promptfoo 0.125.0 → 0.125.1

package/dist/src/remoteGeneration-CKJFE960.cjs

@@ -1,482 +0,0 @@
-const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_logger = require("./logger-DXUHJBHJ.cjs");
-const require_fetch = require("./fetch-DYte6oQX.cjs");
-const require_accounts = require("./accounts-Dpb43yde.cjs");
-const require_packageVersion = require("./packageVersion-CJ4hVGlE.cjs");
-const require_credentials = require("./credentials-CFfK32uY.cjs");
-const require_providerRegistry = require("./providerRegistry-CAn7vpBJ.cjs");
-const require_codex_sdk = require("./codex-sdk-BbxjBvBk.cjs");
-let path = require("path");
-path = require_rolldown_runtime.__toESM(path, 1);
-let fs = require("fs");
-fs = require_rolldown_runtime.__toESM(fs, 1);
-let os = require("os");
-os = require_rolldown_runtime.__toESM(os, 1);
-let _opentelemetry_api = require("@opentelemetry/api");
-let node_crypto = require("node:crypto");
-let semver_functions_satisfies_js = require("semver/functions/satisfies.js");
-semver_functions_satisfies_js = require_rolldown_runtime.__toESM(semver_functions_satisfies_js, 1);
-//#region src/providers/openai/codexDefaults.ts
-const CODEX_AUTH_FILENAME = "auth.json";
-const CODEX_DEFAULT_PROVIDERS_CACHE_EVICTION_GRACE_MS = 6e4;
-const CODEX_DEFAULT_PROVIDERS_CACHE_MAX_ENTRIES = 32;
-const CODEX_DEFAULT_PROVIDERS_CACHE_HMAC_CONTEXT = "promptfoo:codex-default-provider-cache-key";
-const CODEX_DEFAULT_PROVIDERS_CACHE_HMAC_KEY = (0, node_crypto.randomBytes)(32);
-let codexDefaultWorkingDir;
-const CODEX_GRADING_OUTPUT_SCHEMA = {
-	type: "object",
-	properties: {
-		pass: { type: "boolean" },
-		score: { type: "number" },
-		reason: { type: "string" }
-	},
-	required: [
-		"pass",
-		"score",
-		"reason"
-	],
-	additionalProperties: false
-};
-const codexDefaultProvidersByCacheKey = /* @__PURE__ */ new Map();
-const evictedCodexDefaultProviderBundles = /* @__PURE__ */ new Set();
-const codexSdkAvailabilityByEntryPoint = /* @__PURE__ */ new Map();
-function getCodexEnvString(env, key) {
-	return env?.[key] ?? require_logger.getEnvString(key);
-}
-function getCodexHome(env) {
-	const homeDir = os.default.homedir?.();
-	const defaultHome = typeof homeDir === "string" && homeDir ? path.default.join(homeDir, ".codex") : void 0;
-	const codexHome = getCodexEnvString(env, "CODEX_HOME") || defaultHome || ".codex";
-	return path.default.resolve(codexHome);
-}
-function getTempDirectory() {
-	const tempDir = os.default.tmpdir?.();
-	return typeof tempDir === "string" && tempDir ? tempDir : process.cwd();
-}
-function getCodexDefaultWorkingDir() {
-	if (!codexDefaultWorkingDir) codexDefaultWorkingDir = fs.default.mkdtempSync(path.default.join(getTempDirectory(), "promptfoo-codex-default-"));
-	return codexDefaultWorkingDir;
-}
-function hasCodexAuthFile(env) {
-	const authPath = path.default.join(getCodexHome(env), CODEX_AUTH_FILENAME);
-	try {
-		const stats = fs.default.statSync(authPath);
-		return stats.isFile() && stats.size > 0;
-	} catch (err) {
-		const code = err?.code;
-		if (code !== "ENOENT" && code !== "ENOTDIR") require_logger.logger.debug("[CodexDefaults] Could not stat Codex auth file", {
-			authPath,
-			code,
-			err
-		});
-		return false;
-	}
-}
-function canLoadCodexSdkPackage() {
-	const entryPoint = require_codex_sdk.resolveCodexSdkPackage();
-	if (!entryPoint) return false;
-	const cached = codexSdkAvailabilityByEntryPoint.get(entryPoint);
-	if (cached !== void 0) return cached;
-	let compatible = false;
-	try {
-		const version = require_packageVersion.getPackageVersion("@openai/codex-sdk", entryPoint);
-		compatible = Boolean(version && (0, semver_functions_satisfies_js.default)(version, "^0.156.1"));
-	} catch (error) {
-		require_logger.logger.debug("[CodexDefaults] Could not read SDK metadata", { error });
-	}
-	codexSdkAvailabilityByEntryPoint.set(entryPoint, compatible);
-	return compatible;
-}
-function hasCodexDefaultCredentials(env) {
-	return (Boolean(require_credentials.resolveProviderApiKey(void 0, env, ["OPENAI_API_KEY", "CODEX_API_KEY"])) || hasCodexAuthFile(env)) && canLoadCodexSdkPackage();
-}
-function getCodexDefaultProviderConfig(env, config, defaultWorkingDir = getCodexDefaultWorkingDir()) {
-	const codexHome = getCodexEnvString(env, "CODEX_HOME");
-	const workingDir = config?.working_dir || defaultWorkingDir;
-	fs.default.mkdirSync(workingDir, { recursive: true });
-	const cliEnv = {
-		...codexHome ? { CODEX_HOME: path.default.resolve(codexHome) } : {},
-		...config?.cli_env
-	};
-	return {
-		approval_policy: "never",
-		sandbox_mode: "read-only",
-		skip_git_repo_check: true,
-		working_dir: workingDir,
-		...config,
-		...Object.keys(cliEnv).length > 0 ? { cli_env: cliEnv } : {}
-	};
-}
-function getSecretCacheFingerprint(value) {
-	return value ? (0, node_crypto.createHmac)("sha256", CODEX_DEFAULT_PROVIDERS_CACHE_HMAC_KEY).update(CODEX_DEFAULT_PROVIDERS_CACHE_HMAC_CONTEXT).update("\0").update(value).digest("hex") : void 0;
-}
-function getCodexDefaultProvidersCacheKey(env) {
-	const resolvedApiKey = require_credentials.resolveProviderApiKey(void 0, env, ["OPENAI_API_KEY", "CODEX_API_KEY"]);
-	return JSON.stringify({
-		CODEX_HOME: getCodexEnvString(env, "CODEX_HOME"),
-		hasResolvedApiKey: Boolean(resolvedApiKey),
-		resolvedApiKeyFingerprint: getSecretCacheFingerprint(resolvedApiKey)
-	});
-}
-function getUniqueCodexDefaultProviders(providers) {
-	return Array.from(/* @__PURE__ */ new Set([
-		providers.gradingJsonProvider,
-		providers.gradingProvider,
-		providers.llmRubricProvider,
-		providers.suggestionsProvider,
-		providers.synthesizeProvider,
-		providers.webSearchProvider
-	]));
-}
-function canActOnShutdown(providers) {
-	return !providers.cancelled && providers.shutdownRequested && providers.activeCalls === 0 && !providers.shutdownPromise;
-}
-function shutdownCodexDefaultProviderBundle(providers) {
-	if (!canActOnShutdown(providers)) return;
-	providers.shutdownPromise = Promise.all(getUniqueCodexDefaultProviders(providers).map((provider) => provider.shutdown().catch((error) => {
-		require_logger.logger.warn("[CodexDefaults] Error shutting down evicted provider", { error });
-	}))).then(() => void 0).finally(() => {
-		evictedCodexDefaultProviderBundles.delete(providers);
-	});
-}
-function clearCodexDefaultProviderShutdownTimer(providers) {
-	if (providers.shutdownTimer) {
-		clearTimeout(providers.shutdownTimer);
-		providers.shutdownTimer = void 0;
-	}
-}
-function scheduleCodexDefaultProviderBundleShutdown(providers) {
-	if (!canActOnShutdown(providers) || providers.shutdownTimer) return;
-	providers.shutdownTimer = setTimeout(() => {
-		providers.shutdownTimer = void 0;
-		shutdownCodexDefaultProviderBundle(providers);
-	}, CODEX_DEFAULT_PROVIDERS_CACHE_EVICTION_GRACE_MS);
-	providers.shutdownTimer.unref?.();
-}
-function requestCodexDefaultProviderBundleShutdown(providers) {
-	if (providers.cancelled) return;
-	providers.shutdownRequested = true;
-	evictedCodexDefaultProviderBundles.add(providers);
-	scheduleCodexDefaultProviderBundleShutdown(providers);
-}
-async function resurrectCodexDefaultProviderBundle(providers) {
-	await providers.shutdownPromise;
-	if (providers.cancelled) return;
-	for (const provider of getUniqueCodexDefaultProviders(providers)) require_providerRegistry.providerRegistry.register(provider);
-	providers.shutdownPromise = void 0;
-	evictedCodexDefaultProviderBundles.add(providers);
-}
-function trackCodexDefaultProviderUsage(providers) {
-	for (const provider of getUniqueCodexDefaultProviders(providers)) {
-		const callApi = provider.callApi.bind(provider);
-		provider.callApi = async (...args) => {
-			if (providers.shutdownPromise !== void 0) await resurrectCodexDefaultProviderBundle(providers);
-			clearCodexDefaultProviderShutdownTimer(providers);
-			providers.activeCalls += 1;
-			try {
-				return await callApi(...args);
-			} finally {
-				providers.activeCalls -= 1;
-				scheduleCodexDefaultProviderBundleShutdown(providers);
-			}
-		};
-	}
-}
-function cacheCodexDefaultProviders(cacheKey, providers) {
-	codexDefaultProvidersByCacheKey.set(cacheKey, providers);
-	while (codexDefaultProvidersByCacheKey.size > CODEX_DEFAULT_PROVIDERS_CACHE_MAX_ENTRIES) {
-		const oldestEntry = codexDefaultProvidersByCacheKey.entries().next().value;
-		if (!oldestEntry) break;
-		const [oldestCacheKey, oldestProviders] = oldestEntry;
-		codexDefaultProvidersByCacheKey.delete(oldestCacheKey);
-		requestCodexDefaultProviderBundleShutdown(oldestProviders);
-	}
-	return providers;
-}
-function getCodexDefaultProviders(env) {
-	const cacheKey = getCodexDefaultProvidersCacheKey(env);
-	const cachedProviders = codexDefaultProvidersByCacheKey.get(cacheKey);
-	if (cachedProviders) {
-		codexDefaultProvidersByCacheKey.delete(cacheKey);
-		codexDefaultProvidersByCacheKey.set(cacheKey, cachedProviders);
-		return cachedProviders;
-	}
-	const defaultWorkingDir = getCodexDefaultWorkingDir();
-	const gradingProvider = new require_codex_sdk.OpenAICodexSDKProvider({
-		config: getCodexDefaultProviderConfig(env, void 0, defaultWorkingDir),
-		env
-	});
-	const gradingJsonProvider = new require_codex_sdk.OpenAICodexSDKProvider({
-		config: getCodexDefaultProviderConfig(env, { output_schema: CODEX_GRADING_OUTPUT_SCHEMA }, defaultWorkingDir),
-		env
-	});
-	const providers = {
-		activeCalls: 0,
-		cancelled: false,
-		gradingJsonProvider,
-		gradingProvider,
-		llmRubricProvider: gradingJsonProvider,
-		shutdownRequested: false,
-		suggestionsProvider: gradingProvider,
-		synthesizeProvider: gradingProvider,
-		webSearchProvider: new require_codex_sdk.OpenAICodexSDKProvider({
-			config: getCodexDefaultProviderConfig(env, {
-				network_access_enabled: true,
-				output_schema: CODEX_GRADING_OUTPUT_SCHEMA,
-				web_search_mode: "live"
-			}, defaultWorkingDir),
-			env
-		})
-	};
-	trackCodexDefaultProviderUsage(providers);
-	return cacheCodexDefaultProviders(cacheKey, providers);
-}
-//#endregion
-//#region src/redteam/remoteGenerationContext.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function remoteGenerationContextPayload(contextOrCloudTargetId) {
-	const cloudTargetId = typeof contextOrCloudTargetId === "string" ? contextOrCloudTargetId : isRecord(contextOrCloudTargetId) && typeof contextOrCloudTargetId.cloudTargetId === "string" ? contextOrCloudTargetId.cloudTargetId : void 0;
-	return cloudTargetId ? { targetId: cloudTargetId } : {};
-}
-function getCloudTargetIdFromProviderId(providerId) {
-	return typeof providerId === "string" && providerId.startsWith("promptfoo://provider/") ? providerId.slice(21) || void 0 : void 0;
-}
-function getCloudTargetIdFromTargetIds(targetIds) {
-	for (const targetId of targetIds) {
-		const cloudTargetId = getCloudTargetIdFromProviderId(targetId);
-		if (cloudTargetId) return cloudTargetId;
-	}
-}
-function resolveRedteamGenerationContext({ cloudTargetDatabaseId, redteamGenerationContext, targetIds }) {
-	const providerTargetIds = redteamGenerationContext?.providerTargetIds ?? targetIds ?? [];
-	return {
-		providerTargetIds,
-		cloudTargetId: redteamGenerationContext?.cloudTargetId ?? cloudTargetDatabaseId ?? getCloudTargetIdFromTargetIds(providerTargetIds)
-	};
-}
-//#endregion
-//#region src/redteam/remoteGeneration.ts
-function providerRemoteGenerationContextPayload(contextOrCloudTargetId) {
-	return remoteGenerationContextPayload(contextOrCloudTargetId);
-}
-function resolveRemoteEndpoint(envName, path) {
-	const envUrl = require_logger.getEnvString(envName);
-	if (envUrl) return envUrl;
-	const cloudConfig = new require_fetch.CloudConfig();
-	if (cloudConfig.isEnabled()) return cloudConfig.getApiHost() + path;
-	return "https://api.promptfoo.app" + path;
-}
-/**
-* Gets the remote generation API endpoint URL.
-* Prioritizes: env var > cloud config > default endpoint.
-* @returns The remote generation URL
-*/
-function getRemoteGenerationUrl() {
-	return resolveRemoteEndpoint("PROMPTFOO_REMOTE_GENERATION_URL", "/api/v1/task");
-}
-/**
-* Builds headers for a remote-generation request.
-*
-* Authentication is injected centrally at the fetch layer (monkeyPatchFetch, mirrored
-* in cache.ts for cache-key parity) and only when the request URL's origin matches the
-* configured Promptfoo Cloud host (cloudConfig.getApiHost(), incl. on-prem). Keeping
-* this helper auth-free prevents cloud credentials from leaking to custom
-* remote-generation endpoints.
-*/
-function getRemoteGenerationHeaders(extraHeaders) {
-	const propagatedHeaders = {};
-	_opentelemetry_api.propagation.inject(_opentelemetry_api.context.active(), propagatedHeaders);
-	return {
-		"Content-Type": "application/json",
-		...propagatedHeaders.traceparent ? { traceparent: propagatedHeaders.traceparent } : {},
-		...propagatedHeaders.tracestate ? { tracestate: propagatedHeaders.tracestate } : {},
-		...extraHeaders
-	};
-}
-/**
-* Check if remote generation should never be used.
-* Respects both the general and redteam-specific disable flags.
-* @returns true if remote generation is disabled
-*/
-function neverGenerateRemote() {
-	if (require_logger.getEnvBool("PROMPTFOO_DISABLE_REMOTE_GENERATION")) return true;
-	return require_logger.getEnvBool("PROMPTFOO_DISABLE_REDTEAM_REMOTE_GENERATION");
-}
-/**
-* Check if remote generation should never be used for non-redteam features.
-* This allows granular control: disable redteam remote generation while allowing
-* regular SimulatedUser to use remote generation.
-* @returns true if ALL remote generation is disabled
-*/
-function neverGenerateRemoteForRegularEvals() {
-	return require_logger.getEnvBool("PROMPTFOO_DISABLE_REMOTE_GENERATION");
-}
-/**
-* Builds a remote URL with a substituted pathname, honoring env vars / cloud config.
-*/
-function buildRemoteUrl(pathname, fallback) {
-	if (neverGenerateRemote()) return null;
-	const envUrl = require_logger.getEnvString("PROMPTFOO_REMOTE_GENERATION_URL");
-	if (envUrl) try {
-		const url = new URL(envUrl);
-		url.pathname = pathname;
-		return url.toString();
-	} catch {
-		return fallback;
-	}
-	const cloudConfig = new require_fetch.CloudConfig();
-	if (cloudConfig.isEnabled()) return `${cloudConfig.getApiHost()}${pathname}`;
-	return fallback;
-}
-/**
-* Gets the URL for checking remote API health based on configuration.
-* @returns The health check URL, or null if remote generation is disabled.
-*/
-function getRemoteHealthUrl() {
-	return buildRemoteUrl("/health", "https://api.promptfoo.app/health");
-}
-/**
-* Gets the URL for checking remote API version based on configuration.
-* @returns The version check URL, or null if remote generation is disabled.
-*/
-function getRemoteVersionUrl() {
-	return buildRemoteUrl("/version", "https://api.promptfoo.app/version");
-}
-function getRemoteGenerationDisabledError(strategyName) {
-	return `${strategyName} requires remote generation, which is currently disabled for this configuration. To enable it, run with --remote, set PROMPTFOO_REMOTE_GENERATION_URL to a self-hosted endpoint, or log into Promptfoo Cloud with \`promptfoo auth login\`.`;
-}
-function getRemoteGenerationExplicitlyDisabledError(strategyName) {
-	const activeFlags = ["PROMPTFOO_DISABLE_REMOTE_GENERATION", "PROMPTFOO_DISABLE_REDTEAM_REMOTE_GENERATION"].filter((flag) => require_logger.getEnvBool(flag));
-	return `${strategyName} requires remote generation, which has been explicitly disabled. To enable it, ${activeFlags.length > 0 ? `unset ${activeFlags.join(" and ")}` : "unset PROMPTFOO_DISABLE_REMOTE_GENERATION or PROMPTFOO_DISABLE_REDTEAM_REMOTE_GENERATION (whichever is set)"}. Once re-enabled, you can point at a self-hosted endpoint with PROMPTFOO_REMOTE_GENERATION_URL or use Promptfoo Cloud via \`promptfoo auth login\`.`;
-}
-/**
-* Determines if remote generation should be used based on configuration.
-* @returns true if remote generation should be used
-*/
-function shouldGenerateRemote(options) {
-	if (neverGenerateRemote()) return false;
-	if (require_logger.getEnvString("PROMPTFOO_REMOTE_GENERATION_URL")) return true;
-	if (require_accounts.isLoggedIntoCloud()) return true;
-	return !(Boolean(require_logger.getEnvString("OPENAI_API_KEY")) || options?.canUseCodexDefaultProvider && !options?.requireEmbeddingProvider && hasCodexDefaultCredentials()) || (require_logger.state.remote ?? false);
-}
-/**
-* Gets the URL for unaligned model inference (harmful content generation).
-* Prioritizes: env var > cloud config > default endpoint.
-* @returns The unaligned inference URL
-*/
-function getRemoteGenerationUrlForUnaligned() {
-	return resolveRemoteEndpoint("PROMPTFOO_UNALIGNED_INFERENCE_ENDPOINT", "/api/v1/task/harmful");
-}
-//#endregion
-Object.defineProperty(exports, "getCloudTargetIdFromProviderId", {
-	enumerable: true,
-	get: function() {
-		return getCloudTargetIdFromProviderId;
-	}
-});
-Object.defineProperty(exports, "getCloudTargetIdFromTargetIds", {
-	enumerable: true,
-	get: function() {
-		return getCloudTargetIdFromTargetIds;
-	}
-});
-Object.defineProperty(exports, "getCodexDefaultProviders", {
-	enumerable: true,
-	get: function() {
-		return getCodexDefaultProviders;
-	}
-});
-Object.defineProperty(exports, "getRemoteGenerationDisabledError", {
-	enumerable: true,
-	get: function() {
-		return getRemoteGenerationDisabledError;
-	}
-});
-Object.defineProperty(exports, "getRemoteGenerationExplicitlyDisabledError", {
-	enumerable: true,
-	get: function() {
-		return getRemoteGenerationExplicitlyDisabledError;
-	}
-});
-Object.defineProperty(exports, "getRemoteGenerationHeaders", {
-	enumerable: true,
-	get: function() {
-		return getRemoteGenerationHeaders;
-	}
-});
-Object.defineProperty(exports, "getRemoteGenerationUrl", {
-	enumerable: true,
-	get: function() {
-		return getRemoteGenerationUrl;
-	}
-});
-Object.defineProperty(exports, "getRemoteGenerationUrlForUnaligned", {
-	enumerable: true,
-	get: function() {
-		return getRemoteGenerationUrlForUnaligned;
-	}
-});
-Object.defineProperty(exports, "getRemoteHealthUrl", {
-	enumerable: true,
-	get: function() {
-		return getRemoteHealthUrl;
-	}
-});
-Object.defineProperty(exports, "getRemoteVersionUrl", {
-	enumerable: true,
-	get: function() {
-		return getRemoteVersionUrl;
-	}
-});
-Object.defineProperty(exports, "hasCodexDefaultCredentials", {
-	enumerable: true,
-	get: function() {
-		return hasCodexDefaultCredentials;
-	}
-});
-Object.defineProperty(exports, "isRecord", {
-	enumerable: true,
-	get: function() {
-		return isRecord;
-	}
-});
-Object.defineProperty(exports, "neverGenerateRemote", {
-	enumerable: true,
-	get: function() {
-		return neverGenerateRemote;
-	}
-});
-Object.defineProperty(exports, "neverGenerateRemoteForRegularEvals", {
-	enumerable: true,
-	get: function() {
-		return neverGenerateRemoteForRegularEvals;
-	}
-});
-Object.defineProperty(exports, "providerRemoteGenerationContextPayload", {
-	enumerable: true,
-	get: function() {
-		return providerRemoteGenerationContextPayload;
-	}
-});
-Object.defineProperty(exports, "remoteGenerationContextPayload", {
-	enumerable: true,
-	get: function() {
-		return remoteGenerationContextPayload;
-	}
-});
-Object.defineProperty(exports, "resolveRedteamGenerationContext", {
-	enumerable: true,
-	get: function() {
-		return resolveRedteamGenerationContext;
-	}
-});
-Object.defineProperty(exports, "shouldGenerateRemote", {
-	enumerable: true,
-	get: function() {
-		return shouldGenerateRemote;
-	}
-});
-
-//# sourceMappingURL=remoteGeneration-CKJFE960.cjs.map