thinkpool-pair 0.7.364 → 0.7.366

package/byok-detect.mjs

@@ -1,126 +1 @@
-/* ─────────────────────────────────────────────────────────────
-   byok-detect — "paste a key → pick a model" for the bridge menu.
-   ThinkPool Code is structured-only (Anthropic Messages API). That format
-   has become the de-facto standard for agentic coding: Anthropic, Z.ai/GLM,
-   DeepSeek, Moonshot/Kimi and MiniMax all serve it natively (each base
-   below live-probed 2026-07-10: POST <base>/v1/messages → 401 auth error,
-   i.e. the path exists), and LM Studio / llama.cpp serve it on localhost.
-   The holdouts are OpenAI + Google — those need a translation gateway
-   (LiteLLM etc.). NOTE OpenRouter's native /v1/messages serves ANTHROPIC
-   MODELS ONLY (live-probed 2026-07-09, see src/lib/providers.js) — it is
-   not a GPT/Gemini path, despite what this file used to claim.
-   A bare OpenAI/Gemini/Groq key is DETECTED so we can guide the user to
-   a gateway instead of failing silently.
-   Spec: docs/specs/2026-06-28-byok-only-two-tier-pivot.md (addendum)
-   ───────────────────────────────────────────────────────────── */
-
-// Providers whose endpoint speaks the Anthropic Messages API → usable directly
-// in structured mode. `base` is what we set as ANTHROPIC_BASE_URL; `models` is
-// the model-list endpoint; `auth` is how the model-list call authenticates.
-// A wrong/moved `models` URL degrades gracefully — fetchModels() returns []
-// and the menu falls back to a free-text model prompt.
-export const ANTHROPIC_COMPATIBLE = {
-  anthropic: {
-    name:   'Anthropic',
-    base:   'https://api.anthropic.com',
-    models: 'https://api.anthropic.com/v1/models',
-    auth:   'x-api-key',
-  },
-  openrouter: {
-    name:   'OpenRouter (Anthropic models)',
-    base:   'https://openrouter.ai/api',
-    models: 'https://openrouter.ai/api/v1/models',
-    auth:   'bearer',
-  },
-  zai: {
-    name:   'Z.ai — GLM',
-    base:   'https://api.z.ai/api/anthropic',
-    models: 'https://api.z.ai/api/paas/v4/models',
-    auth:   'bearer',
-  },
-  deepseek: {
-    name:   'DeepSeek',
-    base:   'https://api.deepseek.com/anthropic',
-    models: 'https://api.deepseek.com/models',
-    auth:   'bearer',
-  },
-  moonshot: {
-    name:   'Moonshot — Kimi',
-    base:   'https://api.moonshot.ai/anthropic',
-    models: 'https://api.moonshot.ai/v1/models',
-    auth:   'bearer',
-  },
-  minimax: {
-    name:   'MiniMax',
-    base:   'https://api.minimax.io/anthropic',
-    models: 'https://api.minimax.io/v1/models',
-    auth:   'bearer',
-  },
-}
-
-// Key-prefix → provider. `compatible: true` means it works directly; false
-// means we detected it but it needs a gateway (different wire format).
-// Keep the most specific prefixes first (sk-ant- / sk-or- before sk-).
-// Undetectable-by-prefix but directly compatible: DeepSeek + Moonshot keys are
-// bare `sk-…` (indistinguishable from OpenAI — gatewayHint names the escape),
-// Z.ai keys are `<hex>.<secret>` with no stable prefix. Those route via the
-// dashboard's provider presets (src/lib/providers.js BRIDGE_PROVIDER_PRESETS)
-// or the manual-endpoint path instead.
-const PREFIXES = [
-  ['sk-ant-', 'anthropic',  true,  'Anthropic'],
-  ['sk-or-',  'openrouter', true,  'OpenRouter'],
-  ['AIza',    'google',     false, 'Google Gemini'],
-  ['gsk_',    'groq',       false, 'Groq'],
-  ['pplx-',   'perplexity', false, 'Perplexity'],
-  ['xai-',    'xai',        false, 'xAI (Grok)'],
-  ['fw_',     'fireworks',  false, 'Fireworks'],
-  ['sk-',     'openai',     false, 'OpenAI'],   // generic sk- LAST (after sk-ant-/sk-or-)
-]
-
-// Detect the provider from a pasted key. Returns { id, name, compatible }.
-export function detectProvider(key) {
-  const k = String(key || '').trim()
-  if (!k) return { id: 'unknown', name: 'unknown', compatible: false }
-  for (const [prefix, id, compatible, name] of PREFIXES) {
-    if (k.startsWith(prefix)) return { id, name, compatible }
-  }
-  return { id: 'unknown', name: 'unknown', compatible: false }
-}
-
-// Fetch the model-id list for an Anthropic-compatible provider. Handles both
-// OpenAI-shape ({ data: [{ id }] }) and Google-shape ({ models: [{ name }] }).
-// Returns [] on any failure (caller falls back to a free-text model prompt).
-export async function fetchModels({ modelsUrl, key, auth }) {
-  const headers = auth === 'x-api-key'
-    ? { 'x-api-key': key, 'anthropic-version': '2023-06-01' }
-    : { Authorization: `Bearer ${key}` }
-  const ctrl = new AbortController()
-  const timer = setTimeout(() => ctrl.abort(), 12_000)
-  try {
-    const r = await fetch(modelsUrl, { headers, signal: ctrl.signal, redirect: 'error' })
-    if (!r.ok) return []
-    const data = await r.json()
-    const raw = Array.isArray(data?.data) ? data.data
-              : Array.isArray(data?.models) ? data.models
-              : []
-    return raw
-      .map((m) => String(m.id || m.name || '').replace(/^models\//, ''))
-      .filter(Boolean)
-  } catch {
-    return []
-  } finally {
-    clearTimeout(timer)
-  }
-}
-
-// The friendly message shown when a detected key isn't directly usable.
-// Honest scope (2026-07-10): OpenRouter's native /v1/messages is Anthropic-
-// models-only, so it is NOT the "any model" escape hatch for a GPT/Gemini key —
-// a translation gateway is. And a bare sk- key might not be OpenAI at all:
-// DeepSeek and Moonshot/Kimi keys share the prefix and DO work directly.
-export function gatewayHint(name) {
-  const skAmbiguity = name === 'OpenAI'
-    ? ' (If that key is actually DeepSeek or Moonshot/Kimi — they also start with sk- — it works directly: pick that provider in the dashboard’s LLM providers panel instead.)'
-    : ''
-  return `That key looks like ${name}. ThinkPool Code runs on the Anthropic Messages API — the format Claude, GLM, DeepSeek, Kimi, MiniMax and local models (LM Studio, llama.cpp) all speak natively — but that provider doesn't, so the key can't be used directly. Route it through your own gateway (e.g. LiteLLM) instead.${skAmbiguity}`
-}
+export const ANTHROPIC_COMPATIBLE={anthropic:{name:"Anthropic",base:"https://api.anthropic.com",models:"https://api.anthropic.com/v1/models",auth:"x-api-key"},openrouter:{name:"OpenRouter (Anthropic models)",base:"https://openrouter.ai/api",models:"https://openrouter.ai/api/v1/models",auth:"bearer"},zai:{name:"Z.ai — GLM",base:"https://api.z.ai/api/anthropic",models:"https://api.z.ai/api/paas/v4/models",auth:"bearer"},deepseek:{name:"DeepSeek",base:"https://api.deepseek.com/anthropic",models:"https://api.deepseek.com/models",auth:"bearer"},moonshot:{name:"Moonshot — Kimi",base:"https://api.moonshot.ai/anthropic",models:"https://api.moonshot.ai/v1/models",auth:"bearer"},minimax:{name:"MiniMax",base:"https://api.minimax.io/anthropic",models:"https://api.minimax.io/v1/models",auth:"bearer"}};const e=[["sk-ant-","anthropic",!0,"Anthropic"],["sk-or-","openrouter",!0,"OpenRouter"],["AIza","google",!1,"Google Gemini"],["gsk_","groq",!1,"Groq"],["pplx-","perplexity",!1,"Perplexity"],["xai-","xai",!1,"xAI (Grok)"],["fw_","fireworks",!1,"Fireworks"],["sk-","openai",!1,"OpenAI"]];export function detectProvider(t){const o=String(t||"").trim();if(!o)return{id:"unknown",name:"unknown",compatible:!1};for(const[t,a,i,r]of e)if(o.startsWith(t))return{id:a,name:r,compatible:i};return{id:"unknown",name:"unknown",compatible:!1}}export async function fetchModels({modelsUrl:e,key:t,auth:o}){const a="x-api-key"===o?{"x-api-key":t,"anthropic-version":"2023-06-01"}:{Authorization:`Bearer ${t}`},i=new AbortController,r=setTimeout(()=>i.abort(),12e3);try{const t=await fetch(e,{headers:a,signal:i.signal,redirect:"error"});if(!t.ok)return[];const o=await t.json();return(Array.isArray(o?.data)?o.data:Array.isArray(o?.models)?o.models:[]).map(e=>String(e.id||e.name||"").replace(/^models\//,"")).filter(Boolean)}catch{return[]}finally{clearTimeout(r)}}export function gatewayHint(e){return`That key looks like ${e}. ThinkPool Code runs on the Anthropic Messages API — the format Claude, GLM, DeepSeek, Kimi, MiniMax and local models (LM Studio, llama.cpp) all speak natively — but that provider doesn't, so the key can't be used directly. Route it through your own gateway (e.g. LiteLLM) instead.${"OpenAI"===e?" (If that key is actually DeepSeek or Moonshot/Kimi — they also start with sk- — it works directly: pick that provider in the dashboard’s LLM providers panel instead.)":""}`}

package/claude-command-catalog.mjs

@@ -1,91 +1 @@
-// Claude Code's SDK init payload is an *advertisement*, not a headless command
-// contract.  In particular, 2.1.206 advertises TUI/profile commands (`/agents`,
-// `/config`, `/doctor`, …) which are not safe or meaningful in a shared room.
-// Keep the room catalog deliberately small and evidence-based:
-//
-//   1. bridge-owned controls work through the existing room controls;
-//   2. `/compact` is the one native lifecycle command proven on the streaming
-//      Agent SDK path; and
-//   3. a discovered slash name is exposed only when the same init event calls it
-//      an installed Skill.  Skills are structured prompt invocations, unlike
-//      Claude Code's interactive/profile command palette.
-//
-// This is also an explicit command matrix for the 2.1.206 probe.  Everything
-// outside the allow path is intentionally omitted; `CLAUDE_COMMAND_EXCLUSIONS`
-// records the high-risk/interactive families so a later SDK change cannot turn
-// discovery into accidental exposure.
-
-const cleanName = (value) => {
-  const name = String(typeof value === 'object' ? value?.name : value || '')
-    .trim()
-    .replace(/^\/+/, '')
-  return /^[A-Za-z0-9][A-Za-z0-9:_-]*$/.test(name) ? name : ''
-}
-
-const stringMeta = (value) => {
-  if (!value || typeof value !== 'object') return {}
-  const description = String(value.description || '').trim()
-  const inputHint = String(value.inputHint || value.input_hint || value.input?.hint || '').trim()
-  return {
-    ...(description ? { description } : {}),
-    ...(inputHint ? { inputHint } : {}),
-  }
-}
-
-export const CLAUDE_COMMAND_MATRIX = Object.freeze({
-  '/clear': Object.freeze({ description: 'clear context · confirms', owner: 'bridge-control' }),
-  '/compact': Object.freeze({ description: 'compact context', owner: 'sdk-lifecycle' }),
-  '/model': Object.freeze({ description: 'pick model — opens selector', owner: 'bridge-control' }),
-  '/usage': Object.freeze({ description: 'session usage and provider limits', owner: 'bridge-control' }),
-  '<installed-skill>': Object.freeze({ description: 'run an installed Claude skill', owner: 'sdk-skill' }),
-})
-
-// Exclusions are grouped by why the room cannot safely implement them.  This
-// is intentionally a deny-list *and* a default-deny catalog: unknown future
-// slash names stay hidden until they have an explicit structured contract.
-export const CLAUDE_COMMAND_EXCLUSIONS = Object.freeze({
-  profileOrIdentity: Object.freeze(['agents', 'color', 'config', 'rename', 'team-onboarding']),
-  credentialsOrUpdates: Object.freeze(['claude-api', 'mcp', 'update-config']),
-  diagnosticsOrUpload: Object.freeze(['debug', 'doctor', 'heapdump', 'insights']),
-  hiddenAgentOrAutomation: Object.freeze(['__remote-workflow', 'batch', 'code-review', 'loop', 'review', 'schedule', 'security-review']),
-  unsafeInteractive: Object.freeze(['design', 'design-consent', 'design-revoke', 'fast', 'fewer-permission-prompts', 'goal', 'init', 'recap', 'reload-skills', 'run']),
-})
-
-const EXCLUDED = new Set(Object.values(CLAUDE_COMMAND_EXCLUSIONS).flat())
-const BRIDGE_CONTROLS = new Set(['clear', 'compact', 'model', 'usage'])
-
-// Convert Claude's string-only 2.1.206 payload (and a future object-shaped
-// payload) into the metadata contract shared by all structured runtimes.  An
-// argument-bearing future skill retains its description and input hint; no
-// argument command is silently advertised as a one-tap action.
-export function normalizeClaudeCommandCatalog({ slashCommands, skills } = {}) {
-  const advertised = Array.isArray(slashCommands) ? slashCommands : []
-  const installedSkills = new Set((Array.isArray(skills) ? skills : []).map(cleanName).filter(Boolean))
-  const byName = new Map()
-
-  for (const command of advertised) {
-    const name = cleanName(command)
-    if (!name || EXCLUDED.has(name)) continue
-    const allowed = BRIDGE_CONTROLS.has(name) || installedSkills.has(name)
-    if (!allowed || byName.has(name)) continue
-    const canonical = CLAUDE_COMMAND_MATRIX[`/${name}`]
-    const supplied = stringMeta(command)
-    byName.set(name, {
-      name: `/${name}`,
-      description: supplied.description || canonical?.description || `Run installed Claude skill: /${name}`,
-      ...(supplied.inputHint ? { inputHint: supplied.inputHint } : {}),
-    })
-  }
-
-  // Room controls remain available on older SDK init shapes that omit the raw
-  // slash list.  They are ordered first because they have bridge support.
-  const controls = ['clear', 'compact', 'model', 'usage'].map((name) => byName.get(name) || ({
-    name: `/${name}`,
-    description: CLAUDE_COMMAND_MATRIX[`/${name}`].description,
-  }))
-  const skillsOnly = [...byName.entries()]
-    .filter(([name]) => !BRIDGE_CONTROLS.has(name))
-    .sort(([a], [b]) => a.localeCompare(b))
-    .map(([, command]) => command)
-  return [...controls, ...skillsOnly]
-}
+const e=e=>{const t=String("object"==typeof e?e?.name:e||"").trim().replace(/^\/+/,"");return/^[A-Za-z0-9][A-Za-z0-9:_-]*$/.test(t)?t:""},t=e=>{if(!e||"object"!=typeof e)return{};const t=String(e.description||"").trim(),n=String(e.inputHint||e.input_hint||e.input?.hint||"").trim();return{...t?{description:t}:{},...n?{inputHint:n}:{}}};export const CLAUDE_COMMAND_MATRIX=Object.freeze({"/clear":Object.freeze({description:"clear context · confirms",owner:"bridge-control"}),"/compact":Object.freeze({description:"compact context",owner:"sdk-lifecycle"}),"/model":Object.freeze({description:"pick model — opens selector",owner:"bridge-control"}),"/usage":Object.freeze({description:"session usage and provider limits",owner:"bridge-control"}),"<installed-skill>":Object.freeze({description:"run an installed Claude skill",owner:"sdk-skill"})});export const CLAUDE_COMMAND_EXCLUSIONS=Object.freeze({profileOrIdentity:Object.freeze(["agents","color","config","rename","team-onboarding"]),credentialsOrUpdates:Object.freeze(["claude-api","mcp","update-config"]),diagnosticsOrUpload:Object.freeze(["debug","doctor","heapdump","insights"]),hiddenAgentOrAutomation:Object.freeze(["__remote-workflow","batch","code-review","loop","review","schedule","security-review"]),unsafeInteractive:Object.freeze(["design","design-consent","design-revoke","fast","fewer-permission-prompts","goal","init","recap","reload-skills","run"])});const n=new Set(Object.values(CLAUDE_COMMAND_EXCLUSIONS).flat()),r=new Set(["clear","compact","model","usage"]);export function normalizeClaudeCommandCatalog({slashCommands:i,skills:o}={}){const c=Array.isArray(i)?i:[],s=new Set((Array.isArray(o)?o:[]).map(e).filter(Boolean)),a=new Map;for(const i of c){const o=e(i);if(!o||n.has(o))continue;if(!r.has(o)&&!s.has(o)||a.has(o))continue;const c=CLAUDE_COMMAND_MATRIX[`/${o}`],l=t(i);a.set(o,{name:`/${o}`,description:l.description||c?.description||`Run installed Claude skill: /${o}`,...l.inputHint?{inputHint:l.inputHint}:{}})}return[...["clear","compact","model","usage"].map(e=>a.get(e)||{name:`/${e}`,description:CLAUDE_COMMAND_MATRIX[`/${e}`].description}),...[...a.entries()].filter(([e])=>!r.has(e)).sort(([e],[t])=>e.localeCompare(t)).map(([,e])=>e)]}