super-dsh 0.1.9 → 0.1.10-e

package/agent-codex/dist/codex-providers.js

@@ -0,0 +1,376 @@
+/**
+ * codex-providers.ts — the adapter-owned multi-provider store behind the Hub's
+ * Codex settings panel (2026-10-03 user ruling; reworked 2026-10-04).
+ *
+ * Codex is a single-provider harness: its own `config.toml` can name exactly
+ * ONE `model_provider`, so the LIST of configured providers has nowhere to live
+ * in Codex's home, and this module is where it lives instead:
+ * `<worldHome>/codex-providers.json` under the world's DSH home
+ * (`<dshHome>/agents/codex/`), the location dev-rules §5/§13 already assigns to
+ * the adapter's own DSH state.
+ *
+ * This file is the CANONICAL provider list. The native `config.toml` is a
+ * SOURCE, not a peer: `syncNativeProviders` folds whatever it declares into
+ * this list, deduplicated by endpoint URL (the only identity a hand-written
+ * codex config reliably carries), and never deletes anything. There is no
+ * "selected" provider any more — which provider a session runs on is DSH's own
+ * per-session `model/selection`, and the native home is written by nobody.
+ *
+ * The file carries API keys, so it is written 0600 with the sibling
+ * `.credentials.yaml` posture, and reads are fail-soft: a corrupt or partial
+ * store must degrade to "no providers yet", never take the world down. A
+ * provider entry that does not survive validation is DROPPED rather than
+ * poisoning the whole list.
+ *
+ * @module agent-codex/codex-providers
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+/**
+ * A provider id becomes a TOML table name and is interpolated into the native
+ * config, so the alphabet is deliberately narrow: lowercase alphanumerics and
+ * interior hyphens. (Covers `zai-plan`, `deepseek`, `openai`; rejects spaces,
+ * dots, quotes and anything that would need TOML escaping.)
+ */
+const PROVIDER_ID = /^[a-z0-9][a-z0-9-]*$/;
+/** Longest generated id: the slug part plus its 7-character discriminator. */
+const MAX_ID_LENGTH = 48;
+/** Whether `value` may be used as a provider id. */
+export function isProviderId(value) {
+    return typeof value === "string" && PROVIDER_ID.test(value);
+}
+/** Whether `value` names a wire protocol this adapter understands. */
+export function isWireProtocol(value) {
+    return value === "responses" || value === "chat";
+}
+/** Where the store lives: `<worldHome>/codex-providers.json`. */
+export function providerStorePath(worldHome) {
+    return join(worldHome, "codex-providers.json");
+}
+/** The empty store — also the fail-soft answer for every unreadable input. */
+function emptyStore() {
+    return { version: 1, providers: [] };
+}
+function str(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function auth(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    if (record["kind"] === "apiKey") {
+        // An EMPTY value is a real state, not a malformed entry: it means "this
+        // provider is keyed by auth.json and Super D does not hold a copy", which is
+        // how a provider seeded from the user's own config arrives. Refusing it would
+        // make the user's currently-working provider unrepresentable.
+        const secret = record["value"];
+        return typeof secret === "string" ? { kind: "apiKey", value: secret } : undefined;
+    }
+    if (record["kind"] === "env") {
+        const name = str(record["name"]);
+        return name === undefined ? undefined : { kind: "env", name };
+    }
+    return undefined;
+}
+function model(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const id = str(record["id"]);
+    if (id === undefined)
+        return undefined;
+    const displayName = str(record["displayName"]);
+    const contextWindow = record["contextWindow"];
+    return {
+        id,
+        ...(displayName === undefined ? {} : { displayName }),
+        ...(typeof contextWindow === "number" && Number.isSafeInteger(contextWindow) && contextWindow > 0
+            ? { contextWindow }
+            : {}),
+    };
+}
+/**
+ * Validate one raw entry. Returns `undefined` for anything unusable — an
+ * unknown protocol, an id that cannot be a TOML table, a missing endpoint — so
+ * the caller can drop it and keep the rest. An empty `models` list is VALID
+ * (see {@link CodexProviderEntry.models}).
+ */
+export function providerEntry(value) {
+    if (value === null || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const id = record["id"];
+    const label = str(record["label"]);
+    const baseUrl = str(record["baseUrl"]);
+    const protocol = record["protocol"];
+    const credentials = auth(record["auth"]);
+    if (!isProviderId(id) || label === undefined || baseUrl === undefined || !isWireProtocol(protocol) || credentials === undefined) {
+        return undefined;
+    }
+    const rawModels = record["models"];
+    const models = (Array.isArray(rawModels) ? rawModels : [])
+        .map(model)
+        .filter((entry) => entry !== undefined);
+    const origin = record["origin"] === "native" ? "native" : "user";
+    return { id, label, baseUrl, protocol, auth: credentials, models, origin };
+}
+/**
+ * Read the store. Fail-soft by construction: a missing file, unparsable JSON,
+ * a wrong top-level shape, or individual bad entries all degrade toward an
+ * empty (or shorter) list rather than throwing.
+ *
+ * A `selected` member written by an earlier build is ignored on purpose — the
+ * global selection was retired in favour of DSH's per-session `model/selection`.
+ */
+export function readProviderStore(worldHome) {
+    const path = providerStorePath(worldHome);
+    if (!existsSync(path))
+        return emptyStore();
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return emptyStore();
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return emptyStore();
+    const record = parsed;
+    if (!Array.isArray(record["providers"]))
+        return emptyStore();
+    const providers = record["providers"]
+        .map(providerEntry)
+        .filter((entry) => entry !== undefined);
+    const rawRemoved = record["removed"];
+    const removed = (Array.isArray(rawRemoved) ? rawRemoved : [])
+        .filter((value) => typeof value === "string" && value.trim() !== "");
+    return { version: 1, providers, ...(removed.length === 0 ? {} : { removed }) };
+}
+/**
+ * Persist the store atomically (tmp + rename) and 0600 — the file holds API
+ * keys in the clear, exactly like the sibling `.credentials.yaml`, so it must
+ * never be group- or world-readable even for the instant before a rewrite.
+ */
+export function writeProviderStore(worldHome, store) {
+    const path = providerStorePath(worldHome);
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.tmp-${process.pid}`;
+    writeFileSync(temp, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    renameSync(temp, path);
+}
+/**
+ * Insert or replace one provider by id, preserving list order.
+ *
+ * An explicit add also clears the endpoint's removal tombstone: re-adding a
+ * provider is the user overruling their own earlier removal, and leaving the
+ * tombstone would make the next sync skip it again.
+ */
+export function upsertProvider(store, entry) {
+    const at = store.providers.findIndex((existing) => existing.id === entry.id);
+    const providers = at === -1
+        ? [...store.providers, entry]
+        : store.providers.map((existing, index) => (index === at ? entry : existing));
+    const key = endpointKey(entry.baseUrl);
+    const removed = (store.removed ?? []).filter((candidate) => candidate !== key);
+    // `removed` must be CLEARED, not merely omitted: spreading the old store would
+    // carry the tombstone forward, and the next sync would keep skipping the
+    // endpoint the user just re-added.
+    const { removed: _stale, ...rest } = store;
+    return { ...rest, providers, ...(removed.length === 0 ? {} : { removed }) };
+}
+/**
+ * Drop one provider, and TOMBSTONE its endpoint so the reconcile cannot bring
+ * it back: the user's own `config.toml` still declares it, and a list editor
+ * whose delete button undoes itself every ten minutes is worse than no button.
+ *
+ * Removing from this list is still not "unconfiguring Codex": nothing native is
+ * touched, and the user's own CLI keeps running whatever their file says.
+ */
+export function removeProvider(store, id) {
+    const entry = store.providers.find((candidate) => candidate.id === id);
+    const providers = store.providers.filter((candidate) => candidate.id !== id);
+    if (entry === undefined)
+        return { ...store, providers };
+    const key = endpointKey(entry.baseUrl);
+    const removed = store.removed?.includes(key) === true ? store.removed : [...store.removed ?? [], key];
+    return { ...store, providers, removed };
+}
+/**
+ * The comparison key for "the same endpoint". Codex itself treats two provider
+ * tables with the same `base_url` as the same service, and a hand-written
+ * config carries no other identity worth trusting — so the endpoint IS the
+ * dedupe key. Case, a trailing slash, and the default port are noise.
+ *
+ * @param baseUrl - a provider's `base_url` (any shape; unparsable input is compared verbatim).
+ * @returns a stable key.
+ */
+export function endpointKey(baseUrl) {
+    const trimmed = baseUrl.trim();
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return trimmed.toLowerCase();
+    }
+    const path = parsed.pathname.replace(/\/+$/, "");
+    const port = parsed.port === "" || (parsed.protocol === "https:" && parsed.port === "443")
+        || (parsed.protocol === "http:" && parsed.port === "80")
+        ? ""
+        : `:${parsed.port}`;
+    return `${parsed.protocol}//${parsed.hostname.toLowerCase()}${port}${path}`;
+}
+/** Reduce arbitrary text to the provider-id alphabet, collapsing runs of junk. */
+function slugify(value) {
+    const slug = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    return slug === "" ? "provider" : slug.slice(0, MAX_ID_LENGTH - 8);
+}
+/** A short, stable discriminator so two endpoints sharing a host stay distinct. */
+function discriminator(value) {
+    let hash = 0x811c9dc5;
+    for (let index = 0; index < value.length; index += 1) {
+        hash ^= value.charCodeAt(index);
+        hash = Math.imul(hash, 0x01000193) >>> 0;
+    }
+    return hash.toString(36).padStart(6, "0").slice(-6);
+}
+/**
+ * The provider id for an endpoint that arrives without a usable one. Codex's
+ * own `config.toml` tables are already valid ids and are preferred by the
+ * caller; this is the fallback for a UI-added provider and for a native table
+ * name that cannot be a TOML key.
+ *
+ * @param baseUrl - the provider's endpoint.
+ * @returns a slug that satisfies {@link isProviderId}.
+ */
+export function providerIdFromEndpoint(baseUrl) {
+    const key = endpointKey(baseUrl);
+    let host = "provider";
+    let path = "";
+    try {
+        const parsed = new URL(key);
+        host = parsed.hostname;
+        path = parsed.pathname;
+    }
+    catch {
+        // keep the defaults
+    }
+    return `${slugify(`${host}${path}`)}-${discriminator(key)}`;
+}
+/**
+ * Make `wanted` usable and unique within `taken`.
+ *
+ * @param wanted - the preferred id (a native table name, or a generated slug).
+ * @param taken - ids already claimed by other entries.
+ * @returns a valid id not present in `taken`.
+ */
+export function uniqueProviderId(wanted, taken) {
+    const used = new Set(taken);
+    const base = isProviderId(wanted) ? wanted : slugify(wanted);
+    if (!used.has(base))
+        return base;
+    const salted = `${base.slice(0, MAX_ID_LENGTH - 7)}-${discriminator(wanted)}`;
+    if (!used.has(salted))
+        return salted;
+    for (let index = 2;; index += 1) {
+        const candidate = `${base.slice(0, MAX_ID_LENGTH - 4)}-${index}`;
+        if (!used.has(candidate))
+            return candidate;
+    }
+}
+/** Append the models of `incoming` that `existing` does not already carry. */
+function unionModels(existing, incoming) {
+    const known = new Set(existing.map((entry) => entry.id));
+    const additions = incoming
+        .filter((id) => id !== "" && !known.has(id))
+        .map((id) => ({ id }));
+    return additions.length === 0 ? existing : [...existing, ...additions];
+}
+/**
+ * Structural auth equality.
+ *
+ * Reference equality is wrong here: a native sync re-parses the config on every
+ * tick, so the incoming auth object is a FRESH one each time and `!==` would
+ * report a change forever. That is not a cosmetic difference — it makes the
+ * "only write when something moved" contract fail, so every scheduled reconcile
+ * would rewrite a 0600 secrets file (observed: `updated=["deepseek","zhipu-cn"]`
+ * on an unchanged config).
+ */
+function sameAuth(left, right) {
+    if (left.kind === "env")
+        return right.kind === "env" && left.name === right.name;
+    return right.kind === "apiKey" && left.value === right.value;
+}
+/**
+ * Fold the providers a native `config.toml` declares into the canonical store.
+ *
+ * Identity is the endpoint (see {@link endpointKey}); a native provider whose id
+ * or endpoint already matches an entry refreshes that entry's endpoint,
+ * protocol, model list and — only when the entry holds no secret of its own —
+ * its auth shape. Anything unmatched is appended, labelled with its endpoint
+ * URL, because that is the only name a hand-written codex config gives it.
+ * Nothing is ever deleted here: a provider dropped from `config.toml` may still
+ * be one the user uses through Super D. The one exception runs the other way —
+ * an endpoint the user REMOVED in the panel is skipped, so their removal is not
+ * undone by the next reconcile.
+ *
+ * @param store - the canonical list.
+ * @param imported - providers parsed from the native config, in file order.
+ * @returns the new store plus which ids were added and which were refreshed.
+ */
+export function syncNativeProviders(store, imported) {
+    const providers = [...store.providers];
+    const added = [];
+    const updated = [];
+    for (const incoming of imported) {
+        const baseUrl = incoming.baseUrl.trim();
+        if (baseUrl === "")
+            continue;
+        const key = endpointKey(baseUrl);
+        if (store.removed?.includes(key) === true)
+            continue;
+        const wantedId = incoming.nativeId !== undefined && isProviderId(incoming.nativeId) ? incoming.nativeId : undefined;
+        const at = providers.findIndex((entry) => (wantedId !== undefined && entry.id === wantedId) || endpointKey(entry.baseUrl) === key);
+        if (at === -1) {
+            const id = uniqueProviderId(wantedId ?? providerIdFromEndpoint(baseUrl), providers.map((entry) => entry.id));
+            providers.push({
+                id,
+                label: baseUrl,
+                baseUrl,
+                protocol: incoming.protocol,
+                auth: incoming.auth,
+                models: unionModels([], incoming.models),
+                origin: "native",
+            });
+            added.push(id);
+            continue;
+        }
+        const entry = providers[at];
+        const models = unionModels(entry.models, incoming.models);
+        // The native table is the user's own statement about how codex should
+        // authenticate, but a secret Super D already holds must not be dropped in
+        // favour of "look in auth.json" — an empty apiKey value is the only shape
+        // that defers to the runtime, so only that one follows the native file.
+        const adoptAuth = entry.auth.kind === "env" || entry.auth.value === "";
+        const next = {
+            ...entry,
+            baseUrl,
+            protocol: incoming.protocol,
+            ...(adoptAuth ? { auth: incoming.auth } : {}),
+            models,
+        };
+        const changed = next.baseUrl !== entry.baseUrl
+            || next.protocol !== entry.protocol
+            || next.models !== entry.models
+            || !sameAuth(next.auth, entry.auth);
+        if (changed) {
+            providers[at] = next;
+            updated.push(entry.id);
+        }
+    }
+    const removed = store.removed ?? [];
+    const next = removed.length === 0
+        ? { version: 1, providers }
+        : { version: 1, providers, removed };
+    return { store: next, added, updated };
+}

package/agent-codex/dist/codex-route.js

@@ -0,0 +1,86 @@
+/**
+ * codex-route.ts — which provider/model a Codex turn must run
+ * (2026-10-04 multi-provider rework).
+ *
+ * This is the whole of Super D's model-selection policy, and the point is that
+ * there is almost none: the precedence below is the harness's own
+ * (`sessionController.selectionFor(agent).current`), so a session's route is
+ * decided by DSH exactly as it would be for a native agent, and Super D only
+ * has to read it.
+ *
+ *   pending   the durable `modelSelection` projection's `pending` — a switch
+ *             made through `session/selectModel` that no `request/header` has
+ *             retired yet. This is what makes a mid-turn switch land on the NEXT
+ *             turn, for free: the harness records the intent and the next
+ *             request consumes it.
+ *   logged    the last `request/header` snapshot — what the session ACTUALLY ran
+ *             last. It is also what lets a resumed session name the provider
+ *             that produced its transcript.
+ *   default   `ctx.agentDefaultModel` — the deployment default for a session
+ *             that has never run.
+ *   fallback  the agent's own options, which the factory built from the user's
+ *             native `config.toml`.
+ *
+ * Extracted from `agent.ts` so the precedence can be pinned without standing up
+ * a Session, a Context and a client: it is the one piece of this feature whose
+ * mistakes are silent.
+ *
+ * @module agent-codex/codex-route
+ */
+/**
+ * Read a route out of one candidate value.
+ *
+ * Every candidate arrives as untyped projection/config data, so this validates
+ * structurally and answers `undefined` for anything incomplete. A half-filled
+ * route must never win the precedence: falling through to a complete one is
+ * always better than launching a child with an empty model.
+ *
+ * @param value - a candidate route (a `ModelSelection`-shaped object, or junk).
+ * @returns the route, or `undefined` when it does not name both halves.
+ */
+export function routeOf(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const record = value;
+    const provider = record["provider"];
+    const model = record["model"];
+    if (typeof provider !== "string" || provider === "" || typeof model !== "string" || model === "")
+        return undefined;
+    const reasoningEffort = record["reasoningEffort"];
+    return {
+        provider,
+        model,
+        ...(typeof reasoningEffort === "string" && reasoningEffort !== "" ? { reasoningEffort } : {}),
+    };
+}
+/**
+ * Resolve the route for the next request by the harness's own precedence.
+ *
+ * @param candidates - the candidates in descending priority: `pending`,
+ * `logged`, `preferred`, `fallback`. `preferred` is the harness default
+ * (`agentDefaultModel`); `fallback` is the factory's own options.
+ * @returns the first complete route, or `undefined` when none is usable.
+ */
+export function resolveRoute(candidates) {
+    return routeOf(candidates.pending)
+        ?? routeOf(candidates.logged)
+        ?? routeOf(candidates.preferred)
+        ?? routeOf(candidates.fallback);
+}
+/**
+ * The route a brand-new session's log is SEEDED with.
+ *
+ * The single argument is deliberate. The factory's reconciled `AgentOptions` is
+ * the only acceptable source, because it is already ONE pair: a first attempt at
+ * this built the seed from the native provider id and the deployment default
+ * model independently, which produced `zhipu-cn/deepseek-flash` — a route no
+ * provider serves, and which had to be caught by reading a live session's
+ * projection rather than by any unit test. Taking one object makes that mistake
+ * unrepresentable.
+ *
+ * @param options - the factory's reconciled agent options.
+ * @returns the seed, or `undefined` when the pair is incomplete.
+ */
+export function seedRoute(options) {
+    return routeOf(options);
+}