super-dsh 0.1.9 → 0.1.10-e

package/agent-claude/dist/claude-providers.js

@@ -0,0 +1,391 @@
+/**
+ * claude-providers.ts — the adapter-owned multi-provider store behind the Hub's
+ * Claude settings panel (2026-10-04 multi-provider ruling).
+ *
+ * Claude Code is a single-provider harness: its own `settings.json` env block
+ * names exactly ONE `ANTHROPIC_BASE_URL` with one key, so the LIST of
+ * configured providers has nowhere to live in Claude's home, and this module
+ * is where it lives instead: `<worldHome>/claude-providers.json` under the
+ * world's DSH home (`<dshHome>/agents/claude/`), the location dev-rules §5/§13
+ * already assigns to the adapter's own DSH state.
+ *
+ * This file is the CANONICAL provider list. The native `settings.json` env
+ * block is a SOURCE, not a peer: `syncNativeProviders` folds whatever it
+ * declares into this list, deduplicated by endpoint URL (the only identity a
+ * hand-written settings env reliably carries), and never deletes anything.
+ * There is no "selected" provider — which provider a session runs on is DSH's
+ * own per-session `model/selection`, and the native home is written by nobody.
+ *
+ * The file carries API keys, so it is written 0600 with the sibling
+ * `.credentials.yaml` posture, and reads are fail-soft: a corrupt or partial
+ * store must degrade to "no providers yet", never take the world down. A
+ * provider entry that does not survive validation is DROPPED rather than
+ * poisoning the whole list.
+ *
+ * @module agent-claude/claude-providers
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+/**
+ * A provider id becomes one half of the composite model id and is shown in the
+ * panel, so the alphabet is deliberately narrow: lowercase alphanumerics and
+ * interior hyphens. (Covers `zai-plan`, `deepseek`, `glm`; rejects spaces,
+ * dots, quotes, the composite-key separator `/` and anything else a slug was
+ * never meant to carry.)
+ */
+const PROVIDER_ID = /^[a-z0-9][a-z0-9-]*$/;
+/** Longest generated id: the slug part plus its 7-character discriminator. */
+const MAX_ID_LENGTH = 48;
+/** Whether `value` may be used as a provider id. */
+export function isProviderId(value) {
+    return typeof value === "string" && PROVIDER_ID.test(value);
+}
+/** Where the store lives: `<worldHome>/claude-providers.json`. */
+export function providerStorePath(worldHome) {
+    return join(worldHome, "claude-providers.json");
+}
+/** The empty store — also the fail-soft answer for every unreadable input. */
+function emptyStore() {
+    return { providers: [], removed: [] };
+}
+function str(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function auth(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const kind = record["kind"];
+    if (kind !== "authToken" && kind !== "apiKey")
+        return undefined;
+    // An EMPTY value is a real state, not a malformed entry: it means "this
+    // provider is keyed outside Super D", which is how a provider seeded from
+    // the user's own settings arrives. See ClaudeProviderAuth.
+    const secret = record["value"];
+    return typeof secret === "string" ? { kind, value: secret } : undefined;
+}
+function model(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const id = str(record["id"]);
+    if (id === undefined)
+        return undefined;
+    const displayName = str(record["displayName"]);
+    const contextWindow = record["contextWindow"];
+    return {
+        id,
+        ...(displayName === undefined ? {} : { displayName }),
+        ...(typeof contextWindow === "number" && Number.isSafeInteger(contextWindow) && contextWindow > 0
+            ? { contextWindow }
+            : {}),
+    };
+}
+function aliases(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const sonnet = str(record["sonnet"]);
+    const opus = str(record["opus"]);
+    const haiku = str(record["haiku"]);
+    if (sonnet === undefined && opus === undefined && haiku === undefined)
+        return undefined;
+    return {
+        ...(sonnet === undefined ? {} : { sonnet }),
+        ...(opus === undefined ? {} : { opus }),
+        ...(haiku === undefined ? {} : { haiku }),
+    };
+}
+/**
+ * Validate one raw entry. Returns `undefined` for anything unusable — an id
+ * outside the alphabet, a missing endpoint, an auth shape this build does not
+ * understand — so the caller can drop it and keep the rest. An empty `models`
+ * list is VALID (see {@link ClaudeProviderEntry.models}).
+ */
+export function providerEntry(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const id = record["id"];
+    const label = str(record["label"]);
+    const baseUrl = str(record["baseUrl"]);
+    const credentials = auth(record["auth"]);
+    if (!isProviderId(id) || label === undefined || baseUrl === undefined || credentials === undefined) {
+        return undefined;
+    }
+    const rawModels = record["models"];
+    const models = (Array.isArray(rawModels) ? rawModels : [])
+        .map(model)
+        .filter((entry) => entry !== undefined);
+    const parsedAliases = aliases(record["aliases"]);
+    const origin = record["origin"] === "native" ? "native" : "user";
+    return {
+        id,
+        label,
+        baseUrl,
+        auth: credentials,
+        models,
+        ...(parsedAliases === undefined ? {} : { aliases: parsedAliases }),
+        origin,
+    };
+}
+/**
+ * Read the store. Fail-soft by construction: a missing file, unparsable JSON,
+ * a wrong top-level shape, or individual bad entries all degrade toward an
+ * empty (or shorter) list rather than throwing.
+ */
+export function readProviderStore(worldHome) {
+    const path = providerStorePath(worldHome);
+    if (!existsSync(path))
+        return emptyStore();
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return emptyStore();
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return emptyStore();
+    const record = parsed;
+    if (!Array.isArray(record["providers"]))
+        return emptyStore();
+    const providers = record["providers"]
+        .map(providerEntry)
+        .filter((entry) => entry !== undefined);
+    const rawRemoved = record["removed"];
+    const removed = (Array.isArray(rawRemoved) ? rawRemoved : [])
+        .filter((value) => typeof value === "string" && value.trim() !== "");
+    return { providers, removed };
+}
+/**
+ * Persist the store atomically (tmp + rename) and 0600 — the file holds API
+ * keys in the clear, exactly like the sibling `.credentials.yaml`, so it must
+ * never be group- or world-readable even for the instant before a rewrite.
+ */
+export function writeProviderStore(worldHome, store) {
+    const path = providerStorePath(worldHome);
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.tmp-${process.pid}`;
+    writeFileSync(temp, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    renameSync(temp, path);
+}
+/**
+ * Insert or replace one provider by id, preserving list order.
+ *
+ * An explicit add also clears the endpoint's removal tombstone: re-adding a
+ * provider is the user overruling their own earlier removal, and leaving the
+ * tombstone would make the next sync skip it again.
+ */
+export function upsertProvider(store, entry) {
+    const at = store.providers.findIndex((existing) => existing.id === entry.id);
+    const providers = at === -1
+        ? [...store.providers, entry]
+        : store.providers.map((existing, index) => (index === at ? entry : existing));
+    const key = endpointKey(entry.baseUrl);
+    // The endpoint's tombstone is FILTERED OUT, not carried forward: leaving it
+    // would make the next sync skip the endpoint the user just re-added.
+    const removed = store.removed.filter((candidate) => candidate !== key);
+    return { providers, removed };
+}
+/**
+ * Drop one provider, and TOMBSTONE its endpoint so the reconcile cannot bring
+ * it back: the user's own `settings.json` still declares it, and a list editor
+ * whose delete button undoes itself every ten minutes is worse than no button.
+ *
+ * Removing from this list is still not "unconfiguring Claude Code": nothing
+ * native is touched, and the user's own CLI keeps running whatever their file
+ * says.
+ */
+export function removeProvider(store, id) {
+    const entry = store.providers.find((candidate) => candidate.id === id);
+    const providers = store.providers.filter((candidate) => candidate.id !== id);
+    if (entry === undefined)
+        return { providers, removed: store.removed };
+    const key = endpointKey(entry.baseUrl);
+    const removed = store.removed.includes(key) ? store.removed : [...store.removed, key];
+    return { providers, removed };
+}
+/**
+ * The comparison key for "the same endpoint". A settings env block has no
+ * identity beyond its `ANTHROPIC_BASE_URL`, and a hand-written one carries no
+ * other identity worth trusting — so the endpoint IS the dedupe key. Case, a
+ * trailing slash, and the default port are noise.
+ *
+ * @param baseUrl - a provider's `ANTHROPIC_BASE_URL` (any shape; unparsable input is compared verbatim).
+ * @returns a stable key.
+ */
+export function endpointKey(baseUrl) {
+    const trimmed = baseUrl.trim();
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return trimmed.toLowerCase();
+    }
+    const path = parsed.pathname.replace(/\/+$/, "");
+    const port = parsed.port === "" || (parsed.protocol === "https:" && parsed.port === "443")
+        || (parsed.protocol === "http:" && parsed.port === "80")
+        ? ""
+        : `:${parsed.port}`;
+    return `${parsed.protocol}//${parsed.hostname.toLowerCase()}${port}${path}`;
+}
+/** Reduce arbitrary text to the provider-id alphabet, collapsing runs of junk. */
+function slugify(value) {
+    const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    return slug === "" ? "provider" : slug.slice(0, MAX_ID_LENGTH - 8);
+}
+/** A short, stable discriminator so two endpoints sharing a host stay distinct. */
+function discriminator(value) {
+    let hash = 0x811c9dc5;
+    for (let index = 0; index < value.length; index += 1) {
+        hash ^= value.charCodeAt(index);
+        hash = Math.imul(hash, 0x01000193) >>> 0;
+    }
+    return hash.toString(36).padStart(6, "0").slice(-6);
+}
+/**
+ * The provider id for an endpoint. A settings env block carries no provider
+ * name at all, so this is the path every folded provider takes, and the one a
+ * UI-added provider reuses.
+ *
+ * @param baseUrl - the provider's endpoint.
+ * @returns a slug that satisfies {@link isProviderId}.
+ */
+export function providerIdFromEndpoint(baseUrl) {
+    const key = endpointKey(baseUrl);
+    let host = "provider";
+    let path = "";
+    try {
+        const parsed = new URL(key);
+        host = parsed.hostname;
+        path = parsed.pathname;
+    }
+    catch {
+        // keep the defaults
+    }
+    return `${slugify(`${host}${path}`)}-${discriminator(key)}`;
+}
+/**
+ * Make `wanted` usable and unique within `taken`.
+ *
+ * @param wanted - the preferred id (usually a generated slug).
+ * @param taken - ids already claimed by other entries.
+ * @returns a valid id not present in `taken`.
+ */
+export function uniqueProviderId(wanted, taken) {
+    const used = new Set(taken);
+    const base = isProviderId(wanted) ? wanted : slugify(wanted);
+    if (!used.has(base))
+        return base;
+    const salted = `${base.slice(0, MAX_ID_LENGTH - 7)}-${discriminator(wanted)}`;
+    if (!used.has(salted))
+        return salted;
+    for (let index = 2;; index += 1) {
+        const candidate = `${base.slice(0, MAX_ID_LENGTH - 4)}-${index}`;
+        if (!used.has(candidate))
+            return candidate;
+    }
+}
+/** Append the models of `incoming` that `existing` does not already carry. */
+function unionModels(existing, incoming) {
+    const known = new Set(existing.map((entry) => entry.id));
+    const additions = [];
+    for (const candidate of incoming) {
+        // Same validation a store read applies: junk in an import is skipped, not
+        // propagated — and a duplicate id (even twice within one import) is noise.
+        const parsed = model(candidate);
+        if (parsed === undefined || known.has(parsed.id))
+            continue;
+        known.add(parsed.id);
+        additions.push(parsed);
+    }
+    return additions.length === 0 ? existing : [...existing, ...additions];
+}
+/**
+ * Structural auth equality.
+ *
+ * Reference equality is wrong here: a native sync re-parses the settings on
+ * every tick, so the incoming auth object is a FRESH one each time and `!==`
+ * would report a change forever. That is not a cosmetic difference — it makes
+ * the "only write when something moved" contract fail, so every scheduled
+ * reconcile would rewrite a 0600 secrets file.
+ */
+function sameAuth(left, right) {
+    return left.kind === right.kind && left.value === right.value;
+}
+/** Structural alias equality — same reasoning as {@link sameAuth}. */
+function sameAliases(left, right) {
+    if (left === undefined || right === undefined)
+        return left === right;
+    return left.sonnet === right.sonnet && left.opus === right.opus && left.haiku === right.haiku;
+}
+/**
+ * Fold the providers a native settings env declares into the canonical store.
+ *
+ * Identity is the endpoint (see {@link endpointKey}); an import whose endpoint
+ * already matches an entry refreshes that entry's endpoint, model list, aliases
+ * and — only when the entry holds no secret of its own — its auth shape.
+ * Anything unmatched is appended, labelled with its endpoint URL, because that
+ * is the only name a settings env block gives it. Nothing is ever deleted
+ * here: a provider dropped from the settings may still be one the user uses
+ * through Super D. The one exception runs the other way — an endpoint the user
+ * REMOVED in the panel is skipped, so their removal is not undone by the next
+ * reconcile.
+ *
+ * @param store - the canonical list.
+ * @param imported - providers parsed from the native settings env, in file order.
+ * @returns the new store plus which ids were added and which were refreshed.
+ */
+export function syncNativeProviders(store, imported) {
+    const providers = [...store.providers];
+    const added = [];
+    const updated = [];
+    for (const incoming of imported) {
+        const baseUrl = incoming.baseUrl.trim();
+        if (baseUrl === "")
+            continue;
+        const key = endpointKey(baseUrl);
+        if (store.removed.includes(key))
+            continue;
+        const at = providers.findIndex((entry) => endpointKey(entry.baseUrl) === key);
+        if (at === -1) {
+            const id = uniqueProviderId(providerIdFromEndpoint(baseUrl), providers.map((entry) => entry.id));
+            providers.push({
+                id,
+                label: baseUrl,
+                baseUrl,
+                auth: incoming.auth,
+                models: unionModels([], incoming.models ?? []),
+                ...(incoming.aliases === undefined ? {} : { aliases: incoming.aliases }),
+                origin: "native",
+            });
+            added.push(id);
+            continue;
+        }
+        const entry = providers[at];
+        const models = unionModels(entry.models, incoming.models ?? []);
+        // The native env block is the user's own statement about how Claude Code
+        // should authenticate, but a secret Super D already holds must not be
+        // dropped in favour of it — an EMPTY value is the only shape that defers
+        // ("Super D holds no copy"), so only that one follows the native file.
+        const adoptAuth = entry.auth.value === "";
+        const next = {
+            ...entry,
+            baseUrl,
+            ...(adoptAuth ? { auth: incoming.auth } : {}),
+            models,
+            ...(incoming.aliases === undefined ? {} : { aliases: incoming.aliases }),
+        };
+        const changed = next.baseUrl !== entry.baseUrl
+            || next.models !== entry.models
+            || !sameAuth(next.auth, entry.auth)
+            || !sameAliases(next.aliases, entry.aliases);
+        if (changed) {
+            providers[at] = next;
+            updated.push(entry.id);
+        }
+    }
+    return { store: { providers, removed: store.removed }, added, updated };
+}

package/agent-claude/dist/claude-route.js

@@ -0,0 +1,152 @@
+/**
+ * claude-route.ts — which provider/model a Claude turn must run
+ * (2026-10-04 multi-provider rework).
+ *
+ * This is the whole of Super D's model-selection policy, and the point is that
+ * there is almost none: the precedence below is the harness's own
+ * (`sessionController.selectionFor(agent).current`), so a session's route is
+ * decided by DSH exactly as it would be for a native agent, and Super D only
+ * has to read it.
+ *
+ *   pending   the durable `modelSelection` projection's `pending` — a switch
+ *             made through `session/selectModel` that no `request/header` has
+ *             retired yet. This is what makes a mid-turn switch land on the NEXT
+ *             turn, for free: the harness records the intent and the next
+ *             request consumes it.
+ *   logged    the last `request/header` snapshot — what the session ACTUALLY ran
+ *             last. It is also what lets a resumed session name the provider
+ *             that produced its transcript.
+ *   preferred `ctx.agentDefaultModel` — the deployment default for a session
+ *             that has never run.
+ *   fallback  the agent's own reconciled options — the pair the factory built
+ *             from the provider store and the user's native `settings.json`.
+ *
+ * The Dash model selector, though, speaks one id per model, and with more than
+ * one provider a bare CLI alias (`glm-5.2`) is ambiguous. The catalog therefore
+ * mints every entry's id as `provider/model` (`compositeModelId`), and a
+ * selection's id splits back into its halves here (`parseCompositeModelId`) —
+ * on the FIRST slash, because a provider id is slug-alphabet and never carries
+ * one while a model id may.
+ *
+ * One shape predates the per-provider routes and is still in the wild: sessions
+ * created before the rework pinned the hardcoded `claude` route with the
+ * COMPOSITE id as their model half (`{provider: "claude", model: "glm/glm-5.3"}`).
+ * Read raw it names no store entry, so the session would silently relaunch on
+ * the native endpoint; {@link routeOf} revives it by splitting that one legacy
+ * shape, and only that one — a new-shape selection's raw model id may carry a
+ * slash of its own (`zai-plan` + `anthropic/claude-sonnet-4`).
+ *
+ * Kept out of `agent.ts` so the precedence can be pinned without standing up
+ * a Session, a Context and a client: it is the one piece of this feature whose
+ * mistakes are silent.
+ *
+ * @module agent-claude/claude-route
+ */
+/**
+ * The route id every selection was pinned under BEFORE the per-provider-route
+ * rework. A local literal on purpose: importing `CLAUDE_PROVIDER_ID` from
+ * `adapter.ts` would close a module cycle (`adapter → models → claude-route`).
+ */
+const LEGACY_ROUTE_ID = "claude";
+/**
+ * Read a route out of one candidate value.
+ *
+ * Every candidate arrives as untyped projection/config data, so this validates
+ * structurally and answers `undefined` for anything incomplete. A half-filled
+ * route must never win the precedence: falling through to a complete one is
+ * always better than launching a child with an empty model.
+ *
+ * @param value - a candidate route (a `ModelSelection`-shaped object, or junk).
+ * @returns the route, or `undefined` when it does not name both halves.
+ */
+export function routeOf(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const provider = record["provider"];
+    const model = record["model"];
+    if (typeof provider !== "string" || provider === "" || typeof model !== "string" || model === "")
+        return undefined;
+    // Revive a selection from the pre-per-provider-route architecture: the route
+    // half was hardcoded `claude` and the model half was the COMPOSITE id, so a
+    // resumed session hands back `{provider: "claude", model: "glm/glm-5.3"}`.
+    // Read raw that pair misses the provider store, and the agent falls back to
+    // NATIVE_LAUNCH — the session quietly resumes on the native endpoint instead
+    // of its pinned provider until the user re-picks. Keyed on the provider half
+    // so a new-shape selection passes through untouched, even when its raw model
+    // id carries a slash of its own.
+    if (provider === LEGACY_ROUTE_ID)
+        return parseCompositeModelId(model) ?? { provider, model };
+    return { provider, model };
+}
+/**
+ * Resolve the route for the next request by the harness's own precedence.
+ *
+ * @param candidates - the candidates in descending priority: `pending`,
+ * `logged`, `preferred`, `fallback`. `preferred` is the harness default
+ * (`agentDefaultModel`); `fallback` is the factory's own options.
+ * @returns the first complete route, or `undefined` when none is usable.
+ */
+export function resolveRoute(candidates) {
+    return routeOf(candidates.pending)
+        ?? routeOf(candidates.logged)
+        ?? routeOf(candidates.preferred)
+        ?? routeOf(candidates.fallback);
+}
+/**
+ * Mint the Dash-facing model id for one provider's model: `${provider}/${model}`.
+ *
+ * The catalog publishes this composite as the entry id because the selector
+ * picks by a single id and a bare CLI alias is ambiguous across providers. The
+ * provider half is a store id (slug alphabet — `isProviderId` in
+ * claude-providers.ts), so it can never itself contain the separator.
+ *
+ * @param provider - the store provider id.
+ * @param model - the real model id the provider serves.
+ */
+export function compositeModelId(provider, model) {
+    return `${provider}/${model}`;
+}
+/**
+ * Split a composite model id back into its halves, on the FIRST `/` only.
+ *
+ * The split is anchored at the first slash because the MODEL half may carry
+ * slashes of its own while the provider half never does; any later split point
+ * would shred the model half and would not round-trip through
+ * {@link compositeModelId}.
+ *
+ * @param id - a composite model id (`provider/model`), e.g. a selection the
+ * catalog minted.
+ * @returns the halves, or `undefined` when there is no `/` at all or either
+ * half is empty — the same completeness rule `routeOf` enforces.
+ */
+export function parseCompositeModelId(id) {
+    const slash = id.indexOf("/");
+    if (slash === -1)
+        return undefined;
+    const provider = id.slice(0, slash);
+    const model = id.slice(slash + 1);
+    if (provider === "" || model === "")
+        return undefined;
+    return { provider, model };
+}
+/**
+ * The route a brand-new session's log is SEEDED with.
+ *
+ * The single argument is deliberate. The factory's reconciled options are the
+ * only acceptable source, because they are already ONE pair: a first attempt
+ * at this (the codex line) built the seed from the native provider id and the
+ * deployment default model independently, which produced
+ * `zhipu-cn/deepseek-flash` — a route no provider serves, and which had to be
+ * caught by reading a live session's projection rather than by any unit test.
+ * Taking one object makes that mistake unrepresentable.
+ *
+ * @param options - the factory's reconciled agent options.
+ * @returns the seed. The declared input already names both halves, so the
+ * `routeOf` screen inside always answers a route for it; a pair that somehow
+ * arrives half-empty surfaces as `undefined` to the caller's own guard rather
+ * than as a broken seed.
+ */
+export function routeSeed(options) {
+    return routeOf(options);
+}