thinkpool-pair 0.7.180 → 0.7.181

package/byok-detect.mjs

@@ -1,16 +1,24 @@
 /* ─────────────────────────────────────────────────────────────
    byok-detect — "paste a key → pick a model" for the bridge menu.
-   ThinkPool Code is structured-only (Anthropic Messages API), so only
-   endpoints that speak that format work directly. OpenRouter is the
-   universal path: one key, any model, an Anthropic-compatible endpoint.
+   ThinkPool Code is structured-only (Anthropic Messages API). That format
+   has become the de-facto standard for agentic coding: Anthropic, Z.ai/GLM,
+   DeepSeek, Moonshot/Kimi and MiniMax all serve it natively (each base
+   below live-probed 2026-07-10: POST <base>/v1/messages → 401 auth error,
+   i.e. the path exists), and LM Studio / llama.cpp serve it on localhost.
+   The holdouts are OpenAI + Google — those need a translation gateway
+   (LiteLLM etc.). NOTE OpenRouter's native /v1/messages serves ANTHROPIC
+   MODELS ONLY (live-probed 2026-07-09, see src/lib/providers.js) — it is
+   not a GPT/Gemini path, despite what this file used to claim.
    A bare OpenAI/Gemini/Groq key is DETECTED so we can guide the user to
-   OpenRouter or a gateway instead of failing silently.
+   a gateway instead of failing silently.
    Spec: docs/specs/2026-06-28-byok-only-two-tier-pivot.md (addendum)
    ───────────────────────────────────────────────────────────── */
 
 // Providers whose endpoint speaks the Anthropic Messages API → usable directly
 // in structured mode. `base` is what we set as ANTHROPIC_BASE_URL; `models` is
 // the model-list endpoint; `auth` is how the model-list call authenticates.
+// A wrong/moved `models` URL degrades gracefully — fetchModels() returns []
+// and the menu falls back to a free-text model prompt.
 export const ANTHROPIC_COMPATIBLE = {
   anthropic: {
     name:   'Anthropic',
@@ -19,16 +27,45 @@ export const ANTHROPIC_COMPATIBLE = {
     auth:   'x-api-key',
   },
   openrouter: {
-    name:   'OpenRouter — any model',
+    name:   'OpenRouter (Anthropic models)',
     base:   'https://openrouter.ai/api',
     models: 'https://openrouter.ai/api/v1/models',
     auth:   'bearer',
   },
+  zai: {
+    name:   'Z.ai — GLM',
+    base:   'https://api.z.ai/api/anthropic',
+    models: 'https://api.z.ai/api/paas/v4/models',
+    auth:   'bearer',
+  },
+  deepseek: {
+    name:   'DeepSeek',
+    base:   'https://api.deepseek.com/anthropic',
+    models: 'https://api.deepseek.com/models',
+    auth:   'bearer',
+  },
+  moonshot: {
+    name:   'Moonshot — Kimi',
+    base:   'https://api.moonshot.ai/anthropic',
+    models: 'https://api.moonshot.ai/v1/models',
+    auth:   'bearer',
+  },
+  minimax: {
+    name:   'MiniMax',
+    base:   'https://api.minimax.io/anthropic',
+    models: 'https://api.minimax.io/v1/models',
+    auth:   'bearer',
+  },
 }
 
 // Key-prefix → provider. `compatible: true` means it works directly; false
-// means we detected it but it needs OpenRouter or a gateway (different wire
-// format). Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
+// means we detected it but it needs a gateway (different wire format).
+// Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
+// Undetectable-by-prefix but directly compatible: DeepSeek + Moonshot keys are
+// bare `sk-…` (indistinguishable from OpenAI — gatewayHint names the escape),
+// Z.ai keys are `<hex>.<secret>` with no stable prefix. Those route via the
+// dashboard's provider presets (src/lib/providers.js BRIDGE_PROVIDER_PRESETS)
+// or the manual-endpoint path instead.
 const PREFIXES = [
   ['sk-ant-', 'anthropic',  true,  'Anthropic'],
   ['sk-or-',  'openrouter', true,  'OpenRouter'],
@@ -77,6 +114,13 @@ export async function fetchModels({ modelsUrl, key, auth }) {
 }
 
 // The friendly message shown when a detected key isn't directly usable.
+// Honest scope (2026-07-10): OpenRouter's native /v1/messages is Anthropic-
+// models-only, so it is NOT the "any model" escape hatch for a GPT/Gemini key —
+// a translation gateway is. And a bare sk- key might not be OpenAI at all:
+// DeepSeek and Moonshot/Kimi keys share the prefix and DO work directly.
 export function gatewayHint(name) {
-  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API, so it can't use that key directly. Easiest fix: paste an OpenRouter key (sk-or-…) — one key, every model (GPT, Gemini, Llama, and more). Or point it at your own gateway (e.g. LiteLLM).`
+  const skAmbiguity = name === 'OpenAI'
+    ? ' (If that key is actually DeepSeek or Moonshot/Kimi — they also start with sk- — it works directly: pick that provider in the dashboard’s LLM providers panel instead.)'
+    : ''
+  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API — the format Claude, GLM, DeepSeek, Kimi, MiniMax and local models (LM Studio, llama.cpp) all speak natively — but that provider doesn't, so the key can't be used directly. Route it through your own gateway (e.g. LiteLLM) instead.${skAmbiguity}`
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.180",
+  "version": "0.7.181",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/providers.mjs

@@ -151,12 +151,30 @@ export function unseal(sealedB64) {
 }
 
 // ── CRUD ────────────────────────────────────────────────────────────────
+/* Local-LLM exception (2026-07-10): a provider on the SAME machine (LM Studio,
+   llama.cpp — both speak the Anthropic Messages API natively) is allowed over
+   plain http and without a key. Both relaxations are LOOPBACK-ONLY:
+     • https-only stays for every remote host — a key on plaintext http across a
+       real wire is the leak the rule exists to stop; on 127.0.0.1 there is no wire.
+     • key-required stays for every remote host — local servers simply don't take
+       one (resolveProviderEnv synthesizes a placeholder token so the SDK doesn't
+       fall back to the host's Claude login against a localhost URL). */
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '')
+  // 127/8 must be a LITERAL IPv4 — '127.evil.io' is a DNS name that can resolve
+  // anywhere, so a bare startsWith('127.') would be a spoofable hole.
+  return h === 'localhost' || h === '::1' || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)
+}
+
 function validate({ name, baseUrl, key }) {
   if (!name || typeof name !== 'string' || !name.trim()) return 'name is required'
-  if (!key || typeof key !== 'string' || !key.trim()) return 'key is required'
   let u
   try { u = new URL(String(baseUrl)) } catch { return 'baseUrl must be a valid https url' }
-  if (u.protocol !== 'https:') return 'baseUrl must be https'
+  const local = isLoopbackHost(u.hostname)
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) {
+    return 'baseUrl must be https (plain http is allowed only for localhost)'
+  }
+  if (!local && (!key || typeof key !== 'string' || !key.trim())) return 'key is required'
   return null
 }
 
@@ -174,7 +192,7 @@ export function addProvider(fields) {
     name: String(fields.name).trim(),
     baseUrl: String(fields.baseUrl).trim(),
     model: fields.model ? String(fields.model).trim() : undefined,
-    key: String(fields.key).trim(),
+    key: fields.key ? String(fields.key).trim() : '',   // '' = keyless local provider
     addedAt: Date.now(),
   })
   saveProviders(arr)
@@ -344,7 +362,10 @@ export function resolveProviderEnv(id) {
   if (!id || id === BUILTIN_ID) return null
   const p = loadProviders().find((x) => x.id === id)
   if (!p) return null
-  const env = { ANTHROPIC_BASE_URL: p.baseUrl, ANTHROPIC_AUTH_TOKEN: p.key }
+  // Keyless (loopback) provider: the SDK still needs a non-empty token, or it
+  // falls back to the host's Claude login against the localhost URL. Local
+  // servers (LM Studio / llama.cpp) accept any bearer value.
+  const env = { ANTHROPIC_BASE_URL: p.baseUrl, ANTHROPIC_AUTH_TOKEN: p.key || 'thinkpool-local' }
   if (p.model) env.ANTHROPIC_MODEL = p.model
   return env
 }