ubume 0.1.0

package/src/core/providerRuntime/unsloth.ts

@@ -0,0 +1,216 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+const require = createRequire(import.meta.url);
+
+export const DEFAULT_UNSLOTH_ROOT_URL = "http://127.0.0.1:8888";
+
+type FetchImpl = typeof fetch;
+
+interface UnslothKeyCache {
+  servers?: Record<string, {
+    saved?: unknown;
+    minted?: unknown;
+  }>;
+}
+
+export interface UnslothConnection {
+  rootUrl: string;
+  baseUrl: string;
+  apiKey: string;
+  authSource: "environment" | "agent-cache";
+}
+
+export interface UnslothModelInfo {
+  id: string;
+  loaded: boolean;
+  [key: string]: unknown;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+function resolveHome(env: NodeJS.ProcessEnv): string {
+  return env.USERPROFILE?.trim() || env.HOME?.trim() || homedir();
+}
+
+export function normalizeUnslothRootUrl(value: string): string {
+  const url = new URL(value.trim() || DEFAULT_UNSLOTH_ROOT_URL);
+  if (url.hostname.toLowerCase() === "localhost") {
+    url.hostname = "127.0.0.1";
+  }
+  url.pathname = url.pathname.replace(/\/+$/, "").replace(/\/v1$/i, "") || "/";
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+
+export function resolveUnslothRootUrl(env: NodeJS.ProcessEnv = process.env): string {
+  return normalizeUnslothRootUrl(env.UNSLOTH_STUDIO_URL?.trim() || DEFAULT_UNSLOTH_ROOT_URL);
+}
+
+export function isLoopbackUnslothUrl(value: string): boolean {
+  try {
+    const hostname = new URL(value).hostname.toLowerCase();
+    if (hostname === "localhost" || hostname === "::1") return true;
+    const parts = hostname.split(".").map(Number);
+    return parts.length === 4 && parts.every(Number.isInteger) && parts[0] === 127;
+  } catch {
+    return false;
+  }
+}
+
+function readIdentitySecret(env: NodeJS.ProcessEnv): Buffer | null {
+  const authDb = join(resolveHome(env), ".unsloth", "studio", "auth", "auth.db");
+  if (!existsSync(authDb)) return null;
+  try {
+    const { Database } = require("bun:sqlite") as {
+      Database: new (path: string, options: { readonly: boolean }) => {
+        query: (sql: string) => { get: (...params: unknown[]) => unknown };
+        close: () => void;
+      };
+    };
+    const database = new Database(authDb, { readonly: true });
+    try {
+      const row = asRecord(database.query("SELECT value FROM app_secrets WHERE key = ?").get("studio_identity_secret"));
+      const value = row?.value;
+      return typeof value === "string" && /^[a-f0-9]{64}$/i.test(value)
+        ? Buffer.from(value, "hex")
+        : null;
+    } finally {
+      database.close();
+    }
+  } catch {
+    return null;
+  }
+}
+
+function proofMessage(nonce: Buffer, hostname: string, port: number): Buffer {
+  const normalizedHost = hostname.toLowerCase() === "localhost" ? "127.0.0.1" : hostname.toLowerCase();
+  return Buffer.concat([nonce, Buffer.from(`|${normalizedHost}|${port}`)]);
+}
+
+export async function verifyUnslothIdentity(options: {
+  rootUrl: string;
+  fetchImpl?: FetchImpl;
+  signal?: AbortSignal;
+  env?: NodeJS.ProcessEnv;
+  identitySecret?: Buffer | null;
+  nonce?: Buffer;
+}): Promise<boolean> {
+  if (!isLoopbackUnslothUrl(options.rootUrl)) return false;
+  const env = options.env ?? process.env;
+  const secret = options.identitySecret === undefined ? readIdentitySecret(env) : options.identitySecret;
+  if (!secret || secret.length !== 32) return false;
+
+  const url = new URL(options.rootUrl);
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  const nonce = options.nonce ?? randomBytes(32);
+  const encodedNonce = nonce.toString("base64").replace(/\+/g, "-").replace(/\//g, "_");
+  const identityUrl = new URL("/api/auth/identity", options.rootUrl);
+  identityUrl.searchParams.set("nonce", encodedNonce);
+
+  try {
+    const response = await (options.fetchImpl ?? globalThis.fetch)(identityUrl, {
+      method: "GET",
+      redirect: "manual",
+      signal: options.signal,
+    });
+    if (!response.ok || response.status >= 300 && response.status < 400) return false;
+    const body = asRecord(await response.json());
+    const proof = body?.proof;
+    if (typeof proof !== "string" || !/^[a-f0-9]{64}$/i.test(proof)) return false;
+    const expected = createHmac("sha256", secret)
+      .update(proofMessage(nonce, url.hostname, port))
+      .digest();
+    const actual = Buffer.from(proof, "hex");
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
+}
+
+function cachedKeysForServer(rootUrl: string, env: NodeJS.ProcessEnv): string[] {
+  const cachePath = join(resolveHome(env), ".unsloth", "studio", "auth", "agent_api_key.json");
+  try {
+    const parsed = JSON.parse(readFileSync(cachePath, "utf8")) as UnslothKeyCache;
+    const entry = parsed.servers?.[rootUrl];
+    const keys = [entry?.saved, entry?.minted]
+      .flatMap((value) => Array.isArray(value) ? value : [])
+      .filter((value): value is string => typeof value === "string" && value.startsWith("sk-unsloth-"));
+    return [...new Set(keys)];
+  } catch {
+    return [];
+  }
+}
+
+async function keyAccepted(rootUrl: string, apiKey: string, fetchImpl: FetchImpl, signal?: AbortSignal): Promise<boolean> {
+  const response = await fetchImpl(`${rootUrl}/v1/models`, {
+    method: "GET",
+    headers: { Authorization: `Bearer ${apiKey}` },
+    redirect: "manual",
+    signal,
+  });
+  if (response.status === 401 || response.status === 403) return false;
+  if (!response.ok) throw new Error(`Unsloth returned HTTP ${response.status} while checking its API key.`);
+  return true;
+}
+
+export async function resolveUnslothConnection(options: {
+  fetchImpl?: FetchImpl;
+  signal?: AbortSignal;
+  env?: NodeJS.ProcessEnv;
+  identitySecret?: Buffer | null;
+} = {}): Promise<UnslothConnection> {
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const rootUrl = resolveUnslothRootUrl(env);
+  const explicitKey = env.UNSLOTH_API_KEY?.trim();
+  if (explicitKey) {
+    if (!await keyAccepted(rootUrl, explicitKey, fetchImpl, options.signal)) {
+      throw new Error("UNSLOTH_API_KEY was rejected by the configured Unsloth server.");
+    }
+    return { rootUrl, baseUrl: `${rootUrl}/v1`, apiKey: explicitKey, authSource: "environment" };
+  }
+
+  const identityVerified = await verifyUnslothIdentity({
+    rootUrl,
+    fetchImpl,
+    signal: options.signal,
+    env,
+    identitySecret: options.identitySecret,
+  });
+  if (!identityVerified) {
+    throw new Error("Could not securely verify the local Unsloth server. Set UNSLOTH_API_KEY or create an API key in Unsloth Settings > API.");
+  }
+
+  for (const apiKey of cachedKeysForServer(rootUrl, env)) {
+    if (await keyAccepted(rootUrl, apiKey, fetchImpl, options.signal)) {
+      return { rootUrl, baseUrl: `${rootUrl}/v1`, apiKey, authSource: "agent-cache" };
+    }
+  }
+  throw new Error("No valid Unsloth agent API key was found. Set UNSLOTH_API_KEY or create an API key in Unsloth Settings > API.");
+}
+
+export function parseUnslothModels(value: unknown): UnslothModelInfo[] {
+  const data = asRecord(value)?.data;
+  if (!Array.isArray(data)) return [];
+  const seen = new Set<string>();
+  const models: UnslothModelInfo[] = [];
+  for (const item of data) {
+    const record = asRecord(item);
+    if (!record || typeof record.id !== "string" || !record.id.trim()) continue;
+    const id = record.id.trim();
+    const key = id.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    models.push({ ...record, id, loaded: record.loaded === true });
+  }
+  return models;
+}

package/src/core/providers/codexJsonStream.ts

@@ -0,0 +1,305 @@
+import type { BackendProgressUpdate } from "./types.js";
+import type { RunToolActivity } from "../../session/types.js";
+
+type CodexThreadEvent =
+  | { type: "thread.started"; thread_id: string }
+  | { type: "turn.started" }
+  | { type: "turn.completed"; usage?: { input_tokens?: number; cached_input_tokens?: number; output_tokens?: number } }
+  | { type: "turn.failed"; error?: { message?: string } }
+  | { type: "error"; message?: string }
+  | { type: "item.started" | "item.updated" | "item.completed"; item: CodexThreadItem };
+
+type CodexThreadItem =
+  | {
+    id: string;
+    type: "agent_message";
+    text: string;
+  }
+  | {
+    id: string;
+    type: "reasoning";
+    text: string;
+  }
+  | {
+    id: string;
+    type: "command_execution";
+    command: string;
+    status: "in_progress" | "completed" | "failed";
+    aggregated_output?: string;
+    exit_code?: number;
+  }
+  | {
+    id: string;
+    type: "mcp_tool_call";
+    server: string;
+    tool: string;
+    status: "in_progress" | "completed" | "failed";
+    error?: { message?: string };
+  }
+  | {
+    id: string;
+    type: "web_search";
+    query: string;
+  }
+  | {
+    id: string;
+    type: "todo_list";
+    items: Array<{ text: string; completed: boolean }>;
+  }
+  | {
+    id: string;
+    type: "file_change";
+    changes: Array<{ path: string; kind: "add" | "delete" | "update" }>;
+    status: "completed" | "failed";
+  }
+  | {
+    id: string;
+    type: "error";
+    message: string;
+  };
+
+export interface CodexJsonStreamHandlers {
+  onAssistantDelta?: (chunk: string) => void;
+  onFinalAnswerObserved?: (response: string) => void;
+  onProgress?: (update: BackendProgressUpdate) => void;
+  onToolActivity?: (activity: RunToolActivity) => void;
+}
+
+function normalizeProgressText(text: string | undefined): string | null {
+  if (!text) return null;
+  const normalized = text
+    .replace(/\r\n/g, "\n")
+    .replace(/\r/g, "\n")
+    .replace(/[ \t]+\n/g, "\n")
+    .trim();
+  return normalized || null;
+}
+
+function firstMeaningfulLine(text: string | undefined): string | null {
+  if (!text) return null;
+  const line = text
+    .replace(/\r\n/g, "\n")
+    .replace(/\r/g, "\n")
+    .split("\n")
+    .map((part) => part.trim())
+    .find(Boolean);
+  return line ?? null;
+}
+
+function summarizeCommandExecution(item: Extract<CodexThreadItem, { type: "command_execution" }>): string {
+  const firstLine = firstMeaningfulLine(item.aggregated_output);
+  if (item.status === "failed") {
+    if (firstLine) return firstLine;
+    if (item.exit_code != null) return `Exit code ${item.exit_code}`;
+    return "Failed";
+  }
+  if (firstLine) return firstLine;
+  if (item.exit_code != null) return `Exit code ${item.exit_code}`;
+  return item.status === "completed" ? "Completed" : "Running";
+}
+
+function summarizeTodoList(item: Extract<CodexThreadItem, { type: "todo_list" }>): string | null {
+  if (!item.items.length) return null;
+  const completedCount = item.items.filter((entry) => entry.completed).length;
+  const nextPending = item.items.find((entry) => !entry.completed);
+  if (nextPending) {
+    return `Todo ${completedCount}/${item.items.length}: ${nextPending.text}`;
+  }
+  return `Todo ${completedCount}/${item.items.length}: all tasks complete`;
+}
+
+function summarizeReasoning(item: Extract<CodexThreadItem, { type: "reasoning" }>): string | null {
+  return normalizeProgressText(item.text);
+}
+
+function summarizeFileChange(item: Extract<CodexThreadItem, { type: "file_change" }>): string | null {
+  if (!item.changes.length) return null;
+  const [first] = item.changes;
+  if (item.changes.length === 1 && first) {
+    const verb = first.kind === "add" ? "Created" : first.kind === "delete" ? "Deleted" : "Updated";
+    return `${verb} ${first.path}`;
+  }
+  return `Applied ${item.changes.length} file changes`;
+}
+
+function mapToolActivity(item: Extract<CodexThreadItem, {
+  type: "command_execution" | "mcp_tool_call" | "web_search";
+}>, phase: "item.started" | "item.updated" | "item.completed", existing: RunToolActivity | undefined): RunToolActivity {
+  const startedAt = existing?.startedAt ?? Date.now();
+
+  if (item.type === "command_execution") {
+    const status = item.status === "in_progress" ? "running" : item.status;
+    return {
+      id: item.id,
+      command: item.command,
+      status,
+      startedAt,
+      completedAt: status === "running" ? null : Date.now(),
+      summary: status === "running" ? undefined : summarizeCommandExecution(item),
+    };
+  }
+
+  if (item.type === "mcp_tool_call") {
+    return {
+      id: item.id,
+      command: `${item.server}:${item.tool}`,
+      status: item.status === "in_progress" ? "running" : item.status,
+      startedAt,
+      completedAt: item.status === "in_progress" ? null : Date.now(),
+      summary: item.status === "failed"
+        ? item.error?.message ?? "Failed"
+        : item.status === "completed"
+          ? "Completed"
+          : undefined,
+    };
+  }
+
+  return {
+    id: item.id,
+    command: `web search: ${item.query}`,
+    status: phase === "item.completed" ? "completed" : "running",
+    startedAt,
+    completedAt: phase === "item.completed" ? Date.now() : null,
+    summary: phase === "item.completed" ? "Completed" : undefined,
+  };
+}
+
+export function createCodexJsonStreamParser(handlers: CodexJsonStreamHandlers) {
+  const assistantTextById = new Map<string, string>();
+  const progressTextById = new Map<string, string>();
+  const toolActivityById = new Map<string, RunToolActivity>();
+  let sawEvent = false;
+  let finalResponse = "";
+  let finalAnswerObserved = false;
+  let failureMessage: string | null = null;
+
+  const emitProgress = (
+    key: string,
+    source: BackendProgressUpdate["source"],
+    summary: string | null | undefined,
+  ) => {
+    const next = normalizeProgressText(summary ?? "");
+    if (!next) return;
+    if (progressTextById.get(key) === next) return;
+    progressTextById.set(key, next);
+    handlers.onProgress?.({ id: key, source, text: next });
+  };
+
+  // Codex JSON stream sends cumulative text per item ID rather than deltas.
+  // We track the last emitted text and emit only the newly appended suffix.
+  const emitAssistantText = (itemId: string, nextText: string) => {
+    const previous = assistantTextById.get(itemId) ?? "";
+    assistantTextById.set(itemId, nextText);
+    finalResponse = nextText;
+
+    if (!nextText) return;
+    if (!previous) {
+      handlers.onAssistantDelta?.(nextText);
+      return;
+    }
+
+    if (nextText.startsWith(previous)) {
+      const delta = nextText.slice(previous.length);
+      if (delta) {
+        handlers.onAssistantDelta?.(delta);
+      }
+    }
+  };
+
+  const upsertTool = (item: Extract<CodexThreadItem, {
+    type: "command_execution" | "mcp_tool_call" | "web_search";
+  }>, phase: "item.started" | "item.updated" | "item.completed") => {
+    const next = mapToolActivity(item, phase, toolActivityById.get(item.id));
+    toolActivityById.set(item.id, next);
+    handlers.onToolActivity?.(next);
+  };
+
+  const handleItem = (phase: "item.started" | "item.updated" | "item.completed", item: CodexThreadItem) => {
+    switch (item.type) {
+      case "agent_message":
+        emitAssistantText(item.id, item.text ?? "");
+        break;
+      case "reasoning":
+        emitProgress(item.id, "reasoning", summarizeReasoning(item));
+        break;
+      case "todo_list":
+        emitProgress(item.id, "todo", summarizeTodoList(item));
+        break;
+      case "command_execution":
+        upsertTool(item, phase);
+        emitProgress(item.id, "tool", item.status === "in_progress" ? `Running ${item.command}` : summarizeCommandExecution(item));
+        break;
+      case "mcp_tool_call":
+        upsertTool(item, phase);
+        emitProgress(
+          item.id,
+          "tool",
+          item.status === "in_progress" ? `Calling ${item.server}:${item.tool}` : item.error?.message ?? `Completed ${item.server}:${item.tool}`,
+        );
+        break;
+      case "web_search":
+        upsertTool(item, phase);
+        emitProgress(item.id, "tool", `Searching web: ${item.query}`);
+        break;
+      case "file_change":
+        emitProgress(item.id, "activity", summarizeFileChange(item));
+        break;
+      case "error":
+        failureMessage = item.message;
+        break;
+    }
+  };
+
+  return {
+    feedLine(line: string): boolean {
+      const trimmed = line.trim();
+      if (!trimmed) return false;
+
+      let event: CodexThreadEvent;
+      try {
+        event = JSON.parse(trimmed) as CodexThreadEvent;
+      } catch {
+        return false;
+      }
+
+      if (!event || typeof event !== "object" || typeof event.type !== "string") {
+        return false;
+      }
+
+      sawEvent = true;
+
+      switch (event.type) {
+        case "item.started":
+        case "item.updated":
+        case "item.completed":
+          handleItem(event.type, event.item);
+          break;
+        case "turn.completed":
+          if (!finalAnswerObserved && finalResponse) {
+            finalAnswerObserved = true;
+            handlers.onFinalAnswerObserved?.(finalResponse);
+          }
+          break;
+        case "turn.failed":
+          failureMessage = event.error?.message ?? "Turn failed";
+          break;
+        case "error":
+          failureMessage = event.message ?? "Stream error";
+          break;
+        default:
+          break;
+      }
+
+      return true;
+    },
+    getFinalResponse(): string {
+      return finalResponse;
+    },
+    getFailureMessage(): string | null {
+      return failureMessage;
+    },
+    hasStructuredEvents(): boolean {
+      return sawEvent;
+    },
+  };
+}