Three findings, and the first two are the same recurring shape. envKeyForProvider (env.go) is now the single definition of the LLM_<NAME> form. It lived in two places — lazy resolution in registry.go and the missing-key hint in openaiCompatScheme — with a comment on the second asserting it matched the first. A comment is not enforcement: if either had drifted, a keyless DSN target would have named a variable that does nothing, and nothing would have failed. The kimi and qwen test files had become near-identical, which is round 1's finding at the level above it: I deduped the fixtures, then left two parallel suites asserting the same four things. They are now ONE table in builtin_openaicompat_test.go — endpoint + credential, missing key fails closed naming its own variable and never reaching the network, the name:// DSN reaching another host, and a keyless DSN naming LLM_<NAME> instead of the built-in's key. Adding an OpenAI-compat built-in is a table row that immediately owes all four; builtin_kimi_test.go is deleted because the table covers it. Only genuinely qwen-specific tests remain in the qwen file: the reverse credential leak and the reasoning_effort wire claim ADR-0027 rests on. Also trimmed ProviderQwen's doc comment, which restated the ADR-0027 rationale already given at the registration site. The break-check suite caught its own rot again — two mutations went stale when these tests were renamed, and the landed-check reported them loudly instead of passing them off as green. Now 9 cases, including one that drifts envKeyForProvider to prove the shared helper is load-bearing. 9/9 apply and are caught. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
213 lines
9.0 KiB
Go
213 lines
9.0 KiB
Go
package majordomo
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/llm"
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/provider/anthropic"
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/provider/google"
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/provider/llamaswap"
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/provider/ollama"
|
|
"gitea.stevedudenhoeffer.com/steve/majordomo/provider/openai"
|
|
)
|
|
|
|
// Built-in provider names.
|
|
const (
|
|
ProviderOpenAI = "openai"
|
|
// ProviderKimi is Moonshot AI's Kimi models over their OpenAI-compatible
|
|
// Chat Completions endpoint. Reuses the openai client (like llama-swap);
|
|
// keyed by KIMI_API_KEY, default base URL kimiBaseURL.
|
|
ProviderKimi = "kimi"
|
|
// ProviderQwen is Alibaba's Qwen models over Model Studio's
|
|
// OpenAI-compatible Chat Completions endpoint. Reuses the openai client
|
|
// (like kimi and llama-swap); keyed by QWEN_API_KEY, default base URL
|
|
// qwenBaseURL. ADR-0027 records why the OpenAI surface and not the
|
|
// Anthropic-compatible one Model Studio also exposes.
|
|
ProviderQwen = "qwen"
|
|
ProviderAnthropic = "anthropic"
|
|
ProviderGoogle = "google"
|
|
ProviderOllama = "ollama"
|
|
ProviderOllamaCloud = "ollama-cloud"
|
|
ProviderForeman = "foreman"
|
|
ProviderLlamaSwap = "llama-swap"
|
|
// ProviderLlamaSwapTLS is the DSN scheme for a TLS-fronted llama-swap
|
|
// (https base URL). It is a scheme only, not a default built-in provider
|
|
// name. Why a separate scheme rather than auto-detecting: a DSN carries no
|
|
// reliable signal for http vs https, so the choice is explicit
|
|
// (llama-swap = http local-first, llama-swaps = https), mirroring rediss.
|
|
ProviderLlamaSwapTLS = "llama-swaps"
|
|
)
|
|
|
|
// kimiBaseURL is Moonshot AI's international OpenAI-compatible endpoint. The
|
|
// China endpoint (api.moonshot.cn/v1) is reachable via a kimi:// LLM_* DSN.
|
|
const kimiBaseURL = "https://api.moonshot.ai/v1"
|
|
|
|
// qwenBaseURL is Alibaba Model Studio's international (Singapore) endpoint in
|
|
// OpenAI-compatible mode. The China endpoint
|
|
// (dashscope.aliyuncs.com/compatible-mode/v1) and any regional host are
|
|
// reachable via a qwen:// LLM_* DSN.
|
|
const qwenBaseURL = "https://dashscope-intl.aliyuncs.com/compatible-mode/v1"
|
|
|
|
// openaiCompatScheme builds the DSN factory shared by every built-in that is
|
|
// "the openai client pointed somewhere else" (kimi, qwen, ...). The provider
|
|
// is named after the LLM_<NAME> var that defined it, takes its credential from
|
|
// the DSN token — not the built-in's own env var, which does nothing for a
|
|
// DSN-defined provider — and so names that same LLM_<NAME> var in the
|
|
// missing-key hint, matching the lazy-resolution key form in providerFor.
|
|
//
|
|
// wrap is the caller's option-decorator (it injects the registry's HTTP
|
|
// client), so a DSN provider is built exactly like the eager built-ins.
|
|
func openaiCompatScheme(wrap func(...openai.Option) []openai.Option) SchemeFactory {
|
|
return func(name string, dsn DSN) (llm.Provider, error) {
|
|
return openai.New(wrap(
|
|
openai.WithName(name),
|
|
openai.WithBaseURL(dsn.BaseURL()),
|
|
openai.WithAPIKey(dsn.Token),
|
|
openai.WithAPIKeyName(envKeyForProvider(name)),
|
|
)...), nil
|
|
}
|
|
}
|
|
|
|
// registerOpenAICompatBuiltin installs BOTH halves of an OpenAI-compat
|
|
// built-in: the eager provider under name (credential from keyEnv) and the
|
|
// matching name:// DSN scheme. Why both in one call: the two halves are a pair
|
|
// — a built-in whose scheme is missing resolves as a spec but not from an
|
|
// LLM_* DSN, and the credential rules below have to hold identically in each.
|
|
// Adding the next one is a single line rather than six lines to copy.
|
|
//
|
|
// The two credential rules, holding by construction for every caller:
|
|
// - WithAPIKey is passed UNCONDITIONALLY, even when the lookup comes back
|
|
// empty. openai.New defaults its key to OPENAI_API_KEY, so anything less
|
|
// lets an unset keyEnv silently authenticate as OpenAI.
|
|
// - WithAPIKeyName makes the synthetic-401 hint name keyEnv, so a keyless
|
|
// call tells the operator the variable that actually fixes it.
|
|
func registerOpenAICompatBuiltin(r *Registry, wrap func(...openai.Option) []openai.Option, name, baseURL, keyEnv string) {
|
|
r.providers[name] = openai.New(wrap(
|
|
openai.WithName(name),
|
|
openai.WithBaseURL(baseURL),
|
|
openai.WithAPIKey(r.envLookup(keyEnv)),
|
|
openai.WithAPIKeyName(keyEnv),
|
|
)...)
|
|
r.schemes[name] = openaiCompatScheme(wrap)
|
|
}
|
|
|
|
// registerBuiltins installs the built-in providers and env-DSN scheme
|
|
// factories into a fresh registry. httpClient, when non-nil, is used by
|
|
// every provider and factory the registry itself constructs.
|
|
func registerBuiltins(r *Registry, httpClient *http.Client) {
|
|
ollamaOpts := func(extra ...ollama.Option) []ollama.Option {
|
|
if httpClient != nil {
|
|
extra = append(extra, ollama.WithHTTPClient(httpClient))
|
|
}
|
|
return extra
|
|
}
|
|
|
|
// Native-Ollama family: three names over one client with presets.
|
|
r.providers[ProviderOllama] = ollama.Local(ollamaOpts()...)
|
|
r.providers[ProviderOllamaCloud] = ollama.Cloud(ollamaOpts()...)
|
|
// foreman has no default URL; the no-DSN registration resolves but
|
|
// errors on use with a clear message (use an LLM_* DSN or
|
|
// ollama.Foreman(...) + RegisterProvider).
|
|
r.providers[ProviderForeman] = ollama.New(ollamaOpts(ollama.WithName(ProviderForeman))...)
|
|
|
|
ollamaScheme := func(name string, dsn DSN) (llm.Provider, error) {
|
|
return ollama.New(ollamaOpts(
|
|
ollama.WithName(name),
|
|
ollama.WithBaseURL(dsn.BaseURL()),
|
|
ollama.WithToken(dsn.Token),
|
|
)...), nil
|
|
}
|
|
r.schemes[ProviderOllama] = ollamaScheme
|
|
r.schemes[ProviderOllamaCloud] = ollamaScheme
|
|
r.schemes[ProviderForeman] = ollamaScheme
|
|
|
|
// OpenAI and OpenAI-compatible endpoints.
|
|
openaiOpts := func(extra ...openai.Option) []openai.Option {
|
|
if httpClient != nil {
|
|
extra = append(extra, openai.WithHTTPClient(httpClient))
|
|
}
|
|
return extra
|
|
}
|
|
r.providers[ProviderOpenAI] = openai.New(openaiOpts()...)
|
|
r.schemes[ProviderOpenAI] = func(name string, dsn DSN) (llm.Provider, error) {
|
|
return openai.New(openaiOpts(
|
|
openai.WithName(name),
|
|
openai.WithBaseURL(dsn.BaseURL()),
|
|
openai.WithAPIKey(dsn.Token),
|
|
)...), nil
|
|
}
|
|
|
|
// Third-party endpoints that ARE the openai client at another base URL —
|
|
// no new package, mirroring llama-swap's chat path. Each gets the eager
|
|
// built-in plus its name:// DSN scheme, and the credential rules hold by
|
|
// construction (see registerOpenAICompatBuiltin).
|
|
//
|
|
// kimi (ADR-0026): Moonshot's international endpoint; China host via
|
|
// kimi://[email protected]/v1.
|
|
registerOpenAICompatBuiltin(r, openaiOpts, ProviderKimi, kimiBaseURL, "KIMI_API_KEY")
|
|
// qwen (ADR-0027): Alibaba Model Studio's international host. Model Studio
|
|
// also exposes an Anthropic-compatible endpoint; the ADR records why the
|
|
// OpenAI one is the built-in. China / workspace-scoped regional hosts via
|
|
// qwen://[email protected]/compatible-mode/v1.
|
|
registerOpenAICompatBuiltin(r, openaiOpts, ProviderQwen, qwenBaseURL, "QWEN_API_KEY")
|
|
|
|
// llama-swap: OpenAI-compatible chat + image generation + management
|
|
// endpoints over a model-swapping proxy. Chat reuses the openai client
|
|
// (provider/llamaswap delegates). Two schemes: "llama-swap" builds an
|
|
// http:// base URL (local-first default), "llama-swaps" builds https://
|
|
// for a TLS-fronted instance (mirrors redis/rediss). The no-DSN built-in
|
|
// errors on use with a clear message, mirroring foreman.
|
|
llamaSwapOpts := func(extra ...llamaswap.Option) []llamaswap.Option {
|
|
if httpClient != nil {
|
|
extra = append(extra, llamaswap.WithHTTPClient(httpClient))
|
|
}
|
|
return extra
|
|
}
|
|
llamaSwapScheme := func(urlScheme string) SchemeFactory {
|
|
return func(name string, dsn DSN) (llm.Provider, error) {
|
|
return llamaswap.New(llamaSwapOpts(
|
|
llamaswap.WithName(name),
|
|
llamaswap.WithBaseURL(urlScheme+"://"+dsn.Host),
|
|
llamaswap.WithToken(dsn.Token),
|
|
)...), nil
|
|
}
|
|
}
|
|
r.providers[ProviderLlamaSwap] = llamaswap.New(llamaSwapOpts(llamaswap.WithName(ProviderLlamaSwap))...)
|
|
r.schemes[ProviderLlamaSwap] = llamaSwapScheme("http")
|
|
r.schemes[ProviderLlamaSwapTLS] = llamaSwapScheme("https")
|
|
|
|
// Anthropic and Anthropic-compatible endpoints.
|
|
anthropicOpts := func(extra ...anthropic.Option) []anthropic.Option {
|
|
if httpClient != nil {
|
|
extra = append(extra, anthropic.WithHTTPClient(httpClient))
|
|
}
|
|
return extra
|
|
}
|
|
r.providers[ProviderAnthropic] = anthropic.New(anthropicOpts()...)
|
|
r.schemes[ProviderAnthropic] = func(name string, dsn DSN) (llm.Provider, error) {
|
|
return anthropic.New(anthropicOpts(
|
|
anthropic.WithName(name),
|
|
anthropic.WithBaseURL(dsn.BaseURL()),
|
|
anthropic.WithAPIKey(dsn.Token),
|
|
)...), nil
|
|
}
|
|
|
|
// Google (Gemini) on the official SDK; "gemini" is an alternate scheme.
|
|
googleOpts := func(extra ...google.Option) []google.Option {
|
|
if httpClient != nil {
|
|
extra = append(extra, google.WithHTTPClient(httpClient))
|
|
}
|
|
return extra
|
|
}
|
|
r.providers[ProviderGoogle] = google.New(googleOpts()...)
|
|
googleScheme := func(name string, dsn DSN) (llm.Provider, error) {
|
|
return google.New(googleOpts(
|
|
google.WithName(name),
|
|
google.WithBaseURL(dsn.BaseURL()),
|
|
google.WithAPIKey(dsn.Token),
|
|
)...), nil
|
|
}
|
|
r.schemes[ProviderGoogle] = googleScheme
|
|
r.schemes["gemini"] = googleScheme
|
|
}
|