@aliou/pi-ts-aperture 0.0.1

package/.changeset/config.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch"
+}

package/.envrc

@@ -0,0 +1,21 @@
+# shellcheck disable=2148,2086
+
+# Use `source_up` if part of a monorepo.
+
+use nix
+
+# Load layouts. This basically just sets up PATH and other env vars.
+# Possible values are "node", "bun", and "uv".
+#
+# Options:
+#   --deny bin1,bin2,...  Exclude binaries from local PATH, falling back to system.
+#                         Useful when a local binary shadows a system one you need.
+#
+# Examples:
+#   layout node
+#   layout node --deny pi,prettier
+#   layout uv --deny python
+
+if has node; then
+  layout node --deny pi
+fi

package/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm run lint
+
+      - name: Typecheck
+        run: pnpm run typecheck

package/.github/workflows/publish.yml

@@ -0,0 +1,86 @@
+name: Publish
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }}
+  cancel-in-progress: true
+
+jobs:
+  publish:
+    name: Publish
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == 'main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      pull-requests: write
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+          scope: "@aliou"
+          cache: "pnpm"
+
+      - name: Upgrade npm for OIDC support
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Get release info
+        id: release-info
+        run: |
+          pnpm changeset status --output=release.json 2>/dev/null || echo '{"releases":[]}' > release.json
+          node <<NODE
+          const fs = require('fs');
+          const release = JSON.parse(fs.readFileSync('release.json', 'utf8'));
+          const releases = release.releases?.filter(r => r.type !== 'none') || [];
+
+          let title = 'Version Packages';
+          let commit = 'Version Packages';
+          if (releases.length === 1) {
+            const { name, newVersion } = releases[0];
+            title = 'Updating ' + name + ' to version ' + newVersion;
+            commit = name + '@' + newVersion;
+          } else if (releases.length > 1) {
+            const summary = releases.map(r => r.name + '@' + r.newVersion).join(', ');
+            title = 'Updating ' + summary;
+            commit = summary;
+          }
+
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, 'title=' + title + '\n');
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, 'commit=' + commit + '\n');
+          NODE
+          rm -f release.json
+        continue-on-error: true
+
+      - name: Create Release PR or Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          version: pnpm changeset version
+          publish: pnpm changeset publish
+          title: ${{ steps.release-info.outputs.title || 'Version Packages' }}
+          commit: ${{ steps.release-info.outputs.commit || 'Version Packages' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

package/.osgrep/lancedb/chunks.lance/_transactions/2-5f641c2a-07a9-45a1-b450-72c7d4d38754.txn

@@ -0,0 +1 @@
+$5f641c2a-07a9-45a1-b450-72c7d4d38754�(&path IN ('tsconfig.json','biome.json')

package/AGENTS.md

@@ -0,0 +1,29 @@
+# pi-ts-aperture
+
+Pi extension that routes LLM providers through Tailscale Aperture.
+
+## Structure
+
+- `src/index.ts` - Entry point. Loads config, registers providers, registers commands.
+- `src/config.ts` - Config schema (`ApertureConfig`, `ResolvedConfig`) and `ConfigLoader` instance.
+- `src/commands/setup.ts` - `/aperture:setup` interactive wizard (URL input + provider multi-select).
+- `src/commands/settings.ts` - `/aperture:settings` settings UI via `registerSettingsCommand`.
+
+## Key decisions
+
+- Config is global-only (no per-project scope). Aperture is a network-level concern.
+- Provider list comes from `getProviders()` in `@mariozechner/pi-ai`, not hardcoded.
+- `apiKey` is set to `"-"` because Aperture ignores client-provided keys.
+- URLs are normalized on input: `http://` is prepended if missing, trailing `/v1` is stripped (appended at registration time).
+
+## Dependencies
+
+- `@aliou/pi-utils-settings` - Config loader and settings command infrastructure.
+- `@mariozechner/pi-ai` - `getProviders()` for the known provider list.
+- `@mariozechner/pi-coding-agent` - Extension API, `getSettingsListTheme`.
+- `@mariozechner/pi-tui` - TUI components (`Input`, `Key`, `matchesKey`, `FuzzySelector`).
+
+## Publishing
+
+- Manual publish for 0.0.1, then changesets + GitHub Actions for subsequent versions.
+- CI runs lint + typecheck on push/PR. Publish workflow triggers after CI succeeds on main.

package/README.md

@@ -0,0 +1,44 @@
+# pi-ts-aperture
+
+Route Pi LLM providers through [Tailscale Aperture](https://tailscale.com/docs/features/aperture), a managed AI gateway on your tailnet.
+
+Aperture handles API key injection and request routing server-side. This extension overrides the base URL for selected providers so all LLM requests go through your Aperture instance instead of directly to provider APIs.
+
+## Setup
+
+```bash
+pi install @aliou/pi-ts-aperture
+```
+
+Then run the setup wizard:
+
+```
+/aperture:setup
+```
+
+This will prompt you for:
+1. Your Aperture base URL (e.g. `ai.your-tailnet.ts.net`)
+2. Which providers to route through Aperture (fuzzy searchable, multi-select)
+
+Configuration is saved globally to `~/.pi/agent/extensions/aperture.json`.
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `/aperture:setup` | Interactive wizard to configure Aperture URL and providers |
+| `/aperture:settings` | Settings UI to update base URL and provider list |
+
+## How it works
+
+For each configured provider, the extension calls `registerProvider` with:
+- `baseUrl` set to your Aperture URL + `/v1`
+- `apiKey` set to `"-"` (Aperture ignores client keys, it injects its own)
+
+This means all requests for those providers are routed through Aperture, which handles authentication, logging, and cost tracking on its end.
+
+## Requirements
+
+- A Tailscale tailnet with Aperture configured
+- The device running Pi must be on the tailnet
+- Use HTTP, not HTTPS, for the Aperture URL (WireGuard handles encryption)

package/biome.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.4.2/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "includes": ["**/*.ts", "**/*.json"],
+    "ignoreUnknown": true
+  },
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2
+  }
+}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@aliou/pi-ts-aperture",
+  "description": "Route Pi LLM providers through Tailscale Aperture",
+  "version": "0.0.1",
+  "packageManager": "pnpm@10.26.1",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aliou/pi-ts-aperture"
+  },
+  "keywords": [
+    "pi-package"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "pi": {
+    "extensions": [
+      "./src/index.ts"
+    ],
+    "video": "https://assets.aliou.me/pi-extensions/demos/pi-ts-aperture.mp4"
+  },
+  "dependencies": {
+    "@aliou/pi-utils-settings": "^0.3.0"
+  },
+  "peerDependencies": {
+    "@mariozechner/pi-ai": ">=0.52.12",
+    "@mariozechner/pi-coding-agent": ">=0.52.12"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check",
+    "format": "biome check --write",
+    "prepare": "husky",
+    "changeset": "changeset",
+    "version": "changeset version",
+    "release": "pnpm changeset publish"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.3.13",
+    "@changesets/cli": "^2.27.11",
+    "@mariozechner/pi-coding-agent": "0.52.12",
+    "@mariozechner/pi-tui": "0.52.12",
+    "@sinclair/typebox": "^0.34.48",
+    "@types/node": "^25.0.10",
+    "husky": "^9.1.7",
+    "typescript": "^5.9.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "@mariozechner/pi-ai": "$@mariozechner/pi-coding-agent",
+      "@mariozechner/pi-tui": "$@mariozechner/pi-coding-agent"
+    }
+  }
+}

package/shell.nix

@@ -0,0 +1,10 @@
+{
+  pkgs ? import <nixpkgs> { },
+}:
+
+pkgs.mkShell {
+  buildInputs = with pkgs; [
+    nodejs
+    pnpm_10
+  ];
+}

package/src/commands/settings.ts

@@ -0,0 +1,96 @@
+/**
+ * aperture:settings -- settings UI for Aperture configuration.
+ *
+ * Sections:
+ * - Connection: base URL
+ * - Providers: list of providers routed through Aperture
+ */
+
+import {
+  ArrayEditor,
+  registerSettingsCommand,
+  type SettingsSection,
+  setNestedValue,
+} from "@aliou/pi-utils-settings";
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { getSettingsListTheme } from "@mariozechner/pi-coding-agent";
+import type { ApertureConfig, ResolvedConfig } from "../config";
+import { configLoader } from "../config";
+
+export function registerApertureSettings(
+  pi: ExtensionAPI,
+  onConfigChange: () => void,
+): void {
+  registerSettingsCommand<ApertureConfig, ResolvedConfig>(pi, {
+    commandName: "aperture:settings",
+    title: "Aperture Settings",
+    configStore: configLoader,
+    buildSections: (
+      tabConfig: ApertureConfig | null,
+      resolved: ResolvedConfig,
+      { setDraft },
+    ): SettingsSection[] => {
+      const settingsTheme = getSettingsListTheme();
+
+      const providers = tabConfig?.providers ?? resolved.providers;
+
+      return [
+        {
+          label: "Connection",
+          items: [
+            {
+              id: "baseUrl",
+              label: "Base URL",
+              description:
+                "Aperture gateway URL on your tailnet (e.g. http://ai.pango-lin.ts.net)",
+              currentValue:
+                (tabConfig?.baseUrl ?? resolved.baseUrl) || "(not set)",
+              values: undefined,
+              submenu: undefined,
+            },
+          ],
+        },
+        {
+          label: "Providers",
+          items: [
+            {
+              id: "providers",
+              label: "Routed providers",
+              description: "LLM providers routed through Aperture",
+              currentValue: `${providers.length} provider(s)`,
+              submenu: (_val, submenuDone) => {
+                let latest = [...providers];
+                return new ArrayEditor({
+                  label: "Providers",
+                  items: [...providers],
+                  theme: settingsTheme,
+                  onSave: (items) => {
+                    latest = items;
+                    const updated = structuredClone(
+                      tabConfig ?? {},
+                    ) as ApertureConfig;
+                    setNestedValue(updated, "providers", items);
+                    setDraft(updated);
+                  },
+                  onDone: () => submenuDone(`${latest.length} provider(s)`),
+                });
+              },
+            },
+          ],
+        },
+      ];
+    },
+    onSettingChange: (id, newValue, config) => {
+      const updated = structuredClone(config);
+      if (id === "baseUrl") {
+        updated.baseUrl = newValue;
+      } else {
+        setNestedValue(updated, id, newValue);
+      }
+      return updated;
+    },
+    onSave: () => {
+      onConfigChange();
+    },
+  });
+}

package/src/commands/setup.ts

@@ -0,0 +1,204 @@
+/**
+ * aperture:setup -- interactive wizard for configuring Aperture.
+ *
+ * Steps:
+ * 1. Ask for Aperture base URL (Input)
+ * 2. Select providers to route through Aperture (FuzzySelector, multi-select loop)
+ * 3. Save config and register providers
+ */
+
+import { FuzzySelector } from "@aliou/pi-utils-settings";
+import { getProviders } from "@mariozechner/pi-ai";
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { getSettingsListTheme } from "@mariozechner/pi-coding-agent";
+import type { Component } from "@mariozechner/pi-tui";
+import { Input, Key, matchesKey } from "@mariozechner/pi-tui";
+import { configLoader } from "../config";
+
+function normalizeUrl(url: string): string {
+  let result = url.trim();
+  if (!result) return result;
+  if (!result.startsWith("http://") && !result.startsWith("https://")) {
+    result = `http://${result}`;
+  }
+  return result.replace(/\/v1\/?$/, "").replace(/\/+$/, "");
+}
+
+/**
+ * Simple input prompt component for the base URL step.
+ */
+class UrlPrompt implements Component {
+  private input: Input;
+  private done: (value: string | undefined) => void;
+  private theme: ReturnType<typeof getSettingsListTheme>;
+  private placeholder = "ai.pango-lin.ts.net";
+
+  constructor(
+    theme: ReturnType<typeof getSettingsListTheme>,
+    currentValue: string,
+    done: (value: string | undefined) => void,
+  ) {
+    this.theme = theme;
+    this.done = done;
+    this.input = new Input();
+    if (currentValue) {
+      this.input.setValue(currentValue);
+    }
+
+    this.input.onSubmit = () => {
+      const value = this.input.getValue().trim();
+      if (!value) return;
+      this.done(normalizeUrl(value));
+    };
+    this.input.onEscape = () => {
+      this.done(undefined);
+    };
+  }
+
+  render(width: number): string[] {
+    const lines: string[] = [];
+    lines.push(this.theme.label(" Aperture Setup", true));
+    lines.push("");
+    lines.push(
+      this.theme.hint(`  Aperture base URL (e.g. ${this.placeholder}):`),
+    );
+    lines.push(`  ${this.input.render(width - 4).join("")}`);
+    lines.push("");
+    lines.push(this.theme.hint("  Enter: confirm · Esc: cancel"));
+    return lines;
+  }
+
+  invalidate() {}
+
+  handleInput(data: string) {
+    this.input.handleInput(data);
+  }
+}
+
+/**
+ * Provider multi-select component. Uses FuzzySelector for search,
+ * tracks selected providers, and lets the user confirm with Ctrl+S.
+ */
+class ProviderMultiSelect implements Component {
+  private allProviders: string[];
+  private selected: Set<string>;
+  private theme: ReturnType<typeof getSettingsListTheme>;
+  private done: (value: string[] | undefined) => void;
+  private fuzzy: FuzzySelector;
+
+  constructor(
+    theme: ReturnType<typeof getSettingsListTheme>,
+    providers: string[],
+    preselected: string[],
+    done: (value: string[] | undefined) => void,
+  ) {
+    this.allProviders = providers;
+    this.selected = new Set(preselected);
+    this.theme = theme;
+    this.done = done;
+
+    this.fuzzy = new FuzzySelector({
+      label: "Select providers (Enter to toggle, Ctrl+S to confirm)",
+      items: this.allProviders,
+      theme,
+      onSelect: (value) => {
+        if (this.selected.has(value)) {
+          this.selected.delete(value);
+        } else {
+          this.selected.add(value);
+        }
+      },
+      onDone: () => {
+        this.done(undefined);
+      },
+    });
+  }
+
+  render(width: number): string[] {
+    const lines = this.fuzzy.render(width);
+
+    // Append selected providers summary
+    if (this.selected.size > 0) {
+      lines.push("");
+      lines.push(this.theme.hint(`  Selected (${this.selected.size}):`));
+      for (const p of this.selected) {
+        lines.push(`    ${this.theme.value(p, false)}`);
+      }
+    }
+
+    // Replace the hint line from FuzzySelector
+    const hintIndex = lines.findIndex((l) => l.includes("Type to search"));
+    if (hintIndex !== -1) {
+      lines[hintIndex] = this.theme.hint(
+        "  Type to search · Enter: toggle · Ctrl+S: confirm · Esc: cancel",
+      );
+    }
+
+    return lines;
+  }
+
+  invalidate() {
+    this.fuzzy.invalidate();
+  }
+
+  handleInput(data: string) {
+    if (matchesKey(data, Key.ctrl("s"))) {
+      this.done([...this.selected]);
+      return;
+    }
+    this.fuzzy.handleInput(data);
+  }
+}
+
+export function registerSetupCommand(
+  pi: ExtensionAPI,
+  onConfigChange: () => void,
+): void {
+  pi.registerCommand("aperture:setup", {
+    description: "Configure Tailscale Aperture integration",
+    handler: async (_args, ctx) => {
+      if (!ctx.hasUI) {
+        ctx.ui.notify(
+          "aperture:setup requires an interactive terminal",
+          "error",
+        );
+        return;
+      }
+
+      const config = configLoader.getConfig();
+      const settingsTheme = getSettingsListTheme();
+
+      // Step 1: base URL
+      const baseUrl = await ctx.ui.custom<string | undefined>(
+        (_tui, _theme, _kb, done) => {
+          return new UrlPrompt(settingsTheme, config.baseUrl, done);
+        },
+      );
+
+      if (!baseUrl) return;
+
+      // Step 2: select providers
+      const knownProviders = getProviders();
+      const providers = await ctx.ui.custom<string[] | undefined>(
+        (_tui, _theme, _kb, done) => {
+          return new ProviderMultiSelect(
+            settingsTheme,
+            knownProviders,
+            config.providers,
+            done,
+          );
+        },
+      );
+
+      if (!providers) return;
+
+      // Step 3: save and register
+      await configLoader.save("global", { baseUrl, providers });
+      onConfigChange();
+      ctx.ui.notify(
+        `Aperture configured: ${providers.length} provider(s) via ${baseUrl}`,
+        "info",
+      );
+    },
+  });
+}

package/src/config.ts

@@ -0,0 +1,29 @@
+/**
+ * Configuration schema and loader for the Aperture extension.
+ *
+ * ApertureConfig is the user-facing schema (all fields optional).
+ * ResolvedConfig is the internal schema (all fields required, defaults applied).
+ */
+
+import { ConfigLoader } from "@aliou/pi-utils-settings";
+
+export interface ApertureConfig {
+  baseUrl?: string;
+  providers?: string[];
+}
+
+export interface ResolvedConfig {
+  baseUrl: string;
+  providers: string[];
+}
+
+const DEFAULT_CONFIG: ResolvedConfig = {
+  baseUrl: "",
+  providers: [],
+};
+
+export const configLoader = new ConfigLoader<ApertureConfig, ResolvedConfig>(
+  "aperture",
+  DEFAULT_CONFIG,
+  { scopes: ["global"] },
+);

package/src/index.ts

@@ -0,0 +1,39 @@
+/**
+ * Pi extension for Tailscale Aperture integration.
+ *
+ * Routes selected LLM providers through an Aperture gateway on your tailnet.
+ * Aperture handles API key injection and request routing, so this extension
+ * overrides each provider's baseUrl and sets a dummy apiKey.
+ */
+
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+import { registerApertureSettings } from "./commands/settings";
+import { registerSetupCommand } from "./commands/setup";
+import { configLoader } from "./config";
+
+function registerProviders(pi: ExtensionAPI): void {
+  const config = configLoader.getConfig();
+  if (!config.baseUrl || config.providers.length === 0) return;
+
+  const baseUrl = config.baseUrl.replace(/\/+$/, "");
+
+  for (const provider of config.providers) {
+    pi.registerProvider(provider, {
+      baseUrl: `${baseUrl}/v1`,
+      apiKey: "-",
+    });
+  }
+}
+
+export default async function (pi: ExtensionAPI): Promise<void> {
+  await configLoader.load();
+
+  const onConfigChange = () => {
+    // Config is already reloaded by configLoader.save(), just re-register.
+    registerProviders(pi);
+  };
+
+  registerProviders(pi);
+  registerSetupCommand(pi, onConfigChange);
+  registerApertureSettings(pi, onConfigChange);
+}

package/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "jsxImportSource": "@mariozechner/pi-tui"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules"]
+}