || legacyProvided)
+            missing('Codex subscription does not accept API keys');
+        if (target.credential.source !== 'vault')
+            missing('Codex subscription requires a vault OAuth credential');
+        const profileId = target.credential.profile ?? target.profileId;
+        if (profileId !== target.profileId)
+            missing('Codex subscription vault profile must match the selected profile');
+        let record;
+        try {
+            record = await options.vault.read(keyFor(target, target.profileId));
+        }
+        catch {
+            missing(`vault credential for ${target.providerId}/${target.profileId} is unavailable`);
+        }
+        if (!record || record.type !== 'oauth')
+            missing(`vault OAuth credential for ${target.providerId}/${target.profileId} is unavailable`);
+        return {
+            type: 'oauth',
+            accessToken: record.accessToken,
+            refreshToken: record.refreshToken,
+            expiresAt: record.expiresAt,
+            ...(record.accountId === undefined
+                ? {}
+                : { accountId: record.accountId }),
+            source: {
+                source: 'vault',
+                providerId: target.providerId,
+                profileId: target.profileId,
+            },
+        };
+    }
+    if (explicitProvided) {
+        return {
+            type: 'api-key',
+            secret: secretValue(options.apiKey, 'explicit API key'),
+            source: { source: 'explicit' },
+        };
+    }
+    if (legacyProvided) {
+        return {
+            type: 'api-key',
+            secret: secretValue(environment.PRAXIS_API_KEY, 'PRAXIS_API_KEY'),
+            source: { source: 'legacy-env', name: 'PRAXIS_API_KEY' },
+        };
+    }
+    const source = target.credential;
+    if (source.source === 'env') {
+        return {
+            type: 'api-key',
+            secret: secretValue(environment[source.name], source.name),
+            source: { source: 'env', name: source.name },
+        };
+    }
+    if (source.source === 'command') {
+        const runner = options.commandRunner ?? defaultCommandRunner;
+        let result;
+        try {
+            result = await runner(source.command, {
+                timeoutMs: COMMAND_TIMEOUT_MS,
+                maxOutputBytes: MAX_COMMAND_OUTPUT,
+            });
+        }
+        catch {
+            missing('credential command failed');
+        }
+        if (result.exitCode !== 0)
+            missing('credential command exited unsuccessfully');
+        const output = secretValue(result.stdout, 'credential command output').trim();
+        if (output.length > MAX_COMMAND_OUTPUT)
+            missing('credential command output exceeds 64 KiB');
+        if (/\r?\n/u.test(output))
+            missing('credential command must return exactly one secret');
+        return {
+            type: 'api-key',
+            secret: output,
+            source: { source: 'command', command: source.command },
+        };
+    }
+    return vaultApiKey(target, options.vault, source.profile ?? target.profileId);
+}
+//# sourceMappingURL=provider-auth.js.map

package/dist/providers/provider-registry.d.ts

@@ -0,0 +1,52 @@
+import type { ModelProvider, ModelThinkingConfig } from '../core/runtime.js';
+import { type CodexOAuthVault } from './codex-oauth.js';
+import { type ProviderTarget } from './provider-settings.js';
+import type { ProviderCredentialSourceMetadata, ProviderCredentialReader, ResolvedProviderCredential } from './provider-auth.js';
+import { parseProviderEnvironment, type ContextEnvironment } from './environment.js';
+import { type AnthropicPromptCachePolicy } from './anthropic-prompt-cache.js';
+export type ProviderRegistryErrorCode = 'unsupported_provider';
+export declare class ProviderRegistryError extends Error {
+    readonly code: ProviderRegistryErrorCode;
+    constructor(code: ProviderRegistryErrorCode, message: string);
+}
+export interface ProviderRegistryOptions {
+    target: ProviderTarget;
+    credential: ResolvedProviderCredential;
+    context?: ContextEnvironment;
+    anthropicThinking?: ModelThinkingConfig;
+    openAiThinking?: ModelThinkingConfig;
+    codexThinking?: ModelThinkingConfig;
+    anthropicPromptCacheResolver?: (target: {
+        baseUrl: string;
+        model: string;
+    }) => AnthropicPromptCachePolicy;
+    fetchImplementation?: typeof fetch;
+    providerEnvironment?: ReturnType<typeof parseProviderEnvironment>;
+    vault?: CodexOAuthVault;
+}
+export interface ResolveProviderRegistryOptions {
+    configRoot: string;
+    cwd: string;
+    environment?: Readonly<Record<string, string | undefined>>;
+    provider?: string;
+    profile?: string;
+    model?: string;
+    includeSettings?: boolean;
+    includeProjectSettings?: boolean;
+    apiKey?: string;
+    context?: ContextEnvironment;
+    anthropicThinking?: ModelThinkingConfig;
+    openAiThinking?: ModelThinkingConfig;
+    codexThinking?: ModelThinkingConfig;
+    vault: ProviderCredentialReader & CodexOAuthVault;
+    fetchImplementation?: typeof fetch;
+}
+export type ProviderRegistrySourceMetadata = ProviderCredentialSourceMetadata;
+export interface ProviderRegistry {
+    readonly target: ProviderTarget;
+    readonly credentialSource: ProviderRegistrySourceMetadata;
+    create(modelId?: string): ModelProvider;
+}
+export declare function resolveProviderRegistry(options: ResolveProviderRegistryOptions): Promise<ProviderRegistry>;
+export declare function createProviderRegistry(options: ProviderRegistryOptions): ProviderRegistry;
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/providers/provider-registry.js

@@ -0,0 +1,187 @@
+import { AnthropicCompatibleProvider } from './anthropic-compatible.js';
+import { OpenAICompatibleProvider } from './openai-compatible.js';
+import { CodexSubscriptionProvider } from './codex-subscription.js';
+import { DeadlineModelProvider } from './deadline-provider.js';
+import { CodexOAuthCredentialManager, } from './codex-oauth.js';
+import { resolveProviderTarget, } from './provider-settings.js';
+import { ProviderAuthenticationError, resolveProviderCredential, } from './provider-auth.js';
+import { parseContextEnvironment, parseProviderEnvironment, } from './environment.js';
+import { createAnthropicPromptCachePolicyResolver, } from './anthropic-prompt-cache.js';
+export class ProviderRegistryError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ProviderRegistryError';
+        this.code = code;
+    }
+}
+export async function resolveProviderRegistry(options) {
+    const environment = options.environment ?? process.env;
+    const target = await resolveProviderTarget({
+        configRoot: options.configRoot,
+        cwd: options.cwd,
+        environment,
+        ...(options.provider === undefined ? {} : { provider: options.provider }),
+        ...(options.profile === undefined ? {} : { profile: options.profile }),
+        ...(options.model === undefined ? {} : { model: options.model }),
+        ...(options.includeSettings === undefined
+            ? {}
+            : { includeSettings: options.includeSettings }),
+        ...(options.includeProjectSettings === undefined
+            ? {}
+            : { includeProjectSettings: options.includeProjectSettings }),
+    });
+    const credential = await resolveProviderCredential({
+        target,
+        environment,
+        vault: options.vault,
+        ...(options.apiKey === undefined ? {} : { apiKey: options.apiKey }),
+    });
+    const context = options.context ?? parseContextEnvironment(environment);
+    const controlsEnvironment = {
+        ...environment,
+        PRAXIS_PROVIDER: target.protocol === 'anthropic-messages' ? 'anthropic' : 'openai',
+        PRAXIS_BASE_URL: target.baseUrl,
+    };
+    const providerEnvironment = parseProviderEnvironment(controlsEnvironment);
+    const promptCacheResolver = target.protocol === 'anthropic-messages'
+        ? createAnthropicPromptCachePolicyResolver(controlsEnvironment)
+        : undefined;
+    return createProviderRegistry({
+        target,
+        credential,
+        context,
+        ...(options.anthropicThinking === undefined
+            ? {}
+            : { anthropicThinking: options.anthropicThinking }),
+        ...(options.openAiThinking === undefined
+            ? {}
+            : { openAiThinking: options.openAiThinking }),
+        ...(options.codexThinking === undefined
+            ? {}
+            : { codexThinking: options.codexThinking }),
+        ...(promptCacheResolver === undefined
+            ? {}
+            : { anthropicPromptCacheResolver: promptCacheResolver }),
+        ...(options.fetchImplementation === undefined
+            ? {}
+            : { fetchImplementation: options.fetchImplementation }),
+        providerEnvironment,
+        vault: options.vault,
+    });
+}
+export function createProviderRegistry(options) {
+    return new NativeProviderRegistry(options);
+}
+class NativeProviderRegistry {
+    options;
+    target;
+    credentialSource;
+    codexManager;
+    constructor(options) {
+        this.options = options;
+        this.target = options.target;
+        this.credentialSource = options.credential.source;
+        if (options.target.protocol === 'codex-subscription') {
+            if (options.credential.type !== 'oauth') {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: Codex subscription requires an OAuth credential');
+            }
+            if (!options.vault) {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: Codex subscription requires a credential vault');
+            }
+            this.codexManager = new CodexOAuthCredentialManager(options.vault, options.target.profileId, options.fetchImplementation === undefined
+                ? {}
+                : { fetchImplementation: options.fetchImplementation });
+        }
+    }
+    create(modelId = this.target.modelId) {
+        const target = { ...this.target, modelId };
+        if (target.protocol === 'codex-subscription') {
+            if (!this.codexManager)
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: Codex subscription credentials are unavailable');
+            return this.withDeadline(new CodexSubscriptionProvider({
+                model: target.modelId,
+                access: this.codexManager.access.bind(this.codexManager),
+                ...(this.options.fetchImplementation === undefined
+                    ? {}
+                    : { fetchImplementation: this.options.fetchImplementation }),
+                ...(this.options.codexThinking === undefined
+                    ? {}
+                    : { thinking: this.options.codexThinking }),
+            }));
+        }
+        if (target.protocol === 'openai-compatible') {
+            if (this.options.credential.type !== 'api-key') {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');
+            }
+            return this.withDeadline(new OpenAICompatibleProvider({
+                baseUrl: target.baseUrl,
+                model: target.modelId,
+                apiKey: this.options.credential.secret,
+                ...(this.options.context?.contextWindowTokens === undefined
+                    ? {}
+                    : {
+                        contextWindowTokens: this.options.context.contextWindowTokens,
+                    }),
+                ...(this.options.openAiThinking === undefined
+                    ? {}
+                    : { thinking: this.options.openAiThinking }),
+                ...(this.options.fetchImplementation === undefined
+                    ? {}
+                    : { fetchImplementation: this.options.fetchImplementation }),
+            }));
+        }
+        if (target.protocol === 'anthropic-messages') {
+            if (this.options.credential.type !== 'api-key') {
+                throw new ProviderAuthenticationError('invalid_credential', 'Provider authentication failed: an API key is required');
+            }
+            return this.withDeadline(new AnthropicCompatibleProvider({
+                baseUrl: target.baseUrl,
+                model: target.modelId,
+                apiKey: this.options.credential.secret,
+                ...(this.options.context?.contextWindowTokens === undefined
+                    ? {}
+                    : {
+                        contextWindowTokens: this.options.context.contextWindowTokens,
+                    }),
+                ...(this.options.anthropicThinking === undefined
+                    ? {}
+                    : {
+                        thinking: this.options.anthropicThinking,
+                    }),
+                ...(this.options.anthropicPromptCacheResolver === undefined
+                    ? {}
+                    : {
+                        promptCaching: this.options.anthropicPromptCacheResolver({
+                            baseUrl: target.baseUrl,
+                            model: target.modelId,
+                        }),
+                    }),
+                ...(this.options.providerEnvironment?.maxOutputTokens === undefined
+                    ? {}
+                    : {
+                        maxOutputTokens: this.options.providerEnvironment.maxOutputTokens,
+                    }),
+                ...(this.options.providerEnvironment?.anthropicVersion === undefined
+                    ? {}
+                    : {
+                        anthropicVersion: this.options.providerEnvironment.anthropicVersion,
+                    }),
+                ...(this.options.providerEnvironment?.webSearch === undefined
+                    ? {}
+                    : { webSearch: this.options.providerEnvironment.webSearch }),
+                ...(this.options.fetchImplementation === undefined
+                    ? {}
+                    : { fetchImplementation: this.options.fetchImplementation }),
+            }));
+        }
+        throw new ProviderRegistryError('unsupported_provider', `Unsupported provider protocol: ${target.protocol}`);
+    }
+    withDeadline(provider) {
+        const deadlineMs = this.options.providerEnvironment?.deadlineMs;
+        return deadlineMs === undefined
+            ? provider
+            : new DeadlineModelProvider({ provider, deadlineMs });
+    }
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/providers/provider-settings.d.ts

@@ -0,0 +1,38 @@
+export type ProviderProtocol = 'openai-compatible' | 'anthropic-messages' | 'codex-subscription';
+export type CredentialSource = {
+    source: 'env';
+    name: string;
+} | {
+    source: 'command';
+    command: readonly [string, ...string[]];
+} | {
+    source: 'vault';
+    profile?: string;
+};
+export interface ProviderTarget {
+    providerId: string;
+    profileId: string;
+    modelId: string;
+    protocol: ProviderProtocol;
+    baseUrl: string;
+    credential: CredentialSource;
+    billingMode: 'api' | 'subscription';
+    experimental: boolean;
+}
+export interface ResolveProviderTargetOptions {
+    configRoot: string;
+    cwd: string;
+    environment?: Readonly<Record<string, string | undefined>>;
+    model?: string;
+    provider?: string;
+    profile?: string;
+    includeSettings?: boolean;
+    includeProjectSettings?: boolean;
+}
+export type ProviderSettingsErrorCode = 'invalid_settings' | 'model_required' | 'unknown_provider' | 'unknown_profile';
+export declare class ProviderSettingsError extends Error {
+    readonly code: ProviderSettingsErrorCode;
+    constructor(code: ProviderSettingsErrorCode, message: string);
+}
+export declare function resolveProviderTarget(options: ResolveProviderTargetOptions): Promise<ProviderTarget>;
+//# sourceMappingURL=provider-settings.d.ts.map