Files
zesdex/crates/zesdex-backend/src/service/provider.rs
T

538 lines
22 KiB
Rust

//! Blocking HTTP client for OpenAI/Anthropic-compatible chat completion APIs,
//! supporting both non-streaming and SSE-streaming requests with automatic retry.
//!
//! # Retry policy
//!
//! Both paths use exponential backoff with ±25% jitter so retries spread out
//! naturally instead of hammering the server in lockstep. Auth errors
//! (401/402/403) are never retried — they indicate a bad key or billing issue
//! that retrying won't fix. Rate-limit (429) responses get a longer backoff
//! (base 5s instead of the usual 1s) so the server has time to drain its queue.
//!
//! ## Non-streaming (`chat_with_tools_non_streaming`)
//! - Up to **10** attempts
//! - Backoff: `1s, 2s, 4s, 8s, 16s, 30s(capped), 30s, …` + jitter
//! - Auth errors → abort immediately on the **status code** embedded in the
//! error message (avoids false positives from port numbers, model names etc.)
//!
//! ## Streaming (`chat_with_tools_streaming`)
//! - Up to **5** attempts *before* any meaningful content (tokens / reasoning)
//! - After meaningful content arrives, falls back to a **non-streaming retry**
//! (the non-streaming call carries 10 retries of its own), so a mid-stream
//! network blip is recovered instead of killing the whole turn.
//! - The `started` flag still prevents retries on the raw SSE call once the
//! stream has begun (partial content cannot be safely replayed), but the
//! caller-level fallback handles that case.
use anyhow::Result;
use std::sync::atomic::AtomicBool;
use std::time::Duration;
use crate::app::runtime::stream::turn::StreamedTurn;
use crate::app::util::backoff::backoff_seconds;
use crate::app::runtime::stream::{SseParser, StreamEvent};
use crate::dto::chat::message::ChatMessage;
use crate::dto::provider::request::{ChatRequest, StreamOptions, ToolDef};
pub(crate) const DEFAULT_BASE_URL: &str = "https://opencode.ai/zen/v1";
const DEFAULT_MODEL: &str = "deepseek-v4-flash-free";
pub const DEFAULT_API_KEY: &str = "";
const CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
const REQUEST_TIMEOUT: Duration = Duration::from_mins(1);
// ---------------------------------------------------------------------------
// Retry helpers
// ---------------------------------------------------------------------------
/// Exponential backoff with ±25% jitter, capped at 30 seconds.
///
/// `attempt` is 1-based (first retry → attempt=1).
fn backoff_duration(attempt: u32) -> Duration {
backoff_seconds(attempt, 30)
}
/// Is the error an auth / billing failure that retrying won't fix?
///
/// Matches the structured "API error {status} from …" format used by the
/// request builders below, plus well-known auth keywords in case the body
/// contains them. This is intentionally tighter than `contains("401")`,
/// which could false-positive on a URL port, model name, or body text.
pub fn is_auth_error(err_str: &str) -> bool {
let err_lower = err_str.to_lowercase();
// Structured HTTP status patterns
(err_str.contains("API error 401")
|| err_str.contains("API error 402")
|| err_str.contains("API error 403"))
// Keyword fallback for non-standard error formats
|| err_lower.contains("unauthorized")
|| err_lower.contains("forbidden")
|| err_lower.contains("authentication failed")
}
/// Is the error a rate-limit response?
fn is_rate_limit(err_str: &str) -> bool {
err_str.contains("API error 429") || err_str.to_lowercase().contains("rate limit")
}
/// Return a rate-appropriate backoff (longer for 429).
fn backoff_for_error(attempt: u32, err_str: &str) -> Duration {
if is_rate_limit(err_str) {
// Rate limits need more time to drain — backoff capped at 60s.
backoff_seconds(attempt, 60)
} else {
backoff_duration(attempt)
}
}
// ---------------------------------------------------------------------------
// Client
// ---------------------------------------------------------------------------
/// Blocking HTTP client for a single LLM provider endpoint.
///
/// Holds the reqwest client, credentials, and model/base URL selection used
/// by both the non-streaming and streaming chat completion calls.
pub struct LlmClient {
pub client: reqwest::blocking::Client,
pub api_key: String,
pub base_url: String,
pub model: String,
}
impl LlmClient {
/// Construct a client, falling back to built-in defaults for empty inputs.
///
/// Flow: empty `api_key/model` → substitute defaults → build reqwest client
/// with connect/request timeouts → if TLS config fails, retry with just
/// request timeout (no connect timeout) → normalize `base_url`.
///
/// Why: empty strings are treated as "unset" rather than errors so callers
/// can pass through unconfigured settings without special-casing them.
/// Timeouts are always enforced — the pure-default-client fallback is only
/// used as a last resort when even the no-connect-timeout build fails.
pub fn new(mut api_key: String, model: String, base_url: Option<String>) -> Self {
if api_key.is_empty() {
api_key = DEFAULT_API_KEY.to_string();
}
let model = if model.is_empty() {
DEFAULT_MODEL.to_string()
} else {
model
};
let client = match reqwest::blocking::Client::builder()
.timeout(REQUEST_TIMEOUT)
.connect_timeout(CONNECT_TIMEOUT)
.build()
{
Ok(c) => c,
Err(e) => {
tracing::warn!(
"failed to build reqwest client with connect timeout: {}. \
retrying without connect timeout",
e,
);
match reqwest::blocking::Client::builder()
.timeout(REQUEST_TIMEOUT)
.build()
{
Ok(c) => c,
Err(e2) => {
tracing::warn!(
"also failed: {}. using default client (no configured timeouts)",
e2,
);
reqwest::blocking::Client::new()
}
}
}
};
LlmClient {
client,
api_key,
base_url: base_url
.filter(|s| !s.is_empty())
.unwrap_or_else(|| DEFAULT_BASE_URL.to_string()),
model,
}
}
/// Send a non-streaming chat completion request and return the assistant's reply.
///
/// Flow: build request → POST with retry loop (up to 10 attempts, exponential
/// backoff with jitter) → parse JSON response → extract first choice's message
/// and token usage.
///
/// Why: retries transient failures but aborts immediately on 401/402/403 (bad
/// API key / billing issue — retrying won't fix). 429 (rate-limit) responses
/// get a longer backoff so the server has time to recover.
///
/// Return: `Err` if all retries are exhausted, an auth error occurs, or the
/// response has no choices.
pub fn chat_with_tools_non_streaming(
&self,
messages: &[ChatMessage],
tools: Option<Vec<ToolDef>>,
max_tokens: Option<u32>,
temperature: Option<f32>,
abort_flag: Option<&AtomicBool>,
) -> Result<(ChatMessage, Option<(u64, u64)>)> {
let req = ChatRequest {
model: self.model.clone(),
messages: messages.to_vec(),
max_tokens: Some(max_tokens.unwrap_or(4096)),
temperature: Some(temperature.unwrap_or(0.7)),
tools,
stream: Some(false),
stop: None,
stream_options: None,
tool_choice: None,
top_p: None,
};
let url = format!("{}/chat/completions", self.base_url);
let max_retries = 10;
let mut attempt = 0u32;
loop {
attempt += 1;
// Check abort before each retry so user cancellation is
// responsive even during a long non-streaming backoff chain.
if crate::app::util::abort::is_aborted_ref(abort_flag) {
anyhow::bail!("aborted");
}
let mut http_req = self
.client
.post(&url)
.header("Content-Type", "application/json");
if !self.api_key.is_empty() {
http_req = http_req.header("Authorization", format!("Bearer {}", self.api_key));
}
let result = (|| -> Result<(ChatMessage, Option<(u64, u64)>)> {
let resp = http_req.json(&req).send().map_err(|e| {
if e.is_timeout() {
anyhow::anyhow!("API request timed out after {REQUEST_TIMEOUT:?}. Check your network or try again.")
} else if e.is_connect() {
anyhow::anyhow!("Could not connect to {}. Is the URL correct and is the service reachable?", self.base_url)
} else {
anyhow::anyhow!("API request failed: {e}")
}
})?;
if !resp.status().is_success() {
let status = resp.status();
let body = resp.text().unwrap_or_default();
anyhow::bail!("API error {} from {}: {}", status, self.base_url, body);
}
let data: crate::dto::provider::response::ChatResponse = resp.json()?;
let usage = data
.usage
.map(|u| (u64::from(u.prompt_tokens), u64::from(u.completion_tokens)));
let message = data
.choices
.into_iter()
.next()
.and_then(|c| c.message)
.ok_or_else(|| anyhow::anyhow!("API response had no choices"))?;
Ok((message, usage))
})();
match result {
Ok((msg, usage)) => return Ok((msg, usage)),
Err(e) => {
let err_str = e.to_string();
if attempt >= max_retries || is_auth_error(&err_str) {
return Err(e);
}
let delay = backoff_for_error(attempt, &err_str);
tracing::warn!(
"Warning: {}. Retrying {}/{}, sleeping {delay:?}...",
e,
attempt,
max_retries,
);
std::thread::sleep(delay);
}
}
}
}
/// Streaming variant of `chat_with_tools`. Feeds SSE chunks into an
/// `SseParser` / `StreamedTurn` and invokes `on_event` for every parsed
/// `StreamEvent` as it arrives, so the caller can push incremental UI
/// updates in real time.
///
/// Returns the fully assembled assistant message plus token usage (prompt,
/// completion) if the server reported it.
///
/// # Retry semantics
///
/// Retries the raw SSE request only *before* any meaningful content (text
/// tokens or reasoning tokens) has been received — once the LLM has started
/// generating, a partial stream cannot be safely replayed without duplicating
/// or garbling output.
///
/// Once meaningful content has arrived and the stream fails, **this method
/// falls back to a non-streaming call** (which carries its own 10-retry
/// loop). The non-streaming call uses the same `messages` independently
/// (no SSE state to replay), so the caller always gets a complete result if
/// the provider is reachable.
///
/// Auth errors (401/402/403) are never retried on either path. Rate-limit
/// (429) responses get a longer backoff.
pub fn chat_with_tools_streaming(
&self,
messages: &[ChatMessage],
tools: Option<Vec<ToolDef>>,
temperature: Option<f32>,
max_tokens: Option<u32>,
mut on_event: impl FnMut(&StreamEvent) -> bool,
abort_flag: Option<&AtomicBool>,
) -> Result<(ChatMessage, Option<(u64, u64)>)> {
// Clone tools for the non-streaming fallback path — the original
// is moved into the ChatRequest below and cannot be used again.
let tools_for_fallback = tools.clone();
let req = ChatRequest {
model: self.model.clone(),
messages: messages.to_vec(),
max_tokens: Some(max_tokens.unwrap_or(4096)),
temperature: Some(temperature.unwrap_or(0.7)),
tools,
stream: Some(true),
stop: None,
stream_options: Some(StreamOptions {
include_usage: true,
}),
tool_choice: None,
top_p: None,
};
let url = format!("{}/chat/completions", self.base_url);
// Phase 1: Retry the raw SSE call up to 5 times, but only before
// meaningful content arrives. After that, fall back to non-streaming.
let max_retries_stream = 5;
let mut attempt = 0u32;
let mut started = false;
// Track whether we've emitted text/reasoning tokens (meaningful
// content). Non-meaningful events (role/usage/done) are safe to
// ignore for the retry decision.
let mut meaningful_content = false;
loop {
attempt += 1;
let mut captured_content = false;
let mut wrapped = |event: &StreamEvent| -> bool {
started = true;
match event {
StreamEvent::Token(_) | StreamEvent::Reasoning(_) => {
captured_content = true;
}
_ => {}
}
on_event(event)
};
match self.try_stream_once(&req, &url, &mut wrapped) {
Ok(result) => return Ok(result),
Err(e) => {
let err_str = e.to_string();
if is_auth_error(&err_str) {
return Err(e);
}
// Once meaningful content has been streamed, a raw SSE
// retry would produce a different sequence — fall back
// to non-streaming so the caller gets a clean,
// reproducible answer.
if captured_content || started && (attempt >= max_retries_stream) {
meaningful_content = captured_content || meaningful_content;
break;
}
if attempt >= max_retries_stream {
return Err(e);
}
let delay = backoff_for_error(attempt, &err_str);
tracing::warn!(
"Warning: {}. Retrying stream {}/{}, sleeping {delay:?}...",
e,
attempt,
max_retries_stream,
);
std::thread::sleep(delay);
}
}
}
// Phase 2: If we got meaningful content via SSE but the stream
// failed before completion, fall back to a non-streaming retry.
// This preserves the conversation state because the messages
// passed in are the same — we don't need the partial SSE output.
if meaningful_content {
// Check abort before entering the blocking non-streaming
// call — otherwise the fallback ignores user cancellation.
if crate::app::util::abort::is_aborted_ref(abort_flag) {
return Err(anyhow::anyhow!("aborted"));
}
tracing::warn!(
"streaming failed after meaningful content — falling back to non-streaming call",
);
// Use the same messages and tools so the fallback produces
// a response compatible with what the streaming request
// would have returned (including tool definitions).
return self.chat_with_tools_non_streaming(
messages,
tools_for_fallback,
max_tokens,
temperature,
abort_flag,
);
}
Err(anyhow::anyhow!(
"streaming request failed after {max_retries_stream} attempts"
))
}
/// Perform one streaming chat completion request, parsing SSE events until completion.
///
/// Flow: POST → read body in chunks → advance past valid UTF-8 boundary →
/// feed into `SseParser` → dispatch each `StreamEvent` to `on_event` and
/// accumulate in `StreamedTurn` → return assembled assistant message on `Done`.
///
/// Why: chunk-by-chunk UTF-8-aware reads avoid splitting multi-byte sequences;
/// returns `aborted` error if `on_event` returns false so the caller can cancel.
///
/// Return: assembled message + optional usage on success, `Err` on read
/// failure, non-2xx status, or callback-initiated abort.
fn try_stream_once(
&self,
req: &ChatRequest,
url: &str,
on_event: &mut dyn FnMut(&StreamEvent) -> bool,
) -> Result<(ChatMessage, Option<(u64, u64)>)> {
use std::io::Read;
let mut http_req = self
.client
.post(url)
.header("Content-Type", "application/json");
if !self.api_key.is_empty() {
http_req = http_req.header("Authorization", format!("Bearer {}", self.api_key));
}
let resp = http_req.json(req).send().map_err(|e| {
if e.is_timeout() {
anyhow::anyhow!("API request timed out after {REQUEST_TIMEOUT:?}. Check your network or try again.")
} else if e.is_connect() {
anyhow::anyhow!("Could not connect to {}. Is the URL correct and is the service reachable?", self.base_url)
} else {
anyhow::anyhow!("API request failed: {e}")
}
})?;
if !resp.status().is_success() {
let status = resp.status();
let body = resp.text().unwrap_or_default();
anyhow::bail!("API error {} from {}: {}", status, self.base_url, body);
}
let mut turn = StreamedTurn::new();
let mut usage: Option<(u64, u64)> = None;
let mut parser = SseParser::new();
let mut reader = resp;
let mut byte_buf: Vec<u8> = Vec::new();
let mut chunk_buf = [0u8; 4096];
loop {
let n = reader
.read(&mut chunk_buf)
.map_err(|e| anyhow::anyhow!("stream read error: {e}"))?;
if n == 0 {
break;
}
byte_buf.extend_from_slice(&chunk_buf[..n]);
let valid_len = match std::str::from_utf8(&byte_buf) {
Ok(s) => s.len(),
Err(e) => e.valid_up_to(),
};
if valid_len == 0 {
continue;
}
let text = String::from_utf8_lossy(&byte_buf[..valid_len]).into_owned();
byte_buf.drain(..valid_len);
for event in parser.feed(&text) {
if !on_event(&event) {
anyhow::bail!("aborted");
}
match &event {
StreamEvent::Usage {
prompt_tokens,
completion_tokens,
..
} => {
usage = Some((*prompt_tokens, *completion_tokens));
}
StreamEvent::Error(msg) => {
anyhow::bail!("stream error: {msg}");
}
StreamEvent::Done => {
turn.apply_event(&event);
turn.done_received = true;
return Ok((turn.build_assistant_message(), usage));
}
_ => turn.apply_event(&event),
}
}
}
// The connection closed without an explicit `[DONE]` event. Some
// providers legitimately omit it, so EOF alone isn't an error —
// but if it leaves a tool call's arguments as unparsable JSON, the
// response was truncated mid-generation, not finished. Report that
// honestly instead of silently double-stringifying the fragment
// into a tool call that will misbehave (e.g. a `write` call with a
// half-written file body).
if let Some((name, err)) = turn.incomplete_tool_call() {
anyhow::bail!("stream ended before tool call '{name}' arguments were complete: {err}");
}
turn.is_complete = true;
Ok((turn.build_assistant_message(), usage))
}
}
/// Resolve the API key for the currently configured provider, falling back
/// through settings → env var → provider default.
///
/// Used by both the main agent turn loop (`spawn.rs`) and subagent provider
/// resolution (`subagent/provider.rs`) to share the identical fallback chain.
///
/// Flow: try `settings.api_keys[provider]` → try `api_key_env` env var →
/// try `default_api_key` from config → return empty string if all paths
/// exhausted (callers must check and reject the empty case).
pub fn resolve_api_key(
settings: &zesdex_cms::domain::settings::Settings,
app_config: &zesdex_cms::domain::app_config::AppConfig,
) -> String {
let mut api_key = settings
.api_keys
.get(&settings.provider)
.cloned()
.unwrap_or_default();
if api_key.is_empty() {
if let Some(provider_cfg) = app_config.providers.get(&settings.provider) {
api_key = provider_cfg
.api_key_env
.as_ref()
.and_then(|env| std::env::var(env).ok())
.or_else(|| provider_cfg.default_api_key.clone())
.unwrap_or_default();
}
}
api_key
}