vskill 0.5.84 → 0.5.86

package/dist/eval-server/api-routes.js

@@ -28,6 +28,9 @@ import { testActivation } from "../eval/activation-tester.js";
 import { detectMcpDependencies, detectSkillDependencies } from "../eval/mcp-detector.js";
 import { writeActivationRun, listActivationRuns, getActivationRun } from "../eval/activation-history.js";
 import { AGENTS_REGISTRY, detectInstalledAgents } from "../agents/agents-registry.js";
+import { resolveOllamaBaseUrl } from "../eval/env.js";
+import * as settingsStore from "./settings-store.js";
+import { loadStudioSelection, saveStudioSelection } from "./studio-json.js";
 /**
  * Build the response for GET /api/agents/installed.
  * Returns all known agents with installed flag based on detected agents.
@@ -299,22 +302,44 @@ const PROVIDER_MODELS = {
         { id: "meta-llama/llama-3.1-70b-instruct", label: "Llama 3.1 70B" },
         { id: "google/gemini-2.5-pro", label: "Gemini 2.5 Pro (via OpenRouter)" },
     ],
+    // LM Studio's default model list is empty because the actual list depends on
+    // what models the user has loaded. The probe at probeLmStudio() populates
+    // this dynamically from GET /v1/models.
+    "lm-studio": [],
 };
 // ---------------------------------------------------------------------------
-// Ollama detection cache — avoids 500ms+ probe on every /api/config request.
-// Without this, page load blocks on a 2s timeout when Ollama is not running.
+// Local provider detection caches — avoid 500ms+ probes on every /api/config
+// request. Without the caches, page load blocks on the timeout when the
+// local server is not running. TTL is 30s to balance freshness with latency.
+//
+// Both Ollama and LM Studio share the same TTL and silent-failure semantics
+// (probe → non-2xx / throw → `available: false`, no log above debug).
+//
+// Follow-up (out of scope for 0677): Ollama's upstream standard env var is
+// OLLAMA_HOST but this codebase uses OLLAMA_BASE_URL. Do not change here;
+// tracked separately.
 // ---------------------------------------------------------------------------
+const PROBE_CACHE_TTL = 30_000; // re-probe every 30s
 let ollamaCache = null;
-const OLLAMA_CACHE_TTL = 30_000; // re-probe every 30s
+let lmStudioCache = null;
+export const OPENROUTER_CACHE = new Map();
+export function resetOpenRouterCache() {
+    OPENROUTER_CACHE.clear();
+}
+/** Test hook: clear all probe caches so the next detectAvailableProviders() re-probes. */
+export function resetDetectionCache() {
+    ollamaCache = null;
+    lmStudioCache = null;
+}
 async function probeOllama() {
     const now = Date.now();
-    if (ollamaCache && now - ollamaCache.ts < OLLAMA_CACHE_TTL) {
+    if (ollamaCache && now - ollamaCache.ts < PROBE_CACHE_TTL) {
         return ollamaCache;
     }
     let models = PROVIDER_MODELS["ollama"];
     let available = false;
     try {
-        const baseUrl = process.env.OLLAMA_BASE_URL || "http://localhost:11434";
+        const baseUrl = resolveOllamaBaseUrl(process.env);
         const resp = await fetch(`${baseUrl}/api/tags`, { signal: AbortSignal.timeout(500) });
         if (resp.ok) {
             available = true;
@@ -328,37 +353,128 @@ async function probeOllama() {
     ollamaCache = { available, models, ts: now };
     return ollamaCache;
 }
-async function detectAvailableProviders() {
+// ---------------------------------------------------------------------------
+// probeLmStudio — hits GET <base>/models to detect LM Studio and populate the
+// model list from the server's loaded models. Mirrors the Ollama pattern:
+// 500ms AbortSignal timeout, 30s in-memory cache, silent failure on any
+// exception. Base URL is overridable via LM_STUDIO_BASE_URL.
+// ---------------------------------------------------------------------------
+async function probeLmStudio() {
+    const now = Date.now();
+    if (lmStudioCache && now - lmStudioCache.ts < PROBE_CACHE_TTL) {
+        return lmStudioCache;
+    }
+    let models = PROVIDER_MODELS["lm-studio"];
+    let available = false;
+    try {
+        const baseUrl = process.env.LM_STUDIO_BASE_URL || "http://localhost:1234/v1";
+        const resp = await fetch(`${baseUrl}/models`, { signal: AbortSignal.timeout(500) });
+        if (resp.ok) {
+            available = true;
+            const data = await resp.json();
+            if (data.data?.length) {
+                models = data.data.map((m) => ({ id: m.id, label: m.id }));
+            }
+        }
+    }
+    catch { /* lm studio not running */ }
+    lmStudioCache = { available, models, ts: now };
+    return lmStudioCache;
+}
+const DETECTION_WRAPPER_FOLDERS = [
+    ".claude",
+    ".cursor",
+    ".codex",
+    ".gemini",
+    ".github",
+    ".zed",
+    ".specweave",
+];
+const DETECTION_BINARIES = ["claude", "cursor", "codex", "gemini"];
+let detectionCache = null;
+const DETECTION_CACHE_TTL = 30_000;
+export function resetProjectDetectionCache() {
+    detectionCache = null;
+}
+/**
+ * Scan the project root for known agent wrapper folders and the system
+ * PATH for known agent binaries. Cheap synchronous scan (`existsSync` +
+ * `which`) cached for 30 s so repeated `/api/config` polls don't burn CPU.
+ */
+export function detectProjectAgents(root) {
+    const now = Date.now();
+    if (detectionCache && now - detectionCache.ts < DETECTION_CACHE_TTL) {
+        return detectionCache.data;
+    }
+    const wrapperFolders = {};
+    for (const folder of DETECTION_WRAPPER_FOLDERS) {
+        try {
+            wrapperFolders[folder] = existsSync(join(root, folder));
+        }
+        catch {
+            wrapperFolders[folder] = false;
+        }
+    }
+    const binaries = {};
+    for (const bin of DETECTION_BINARIES) {
+        binaries[bin] = isBinaryOnPath(bin);
+    }
+    const data = { wrapperFolders, binaries };
+    detectionCache = { data, ts: now };
+    return data;
+}
+function isBinaryOnPath(name) {
+    try {
+        const cmd = process.platform === "win32" ? `where ${name}` : `command -v ${name}`;
+        execSync(cmd, { stdio: "ignore", timeout: 1000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function detectAvailableProviders() {
     const providers = [];
-    // Claude CLI — always available for the eval server (runs in a separate terminal)
+    // Claude CLI — delegates to the `claude` binary; the CLI owns session auth.
+    // See src/eval/llm.ts createClaudeCliClient compliance doc-block.
     providers.push({
         id: "claude-cli",
-        label: "Claude (Max/Pro subscription)",
+        label: "Use current Claude Code session",
         available: true,
         models: PROVIDER_MODELS["claude-cli"],
     });
-    // Anthropic API — available if ANTHROPIC_API_KEY is set
+    // Anthropic API — available if ANTHROPIC_API_KEY is set OR a key is in the
+    // settings-store (browser tier or Darwin keychain).
     providers.push({
         id: "anthropic",
-        label: "Anthropic API (requires key)",
-        available: !!process.env.ANTHROPIC_API_KEY,
+        label: "Anthropic API",
+        available: !!process.env.ANTHROPIC_API_KEY ||
+            settingsStore.hasKeySync("anthropic"),
         models: PROVIDER_MODELS["anthropic"],
     });
-    // OpenRouter — available if OPENROUTER_API_KEY is set
+    // OpenRouter — available if OPENROUTER_API_KEY is set OR a key is stored.
     providers.push({
         id: "openrouter",
-        label: "OpenRouter (100+ models, requires key)",
-        available: !!process.env.OPENROUTER_API_KEY,
+        label: "OpenRouter",
+        available: !!process.env.OPENROUTER_API_KEY ||
+            settingsStore.hasKeySync("openrouter"),
         models: PROVIDER_MODELS["openrouter"],
     });
-    // Ollama — cached probe (500ms timeout, refreshes every 30s)
-    const ollama = await probeOllama();
+    // Local providers (Ollama + LM Studio) — cached probes fired in parallel so
+    // total detection time stays ≤ 550ms even if both time out.
+    const [ollama, lmStudio] = await Promise.all([probeOllama(), probeLmStudio()]);
     providers.push({
         id: "ollama",
         label: "Ollama (local, free)",
         available: ollama.available,
         models: ollama.models,
     });
+    providers.push({
+        id: "lm-studio",
+        label: "LM Studio (local, free)",
+        available: lmStudio.available,
+        models: lmStudio.models,
+    });
     return providers;
 }
 export function registerRoutes(router, root, projectName) {
@@ -401,19 +517,41 @@ export function registerRoutes(router, root, projectName) {
         req.on("close", cleanup);
         req.on("aborted", cleanup);
     });
-    // OpenRouter model search proxy
+    // OpenRouter model search proxy — 10-minute in-memory cache keyed by the
+    // last-8 chars of the API key so different keys don't collide while the
+    // key itself is never stored in the cache map. Stale cache served (with
+    // X-Vskill-Catalog-Age header) when upstream is down.
     router.get("/api/openrouter/models", async (_req, res) => {
-        const apiKey = process.env.OPENROUTER_API_KEY;
+        const envKey = process.env.OPENROUTER_API_KEY;
+        const storedKey = settingsStore.readKeySync("openrouter");
+        const apiKey = envKey || storedKey;
         if (!apiKey) {
             sendJson(res, { error: "OPENROUTER_API_KEY not configured" }, 400);
             return;
         }
+        const cacheKey = apiKey.slice(-8);
+        const now = Date.now();
+        const cached = OPENROUTER_CACHE.get(cacheKey);
+        const CACHE_TTL_MS = 600_000; // 10 min
+        // Fresh cache hit — serve immediately without upstream.
+        if (cached && now - cached.fetchedAt < CACHE_TTL_MS) {
+            const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+            res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+            sendJson(res, { models: cached.value, ageSec });
+            return;
+        }
         try {
             const resp = await fetch("https://openrouter.ai/api/v1/models", {
                 headers: { "Authorization": `Bearer ${apiKey}` },
                 signal: AbortSignal.timeout(10_000),
             });
             if (!resp.ok) {
+                if (cached) {
+                    const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+                    res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+                    sendJson(res, { models: cached.value, ageSec, stale: true });
+                    return;
+                }
                 sendJson(res, { error: `OpenRouter API returned ${resp.status}` }, 502);
                 return;
             }
@@ -421,40 +559,122 @@ export function registerRoutes(router, root, projectName) {
             const models = (data.data || []).map((m) => ({
                 id: m.id,
                 name: m.name || m.id,
+                contextWindow: typeof m.context_length === "number" ? m.context_length : undefined,
                 pricing: {
                     prompt: parseFloat(m.pricing?.prompt || "0"),
                     completion: parseFloat(m.pricing?.completion || "0"),
                 },
             }));
-            sendJson(res, { models });
+            OPENROUTER_CACHE.set(cacheKey, { value: models, fetchedAt: now });
+            res.setHeader?.("X-Vskill-Catalog-Age", "0");
+            sendJson(res, { models, ageSec: 0 });
         }
         catch (err) {
+            if (cached) {
+                const ageSec = Math.floor((now - cached.fetchedAt) / 1000);
+                res.setHeader?.("X-Vskill-Catalog-Age", String(ageSec));
+                sendJson(res, { models: cached.value, ageSec, stale: true });
+                return;
+            }
             sendJson(res, { error: err.message }, 500);
         }
     });
+    // Settings / API key endpoints (0682 — US-004).
+    // Keys live on-device only. Never logged, never synced, never returned
+    // through GET. Response includes only metadata (stored, updatedAt, tier).
+    router.get("/api/settings/keys", async (_req, res) => {
+        sendJson(res, settingsStore.listKeys());
+    });
+    router.post("/api/settings/keys", async (req, res) => {
+        // Reject any request that smuggles the key in a query-string — JSON body only.
+        const url = req.url || "";
+        if (/[?&]key=/.test(url)) {
+            sendJson(res, { error: "key must not appear in query string" }, 400);
+            return;
+        }
+        const body = (await readBody(req));
+        if (!body.key || typeof body.key !== "string" || body.key.trim().length === 0) {
+            sendJson(res, { error: "key must be non-empty string" }, 400);
+            return;
+        }
+        if (body.provider !== "anthropic" && body.provider !== "openrouter") {
+            sendJson(res, { error: `unknown provider: ${String(body.provider)}` }, 400);
+            return;
+        }
+        try {
+            const saved = await settingsStore.saveKey(body.provider, body.key.trim(), body.tier ?? "browser");
+            // Prefix hint — non-blocking, purely informational
+            let warning;
+            if (body.provider === "anthropic" && !body.key.startsWith("sk-ant-")) {
+                warning = "key doesn't match typical Anthropic prefix sk-ant-";
+            }
+            else if (body.provider === "openrouter" && !body.key.startsWith("sk-or-")) {
+                warning = "key doesn't match typical OpenRouter prefix sk-or-";
+            }
+            sendJson(res, {
+                ok: true,
+                updatedAt: saved.updatedAt,
+                tier: saved.tier,
+                available: true,
+                ...(warning ? { warning } : {}),
+            });
+        }
+        catch (err) {
+            sendJson(res, { error: err.message }, 500);
+        }
+    });
+    router.delete("/api/settings/keys/:provider", async (req, res) => {
+        const provider = req.params?.provider;
+        if (provider !== "anthropic" && provider !== "openrouter") {
+            sendJson(res, { error: `unknown provider: ${String(provider)}` }, 400);
+            return;
+        }
+        await settingsStore.removeKey(provider);
+        sendJson(res, { ok: true });
+    });
     // Config — expose current provider/model + available providers + project
     // IMPORTANT: Return raw model IDs (e.g. "sonnet"), NOT display models
     // (e.g. "claude-sonnet"). The frontend round-trips config.model back to
     // generate-evals and other endpoints, so it must be a valid CLI model ID.
     router.get("/api/config", async (_req, res) => {
+        // On first load (no currentOverrides), try to restore from .vskill/studio.json.
+        if (!currentOverrides.provider) {
+            const stored = loadStudioSelection(root);
+            if (stored) {
+                currentOverrides.provider = stored.activeAgent;
+                if (stored.activeModel)
+                    currentOverrides.model = stored.activeModel;
+            }
+        }
         try {
             // Validate the client can be created (catches missing API keys etc.)
             getClient();
             const providers = await detectAvailableProviders();
+            const detection = detectProjectAgents(root);
             sendJson(res, {
                 provider: currentOverrides.provider || null,
                 model: getEffectiveRawModel(),
                 providers,
+                detection,
                 projectName: projectName || null,
                 root,
             });
         }
         catch (err) {
             const providers = await detectAvailableProviders().catch(() => []);
-            sendJson(res, { provider: null, model: "unknown", error: err.message, providers, projectName: projectName || null, root });
+            const detection = detectProjectAgents(root);
+            sendJson(res, {
+                provider: null,
+                model: "unknown",
+                error: err.message,
+                providers,
+                detection,
+                projectName: projectName || null,
+                root,
+            });
         }
     });
-    // Update config — change provider/model at runtime
+    // Update config — change provider/model at runtime and persist atomically.
     router.post("/api/config", async (req, res) => {
         const body = (await readBody(req));
         if (body.provider)
@@ -468,6 +688,21 @@ export function registerRoutes(router, root, projectName) {
             // Validate the client can be created
             getClient();
             const providers = await detectAvailableProviders();
+            // Persist to .vskill/studio.json (atomic tmp-then-rename). Fire-and-forget
+            // from the handler's perspective — errors are logged but not surfaced,
+            // matching how currentOverrides already survives process lifetime.
+            if (currentOverrides.provider) {
+                try {
+                    await saveStudioSelection(root, {
+                        activeAgent: currentOverrides.provider,
+                        activeModel: getEffectiveRawModel(),
+                        updatedAt: new Date().toISOString(),
+                    });
+                }
+                catch (e) {
+                    console.warn(`[studio.json] atomic write failed: ${e.message}`);
+                }
+            }
             sendJson(res, { provider: currentOverrides.provider || null, model: getEffectiveRawModel(), providers });
         }
         catch (err) {