Skip to content

api: c0mpute as a swarm provider (house key when the user has none) - #178

Merged
ralyodio merged 1 commit into
mainfrom
feat/c0mpute-default
Nov 7, 2026
Merged

ralyodio merged 1 commit into
mainfrom
feat/c0mpute-default

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

Fleet AI rollout: c0mpute next to BYO user keys (ai-providers ROLLOUT.md).

services/api

  • /api/swarm: c0mpute now points at Infernet's OpenAI-compatible endpoint https://infernetprotocol.com/v1 (the old api.c0mpute.com does not resolve), default model huihui_ai/qwen3.5-abliterated:9b, 15 min client timeout.
  • resolveSwarmProvider: a user's own key always wins (any provider, c0mpute included). No key + provider: "c0mpute" runs on the house C0MPUTE_API_KEY (never sent to a caller-supplied baseUrl), capped at SWARM_C0MPUTE_DAILY (30) runs per user per day.
  • No key and no provider is still refused unless SWARM_DEFAULT_PROVIDER=c0mpute: swarm messages are the user's own, and routing them to peer nodes silently is flagged for a decision rather than turned on here. The 400 now says provider: "c0mpute" works without a key.
  • c0mpute runs answer 200 immediately, write a space every 15 s, then the JSON (or {"error"}); leading whitespace is valid JSON. Keeps minutes-long peer calls inside nginx's 300 s read timeout and Bun's idle timer. Response carries provider: "c0mpute".
  • /api/models lists c0mpute models.
  • Note: the Infernet shim ignores tools, so on c0mpute the deep agent answers in one shot rather than using its tools; the rubric judge is plain-text JSON and works.

Clients (own key only, explicit choice): c0mpute added to web settings, the AI sidebar provider table, and @tronbrowser/model-providers (catalog, endpoint, C0MPUTE_API_KEY env var).

Tests: services/api/src/swarm.test.ts (8) for key priority, house key, opt-in default, refusals, daily cap, keepalive JSON; model-providers count updated. api typecheck + lint clean (warnings only, pre-existing).

🤖 Generated with Claude Code

/api/swarm: provider c0mpute runs on Infernet's OpenAI-compatible endpoint
(infernetprotocol.com/v1; api.c0mpute.com never resolved). A user's own key
keeps priority; with no key, provider c0mpute runs on the house
C0MPUTE_API_KEY, capped per user per day. A request naming neither goes to
c0mpute only with SWARM_DEFAULT_PROVIDER=c0mpute (private messages to peer
nodes is an explicit choice). c0mpute runs answer 200 at once with keepalive
spaces then the JSON, so minutes-long calls survive the 300 s proxy.
c0mpute also added to /api/models, the web settings, the sidebar and
model-providers provider tables (own key).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 7, 2026

Copy link
Copy Markdown
Contributor

ThreatCrush Security Scan

51 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 28 | LOW: 21

Severity Rule Location
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:303
HIGH py-ssrf-outbound-request apps/desktop/launcher/tron-tor-helper:437
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:247
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:276
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:346
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:306
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:78
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:166
MEDIUM redos-nested-quantifier apps/desktop/extensions/ai-sidebar/w3bs.js:17
MEDIUM insecure-randomness-for-secret apps/extensions/public/seal.js:107
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:286
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:652
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:188
MEDIUM sh-remote-script-execution apps/web/public/install.sh:428
MEDIUM sh-remote-script-execution apps/web/public/install.sh:446
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:125
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:197
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:125
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:68
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:73
MEDIUM js-unescaped-html-sink services/api/src/profile.ts:59
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:24
LOW js-dynamic-code-execution apps/desktop/extensions/ai-sidebar/pit-proxy.test.js:8
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:16
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:45
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:57
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:80
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:99
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:62
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:101
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:299
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32

…and 1 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 75db7d3 into main Nov 7, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant