vexi-cli 0.8.0 → 0.9.1

package/dist/providers/anthropic.js

@@ -4,57 +4,195 @@
  * so it gets its own small client instead of the OpenAI-compatible one.
  */
 import { ProviderError } from './types.js';
-import { sseEvents, truncate } from './openai-compat.js';
+import { sseEvents, truncate, createStreamTimeoutGuard } from './openai-compat.js';
 const ANTHROPIC_BASE = 'https://api.anthropic.com/v1';
 const ANTHROPIC_VERSION = '2023-06-01';
+/**
+ * Accumulate token usage from an Anthropic SSE event. Input tokens arrive in
+ * `message_start`; output tokens accumulate in `message_delta`. Returns the
+ * running total (mutated in place).
+ */
+function accumulateUsage(json, usage) {
+    if (json.type === 'message_start' && json.message?.usage) {
+        usage.inputTokens = json.message.usage.input_tokens ?? usage.inputTokens;
+    }
+    else if (json.type === 'message_delta' && json.usage) {
+        usage.outputTokens = json.usage.output_tokens ?? usage.outputTokens;
+    }
+}
+/** Translate Vexi's neutral ChatMessage[] into Anthropic's content-block format. */
+function toAnthropicMessages(chat) {
+    return chat.map((m) => {
+        if (m.role === 'assistant' && m.toolCalls?.length) {
+            const blocks = [];
+            if (m.content)
+                blocks.push({ type: 'text', text: m.content });
+            for (const tc of m.toolCalls) {
+                blocks.push({ type: 'tool_use', id: tc.id, name: tc.name, input: tc.arguments });
+            }
+            return { role: 'assistant', content: blocks };
+        }
+        if (m.role === 'tool') {
+            // Tool results are carried on a user-role turn in Anthropic's API.
+            return {
+                role: 'user',
+                content: [{ type: 'tool_result', tool_use_id: m.toolCallId ?? '', content: m.content }],
+            };
+        }
+        return { role: m.role, content: m.content };
+    });
+}
 export function createAnthropicProvider(apiKey, model, baseUrl) {
     const messagesEndpoint = `${baseUrl ?? ANTHROPIC_BASE}/messages`;
     return {
         id: 'anthropic',
         model,
-        async stream(messages, onText) {
+        supportsTools: true,
+        async streamTools(messages, tools, onText, onUsage) {
+            const system = messages.filter((m) => m.role === 'system').map((m) => m.content).join('\n\n');
+            const chat = messages.filter((m) => m.role !== 'system');
+            const usage = { inputTokens: 0, outputTokens: 0 };
+            const guard = createStreamTimeoutGuard('anthropic');
+            try {
+                const res = await fetch(messagesEndpoint, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'x-api-key': apiKey,
+                        'anthropic-version': ANTHROPIC_VERSION,
+                    },
+                    body: JSON.stringify({
+                        model,
+                        max_tokens: 8192,
+                        ...(system ? { system } : {}),
+                        messages: toAnthropicMessages(chat),
+                        tools: tools.map((t) => ({ name: t.name, description: t.description, input_schema: t.inputSchema })),
+                        stream: true,
+                    }),
+                    signal: guard.signal,
+                }).catch((err) => {
+                    throw guard.wrapNetworkError(err);
+                });
+                if (!res.ok || !res.body) {
+                    const body = await res.text().catch(() => '');
+                    throw new ProviderError(`anthropic API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
+                }
+                let full = '';
+                const toolCalls = [];
+                // tool_use blocks stream their arguments as partial_json fragments,
+                // keyed by content-block index; accumulate then parse at block stop.
+                const partials = new Map();
+                try {
+                    for await (const data of sseEvents(res.body)) {
+                        guard.resetIdleTimer();
+                        try {
+                            const json = JSON.parse(data);
+                            if (json.type === 'content_block_start' && json.content_block?.type === 'tool_use') {
+                                partials.set(json.index, { id: json.content_block.id, name: json.content_block.name, json: '' });
+                            }
+                            else if (json.type === 'content_block_delta') {
+                                if (json.delta?.type === 'text_delta') {
+                                    full += json.delta.text;
+                                    onText(json.delta.text);
+                                }
+                                else if (json.delta?.type === 'input_json_delta') {
+                                    const p = partials.get(json.index);
+                                    if (p)
+                                        p.json += json.delta.partial_json ?? '';
+                                }
+                            }
+                            else if (json.type === 'content_block_stop') {
+                                const p = partials.get(json.index);
+                                if (p) {
+                                    let args = {};
+                                    try {
+                                        args = p.json ? JSON.parse(p.json) : {};
+                                    }
+                                    catch {
+                                        args = {};
+                                    }
+                                    toolCalls.push({ id: p.id, name: p.name, arguments: args });
+                                    partials.delete(json.index);
+                                }
+                            }
+                            accumulateUsage(json, usage);
+                        }
+                        catch {
+                            // Ignore malformed/keep-alive chunks
+                        }
+                    }
+                }
+                catch (e) {
+                    throw guard.wrapStreamError(e);
+                }
+                if (onUsage)
+                    onUsage(usage);
+                return { text: full, toolCalls };
+            }
+            finally {
+                guard.dispose();
+            }
+        },
+        async stream(messages, onText, onUsage) {
             // Anthropic takes the system prompt as a top-level field
             const system = messages
                 .filter((m) => m.role === 'system')
                 .map((m) => m.content)
                 .join('\n\n');
             const chat = messages.filter((m) => m.role !== 'system');
-            const res = await fetch(messagesEndpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'x-api-key': apiKey,
-                    'anthropic-version': ANTHROPIC_VERSION,
-                },
-                body: JSON.stringify({
-                    model,
-                    max_tokens: 8192,
-                    ...(system ? { system } : {}),
-                    messages: chat,
-                    stream: true,
-                }),
-            }).catch((err) => {
-                throw new ProviderError(`Network error: ${err.message}`);
-            });
-            if (!res.ok || !res.body) {
-                const body = await res.text().catch(() => '');
-                throw new ProviderError(`anthropic API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
-            }
-            let full = '';
-            for await (const data of sseEvents(res.body)) {
+            const usage = { inputTokens: 0, outputTokens: 0 };
+            const guard = createStreamTimeoutGuard('anthropic');
+            try {
+                const res = await fetch(messagesEndpoint, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'x-api-key': apiKey,
+                        'anthropic-version': ANTHROPIC_VERSION,
+                    },
+                    body: JSON.stringify({
+                        model,
+                        max_tokens: 8192,
+                        ...(system ? { system } : {}),
+                        messages: chat,
+                        stream: true,
+                    }),
+                    signal: guard.signal,
+                }).catch((err) => {
+                    throw guard.wrapNetworkError(err);
+                });
+                if (!res.ok || !res.body) {
+                    const body = await res.text().catch(() => '');
+                    throw new ProviderError(`anthropic API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
+                }
+                let full = '';
                 try {
-                    const json = JSON.parse(data);
-                    if (json.type === 'content_block_delta' && json.delta?.type === 'text_delta') {
-                        const text = json.delta.text;
-                        full += text;
-                        onText(text);
+                    for await (const data of sseEvents(res.body)) {
+                        guard.resetIdleTimer();
+                        try {
+                            const json = JSON.parse(data);
+                            if (json.type === 'content_block_delta' && json.delta?.type === 'text_delta') {
+                                const text = json.delta.text;
+                                full += text;
+                                onText(text);
+                            }
+                            accumulateUsage(json, usage);
+                        }
+                        catch {
+                            // Ignore malformed/keep-alive chunks
+                        }
                     }
                 }
-                catch {
-                    // Ignore malformed/keep-alive chunks
+                catch (e) {
+                    throw guard.wrapStreamError(e);
                 }
+                if (onUsage)
+                    onUsage(usage);
+                return full;
+            }
+            finally {
+                guard.dispose();
             }
-            return full;
         },
     };
 }

package/dist/providers/detect.js

@@ -38,11 +38,19 @@ export const PROVIDER_PATTERNS = [
     // they always fall back to the interactive provider-selection list.
 ];
 /**
- * Sanitize a pasted API key: trim whitespace/newlines and strip
- * surrounding quotes (users often paste keys with extra characters).
+ * Sanitize a pasted API key: strip characters that can't be sent in an HTTP
+ * header, trim whitespace/newlines, and strip surrounding quotes.
+ *
+ * API keys are always printable ASCII, but pasting one — especially on an
+ * RTL/multilingual system — can silently pull in invisible bidi marks
+ * (U+200E/U+200F), a non-breaking space, smart quotes, or a stray newline.
+ * `fetch()` then rejects the Authorization header with a cryptic
+ * "character … has a value greater than 255" error on *every* request. We
+ * drop anything outside printable ASCII up front so that never happens.
  */
 export function sanitizeKey(raw) {
-    let key = raw.trim();
+    // Keep only space + printable ASCII (0x20–0x7E); trim() handles edge spaces.
+    let key = raw.replace(/[^\x20-\x7E]/g, '').trim();
     // Strip matching surrounding quotes ("key", 'key', `key`)
     while (key.length >= 2 && `"'\``.includes(key[0]) && key[0] === key[key.length - 1]) {
         key = key.slice(1, -1).trim();

package/dist/providers/detect.test.js

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { sanitizeKey, detectProvider } from './detect.js';
+describe('sanitizeKey', () => {
+    it('trims surrounding whitespace and quotes', () => {
+        expect(sanitizeKey('  gsk_abc123  ')).toBe('gsk_abc123');
+        expect(sanitizeKey('"gsk_abc123"')).toBe('gsk_abc123');
+        expect(sanitizeKey("'gsk_abc123'")).toBe('gsk_abc123');
+    });
+    it('strips invisible bidi marks pasted on RTL systems', () => {
+        // U+200F RIGHT-TO-LEFT MARK embedded around the key — the exact class of
+        // char that makes fetch() throw "value greater than 255" on the header.
+        expect(sanitizeKey('‏gsk_abc123‏')).toBe('gsk_abc123');
+        expect(sanitizeKey('gsk_‎abc123')).toBe('gsk_abc123');
+    });
+    it('strips non-breaking spaces, newlines, and smart quotes', () => {
+        expect(sanitizeKey('gsk_abc 123')).toBe('gsk_abc123');
+        expect(sanitizeKey('gsk_abc123\n')).toBe('gsk_abc123');
+        expect(sanitizeKey('“gsk_abc123”')).toBe('gsk_abc123');
+    });
+    it('produces a header-safe (all printable ASCII) result', () => {
+        const cleaned = sanitizeKey('‏gsk_ab c123');
+        expect([...cleaned].every((ch) => ch.charCodeAt(0) >= 0x21 && ch.charCodeAt(0) <= 0x7e)).toBe(true);
+    });
+    it('leaves a clean key untouched and still auto-detects the provider', () => {
+        const key = sanitizeKey('gsk_1234567890');
+        expect(key).toBe('gsk_1234567890');
+        expect(detectProvider(key)).toBe('groq');
+    });
+});

package/dist/providers/index.js

@@ -5,6 +5,8 @@
 import { PROVIDER_INFO } from './types.js';
 import { createAnthropicProvider } from './anthropic.js';
 import { createOpenAICompatProvider } from './openai-compat.js';
+import { defaultModelFor } from './manifest.js';
+export { refreshManifest } from './manifest.js';
 export { detectProvider, sanitizeKey, PROVIDER_PATTERNS } from './detect.js';
 export { PROVIDER_INFO, ProviderError } from './types.js';
 /** Base URLs for the OpenAI-compatible providers. */
@@ -23,12 +25,25 @@ const BASE_URLS = {
     moonshot: 'https://api.moonshot.cn/v1', // Kimi — free quota on signup
     minimax: 'https://api.minimax.chat/v1', // MiniMax-Text-01 — free tier
 };
+/**
+ * Provider ids whose APIs reliably support native function-calling. Others
+ * (and unknown URL-based endpoints) fall back to the text `vexi-tool` protocol.
+ */
+const NATIVE_TOOL_PROVIDERS = new Set([
+    'anthropic', 'openai', 'openrouter', 'groq', 'gemini', 'mistral',
+    'cerebras', 'deepseek', 'qwen', 'moonshot', 'glm',
+]);
+/** Whether native function-calling should be used for a given provider id. */
+export function providerSupportsNativeTools(id) {
+    return NATIVE_TOOL_PROVIDERS.has(id);
+}
 export function createProvider(id, apiKey, model) {
     const info = PROVIDER_INFO[id];
     if (!info) {
         throw new Error(`Unknown provider "${id}". Run \`vexi config reset\` to reconfigure.`);
     }
-    const resolvedModel = model ?? info.defaultModel;
+    // Prefer an explicit model, then a remote-manifest default, then the compiled-in default.
+    const resolvedModel = model ?? defaultModelFor(id, info.defaultModel);
     if (id === 'anthropic') {
         return createAnthropicProvider(apiKey, resolvedModel);
     }
@@ -41,6 +56,7 @@ export function createProvider(id, apiKey, model) {
         apiKey,
         model: resolvedModel,
         extraHeaders,
+        supportsTools: providerSupportsNativeTools(id),
     });
 }
 /**
@@ -53,7 +69,7 @@ export function createProviderFromConfig(config) {
         // Old-style config: route by ProviderId
         return createProvider(config.provider, config.apiKey, config.model);
     }
-    const model = config.model ?? 'gpt-4o';
+    const model = config.model ?? defaultModelFor(config.provider, 'gpt-4o');
     if (config.provider === 'anthropic') {
         return createAnthropicProvider(config.apiKey, model, config.baseUrl);
     }
@@ -69,5 +85,6 @@ export function createProviderFromConfig(config) {
         model,
         extraHeaders,
         extraBody,
+        supportsTools: providerSupportsNativeTools(config.provider),
     });
 }

package/dist/providers/manifest.js

@@ -0,0 +1,96 @@
+/**
+ * Remote model manifest — Feature #4.
+ *
+ * Default models drift as providers ship new versions. Hardcoding them in
+ * PROVIDER_INFO means a stale default requires a full Vexi release to fix.
+ * This module lets Vexi pick up refreshed defaults from a small, version-pinned
+ * JSON manifest hosted at vexi.pro, cached locally, with the compiled-in
+ * PROVIDER_INFO defaults as the always-safe fallback.
+ *
+ * Design mirrors the npm update check (src/update): a synchronous read of the
+ * local cache on the hot path, plus a best-effort background refresh that never
+ * blocks startup and swallows all errors.
+ *
+ *   manifest shape:  { "version": 1, "defaults": { "openai": "gpt-4o-mini", … } }
+ */
+import { promises as fs } from 'node:fs';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { VEXI_DIR } from '../config.js';
+const MANIFEST_URL = 'https://vexi.pro/models.json';
+const MANIFEST_CACHE_PATH = join(VEXI_DIR, 'models.json');
+const REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const FETCH_TIMEOUT_MS = 1500;
+/** Manifest schema version this Vexi understands. Newer manifests are ignored. */
+const SUPPORTED_MANIFEST_VERSION = 1;
+/** Validate an unknown value as a usable manifest, or return null. */
+function parseManifest(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const obj = raw;
+    if (obj.version !== SUPPORTED_MANIFEST_VERSION)
+        return null;
+    if (!obj.defaults || typeof obj.defaults !== 'object')
+        return null;
+    const defaults = {};
+    for (const [k, v] of Object.entries(obj.defaults)) {
+        if (typeof v === 'string' && v.trim())
+            defaults[k] = v.trim();
+    }
+    return { version: SUPPORTED_MANIFEST_VERSION, defaults };
+}
+/**
+ * Read the locally cached manifest synchronously (hot path). Returns null when
+ * absent, unreadable, malformed, or a version this build doesn't support.
+ */
+function loadCachedManifest() {
+    try {
+        const raw = readFileSync(MANIFEST_CACHE_PATH, 'utf8');
+        return parseManifest(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the default model for a provider id: a cached remote override if one
+ * exists, otherwise the compiled-in fallback. Never throws.
+ */
+export function defaultModelFor(id, fallback) {
+    const manifest = loadCachedManifest();
+    return manifest?.defaults[id] ?? fallback;
+}
+/**
+ * Best-effort background refresh of the model manifest. Fire-and-forget from
+ * startup — returns immediately if the cache is fresh, otherwise fetches (max
+ * 1500 ms) and rewrites the cache. All errors are swallowed.
+ */
+export async function refreshManifest() {
+    try {
+        const cacheRaw = await fs.readFile(MANIFEST_CACHE_PATH, 'utf8').catch(() => null);
+        if (cacheRaw) {
+            try {
+                const cache = JSON.parse(cacheRaw);
+                const age = Date.now() - new Date(cache.lastCheck).getTime();
+                if (Number.isFinite(age) && age < REFRESH_INTERVAL_MS)
+                    return; // still fresh
+            }
+            catch {
+                // malformed cache — fall through and refetch
+            }
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        const res = await fetch(MANIFEST_URL, { signal: controller.signal }).finally(() => clearTimeout(timer));
+        if (!res.ok)
+            return;
+        const manifest = parseManifest(await res.json());
+        if (!manifest)
+            return;
+        await fs.mkdir(VEXI_DIR, { recursive: true }).catch(() => { });
+        await fs.writeFile(MANIFEST_CACHE_PATH, JSON.stringify({ ...manifest, lastCheck: new Date().toISOString() }), 'utf8').catch(() => { });
+    }
+    catch {
+        // network error, timeout, or bad JSON — silently ignored
+    }
+}

package/dist/providers/manifest.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { promises as fs } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+// config.ts derives VEXI_DIR from os.homedir() at import time, and manifest.ts
+// imports VEXI_DIR from it. Mock homedir to a throwaway dir and re-import so the
+// cache path is deterministic on every platform (no reliance on $HOME/$USERPROFILE).
+let home;
+let defaultModelFor;
+let refreshManifest;
+beforeEach(async () => {
+    home = await fs.mkdtemp(join(tmpdir(), 'vexi-manifest-'));
+    vi.resetModules();
+    vi.doMock('node:os', async (importOriginal) => {
+        const actual = await importOriginal();
+        return { ...actual, homedir: () => home };
+    });
+    const mod = await import('./manifest.js');
+    defaultModelFor = mod.defaultModelFor;
+    refreshManifest = mod.refreshManifest;
+});
+afterEach(async () => {
+    vi.doUnmock('node:os');
+    vi.restoreAllMocks();
+    await fs.rm(home, { recursive: true, force: true });
+});
+async function writeCache(obj) {
+    await fs.mkdir(join(home, '.vexi'), { recursive: true });
+    await fs.writeFile(join(home, '.vexi', 'models.json'), JSON.stringify(obj), 'utf8');
+}
+describe('defaultModelFor', () => {
+    it('returns the compiled-in fallback when no cache exists', () => {
+        expect(defaultModelFor('openai', 'gpt-4o-mini')).toBe('gpt-4o-mini');
+    });
+    it('prefers a cached remote override', async () => {
+        await writeCache({ version: 1, defaults: { openai: 'gpt-5-mini' }, lastCheck: new Date().toISOString() });
+        expect(defaultModelFor('openai', 'gpt-4o-mini')).toBe('gpt-5-mini');
+        expect(defaultModelFor('anthropic', 'claude-sonnet-5')).toBe('claude-sonnet-5'); // not overridden → fallback
+    });
+    it('ignores a manifest with an unsupported version', async () => {
+        await writeCache({ version: 99, defaults: { openai: 'from-the-future' }, lastCheck: new Date().toISOString() });
+        expect(defaultModelFor('openai', 'gpt-4o-mini')).toBe('gpt-4o-mini');
+    });
+    it('ignores malformed cache files', async () => {
+        await fs.mkdir(join(home, '.vexi'), { recursive: true });
+        await fs.writeFile(join(home, '.vexi', 'models.json'), 'not json', 'utf8');
+        expect(defaultModelFor('groq', 'llama-3.3-70b-versatile')).toBe('llama-3.3-70b-versatile');
+    });
+});
+describe('refreshManifest', () => {
+    it('fetches and caches a valid manifest, which then feeds defaultModelFor', async () => {
+        vi.stubGlobal('fetch', vi.fn(async () => ({
+            ok: true,
+            json: async () => ({ version: 1, defaults: { deepseek: 'deepseek-v4' } }),
+        })));
+        await refreshManifest();
+        expect(defaultModelFor('deepseek', 'deepseek-chat')).toBe('deepseek-v4');
+    });
+    it('skips the network when the cache is still fresh', async () => {
+        await writeCache({ version: 1, defaults: { openai: 'cached' }, lastCheck: new Date().toISOString() });
+        const fetchSpy = vi.fn();
+        vi.stubGlobal('fetch', fetchSpy);
+        await refreshManifest();
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+    it('swallows network errors and leaves the fallback intact', async () => {
+        vi.stubGlobal('fetch', vi.fn(async () => { throw new Error('offline'); }));
+        await expect(refreshManifest()).resolves.toBeUndefined();
+        expect(defaultModelFor('openai', 'gpt-4o-mini')).toBe('gpt-4o-mini');
+    });
+});