Files
AgapHost/ai/hindsight-llm/server.js
alvis 9094d71e2f ai: migrate LLM backbone from Kimi CLI to Codex CLI
Retires the Moonshot/Kimi subscription in favour of the already-paid ChatGPT
plan. Both CLI wrappers now run `codex exec`; the kimi-agent container is gone.

adolf-llm + hindsight-llm:
- runKimi -> runCodex (`codex exec --json --skip-git-repo-check`), resume via
  `codex exec resume <thread_id>`.
- MCP moves from a per-session .mcp.json (a workaround for Kimi having no
  --mcp-config-file flag) to a $CODEX_HOME/config.toml generated once at
  startup from shared-mcp.json. Field translation is load-bearing:
  bearerTokenEnvVar -> bearer_token_env_var, enabledTools -> enabled_tools.
- approval_policy="never" + sandbox_mode required, or unattended turns block
  on an approval prompt nobody can answer.

kimi-agent removed. It was the ONLY large-tier deployment behind LiteLLM, so
deleting it outright would have silently degraded every large-tier request to
the local 4B model via the existing fallbacks. tier-large, the auto_router
complex-reasoning route and their fallbacks now point at the codex-backed
adolf-llm wrapper (model_name: codex-agent).

Three environment blockers fixed along the way:
- OpenAI geo-blocks this host (403 unsupported_country_region_territory).
  Both containers now egress via the host xray proxy, with NO_PROXY keeping
  MCP and *.alogins.net traffic off the tunnel.
- node:22-slim ships no system CA store; the Rust codex binary validates TLS
  against it, so every HTTPS call failed with a generic transport error while
  Node's own fetch worked. ca-certificates added to both images.
- `codex exec resume` rejects -C/--cd (plain `codex exec` accepts it), which
  broke follow-up turns while first turns succeeded.

Known regression: Kimi's managed-usage API has no Codex equivalent, so the
/usage route returns 501 and there is no quota probe for the codex model.
The two quota plugins degrade quietly to no output.

Also: stop tracking cognee.env (live LLM + JWT secrets) and gitignore it.
The secrets remain in earlier history and should be rotated.

Verified live: plain turn, SSE streaming, session resume, MCP tool call,
bearer-token MCP call, and completions through both LiteLLM routes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff
2026-08-01 06:13:27 +00:00

198 lines
7.4 KiB
JavaScript

const http = require('http');
const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const { spawn } = require('child_process');
const PORT = 8012;
const MODEL_ID = 'hindsight-llm';
const TIMEOUT_MS = 5 * 60 * 1000; // one-shot structured calls; generous but bounded
// Bounded parallelism: SPIKE-FINDINGS.md gate 5 flagged the Kimi subscription as a
// single-seat, interactive-oriented plan — batch cognify must not hammer it with
// unbounded concurrent CLI spawns (rate-limit/throttle risk on a shared live account).
const MAX_CONCURRENCY = 3;
const WORKSPACE = '/workspace';
fs.mkdirSync(WORKSPACE, { recursive: true });
// The CLI has no raw sampling-temperature knob (it's an agent loop, not a
// completions API) — "low temperature" for structured extraction is enforced
// via an instruction preamble instead, prepended to whatever system prompt
// the caller (Cognee) supplies.
const STRUCTURED_SYSTEM_PREAMBLE = [
'You are a stateless structured-extraction engine.',
'This is a one-shot call with no memory of prior calls: do not reference earlier turns.',
'Respond deterministically and concisely. When asked for JSON, output raw JSON only',
'- no prose, no markdown code fences, no commentary before or after.',
].join(' ');
// --- message helpers ---------------------------------------------------------
// Text only, no media parts: this wrapper's policy is no-media/no-MCP, unlike
// adolf-llm which persists inbound images and lets the CLI's ReadMediaFile
// tool read them.
function textOf(msg) {
const c = msg.content;
if (Array.isArray(c)) return c.map(p => (typeof p.text === 'string' ? p.text : '')).join('\n');
return c == null ? '' : String(c);
}
function buildPrompt(messages) {
const systemParts = messages.filter(m => m.role === 'system').map(textOf);
const rest = messages.filter(m => m.role !== 'system');
const preamble = [STRUCTURED_SYSTEM_PREAMBLE, ...systemParts].join('\n\n');
const transcript = rest
.map(m => `${m.role === 'assistant' ? 'Assistant' : 'User'}: ${textOf(m)}`)
.join('\n\n');
return `${preamble}\n\n${transcript}`.trim();
}
// --- bounded concurrency queue -----------------------------------------------
let active = 0;
const queue = [];
function drain() {
if (queue.length && active < MAX_CONCURRENCY) queue.shift()();
}
function withSlot(fn) {
return new Promise((resolve, reject) => {
const run = () => {
active++;
fn().then(
v => { active--; drain(); resolve(v); },
e => { active--; drain(); reject(e); },
);
};
if (active < MAX_CONCURRENCY) run();
else queue.push(run);
});
}
// --- codex invocation: stateless one-shot, no resume -------------------------
// Fresh temp dir per call, no `exec resume`, discard the dir after.
// Parses `codex exec --json`, which ships two event schemas depending on
// release (see adolf-llm/server.js for the same dual handling):
// legacy: {"msg":{"type":"agent_message_delta","delta":"..."}}
// {"msg":{"type":"agent_message","message":"..."}}
// newer: {"type":"item.completed","item":{"type":"agent_message","text":...}}
// Deltas are preferred when present; the terminal full message is a fallback,
// never an addition, or the extraction output would be duplicated.
function runCodex({ prompt, cwd }) {
return new Promise((resolve, reject) => {
// --skip-git-repo-check: the per-call temp dir is not a git repo.
const args = ['exec', '--json', '--skip-git-repo-check', '-C', cwd, prompt];
// stdin 'ignore': otherwise codex waits for EOF on an unused pipe and the
// call hangs until TIMEOUT_MS. See adolf-llm/server.js for detail.
const child = spawn('codex', args, {
cwd,
timeout: TIMEOUT_MS,
stdio: ['ignore', 'pipe', 'pipe'],
});
let stdout = '';
let stderr = '';
child.stdout.on('data', d => { stdout += d; });
child.stderr.on('data', d => { stderr += d; });
child.on('error', reject);
child.on('close', code => {
const parts = [];
let finalText = null;
for (const line of stdout.split('\n')) {
const t = line.trim();
if (!t) continue;
let obj;
try { obj = JSON.parse(t); } catch { continue; }
const msg = obj.msg;
if (msg && typeof msg.type === 'string') {
if (msg.type === 'agent_message_delta' && msg.delta) parts.push(msg.delta);
else if (msg.type === 'agent_message' && msg.message) finalText = msg.message;
continue;
}
if (obj.type === 'item.completed' && obj.item && obj.item.type === 'agent_message') {
const text = typeof obj.item.text === 'string' ? obj.item.text : obj.item.message;
if (text) finalText = text;
}
}
const text = (parts.join('').trim() || (finalText || '').trim());
if (!text && code !== 0) {
reject(new Error(`codex exited ${code}: ${stderr.slice(0, 2000)}`));
} else {
resolve(text);
}
});
});
}
async function handleTurn(messages) {
const prompt = buildPrompt(messages || []);
const reqId = crypto.randomUUID();
const dir = path.join(WORKSPACE, reqId);
fs.mkdirSync(dir, { recursive: true });
try {
return await withSlot(() => runCodex({ prompt, cwd: dir }));
} finally {
// Stateless one-shot: nothing about this call is meant to survive it, so
// the temp dir is discarded unconditionally, success or failure.
fs.rm(dir, { recursive: true, force: true }, () => {});
}
}
// --- OpenAI-compatible HTTP surface (non-streaming only) ---------------------
function completionBody(text) {
return {
id: `chatcmpl-${Date.now()}`,
object: 'chat.completion',
created: Math.floor(Date.now() / 1000),
model: MODEL_ID,
choices: [{
index: 0,
message: { role: 'assistant', content: text },
finish_reason: 'stop',
}],
usage: { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 },
};
}
const server = http.createServer((req, res) => {
if (req.method === 'GET' && req.url === '/v1/models') {
res.writeHead(200, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({
object: 'list',
data: [{ id: MODEL_ID, object: 'model', owned_by: 'openai' }],
}));
return;
}
if (req.method === 'POST' && req.url === '/v1/chat/completions') {
let body = '';
req.on('data', d => { body += d; });
req.on('end', async () => {
let parsed;
try {
parsed = JSON.parse(body);
} catch {
res.writeHead(400, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({ error: 'invalid JSON body' }));
return;
}
try {
const text = await handleTurn(parsed.messages || []);
// Non-streaming policy: always return the full body even if the
// caller sets stream:true. Cognee's batch cognify has no use for SSE,
// and a one-shot call has nothing to incrementally stream anyway.
res.writeHead(200, { 'Content-Type': 'application/json' });
res.end(JSON.stringify(completionBody(text)));
} catch (err) {
res.writeHead(500, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({ error: String(err.message || err) }));
}
});
return;
}
res.writeHead(404, { 'Content-Type': 'application/json' });
res.end(JSON.stringify({ error: 'not found' }));
});
server.listen(PORT, () => console.log(`hindsight-llm wrapper listening on :${PORT}`));