sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/request-route-resolver.js

@@ -0,0 +1,172 @@
+import { providerEndpointSecurityBlocker } from './provider-registry.js';
+import { validateBridgeRoutingPolicy } from './provider-route-policy.js';
+import { canonicalizeBridgeModelId, normalizeBridgeUpstreamModelId, routeIndexMatchesGeneration } from './route-index.js';
+export function resolveBridgeRequestRoute(request, policy, options) {
+    const model = canonicalizeBridgeModelId(request.model);
+    const base = {
+        schema: 'sks.bridge-request-route-resolution.v1',
+        requested_model: model,
+        fallback: 'none',
+        catalog_generation: policy.catalog_generation,
+        route_policy_generation: policy.policy_generation,
+        warnings: []
+    };
+    if (!model)
+        return blocked(base, 'catalog_model_route_missing');
+    const policyBlockers = validateBridgeRoutingPolicy(policy, options.route_index);
+    if (policyBlockers.length > 0)
+        return blocked(base, policyBlockers[0]);
+    if (!routeIndexMatchesGeneration(options.route_index, options.route_index.generation)) {
+        return blocked(base, 'catalog_route_index_generation_invalid');
+    }
+    if (options.active_catalog_generation && options.active_catalog_generation !== policy.catalog_generation) {
+        return blocked(base, 'catalog_route_index_stale');
+    }
+    const pin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
+    if (pin && canonicalizeBridgeModelId(pin.public_model) === model) {
+        const pinBlocker = validateSessionPin(pin, policy, options.route_index, options.registry);
+        if (pinBlocker)
+            return blocked(base, pinBlocker);
+        const route = { provider_id: pin.provider_id, upstream_model: pin.upstream_model };
+        const providerBlocker = validateProviderRoute(route, request.requested_endpoint_origin, options.registry, options.route_index);
+        if (providerBlocker)
+            return blocked(base, providerBlocker);
+        return {
+            ...base,
+            ok: true,
+            route,
+            endpoint_url: options.registry.profiles[route.provider_id].endpoint.url,
+            source: 'session_pin',
+            proposed_session_pin: pin,
+            blockers: [],
+            recovery_action: null
+        };
+    }
+    const conflict = options.route_index.conflicts.find((entry) => canonicalizeBridgeModelId(entry.public_id) === model);
+    if (conflict)
+        return blocked(base, 'catalog_model_route_ambiguous');
+    const indexed = options.route_index.routes[model];
+    const policyTarget = policy.model_routes[model];
+    if (!indexed || !policyTarget)
+        return blocked(base, 'catalog_model_route_missing');
+    if (!sameTarget(indexed, policyTarget))
+        return blocked(base, 'bridge_route_policy_route_index_mismatch');
+    const providerBlocker = validateProviderRoute(indexed, request.requested_endpoint_origin, options.registry, options.route_index);
+    if (providerBlocker)
+        return blocked(base, providerBlocker);
+    const proposedPin = request.thread_id
+        ? {
+            thread_id: request.thread_id,
+            provider_id: indexed.provider_id,
+            public_model: model,
+            upstream_model: indexed.upstream_model,
+            catalog_generation: policy.catalog_generation,
+            route_policy_generation: policy.policy_generation,
+            created_at: (options.now || (() => new Date().toISOString()))()
+        }
+        : null;
+    return {
+        ...base,
+        ok: true,
+        route: indexed,
+        endpoint_url: options.registry.profiles[indexed.provider_id].endpoint.url,
+        source: 'route_index',
+        proposed_session_pin: proposedPin,
+        blockers: [],
+        recovery_action: null
+    };
+}
+function validateSessionPin(pin, policy, routeIndex, registry) {
+    if (pin.catalog_generation !== policy.catalog_generation
+        || pin.route_policy_generation !== policy.policy_generation) {
+        return 'session_pin_route_unavailable';
+    }
+    if (!isProviderId(pin.provider_id) || !registry.profiles[pin.provider_id]) {
+        return 'session_pin_route_unavailable';
+    }
+    const model = canonicalizeBridgeModelId(pin.public_model);
+    const upstream = normalizeBridgeUpstreamModelId(pin.upstream_model);
+    if (!model || !upstream)
+        return 'session_pin_route_unavailable';
+    const indexed = routeIndex.routes[model] || routeIndex.routes[`${pin.provider_id}:${model}`];
+    if (!indexed || indexed.provider_id !== pin.provider_id || indexed.upstream_model !== upstream) {
+        return 'session_pin_route_unavailable';
+    }
+    return null;
+}
+function validateProviderRoute(route, requestedOrigin, registry, routeIndex) {
+    if (!isProviderId(route.provider_id))
+        return 'catalog_route_provider_unknown';
+    const profile = registry.profiles[route.provider_id];
+    if (!profile)
+        return 'catalog_route_provider_unknown';
+    if (routeIndex.providers[route.provider_id].state !== 'ready') {
+        return `${providerCode(route.provider_id)}_catalog_route_not_ready`;
+    }
+    if (!profile.enabled)
+        return `${providerCode(route.provider_id)}_provider_disabled`;
+    if (profile.state === 'not_configured')
+        return `${providerCode(route.provider_id)}_credential_missing`;
+    if (profile.state !== 'ready')
+        return `${providerCode(route.provider_id)}_route_not_ready`;
+    const endpointBlocker = providerEndpointSecurityBlocker(route.provider_id, profile.endpoint.url, profile.endpoint.allowed_origins);
+    if (endpointBlocker)
+        return endpointBlocker;
+    if (requestedOrigin) {
+        let origin = '';
+        try {
+            origin = new URL(requestedOrigin).origin;
+        }
+        catch {
+            return 'provider_endpoint_origin_not_allowlisted';
+        }
+        if (origin !== profile.endpoint.origin || !profile.endpoint.allowed_origins.includes(origin)) {
+            return 'provider_endpoint_origin_not_allowlisted';
+        }
+    }
+    return null;
+}
+function findSessionPin(pins, threadId) {
+    if (!pins)
+        return null;
+    if (Array.isArray(pins))
+        return pins.find((pin) => pin.thread_id === threadId) || null;
+    return pins.get(threadId) || null;
+}
+function blocked(base, blocker) {
+    return {
+        ...base,
+        ok: false,
+        route: null,
+        endpoint_url: null,
+        source: null,
+        proposed_session_pin: null,
+        blockers: [blocker],
+        recovery_action: recoveryAction(blocker)
+    };
+}
+function recoveryAction(blocker) {
+    if (blocker === 'catalog_model_route_ambiguous')
+        return 'resolve_catalog_route_conflict';
+    if (blocker === 'catalog_model_route_missing')
+        return 'refresh_catalog_or_select_supported_model';
+    if (blocker === 'session_pin_route_unavailable' || blocker === 'catalog_route_index_stale') {
+        return 'select_supported_model_and_refresh_session_pin';
+    }
+    if (blocker === 'codex_lb_credential_missing')
+        return 'configure_codex_lb_credential';
+    if (blocker === 'openrouter_credential_missing')
+        return 'configure_openrouter_credential';
+    if (blocker.includes('origin_not_allowlisted'))
+        return 'review_provider_endpoint_configuration';
+    return 'review_bridge_route_status';
+}
+function providerCode(providerId) {
+    return providerId === 'codex-lb' ? 'codex_lb' : 'openrouter';
+}
+function isProviderId(value) {
+    return value === 'codex-lb' || value === 'openrouter';
+}
+function sameTarget(left, right) {
+    return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
+}

package/dist/core/codex-lb/route-index.js

@@ -0,0 +1,148 @@
+import crypto from 'node:crypto';
+export function canonicalizeBridgeModelId(value) {
+    const model = String(value || '').trim().toLowerCase();
+    if (!model || model.length > 240)
+        return null;
+    if (!/^[a-z0-9][a-z0-9._:/-]*$/.test(model))
+        return null;
+    return model;
+}
+export function normalizeBridgeUpstreamModelId(value) {
+    const model = String(value || '').trim();
+    if (!model || model.length > 240)
+        return null;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]*$/.test(model))
+        return null;
+    return model;
+}
+export function providerRouteKey(providerId, publicId) {
+    const model = canonicalizeBridgeModelId(publicId);
+    if (!model)
+        throw new Error('catalog_model_id_invalid');
+    return `${providerId}:${model}`;
+}
+export function buildBridgeRouteIndex(input) {
+    const grouped = new Map();
+    const explicitRoutes = new Map();
+    const blockers = [];
+    for (const source of [...input.models].sort(compareModels)) {
+        const publicId = canonicalizeBridgeModelId(source.public_id);
+        const upstream = normalizeBridgeUpstreamModelId(source.upstream_model);
+        if (!publicId || !upstream) {
+            blockers.push('catalog_model_id_invalid');
+            continue;
+        }
+        const model = {
+            ...source,
+            public_id: publicId,
+            upstream_model: upstream,
+            capabilities: unique(source.capabilities).sort(),
+            route_key: providerRouteKey(source.provider_id, publicId)
+        };
+        const rows = grouped.get(publicId) || [];
+        rows.push(model);
+        grouped.set(publicId, rows);
+        const explicit = explicitRoutes.get(model.route_key);
+        const target = { provider_id: model.provider_id, upstream_model: model.upstream_model };
+        if (explicit && !sameTarget(explicit, target))
+            blockers.push('catalog_model_route_ambiguous');
+        else
+            explicitRoutes.set(model.route_key, target);
+    }
+    const routes = new Map(explicitRoutes);
+    const conflicts = [];
+    for (const [publicId, rows] of [...grouped.entries()].sort(([left], [right]) => left.localeCompare(right))) {
+        const targets = uniqueTargets(rows);
+        if (targets.length === 1) {
+            routes.set(publicId, targets[0]);
+            continue;
+        }
+        conflicts.push({
+            public_id: publicId,
+            providers: unique(rows.map((row) => row.provider_id)).sort(),
+            blocker: 'catalog_model_route_ambiguous'
+        });
+    }
+    const canonicalProviders = {
+        'codex-lb': canonicalProvider(input.providers['codex-lb']),
+        openrouter: canonicalProvider(input.providers.openrouter)
+    };
+    const canonicalRoutes = Object.fromEntries([...routes.entries()].sort(([left], [right]) => left.localeCompare(right)));
+    const semantic = {
+        providers: canonicalProviders,
+        routes: canonicalRoutes,
+        conflicts
+    };
+    const generation = sha256Stable(semantic);
+    const routeIndex = {
+        schema: 'sks.bridge-route-index.v1',
+        generation,
+        created_at: input.created_at || new Date().toISOString(),
+        providers: canonicalProviders,
+        routes: canonicalRoutes,
+        conflicts
+    };
+    return {
+        route_index: routeIndex,
+        digest: generation,
+        route_count: Object.keys(canonicalRoutes).length,
+        conflict_count: conflicts.length,
+        blockers: unique([
+            ...blockers,
+            ...(conflicts.length > 0 ? ['catalog_model_route_ambiguous'] : [])
+        ])
+    };
+}
+export function routeIndexMatchesGeneration(index, expectedGeneration) {
+    return index.schema === 'sks.bridge-route-index.v1'
+        && index.generation === expectedGeneration
+        && sha256Stable({
+            providers: index.providers,
+            routes: index.routes,
+            conflicts: index.conflicts
+        }) === index.generation;
+}
+export function stableJson(value) {
+    return `${stableStringify(value)}\n`;
+}
+export function sha256Stable(value) {
+    return crypto.createHash('sha256').update(stableStringify(value)).digest('hex');
+}
+function canonicalProvider(input) {
+    return {
+        catalog_generation: input.catalog_generation,
+        credential_fingerprint: input.credential_fingerprint,
+        state: String(input.state || 'unknown')
+    };
+}
+function uniqueTargets(rows) {
+    const map = new Map();
+    for (const row of rows) {
+        const target = { provider_id: row.provider_id, upstream_model: row.upstream_model };
+        map.set(`${target.provider_id}\u0000${target.upstream_model}`, target);
+    }
+    return [...map.values()].sort((left, right) => left.provider_id.localeCompare(right.provider_id)
+        || left.upstream_model.localeCompare(right.upstream_model));
+}
+function compareModels(left, right) {
+    return left.public_id.localeCompare(right.public_id)
+        || left.provider_id.localeCompare(right.provider_id)
+        || left.upstream_model.localeCompare(right.upstream_model);
+}
+function sameTarget(left, right) {
+    return left.provider_id === right.provider_id && left.upstream_model === right.upstream_model;
+}
+function stableStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableStringify(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}