openscience 科研 Agent 工作台

76/** The uniform contract every scientific data source implements. */
77export interface Connector {
78  /** Unique, stable, lowercase id used to route (e.g. "uniprot", "rcsb-pdb"). */
79  id: string
80  /** Display name (e.g. "UniProt", "RCSB PDB"). */
81  name: string
82  /** Primary domain for grouping in the catalog. */
83  domain: ConnectorDomain
84  /** One-line description shown in `science_list_dbs`. */
85  description: string
86  /** Homepage / docs URL. */
87  homepage?: string
88  /** Search the source; returns normalized hits. */
89  search(query: string, opts?: SearchOptions): Promise<ConnectorHit[]>
90  /** Fetch a single record by id. Return shape is source-specific. */
91  fetch(id: string, opts?: FetchOptions): Promise<unknown>
92}

77    const result: Record<string, Info> = {
78      // --- Research modes (top) ---
79      research: {
80        name: "research",
81        description:
82          "Scientific research agent — literature review, data analysis, GPU compute, and synthesis across 241 skills.",
83        options: {},
84        color: "#06b6d4",
85        permission: PermissionNext.merge(
86          defaults,
87          PermissionNext.fromConfig({
88            question: "allow",
89            plan_enter: "allow",
90          }),
91          user,
92        ),
93        mode: "primary",
94        native: true,
95      },

82  function isAtlasApiKey(key: unknown): key is string {
83    return typeof key === "string" && key.startsWith("thk_")
84  }
85
86  function isAtlasProxyBaseURL(baseURL: unknown): baseURL is string {
87    return typeof baseURL === "string" && baseURL.includes("/api/llm/proxy/")
88  }
89
90  // Explicit apiKey for a provider routed through the Atlas managed proxy: force
91  // the session thk_ token. These SDKs read `<PROVIDER>_API_KEY` straight from
92  // env, so a shell `export OPENAI_API_KEY=sk-...` would otherwise shadow the
93  // managed token and 401 the proxy ("thk_* token not found"). Returns {} unless
94  // both managed spend is on AND the baseURL is the Atlas proxy — genuine BYOK
95  // (no proxy URL) is untouched and hits the provider directly.
96  async function managedProxyKey(providerID: string, baseURL: unknown): Promise<{ apiKey?: string }> {
97    const managed =
98      isAtlasProxyBaseURL(baseURL) && (await Config.get().catch(() => undefined))?.billing?.llm === "managed"
99    if (!managed) return {}
100    // Managed wallet routes through OpenRouter ONLY: never attach the wallet's
101    // thk_ token to a first-party proxy (anthropic / openai / google). Those
102    // providers are also dropped from availability (see isProviderAllowed), so
103    // this is belt-and-suspenders — a managed token can only ever reach the
104    // sanctioned OpenRouter (or hosted synsci) route.
105    if (!managedProviderAllowed(providerID)) return {}
106    const session = await OpenScience.getSession().catch(() => null)
107    return session?.api_key ? { apiKey: session.api_key } : {}
108  }

46export function isAllowedHost(hostHeader: string | undefined): boolean {
47  if (!hostHeader) return false
48  const host = hostHeader.startsWith("[")
49    ? hostHeader.slice(0, hostHeader.indexOf("]") + 1) // keep "[::1]" bracket form
50    : hostHeader.split(":")[0]
51  return ALLOWED_HOSTS.has(host)
52}
53
54export function isAllowedOrigin(origin: string, extraWhitelist: string[] = []): boolean {
55  if (origin.startsWith("http://localhost:") || origin === "http://localhost") return true
56  if (origin.startsWith("http://127.0.0.1:") || origin === "http://127.0.0.1") return true
57  if (origin === "tauri://localhost" || origin === "http://tauri.localhost") return true
58  // Trusted hosted-UI subdomains (default syntheticsciences.ai, extended via
59  // OPENSCIENCE_CORS_DOMAINS). See matchesAllowedSubdomain.
60  if (matchesAllowedSubdomain(origin)) return true
61  return extraWhitelist.includes(origin)
62}
63
64// Decide whether a NETWORK request is cross-origin and must be rejected. An
65// Origin header (always present on cross-origin fetch and WebSocket upgrades)
66// is checked against the allow-list; when it is absent (same-origin requests
67// and same-/cross-site GET navigations omit it) we fall back to Sec-Fetch-Site
68// and reject only explicit cross-site contexts. Non-browser clients send
69// neither header and are allowed (the loopback bind already gates them).
70export function isCrossOrigin(
71  origin: string | undefined,
72  secFetchSite: string | undefined,
73  extraWhitelist: string[] = [],
74): boolean {
75  if (origin !== undefined) return !isAllowedOrigin(origin, extraWhitelist)
76  return secFetchSite === "cross-site"
77}

176  function pinByokToPublicEndpoint(provider: Info, options: Record<string, any>, publicURL: string) {
177    const effectiveKey =
178      (typeof options["apiKey"] === "string" ? (options["apiKey"] as string) : undefined) ??
179      provider.key ??
180      provider.env.map((key) => Env.get(key)).find((value): value is string => !!value)
181    // Managed (thk_*) keys must keep their Atlas proxy routing.
182    if (isAtlasApiKey(effectiveKey)) return
183    if (!isByokKey(effectiveKey)) return
184    if (isAtlasProxyBaseURL(options["baseURL"])) {
185      log.warn("refusing to route BYOK key through Atlas proxy — pinning to public endpoint", {
186        provider: provider.id,
187      })
188      options["baseURL"] = publicURL
189    }
190  }

261  export async function installDependencies(dir: string) {
262    const pkg = path.join(dir, "package.json")
263
264    if (!(await Bun.file(pkg).exists())) {
265      await Bun.write(pkg, "{}")
266    }
267
268    const gitignore = path.join(dir, ".gitignore")
269    const hasGitIgnore = await Bun.file(gitignore).exists()
270    if (!hasGitIgnore) await Bun.write(gitignore, ["node_modules", "package.json", "bun.lock", ".gitignore"].join("\n"))
271
272    await BunProc.run(
273      ["add", "@synsci/plugin@" + (Installation.isLocal() ? "latest" : Installation.VERSION), "--exact"],
274      {
275        cwd: dir,
276      },
277    ).catch(() => {})
278
279    // Install any additional dependencies defined in the package.json
280    // This allows local plugins and custom tools to use external packages
281    await BunProc.run(["install"], { cwd: dir }).catch(() => {})