@ai-sdk/harness-pi 1.0.92 → 1.0.94

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @ai-sdk/harness-pi
 
+## 1.0.94
+
+### Patch Changes
+
+- e0d7cfb: feat(harness): allow harness sessions to optionally authenticate from an isolated environment supplied through the `auth` option, and remove support for the formerly deprecated legacy auth options types
+- Updated dependencies [e0d7cfb]
+  - @ai-sdk/harness@1.0.92
+
+## 1.0.93
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.91
+
 ## 1.0.92
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,33 +1,12 @@
 import * as _ai_sdk_harness from '@ai-sdk/harness';
-import { HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
+import { HarnessV1Authentication, HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
 import { ExtensionFactory } from '@earendil-works/pi-coding-agent';
 
 /**
  * Pi auth options. Choose an explicit mode or rely on 'auto' (precedence:
  * explicit gateway, then OpenAI / Anthropic / custom environment variables).
  */
-type PiAuthenticationMode = 'auto' | 'openai' | 'anthropic' | 'custom' | 'ai-gateway';
-/**
- * @deprecated Passing an object to auth options is deprecated. Use a `PiAuthenticationMode` string value ("auto" | "openai" | "anthropic" | "custom" | "ai-gateway") instead, and pass credentials via environment variables.
- */
-type LegacyPiAuthOptions = {
-    readonly gateway?: {
-        readonly apiKey?: string;
-        readonly baseUrl?: string;
-    };
-    /**
-     * Resolved environment-variable pairs of the form `<PREFIX>_API_KEY` and
-     * (optionally) `<PREFIX>_BASE_URL`. Special-cased prefixes:
-     *  - `AI_GATEWAY` → registers `vercel-ai-gateway`
-     *  - `OPENAI`     → registers `openai`
-     *  - `ANTHROPIC`  → registers `anthropic` (`ANTHROPIC_AUTH_TOKEN` adds a
-     *                   bearer auth header)
-     * Any other `<PREFIX>_API_KEY` with a matching `<PREFIX>_BASE_URL` is
-     * registered as the lowercased, dash-separated prefix.
-     */
-    readonly customEnv?: Record<string, string>;
-};
-type PiAuthOptions = PiAuthenticationMode | LegacyPiAuthOptions;
+type PiAuthenticationMode = HarnessV1Authentication<'openai' | 'anthropic' | 'custom'>;
 
 type PiThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
 
@@ -37,7 +16,7 @@ type PiThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
  */
 type PiHarnessSettings = {
     /** Where Pi sources API keys / gateway credentials from. */
-    readonly auth?: PiAuthOptions;
+    readonly auth?: PiAuthenticationMode;
     /**
      * Pi model id (or name). Leaving this unset falls back to the AI Gateway
      * default when `AI_GATEWAY_API_KEY` / `VERCEL_OIDC_TOKEN` is set, and to
@@ -143,4 +122,4 @@ declare const pi: _ai_sdk_harness.HarnessV1<{
     readonly ls: _ai_sdk_harness.HarnessV1BuiltinTool;
 }>;
 
-export { type PiAuthOptions, type PiAuthenticationMode, type PiHarnessSettings, VERSION, createPi, pi };
+export { type PiAuthenticationMode, type PiHarnessSettings, VERSION, createPi, pi };

package/dist/index.js

@@ -108,7 +108,6 @@ import {
   DefaultResourceLoader,
   defineTool,
   ModelRegistry,
-  ModelRuntime,
   SessionManager,
   SettingsManager
 } from "@earendil-works/pi-coding-agent";
@@ -125,16 +124,121 @@ import {
 } from "@ai-sdk/harness/utils";
 
 // src/pi-auth.ts
-import { getAiGatewayAuthFromEnv } from "@ai-sdk/harness/utils";
+import {
+  ModelRuntime
+} from "@earendil-works/pi-coding-agent";
+import {
+  getAiGatewayAuthFromEnv,
+  isHarnessAuthenticationEnvironment
+} from "@ai-sdk/harness/utils";
+import { access } from "fs/promises";
 
 // src/version.ts
-var VERSION = true ? "1.0.92" : "0.0.0-test";
+var VERSION = true ? "1.0.94" : "0.0.0-test";
 
 // src/pi-auth.ts
 var DEFAULT_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh";
 var DEFAULT_OPENAI_BASE_URL = "https://api.openai.com/v1";
 var DEFAULT_ANTHROPIC_BASE_URL = "https://api.anthropic.com";
 var HARNESS_CLIENT_APP = `ai-sdk/harness-pi/${VERSION}`;
+function createIsolatedPiCredentialStore() {
+  let initializing = true;
+  const bootstrapEnvironment = new Proxy(
+    {},
+    {
+      get: (_target, property) => typeof property === "string" ? "harness-pi-authentication-bootstrap" : void 0
+    }
+  );
+  const bootstrapCredential = {
+    type: "api_key",
+    key: "harness-pi-authentication-bootstrap",
+    env: bootstrapEnvironment
+  };
+  const credentials = {
+    async read() {
+      return initializing ? bootstrapCredential : void 0;
+    },
+    async list() {
+      return [];
+    },
+    async modify(..._input) {
+      return void 0;
+    },
+    async delete() {
+    }
+  };
+  return {
+    credentials,
+    finishInitialization() {
+      initializing = false;
+    }
+  };
+}
+function scopePiProviderEnvironment({
+  modelRuntime,
+  authenticationEnvironment
+}) {
+  for (const provider of modelRuntime.getProviders()) {
+    const apiKeyAuthentication = provider.auth.apiKey;
+    if (!apiKeyAuthentication) continue;
+    provider.auth = {
+      ...provider.auth,
+      apiKey: {
+        ...apiKeyAuthentication,
+        resolve: async (input) => {
+          const result = await apiKeyAuthentication.resolve(input);
+          return result ? {
+            ...result,
+            env: {
+              ...authenticationEnvironment,
+              ...result.env
+            }
+          } : void 0;
+        }
+      }
+    };
+  }
+}
+async function createPiModelRuntime({
+  auth,
+  authPath,
+  modelsPath
+}) {
+  if (!isHarnessAuthenticationEnvironment(auth)) {
+    return ModelRuntime.create({
+      authPath,
+      modelsPath,
+      allowModelNetwork: false
+    });
+  }
+  const isolatedCredentials = createIsolatedPiCredentialStore();
+  const modelRuntime = await ModelRuntime.create({
+    credentials: isolatedCredentials.credentials,
+    modelsPath: null,
+    allowModelNetwork: false
+  });
+  modelRuntime.models.authContext = {
+    async env(name) {
+      return auth[name];
+    },
+    async fileExists(filePath) {
+      if (filePath !== auth.GOOGLE_APPLICATION_CREDENTIALS) return false;
+      try {
+        await access(filePath);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+  scopePiProviderEnvironment({
+    modelRuntime,
+    authenticationEnvironment: auth
+  });
+  isolatedCredentials.finishInitialization();
+  await modelRuntime.refresh({ allowNetwork: false });
+  return modelRuntime;
+}
 function createGatewayProviderConfig({
   apiKey,
   baseUrl,
@@ -159,53 +263,41 @@ async function register({
   registries.modelRegistry.registerProvider(provider, config);
   await registries.modelRuntime.setRuntimeApiKey(provider, apiKey);
 }
-function hasConfiguredValue(value) {
-  if (value == null) return false;
-  if (typeof value === "string") return value.length > 0;
-  if (typeof value !== "object") return true;
-  return Object.values(value).some(hasConfiguredValue);
-}
 function resolvePiEnv({
   options,
   env
 }) {
-  const normalizedOptions = normalizePiAuthToLegacyAuth(options);
-  const customEnvConfigured = hasConfiguredValue(normalizedOptions?.customEnv);
-  if (customEnvConfigured) {
-    return resolveCustomEnv({ customEnv: normalizedOptions.customEnv ?? {} });
-  }
-  const gatewayConfigured = hasConfiguredValue(normalizedOptions?.gateway);
-  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env });
-  if (gatewayConfigured) {
-    const apiKey = normalizedOptions.gateway?.apiKey ?? gatewayAuthFromEnv.apiKey;
-    const baseUrl = normalizedOptions.gateway?.baseUrl ?? gatewayAuthFromEnv.baseUrl;
-    if (apiKey) {
-      return { AI_GATEWAY_API_KEY: apiKey, AI_GATEWAY_BASE_URL: baseUrl };
-    }
-    return {};
-  }
+  const suppliedEnvironment = isHarnessAuthenticationEnvironment(options);
+  const authenticationEnvironment = suppliedEnvironment ? options : env;
+  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({
+    env: authenticationEnvironment
+  });
   if (typeof options === "string") {
     switch (options) {
       case "openai":
-        if (env.OPENAI_API_KEY) {
+        if (authenticationEnvironment.OPENAI_API_KEY) {
           return {
-            OPENAI_API_KEY: env.OPENAI_API_KEY,
-            ...env.OPENAI_BASE_URL ? { OPENAI_BASE_URL: env.OPENAI_BASE_URL } : {}
+            OPENAI_API_KEY: authenticationEnvironment.OPENAI_API_KEY,
+            ...authenticationEnvironment.OPENAI_BASE_URL ? { OPENAI_BASE_URL: authenticationEnvironment.OPENAI_BASE_URL } : {}
           };
         }
         return {};
       case "anthropic":
-        if (env.ANTHROPIC_API_KEY) {
+        if (authenticationEnvironment.ANTHROPIC_API_KEY) {
           return {
-            ANTHROPIC_API_KEY: env.ANTHROPIC_API_KEY,
-            ...env.ANTHROPIC_BASE_URL ? { ANTHROPIC_BASE_URL: env.ANTHROPIC_BASE_URL } : {},
-            ...env.ANTHROPIC_AUTH_TOKEN ? { ANTHROPIC_AUTH_TOKEN: env.ANTHROPIC_AUTH_TOKEN } : {}
+            ANTHROPIC_API_KEY: authenticationEnvironment.ANTHROPIC_API_KEY,
+            ...authenticationEnvironment.ANTHROPIC_BASE_URL ? {
+              ANTHROPIC_BASE_URL: authenticationEnvironment.ANTHROPIC_BASE_URL
+            } : {},
+            ...authenticationEnvironment.ANTHROPIC_AUTH_TOKEN ? {
+              ANTHROPIC_AUTH_TOKEN: authenticationEnvironment.ANTHROPIC_AUTH_TOKEN
+            } : {}
           };
         }
         return {};
       case "custom": {
         const result = {};
-        for (const [key, value] of Object.entries(env)) {
+        for (const [key, value] of Object.entries(authenticationEnvironment)) {
           if (value && (key.endsWith("_API_KEY") || key.endsWith("_BASE_URL") || key === "ANTHROPIC_AUTH_TOKEN")) {
             result[key] = value;
           }
@@ -232,7 +324,7 @@ function resolvePiEnv({
     };
   }
   const ambient = {};
-  for (const [key, value] of Object.entries(env)) {
+  for (const [key, value] of Object.entries(authenticationEnvironment)) {
     if (value && (key.endsWith("_API_KEY") || key.endsWith("_BASE_URL") || key === "ANTHROPIC_AUTH_TOKEN")) {
       ambient[key] = value;
     }
@@ -245,21 +337,14 @@ async function registerPiProviders({
   registries,
   clientApp = HARNESS_CLIENT_APP
 }) {
-  const normalizedOptions = normalizePiAuthToLegacyAuth(options);
-  if (hasConfiguredValue(normalizedOptions?.customEnv)) {
-    await registerCustomProviders({
-      customEnv: normalizedOptions.customEnv ?? {},
-      registries,
-      clientApp
-    });
-    return;
-  }
-  const mode = typeof options === "string" ? options : options == null ? "auto" : "legacy";
+  const suppliedEnvironment = isHarnessAuthenticationEnvironment(options);
+  const authenticationEnvironment = suppliedEnvironment ? options : process.env;
+  const mode = typeof options === "string" ? options : "auto";
   switch (mode) {
     case "openai": {
       const env = pickOpenAIEnv(resolvedEnv);
       await registerCustomProviders({
-        customEnv: { ...pickOpenAIEnv(process.env), ...env },
+        customEnv: { ...pickOpenAIEnv(authenticationEnvironment), ...env },
         registries,
         clientApp
       });
@@ -268,7 +353,7 @@ async function registerPiProviders({
     case "anthropic": {
       const env = pickAnthropicEnv(resolvedEnv);
       await registerCustomProviders({
-        customEnv: { ...pickAnthropicEnv(process.env), ...env },
+        customEnv: { ...pickAnthropicEnv(authenticationEnvironment), ...env },
         registries,
         clientApp
       });
@@ -277,14 +362,16 @@ async function registerPiProviders({
     case "custom": {
       const env = pickProviderEnv(resolvedEnv);
       await registerCustomProviders({
-        customEnv: { ...pickProviderEnv(process.env), ...env },
+        customEnv: { ...pickProviderEnv(authenticationEnvironment), ...env },
         registries,
         clientApp
       });
       return;
     }
     case "ai-gateway": {
-      const gatewayAuth = getAiGatewayAuthFromEnv({ env: process.env });
+      const gatewayAuth = getAiGatewayAuthFromEnv({
+        env: authenticationEnvironment
+      });
       const gatewayApiKey = resolvedEnv.AI_GATEWAY_API_KEY ?? gatewayAuth.apiKey;
       const gatewayBaseUrl = resolvedEnv.AI_GATEWAY_BASE_URL ?? gatewayAuth.baseUrl;
       if (!gatewayApiKey) return;
@@ -300,12 +387,11 @@ async function registerPiProviders({
       });
       return;
     }
-    case "legacy":
-      break;
-    // handled below
     case "auto":
     default: {
-      const gatewayAuth = getAiGatewayAuthFromEnv({ env: process.env });
+      const gatewayAuth = getAiGatewayAuthFromEnv({
+        env: authenticationEnvironment
+      });
       const gatewayApiKey = resolvedEnv.AI_GATEWAY_API_KEY ?? gatewayAuth.apiKey;
       const gatewayBaseUrl = resolvedEnv.AI_GATEWAY_BASE_URL ?? gatewayAuth.baseUrl;
       if (gatewayApiKey) {
@@ -323,22 +409,13 @@ async function registerPiProviders({
       }
       const env = pickProviderEnv(resolvedEnv);
       await registerCustomProviders({
-        customEnv: { ...pickProviderEnv(process.env), ...env },
+        customEnv: { ...pickProviderEnv(authenticationEnvironment), ...env },
         registries,
         clientApp
       });
       return;
     }
   }
-  const apiKey = resolvedEnv.AI_GATEWAY_API_KEY;
-  const baseUrl = resolvedEnv.AI_GATEWAY_BASE_URL;
-  if (!apiKey || !baseUrl) return;
-  await register({
-    registries,
-    provider: "vercel-ai-gateway",
-    apiKey,
-    config: createGatewayProviderConfig({ apiKey, baseUrl, clientApp })
-  });
 }
 function pickOpenAIEnv(env) {
   const result = {};
@@ -364,37 +441,6 @@ function pickProviderEnv(env) {
   }
   return result;
 }
-function normalizePiAuthToLegacyAuth(options) {
-  if (options == null || options === "auto") {
-    return void 0;
-  }
-  if (typeof options === "string") {
-    switch (options) {
-      case "ai-gateway":
-        return { gateway: {} };
-      case "custom":
-      case "openai":
-      case "anthropic":
-        return { customEnv: {} };
-      default:
-        return void 0;
-    }
-  }
-  console.warn(
-    '[pi] Passing an object to auth options is deprecated. Use a string mode ("auto" | "openai" | "anthropic" | "custom" | "ai-gateway") instead, and pass credentials via environment variables.'
-  );
-  return options;
-}
-function resolveCustomEnv({
-  customEnv
-}) {
-  const apiKey = customEnv.AI_GATEWAY_API_KEY;
-  if (!apiKey) return {};
-  return {
-    AI_GATEWAY_API_KEY: apiKey,
-    AI_GATEWAY_BASE_URL: customEnv.AI_GATEWAY_BASE_URL ?? DEFAULT_GATEWAY_BASE_URL
-  };
-}
 async function registerCustomProviders({
   customEnv,
   registries,
@@ -1954,10 +2000,10 @@ async function createPiSession(input) {
     readableRoots: sandboxSkillRootDir ? [{ sandboxDir: sandboxSkillRootDir }] : []
   });
   const agentDir = input.agentDir ?? hostAgentDir;
-  const modelRuntime = await ModelRuntime.create({
+  const modelRuntime = await createPiModelRuntime({
+    auth: input.settings.auth,
     authPath: path7.join(agentDir, "auth.json"),
-    modelsPath: path7.join(agentDir, "models.json"),
-    allowModelNetwork: false
+    modelsPath: path7.join(agentDir, "models.json")
   });
   const modelRegistry = new ModelRegistry(modelRuntime);
   const settingsManager = input.agentDir != null ? SettingsManager.create(hostWorkDir, agentDir) : SettingsManager.inMemory();