tryharness 0.7.22 → 0.7.25

package/lib/localmodels.mjs

@@ -0,0 +1,571 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { ensureDir } from "./files.mjs";
+
+// The local models the relay may run, each pinned to one repository commit and the SHA-256 of every file, with its
+// licence and tier. This list is the only way a model reaches the machine: the downloader takes nothing else, refuses a
+// file whose hash differs, and refuses any model whose licence is not on the allowlist. The same list drives what the
+// person can see under "Local models". Core models come down with setup; extended ones the first time a feature needs them.
+
+export const LICENCES = new Set([
+  "apache-2.0",
+  "mit",
+  "bsd-3-clause",
+  "cc-by-4.0",
+]);
+
+// llama.cpp's own release build: the server that hosts every GGUF model (search, decision models) on the GPU when
+// there is one. Release archives as published, pinned by the digest GitHub reports for each asset.
+export const LLAMA = {
+  build: "b11609",
+  licence: "mit",
+  assets: {
+    "darwin-arm64": {
+      name: "llama-b11609-bin-macos-arm64.tar.gz",
+      sha256:
+        "d03f28b5a5baa9cdfbb01db5ed22c695126c11c193326f14cdc51d001be10f4e",
+      size: 12117158,
+    },
+    "darwin-x64": {
+      name: "llama-b11609-bin-macos-x64.tar.gz",
+      sha256:
+        "f95aa88329eb017213114c5f09841e9ee02477dacca2652f2451d322464b4acb",
+      size: 11614045,
+    },
+    "linux-x64-vulkan": {
+      name: "llama-b11609-bin-ubuntu-vulkan-x64.tar.gz",
+      sha256:
+        "8aff188828de76492343e19905f72408c10f5b870a03592155b0e7dd19b76ed0",
+      size: 30359149,
+    },
+    "linux-x64": {
+      name: "llama-b11609-bin-ubuntu-x64.tar.gz",
+      sha256:
+        "f95cbb27dd6e377f2ce30f5cfd7ec987af3259c025fc7c98fff62927a16ff528",
+      size: 17732148,
+    },
+    "linux-arm64-vulkan": {
+      name: "llama-b11609-bin-ubuntu-vulkan-arm64.tar.gz",
+      sha256:
+        "27e37fc8cd9cfa00f99f72c5d4753a81ecbbce30f00266aa9338e5d7ac4dd9fb",
+      size: 24120662,
+    },
+    "linux-arm64": {
+      name: "llama-b11609-bin-ubuntu-arm64.tar.gz",
+      sha256:
+        "af83fe40920dc788bb96b267aa579e76c20ee90f7e777b4a7a3031a4fcb9d942",
+      size: 13842753,
+    },
+    "win32-x64-vulkan": {
+      name: "llama-b11609-bin-win-vulkan-x64.zip",
+      sha256:
+        "7b50bdb2a27b5fe17759104b1d86e082a05583ff1bca8b3202bcfb2a7232a005",
+      size: 32134342,
+    },
+    "win32-x64": {
+      name: "llama-b11609-bin-win-cpu-x64.zip",
+      sha256:
+        "8708a7b81842333927f6377ac3f17ff8bba4dbe1ee0cf28dfd5e7a32e3a46b38",
+      size: 19518618,
+    },
+  },
+};
+
+export const MODELS = [
+  {
+    id: "search",
+    name: "EmbeddingGemma 2 (text)",
+    purpose: "One search space over code, agent sessions and board posts",
+    tier: "core",
+    runtime: "llama",
+    licence: "apache-2.0",
+    repo: "ggml-org/embeddinggemma-2-GGUF",
+    revision: "bfcd298762cc34d0357ece5ebdd31791a3a374d8",
+    files: [
+      {
+        path: "embeddinggemma-2-Q8_0.gguf",
+        sha256:
+          "2188ac1deca4b77dffefd603c2776a9d76d9d74ec01841392982ebb840b09135",
+        size: 309855456,
+      },
+    ],
+    llama: { embedding: true, c: 2048, ub: 2048, b: 2048 },
+  },
+  {
+    id: "guard",
+    name: "Wolf Defender small",
+    purpose: "Spots instructions hidden in what one agent hands another",
+    tier: "core",
+    runtime: "onnx",
+    licence: "apache-2.0",
+    repo: "patronus-studio/wolf-defender-prompt-injection-small",
+    revision: "bcab2eff97bcabd7227849639e2d0d7a61b46c92",
+    files: [
+      {
+        path: "onnx/int8_int4_embeddings/model.onnx",
+        sha256:
+          "a6c77496152e458c072e4787f872192af0449a427359d1afbfa1d4d6b116a305",
+        size: 96296126,
+      },
+      {
+        path: "onnx/onnx_fp16/tokenizer.json",
+        sha256:
+          "7e426c3929b44e6ab4c931770b5f22b913280633f5a1c67c81e9ad64decef55c",
+        size: 34363287,
+      },
+      {
+        path: "onnx/onnx_fp16/tokenizer_config.json",
+        sha256:
+          "14b147f2a4f939d9b12ab36e9633917040dd948fa78ce283b03402e4cf2c9cba",
+        size: 574,
+      },
+      {
+        path: "config.json",
+        sha256:
+          "b5bfba7b100b4b1aa361e8160e5593695164d81ca09b47f3b26561332b520218",
+        size: 2084,
+      },
+    ],
+  },
+  // The second guard reads short windows: in a long page or post, one planted sentence moves a 300-character window
+  // more than an 1,800-character one, and this model separates those better than the first (handoff-firewall eval). It
+  // is built on the first guard's vocabulary, so it uses that tokenizer (about 450 MB in memory) after its own extra step.
+  {
+    id: "guard-short",
+    name: "Horizon PI guard small",
+    purpose: "Finds one planted instruction in a long page or post",
+    tier: "core",
+    runtime: "onnx",
+    licence: "apache-2.0",
+    repo: "Horizon-Labs/prompt-injection-guard-small",
+    revision: "e0e88c4e940ee7e1b52bdf943d501ec696b83b9b",
+    files: [
+      {
+        path: "onnx/model_quantized.onnx",
+        sha256:
+          "61cd0741cdbfcc229e32e1de1392f352736d87d1e8b3c2b67ad9836bb7910d5d",
+        size: 268409234,
+      },
+      {
+        path: "config.json",
+        sha256:
+          "d6264037c9aa4b3d821c1c9a0329572033adbdb622788ecca91c3636066d9622",
+        size: 2031,
+      },
+    ],
+    tokenizer: { from: "guard", prepare: (text) => unhide(text) },
+  },
+  {
+    id: "credentials",
+    name: "credential-line 32M",
+    purpose: "Spots keys and passwords before a brief leaves the computer",
+    tier: "core",
+    runtime: "onnx",
+    licence: "mit",
+    repo: "zaindanaharper/credential-line-32m",
+    revision: "65422b823e9fb91d528b98229ebef6895d81de3b",
+    files: [
+      {
+        path: "onnx/model.onnx",
+        sha256:
+          "bd08c443d1472304624ea0b16ef8e08685a9e8fbe34ddfb9a65cfd00b6b4c47e",
+        size: 128379418,
+      },
+      {
+        path: "tokenizer.json",
+        sha256:
+          "218484396a9d08293b108b0e5ea31e0a1b7c801dcbed35a821deb392d2fe9bb4",
+        size: 3583485,
+      },
+      {
+        path: "tokenizer_config.json",
+        sha256:
+          "5bed9c3a3a8d5192d9e304ef695d265446452ba1b9a49e35183b74f982e21a53",
+        size: 396,
+      },
+      {
+        path: "config.json",
+        sha256:
+          "1fb928ec87f399096fdd444914c15a6643c9a0c4a7a7fc17c1e20f8bd61f7ea6",
+        size: 1918,
+      },
+      {
+        path: "policy.json",
+        sha256:
+          "db74709c4c08dc5d20732ec34aea723194bfa347553e97e81240f896a8de9770",
+        size: 754,
+      },
+    ],
+  },
+  // The search model's image and audio part: the same weights as search with its projector beside them, so a recording
+  // or a screenshot lands in the same space as a typed question. Downloaded when the person first adds a folder of them.
+  {
+    id: "media",
+    name: "EmbeddingGemma 2 (images and audio)",
+    purpose:
+      "Finds the minute of a recording or the screenshot a request is about, in folders the person adds",
+    tier: "extended",
+    runtime: "llama",
+    licence: "apache-2.0",
+    repo: "ggml-org/embeddinggemma-2-GGUF",
+    revision: "bfcd298762cc34d0357ece5ebdd31791a3a374d8",
+    files: [
+      {
+        path: "mmproj-embeddinggemma-2-Q8_0.gguf",
+        sha256:
+          "c4a8a52691ecef40618438928bdf9e68379b854e24166f292592353db0aab64f",
+        size: 554821024,
+      },
+    ],
+    llama: { weights: "search", embedding: true, c: 2048, ub: 2048, b: 2048 },
+  },
+  // The browser's OCR pair (src/shared/localRuntime/gpuWorker/ocr): PaddlePaddle's own ONNX exports, the detector byte
+  // for byte the one the browser serves. The recogniser's character list is read from its inference.yml.
+  {
+    id: "ocr",
+    name: "PP-OCR (v6 small detector, v5 English recogniser)",
+    purpose:
+      "Reads screenshots so keys and personal details are hidden before an image leaves the computer",
+    tier: "core",
+    runtime: "onnx",
+    licence: "apache-2.0",
+    repo: "PaddlePaddle/en_PP-OCRv5_mobile_rec_onnx",
+    revision: "3fafbc3b5dcf93dd72add9f48368be8a3a2cd33b",
+    files: [
+      {
+        path: "det/inference.onnx",
+        repo: "PaddlePaddle/PP-OCRv6_small_det_onnx",
+        revision: "28fe5895c24fd108c19eb3e8479f4ab385fbfc62",
+        from: "inference.onnx",
+        sha256:
+          "d73e0058b7a8086bbd57f3d10b8bcd4ff95363f67e06e2762b5e814fe9c9410e",
+        size: 9880512,
+      },
+      {
+        path: "rec/inference.onnx",
+        from: "inference.onnx",
+        sha256:
+          "b5f833dfc5d0eb71da397b4efa06ebeee9b431b690a47d6af40d77d8eabc557f",
+        size: 7848423,
+      },
+      {
+        path: "rec/inference.yml",
+        from: "inference.yml",
+        sha256:
+          "27e91d0582f40168aa218303c76e184bc78fa7a5d105aad0cfbad8458b441067",
+        size: 3964,
+      },
+    ],
+  },
+  // Talk in the buddy (speech.mjs), downloaded the first time the person holds it: the VAD always, the speech model only
+  // where Apple's transcriber is not used.
+  {
+    id: "vad",
+    name: "Silero VAD 6.2",
+    purpose: "Hears whether anyone spoke while the talk key was held",
+    tier: "extended",
+    runtime: "onnx",
+    licence: "mit",
+    repo: "istupakov/silero-vad-onnx",
+    revision: "b3e3ee3cce4c11ceb63b1a0b229d916069c1ddf6",
+    files: [
+      {
+        path: "silero_vad_16k_op15.onnx",
+        sha256:
+          "7ed98ddbad84ccac4cd0aeb3099049280713df825c610a8ed34543318f1b2c49",
+        size: 1289603,
+      },
+    ],
+  },
+  // Speech where Apple's own transcriber is not on the computer (Linux, Windows, Macs before macOS 26): NVIDIA's
+  // Parakeet TDT 0.6B v3 (CC-BY-4.0; credited in the CLI's README), the 8-bit ONNX export by istupakov. Measured in the
+  // dictation eval against the Moonshine base it replaced: 2.8% of words wrong on real people reading against 4.9%. Two
+  // threads: a 5 s recording in 130 ms here against 205 ms on one (four: 99 ms).
+  {
+    id: "speech",
+    name: "Parakeet TDT 0.6B v3 (8-bit)",
+    purpose: "Turns what the person says into text for the buddy's composer",
+    tier: "extended",
+    runtime: "onnx",
+    licence: "cc-by-4.0",
+    repo: "istupakov/parakeet-tdt-0.6b-v3-onnx",
+    revision: "8f23f0c03c8761650bdb5b40aaf3e40d2c15f1ce",
+    engine: "parakeet",
+    threads: 2,
+    files: [
+      {
+        path: "encoder-model.int8.onnx",
+        sha256:
+          "6139d2fa7e1b086097b277c7149725edbab89cc7c7ae64b23c741be4055aff09",
+        size: 652183999,
+      },
+      {
+        path: "decoder_joint-model.int8.onnx",
+        sha256:
+          "eea7483ee3d1a30375daedc8ed83e3960c91b098812127a0d99d1c8977667a70",
+        size: 18202004,
+      },
+      {
+        path: "nemo128.onnx",
+        sha256:
+          "a9fde1486ebfcc08f328d75ad4610c67835fea58c73ba57e3209a6f6cf019e9f",
+        size: 139764,
+      },
+      {
+        path: "vocab.txt",
+        sha256:
+          "d58544679ea4bc6ac563d1f545eb7d474bd6cfa467f0a6e2c1dc1c7d37e3c35d",
+        size: 93939,
+      },
+      {
+        path: "config.json",
+        sha256:
+          "666903c76b9798caf2c210afd4f6cd60b08a8dbf9800ec8d7a3bc0d2148ac466",
+        size: 97,
+      },
+    ],
+  },
+];
+
+export const modelById = (id, list = MODELS) =>
+  list.find((entry) => entry.id === id) ?? null;
+/**
+ * The extra step in Horizon PI guard small's tokenizer before the one it shares with Wolf Defender (same token ids on
+ * every text tried, hidden ones included): letters spelled in Unicode tag characters or variation selectors become
+ * plain letters, NFKC, then invisible and overlay characters go.
+ */
+export const unhide = (text) =>
+  String(text)
+    .replace(/[\u{E0020}-\u{E007E}]/gu, (c) =>
+      String.fromCodePoint(c.codePointAt(0) - 0xe0000)
+    )
+    .replace(/[\u{E0110}-\u{E016E}]/gu, (c) =>
+      String.fromCodePoint(c.codePointAt(0) - 0xe0110 + 0x20)
+    )
+    .normalize("NFKC")
+    .replace(
+      /[\u00AD\u180E\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF\uFE00-\uFE0F\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}\u0305\u0331-\u0338\u20D0-\u20FF]/gu,
+      ""
+    );
+
+export const modelDir = (root, entry) => path.join(root, entry.id);
+export const modelFile = (root, entry, index = 0) =>
+  path.join(modelDir(root, entry), ...entry.files[index].path.split("/"));
+
+/**
+ * Refuses an entry that could not be verified or used: unpinned, unhashed, or under a licence off the allowlist. A file
+ * may come from another repository (its own repo and revision, under the entry's licence) and from another path there
+ * (from), so models made of parts published apart stay one entry.
+ */
+export function checkEntry(entry) {
+  if (!LICENCES.has(entry.licence))
+    throw new Error(
+      `${entry.name}: licence ${entry.licence} is not on the allowlist`
+    );
+  if (!/^[0-9a-f]{40}$/.test(entry.revision || ""))
+    throw new Error(`${entry.name}: not pinned to a repository commit`);
+  for (const file of entry.files) {
+    if (!/^[0-9a-f]{64}$/.test(file.sha256 || "") || !(file.size > 0))
+      throw new Error(
+        `${entry.name}: ${file.path} has no pinned hash and size`
+      );
+    if (
+      (file.repo !== undefined || file.revision !== undefined) &&
+      !(
+        /^[\w.-]+\/[\w.-]+$/.test(file.repo || "") &&
+        /^[0-9a-f]{40}$/.test(file.revision || "")
+      )
+    )
+      throw new Error(
+        `${entry.name}: ${file.path} names another repository without pinning it to a commit`
+      );
+  }
+  return entry;
+}
+
+export async function sha256File(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of fs.createReadStream(file)) hash.update(chunk);
+  return hash.digest("hex");
+}
+
+const present = (file, size) => {
+  try {
+    return fs.statSync(file).size === size;
+  } catch {
+    return false;
+  }
+};
+
+async function download(url, target, expected, { fetchImpl, log }) {
+  const partial = `${target}.partial`;
+  ensureDir(path.dirname(target));
+  let have = 0;
+  try {
+    have = fs.statSync(partial).size;
+  } catch {}
+  const response = await fetchImpl(url, {
+    headers: have > 0 ? { range: `bytes=${have}-` } : {},
+    redirect: "follow",
+  });
+  if (response.status !== 416) {
+    if (!response.ok)
+      throw new Error(
+        `download of ${path.basename(target)} failed: HTTP ${response.status}`
+      );
+    const out = fs.createWriteStream(partial, {
+      flags: response.status === 206 ? "a" : "w",
+    });
+    for await (const chunk of response.body)
+      if (!out.write(chunk))
+        await new Promise((resolve) => out.once("drain", resolve));
+    await new Promise((resolve, reject) => {
+      out.end();
+      out.on("finish", resolve);
+      out.on("error", reject);
+    });
+  }
+  const actual = await sha256File(partial);
+  if (
+    actual !== expected.sha256 ||
+    fs.statSync(partial).size !== expected.size
+  ) {
+    fs.rmSync(partial, { force: true });
+    throw new Error(
+      `${path.basename(target)} did not match its pinned hash; it was deleted and nothing was installed`
+    );
+  }
+  fs.renameSync(partial, target);
+  log?.(`local models: ${path.basename(target)} verified`);
+}
+
+/** Downloads and verifies the given models' missing files into root. Returns the ids now present. */
+export async function ensureModels({
+  root,
+  ids,
+  list = MODELS,
+  fetchImpl = fetch,
+  log = () => {},
+}) {
+  const done = [];
+  for (const id of ids) {
+    const entry = checkEntry(
+      modelById(id, list) ??
+        (() => {
+          throw new Error(`unknown local model ${id}`);
+        })()
+    );
+    for (const [index, file] of entry.files.entries()) {
+      const target = modelFile(root, entry, index);
+      if (present(target, file.size)) continue;
+      await download(
+        `https://huggingface.co/${file.repo ?? entry.repo}/resolve/${file.revision ?? entry.revision}/${file.from ?? file.path}`,
+        target,
+        file,
+        { fetchImpl, log }
+      );
+    }
+    done.push(id);
+  }
+  return done;
+}
+
+export const modelsPresent = (root, ids, list = MODELS) =>
+  ids.every((id) => {
+    const entry = modelById(id, list);
+    return (
+      entry &&
+      entry.files.every((file, index) =>
+        present(modelFile(root, entry, index), file.size)
+      )
+    );
+  });
+
+/** The llama.cpp build for this machine: the GPU build where the OS has one (Metal is built in on macOS). */
+export function llamaAsset({
+  platform = process.platform,
+  arch = process.arch,
+  gpu = true,
+} = {}) {
+  const base = `${platform}-${arch}`;
+  return (
+    LLAMA.assets[gpu && platform !== "darwin" ? `${base}-vulkan` : base] ??
+    LLAMA.assets[base] ??
+    null
+  );
+}
+
+export const llamaDir = (root) => path.join(root, `llama-${LLAMA.build}`);
+export const llamaServer = (root) => {
+  const dir = llamaDir(root);
+  const name =
+    process.platform === "win32" ? "llama-server.exe" : "llama-server";
+  for (const candidate of [
+    path.join(dir, name),
+    path.join(dir, "build", "bin", name),
+    path.join(dir, `llama-${LLAMA.build}`, name),
+  ])
+    if (fs.existsSync(candidate)) return candidate;
+  return null;
+};
+
+/** Downloads, verifies and unpacks the llama.cpp server. Idempotent. */
+export async function ensureLlama({
+  root,
+  gpu = true,
+  fetchImpl = fetch,
+  log = () => {},
+}) {
+  if (llamaServer(root)) return runs(llamaServer(root));
+  const asset = llamaAsset({ gpu });
+  if (!asset)
+    throw new Error(
+      `no llama.cpp build is pinned for ${process.platform}-${process.arch}`
+    );
+  const archive = path.join(root, asset.name);
+  if (!present(archive, asset.size))
+    await download(
+      `https://github.com/ggml-org/llama.cpp/releases/download/${LLAMA.build}/${asset.name}`,
+      archive,
+      asset,
+      { fetchImpl, log }
+    );
+  else if ((await sha256File(archive)) !== asset.sha256) {
+    fs.rmSync(archive, { force: true });
+    throw new Error(
+      `${asset.name} did not match its pinned hash; it was deleted`
+    );
+  }
+  const dir = llamaDir(root);
+  ensureDir(dir);
+  const unpacked = asset.name.endsWith(".zip")
+    ? spawnSync("tar", ["-xf", archive, "-C", dir], { encoding: "utf8" })
+    : spawnSync(
+        "tar",
+        ["-xzf", archive, "-C", dir, "--strip-components", "1"],
+        { encoding: "utf8" }
+      );
+  if (unpacked.status !== 0)
+    throw new Error(
+      `unpacking ${asset.name} failed: ${(unpacked.stderr || unpacked.error?.message || "").trim()}`
+    );
+  fs.rmSync(archive, { force: true });
+  const server = llamaServer(root);
+  if (!server) throw new Error(`${asset.name} has no llama-server in it`);
+  return runs(server);
+}
+
+// A build that cannot start here says what is missing: on Linux, llama.cpp needs the system's OpenMP library, which
+// minimal installs lack.
+function runs(server) {
+  const missing = (
+    spawnSync(server, ["--version"], { encoding: "utf8" }).stderr || ""
+  ).match(/error while loading shared libraries: ([^:\s]+)/)?.[1];
+  if (missing)
+    throw new Error(
+      `the local model server needs ${missing}, which this computer does not have${missing.startsWith("libgomp") ? " (on Ubuntu or Debian: sudo apt install libgomp1)" : ""}`
+    );
+  return server;
+}