thinkpool-pair 0.7.179 → 0.7.181

package/README.md

@@ -120,10 +120,17 @@ ThinkPool Code runs **any model you choose** — not just Anthropic. The agent
 talks the Anthropic Messages API, so you point it at any endpoint that speaks
 that format:
 
-- **Anthropic-compatible endpoints directly** — Z.ai GLM, OpenRouter, your own proxy.
-- **Any other model via a gateway** — put a translator like **LiteLLM** or
-  OpenRouter in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
-  the gateway presents the Anthropic Messages API while calling whatever you pick.
+- **Anthropic-compatible endpoints directly** — Z.ai GLM, Moonshot Kimi, OpenRouter, your own proxy.
+- **Any other model via a translating gateway** — put **LiteLLM** (or a proxy of
+  your own) in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
+  it presents the Anthropic Messages API while calling whatever you pick.
+
+> OpenRouter is the exception worth knowing: its `/v1/messages` surface is a
+> pass-through for **Anthropic models only**. Per OpenRouter's own docs, "Claude
+> Code expects Anthropic request semantics, so non-Anthropic models aren't
+> supported through the native endpoint" — and this bridge spawns the `claude`
+> CLI. To reach a non-Anthropic model, use a translating gateway (LiteLLM),
+> not OpenRouter's Anthropic endpoint.
 
 ```bash
 npx thinkpool-pair provider custom --base <url> --token <key> [--model <name>]
@@ -134,7 +141,8 @@ Common base urls (the agent appends `/v1/messages`):
 | Provider / gateway | Base url                          | Models                       |
 |--------------------|-----------------------------------|------------------------------|
 | Z.ai GLM           | `https://api.z.ai/api/anthropic`  | GLM                          |
-| OpenRouter         | `https://openrouter.ai/api`       | many, incl. non-Anthropic    |
+| Moonshot Kimi      | `https://api.moonshot.ai/anthropic` | Kimi                       |
+| OpenRouter         | `https://openrouter.ai/api`       | Anthropic models only        |
 | LiteLLM (your own) | `http://localhost:4000`           | GPT, Gemini, Llama, local, … |
 
 > The endpoint must serve the Anthropic Messages API (`/v1/messages`). A raw

package/bridge.mjs

@@ -1566,7 +1566,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
@@ -1608,6 +1608,12 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
   entry.seq = makeSeqCounter(maxSeq(entry.log))
   entry.rolePrompt = rolePrompt || null   // FL-M6 — persisted so a bridge restart restores the flow role prompt
+  // lastUsage — the terminal's most recent usage/ctx meter. Persisted (sessionData) +
+  // restored so a bridge restart can re-emit it on replay: usage is chrome (kept out of
+  // the replayed transcript log), so without this a (re)joiner sees "—" for context until
+  // the terminal's next turn. correctContext nulls ctx for models whose true window we
+  // can't determine; those restore a null ctx and replay nothing (no misleading %).
+  entry.lastUsage = lastUsage || null
   // S5 (slice 1b) — a REVIEW lane's write-block scope: the worktree root(s) of the slice(s)
   // it reviews (its deps). Persisted so a bridge restart re-arms the structural gate. Empty/
   // absent on builder lanes → reviewGate stays null → builder toolset UNCHANGED.
@@ -1775,7 +1781,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -2227,6 +2233,10 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         const m = onBuiltin ? (evt.model || evt.ctx?.model) : null
         if (m && m !== entry.model) { entry.model = m; announce() }
         if (evt.kind === 'models' && Array.isArray(evt.models) && evt.models.length) { roomModels = evt.models; announce() } }
+      // Cache the last usage/ctx meter on the entry (persisted + replayed — see
+      // openStructured). Chrome events bypass pushLog/persist in emitTail below, so
+      // usage needs an explicit persist() here to survive a bridge restart.
+      if (evt.kind === 'usage') { entry.lastUsage = evt; persist() }
       // FL-B2 — fold this flow lane's completed-turn output tokens into its budget so the
       // autopilot cap can halt the next wave before overrun (output_tokens = the billed
       // reasoning+output spend the indicator already tracks; conservative enough for a guard).
@@ -2712,8 +2722,16 @@ channel
       // the terminal. chunkReplayEvents splits it so nothing in the recent window is lost;
       // classifyReplay applies the chunks in arrival order. Older history beyond the chunk
       // budget is covered by the client's DB transcript snapshot.
+      // Attach the terminal's last usage/ctx meter to the FIRST replay chunk. usage is
+      // chrome (filtered out of `events` by both bridge + client), so without this a
+      // (re)joiner's ctx meter is empty ("—") until the terminal's next turn. The client
+      // applies `payload.lastUsage` in its code-replay handler (which is `to`-targeted, so
+      // only the joiner gets it). Gated on `.ctx` — a suppressed meter (correctContext
+      // nulled it for an unknown non-Claude model) replays nothing, never a misleading %.
+      let firstChunk = true
       for (const events of chunkReplayEvents(tail)) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}) })
+        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
+        firstChunk = false
       }
     }
     // Re-send any still-pending permission/question cards. They ride a one-shot
@@ -3060,7 +3078,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, model: rec.model || undefined, provider: rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt,
+            openStructured({ id: rec.id, model: rec.model || undefined, provider: rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).

package/byok-detect.mjs

@@ -1,16 +1,24 @@
 /* ─────────────────────────────────────────────────────────────
    byok-detect — "paste a key → pick a model" for the bridge menu.
-   ThinkPool Code is structured-only (Anthropic Messages API), so only
-   endpoints that speak that format work directly. OpenRouter is the
-   universal path: one key, any model, an Anthropic-compatible endpoint.
+   ThinkPool Code is structured-only (Anthropic Messages API). That format
+   has become the de-facto standard for agentic coding: Anthropic, Z.ai/GLM,
+   DeepSeek, Moonshot/Kimi and MiniMax all serve it natively (each base
+   below live-probed 2026-07-10: POST <base>/v1/messages → 401 auth error,
+   i.e. the path exists), and LM Studio / llama.cpp serve it on localhost.
+   The holdouts are OpenAI + Google — those need a translation gateway
+   (LiteLLM etc.). NOTE OpenRouter's native /v1/messages serves ANTHROPIC
+   MODELS ONLY (live-probed 2026-07-09, see src/lib/providers.js) — it is
+   not a GPT/Gemini path, despite what this file used to claim.
    A bare OpenAI/Gemini/Groq key is DETECTED so we can guide the user to
-   OpenRouter or a gateway instead of failing silently.
+   a gateway instead of failing silently.
    Spec: docs/specs/2026-06-28-byok-only-two-tier-pivot.md (addendum)
    ───────────────────────────────────────────────────────────── */
 
 // Providers whose endpoint speaks the Anthropic Messages API → usable directly
 // in structured mode. `base` is what we set as ANTHROPIC_BASE_URL; `models` is
 // the model-list endpoint; `auth` is how the model-list call authenticates.
+// A wrong/moved `models` URL degrades gracefully — fetchModels() returns []
+// and the menu falls back to a free-text model prompt.
 export const ANTHROPIC_COMPATIBLE = {
   anthropic: {
     name:   'Anthropic',
@@ -19,16 +27,45 @@ export const ANTHROPIC_COMPATIBLE = {
     auth:   'x-api-key',
   },
   openrouter: {
-    name:   'OpenRouter — any model',
+    name:   'OpenRouter (Anthropic models)',
     base:   'https://openrouter.ai/api',
     models: 'https://openrouter.ai/api/v1/models',
     auth:   'bearer',
   },
+  zai: {
+    name:   'Z.ai — GLM',
+    base:   'https://api.z.ai/api/anthropic',
+    models: 'https://api.z.ai/api/paas/v4/models',
+    auth:   'bearer',
+  },
+  deepseek: {
+    name:   'DeepSeek',
+    base:   'https://api.deepseek.com/anthropic',
+    models: 'https://api.deepseek.com/models',
+    auth:   'bearer',
+  },
+  moonshot: {
+    name:   'Moonshot — Kimi',
+    base:   'https://api.moonshot.ai/anthropic',
+    models: 'https://api.moonshot.ai/v1/models',
+    auth:   'bearer',
+  },
+  minimax: {
+    name:   'MiniMax',
+    base:   'https://api.minimax.io/anthropic',
+    models: 'https://api.minimax.io/v1/models',
+    auth:   'bearer',
+  },
 }
 
 // Key-prefix → provider. `compatible: true` means it works directly; false
-// means we detected it but it needs OpenRouter or a gateway (different wire
-// format). Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
+// means we detected it but it needs a gateway (different wire format).
+// Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
+// Undetectable-by-prefix but directly compatible: DeepSeek + Moonshot keys are
+// bare `sk-…` (indistinguishable from OpenAI — gatewayHint names the escape),
+// Z.ai keys are `<hex>.<secret>` with no stable prefix. Those route via the
+// dashboard's provider presets (src/lib/providers.js BRIDGE_PROVIDER_PRESETS)
+// or the manual-endpoint path instead.
 const PREFIXES = [
   ['sk-ant-', 'anthropic',  true,  'Anthropic'],
   ['sk-or-',  'openrouter', true,  'OpenRouter'],
@@ -77,6 +114,13 @@ export async function fetchModels({ modelsUrl, key, auth }) {
 }
 
 // The friendly message shown when a detected key isn't directly usable.
+// Honest scope (2026-07-10): OpenRouter's native /v1/messages is Anthropic-
+// models-only, so it is NOT the "any model" escape hatch for a GPT/Gemini key —
+// a translation gateway is. And a bare sk- key might not be OpenAI at all:
+// DeepSeek and Moonshot/Kimi keys share the prefix and DO work directly.
 export function gatewayHint(name) {
-  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API, so it can't use that key directly. Easiest fix: paste an OpenRouter key (sk-or-…) — one key, every model (GPT, Gemini, Llama, and more). Or point it at your own gateway (e.g. LiteLLM).`
+  const skAmbiguity = name === 'OpenAI'
+    ? ' (If that key is actually DeepSeek or Moonshot/Kimi — they also start with sk- — it works directly: pick that provider in the dashboard’s LLM providers panel instead.)'
+    : ''
+  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API — the format Claude, GLM, DeepSeek, Kimi, MiniMax and local models (LM Studio, llama.cpp) all speak natively — but that provider doesn't, so the key can't be used directly. Route it through your own gateway (e.g. LiteLLM) instead.${skAmbiguity}`
 }

package/context-windows.mjs

@@ -86,7 +86,13 @@ export function correctContext(raw, env = process.env) {
   const correctedMax = override ?? mapped
 
   if (correctedMax == null) {
-    // No correction available — but never ship a >100% pct.
+    // No correction available. For a NON-Claude model the SDK's max is computed for the
+    // wrong model id (it believes it's talking to Claude over ANTHROPIC_BASE_URL) → a %
+    // off that wrong max misleads (the GLM-ran-past-100 bug, 2026-07-04). Rather than ship
+    // a wrong number, SUPPRESS the meter: return null so the mode row + Session info show
+    // nothing / "—" instead. We only display ctx when we know the true window — a Claude
+    // id (SDK max trusted), a known-map model (corrected above), or TP_CONTEXT_MAX (override).
+    if (!isClaudeModel(raw.model)) return null
     const pct = Number(raw.pct)
     if (Number.isFinite(pct) && pct > 100) return { ...raw, pct: 100, over: true }
     return raw

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.179",
+  "version": "0.7.181",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/providers.mjs

@@ -151,12 +151,30 @@ export function unseal(sealedB64) {
 }
 
 // ── CRUD ────────────────────────────────────────────────────────────────
+/* Local-LLM exception (2026-07-10): a provider on the SAME machine (LM Studio,
+   llama.cpp — both speak the Anthropic Messages API natively) is allowed over
+   plain http and without a key. Both relaxations are LOOPBACK-ONLY:
+     • https-only stays for every remote host — a key on plaintext http across a
+       real wire is the leak the rule exists to stop; on 127.0.0.1 there is no wire.
+     • key-required stays for every remote host — local servers simply don't take
+       one (resolveProviderEnv synthesizes a placeholder token so the SDK doesn't
+       fall back to the host's Claude login against a localhost URL). */
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  // 127/8 must be a LITERAL IPv4 — '127.evil.io' is a DNS name that can resolve
+  // anywhere, so a bare startsWith('127.') would be a spoofable hole.
+  return h === 'localhost' || h === '::1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)
+}
+
 function validate({ name, baseUrl, key }) {
   if (!name || typeof name !== 'string' || !name.trim()) return 'name is required'
-  if (!key || typeof key !== 'string' || !key.trim()) return 'key is required'
   let u
   try { u = new URL(String(baseUrl)) } catch { return 'baseUrl must be a valid https url' }
-  if (u.protocol !== 'https:') return 'baseUrl must be https'
+  const local = isLoopbackHost(u.hostname)
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) {
+    return 'baseUrl must be https (plain http is allowed only for localhost)'
+  }
+  if (!local && (!key || typeof key !== 'string' || !key.trim())) return 'key is required'
   return null
 }
 
@@ -174,7 +192,7 @@ export function addProvider(fields) {
     name: String(fields.name).trim(),
     baseUrl: String(fields.baseUrl).trim(),
     model: fields.model ? String(fields.model).trim() : undefined,
-    key: String(fields.key).trim(),
+    key: fields.key ? String(fields.key).trim() : '',   // '' = keyless local provider
     addedAt: Date.now(),
   })
   saveProviders(arr)
@@ -344,7 +362,10 @@ export function resolveProviderEnv(id) {
   if (!id || id === BUILTIN_ID) return null
   const p = loadProviders().find((x) => x.id === id)
   if (!p) return null
-  const env = { ANTHROPIC_BASE_URL: p.baseUrl, ANTHROPIC_AUTH_TOKEN: p.key }
+  // Keyless (loopback) provider: the SDK still needs a non-empty token, or it
+  // falls back to the host's Claude login against the localhost URL. Local
+  // servers (LM Studio / llama.cpp) accept any bearer value.
+  const env = { ANTHROPIC_BASE_URL: p.baseUrl, ANTHROPIC_AUTH_TOKEN: p.key || 'thinkpool-local' }
   if (p.model) env.ANTHROPIC_MODEL = p.model
   return env
 }