@andreprado/agentkit 0.2.0 → 0.3.0

package/docs/guides/use-provider.md

@@ -49,12 +49,12 @@ To use the Codex subscription login instead of an OpenAI API key:
 npm run agentkit -- provider login openai-codex
 ```
 
-Run this in an interactive terminal, open the printed URL, and sign in with ChatGPT. If the browser callback cannot reach the terminal, paste the redirect URL into the prompt. This uses Pi's Codex OAuth flow and creates an AgentKit session; it does not read or change the Codex app/CLI credential cache.
+Run this in an interactive terminal, choose browser login (default) or device code login for headless machines, then sign in with ChatGPT. If the browser callback cannot reach the terminal, paste the redirect URL into the prompt. This uses Pi's Codex OAuth flow and creates an AgentKit session; it does not read or change the Codex app/CLI credential cache.
 
 Configure the capsule:
 
 ```ts
-provider: { name: "openai-codex", model: "gpt-5.4" },
+provider: { name: "openai-codex", model: "gpt-5.5" },
 secrets: [], // Keep any secrets required by your tools or other services.
 ```
 
@@ -102,7 +102,7 @@ Anthropic:
 ```ts
 provider: {
   name: "anthropic",
-  model: "claude-3-5-haiku-latest",
+  model: "claude-haiku-4-5",
 },
 secrets: ["ANTHROPIC_API_KEY"],
 ```
@@ -193,6 +193,8 @@ npm run agentkit -- inspect
 
 For OpenAI, Anthropic, OpenCode Zen, or OpenCode Go, use a model id known to the installed Pi SDK for that provider. For OpenRouter, prefer a known Pi alias when possible; otherwise a raw OpenRouter model id is passed through and any remaining model error comes from OpenRouter.
 
+After upgrading to AgentKit 0.3.0 (Pi 0.99), `openai-codex` no longer offers `gpt-5.4` or `gpt-5.4-mini`, and `anthropic` no longer offers `claude-3-5-haiku-latest`. Switch to a listed model such as `gpt-5.5` or `claude-haiku-4-5`; the error message lists examples.
+
 Provider returns auth failure:
 
 Check the key value, provider account status, and model access.

package/docs/llms-full.txt

@@ -217,7 +217,7 @@ secrets: [],
 
 Before claiming real conversation behavior has been tested, ask the owner which provider to use: OpenRouter, OpenAI, Anthropic, OpenCode Zen, OpenCode Go, or another supported provider. Do not choose for them. After the owner chooses, update `agentkit.config.ts`, `.env.schema`, local secrets, then rerun chat/UI checks.
 
-ChatGPT/Codex subscription login (local only): run `agentkit provider login openai-codex` in an interactive terminal, sign in through the printed URL, and set `provider: { name: "openai-codex", model: "gpt-5.4" }`. No `OPENAI_API_KEY` is required for this provider. Keep secrets needed by tools or other services. The AgentKit session is stored outside capsules in `~/.agentkit/providers/openai-codex.json`, renewed through Pi, and never copied from or into the Codex app cache. `agentkit provider status openai-codex` reports local status without tokens; `agentkit provider logout openai-codex` removes the local session without revoking it at OpenAI. See `docs/guides/use-provider.md`.
+ChatGPT/Codex subscription login (local only): run `agentkit provider login openai-codex` in an interactive terminal, sign in through the printed URL, and set `provider: { name: "openai-codex", model: "gpt-5.5" }`. No `OPENAI_API_KEY` is required for this provider. Keep secrets needed by tools or other services. The AgentKit session is stored outside capsules in `~/.agentkit/providers/openai-codex.json`, renewed through Pi, and never copied from or into the Codex app cache. `agentkit provider status openai-codex` reports local status without tokens; `agentkit provider logout openai-codex` removes the local session without revoking it at OpenAI. See `docs/guides/use-provider.md`.
 
 OpenAI example:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andreprado/agentkit",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": false,
   "type": "module",
   "repository": {
@@ -29,7 +29,7 @@
     "agentkit": "bin/agentkit.mjs"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "^0.75.5",
+    "@earendil-works/pi-ai": "^0.99.2",
     "@libsql/client": "^0.15.15",
     "tsx": "^4.23.12",
     "typebox": "^1.1.38"

package/src/cli/commands/provider.ts

@@ -1,8 +1,8 @@
-import { createInterface } from "node:readline/promises";
+import { createInterface, type Interface } from "node:readline/promises";
 
-import { loginOpenAICodex } from "@earendil-works/pi-ai/oauth";
+import type { AuthEvent, AuthPrompt } from "@earendil-works/pi-ai";
 
-import { clearCodexLogin, codexLoginStatus, saveCodexLogin } from "../../providers/codex-auth";
+import { clearCodexLogin, codexLoginStatus, codexOAuth, saveCodexLogin } from "../../providers/codex-auth";
 import { AgentKitError } from "../../runtime/errors";
 import type { ParsedArgs } from "../args";
 
@@ -28,20 +28,38 @@ export async function handleProviderCommand(args: ParsedArgs): Promise<void> {
   const abort = new AbortController();
   readline.on("SIGINT", () => abort.abort());
   try {
-    const credentials = await loginOpenAICodex({
-      onAuth({ url, instructions }) {
-        console.log(`Open this URL to sign in with ChatGPT:\n${url}`);
-        if (instructions) console.log(instructions);
-      },
-      onPrompt: ({ message }) => readline.question(`${message} `, { signal: abort.signal }),
-      onManualCodeInput: () => readline.question("After signing in, paste the redirect URL here if the browser callback cannot reach this terminal: ", { signal: abort.signal }),
+    const credentials = await codexOAuth().login({
+      signal: abort.signal,
+      notify: printAuthEvent,
+      prompt: (prompt) => askAuthPrompt(readline, prompt, abort.signal),
     }).catch(() => {
       throw new AgentKitError("provider_auth_failed", "Codex login failed or was cancelled. Run agentkit provider login openai-codex again.");
     });
     await saveCodexLogin(credentials);
-    console.log('Signed in. Set provider: { name: "openai-codex", model: "gpt-5.4" } in agentkit.config.ts. No OPENAI_API_KEY is required.');
+    console.log('Signed in. Set provider: { name: "openai-codex", model: "gpt-5.5" } in agentkit.config.ts. No OPENAI_API_KEY is required.');
   } finally {
     abort.abort();
     readline.close();
   }
 }
+
+function printAuthEvent(event: AuthEvent): void {
+  if (event.type === "auth_url") {
+    console.log(`Open this URL to sign in with ChatGPT:\n${event.url}`);
+    if (event.instructions) console.log(event.instructions);
+  } else if (event.type === "device_code") {
+    console.log(`Open ${event.verificationUri} and enter code ${event.userCode}`);
+  } else {
+    console.log(event.message);
+  }
+}
+
+async function askAuthPrompt(readline: Interface, prompt: AuthPrompt, loginSignal: AbortSignal): Promise<string> {
+  const signal = prompt.signal ? AbortSignal.any([loginSignal, prompt.signal]) : loginSignal;
+  if (prompt.type !== "select") return readline.question(`${prompt.message} `, { signal });
+  prompt.options.forEach((option, index) => console.log(`  ${index + 1}. ${option.label}`));
+  const answer = (await readline.question(`${prompt.message} [1] `, { signal })).trim() || "1";
+  const option = prompt.options[Number(answer) - 1];
+  if (!option) throw new Error("Unknown login option.");
+  return option.id;
+}

package/src/providers/codex-auth.ts

@@ -4,10 +4,24 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 
-import { refreshOpenAICodexToken, type OAuthCredentials } from "@earendil-works/pi-ai/oauth";
+import type { OAuthAuth } from "@earendil-works/pi-ai";
+import type { OAuthCredentials } from "@earendil-works/pi-ai/oauth";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 
 import { AgentKitError } from "../runtime/errors";
 
+const REFRESH_TIMEOUT_MS = 15_000;
+
+export function codexOAuth(): OAuthAuth {
+  const oauth = openaiCodexProvider().auth.oauth;
+  if (!oauth) throw new AgentKitError("provider_not_supported", "The installed Pi SDK no longer supports OpenAI Codex sign-in.");
+  return oauth;
+}
+
+function refreshCodexToken(refresh: string): Promise<OAuthCredentials> {
+  return codexOAuth().refresh({ type: "oauth", access: "", refresh, expires: 0 }, AbortSignal.timeout(REFRESH_TIMEOUT_MS));
+}
+
 export function codexAuthPath(): string {
   return join(homedir(), ".agentkit", "providers", "openai-codex.json");
 }
@@ -90,7 +104,7 @@ export async function codexLoginStatus(path = codexAuthPath()) {
 
 export async function getCodexApiKey(
   path = codexAuthPath(),
-  refresh = refreshOpenAICodexToken,
+  refresh = refreshCodexToken,
 ): Promise<string> {
   return withAuthLock(path, async () => {
     const credentials = await readCredentials(path);

package/src/providers/pi.ts

@@ -1,28 +1,51 @@
 import {
-  findEnvKeys,
-  getModel,
-  getModels,
-  stream,
+  createModels,
+  envApiKeyAuth,
   type AssistantMessage,
   type AssistantMessageEvent,
+  type Context,
   type Message,
   type Model,
-  type Provider,
+  type StreamOptions,
   type Tool as PiTool,
   type ToolCall,
   type Usage,
 } from "@earendil-works/pi-ai";
+import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { openaiProvider } from "@earendil-works/pi-ai/providers/openai";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+import { opencodeProvider } from "@earendil-works/pi-ai/providers/opencode";
+import { opencodeGoProvider } from "@earendil-works/pi-ai/providers/opencode-go";
+import { openrouterProvider } from "@earendil-works/pi-ai/providers/openrouter";
 
 import type { AgentProviderName, AgentTool } from "../index";
 import { AgentKitError } from "../runtime/errors";
 import type { ProviderAdapter, ProviderRunInput, ProviderRunResult } from "./types";
 
 const PI_PROVIDER_NAMES = ["openai", "openai-codex", "anthropic", "openrouter", "opencode", "opencode-go"] as const satisfies AgentProviderName[];
+type Provider = (typeof PI_PROVIDER_NAMES)[number];
+const PROVIDER_SECRET_NAMES: Record<Exclude<Provider, "openai-codex">, string[]> = {
+  openai: ["OPENAI_API_KEY"],
+  anthropic: ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"],
+  openrouter: ["OPENROUTER_API_KEY"],
+  opencode: ["OPENCODE_API_KEY"],
+  "opencode-go": ["OPENCODE_API_KEY"],
+};
 const MAX_TOOL_TURNS = 8;
 const OPENROUTER_BASE_URL = "https://openrouter.ai/api/v1";
 const UNKNOWN_OPENROUTER_CONTEXT_WINDOW = 128000;
 const UNKNOWN_OPENROUTER_MAX_TOKENS = 8192;
 
+// AgentKit resolves credentials itself (.env secrets, the local Codex login) and passes
+// them per request, so Pi never reads ambient env vars or its own credential store.
+export const piModels = createModels();
+for (const provider of [openaiProvider(), anthropicProvider(), openrouterProvider(), opencodeProvider(), opencodeGoProvider()]) {
+  piModels.setProvider(provider);
+}
+const codexProvider = openaiCodexProvider();
+// Pi's Codex provider only accepts its own OAuth store; accept the explicit access token instead.
+piModels.setProvider({ ...codexProvider, auth: { ...codexProvider.auth, apiKey: envApiKeyAuth("OpenAI Codex access token", []) } });
+
 export const piProviderAdapters: ProviderAdapter[] = PI_PROVIDER_NAMES.map((name) => ({
   name,
   run(input) {
@@ -129,11 +152,11 @@ export function providerToolResultText(result: {
 
 async function runPiTurn(
   model: Model<any>,
-  context: Parameters<typeof stream>[1],
-  options: Parameters<typeof stream>[2],
+  context: Context,
+  options: StreamOptions,
   rawEvents: AssistantMessageEvent[],
 ): Promise<AssistantMessage> {
-  const eventStream = stream(model, context, options);
+  const eventStream = piModels.stream(model, context, options);
   let assistant: AssistantMessage | undefined;
   let failed: AssistantMessage | undefined;
 
@@ -180,7 +203,7 @@ function requireProviderApiKey(provider: Provider, env: Record<string, string |
     throw new AgentKitError("provider_auth_required", "Run agentkit provider login openai-codex, then use local chat, dev, or eval.");
   }
 
-  const envNames = findEnvKeys(provider) ?? defaultProviderSecretNames(provider);
+  const envNames = PROVIDER_SECRET_NAMES[provider];
   const setName = envNames.find((name) => env[name]);
 
   if (!setName) {
@@ -193,14 +216,6 @@ function requireProviderApiKey(provider: Provider, env: Record<string, string |
   return env[setName] as string;
 }
 
-function defaultProviderSecretNames(provider: Provider): string[] {
-  if (provider === "opencode" || provider === "opencode-go") {
-    return ["OPENCODE_API_KEY"];
-  }
-
-  return [`${provider.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`];
-}
-
 function formatSecretList(names: string[]): string {
   if (names.length === 1) {
     return names[0];
@@ -210,7 +225,7 @@ function formatSecretList(names: string[]): string {
 }
 
 export function resolveModel(provider: Provider, modelId: string): Model<any> {
-  const model = getModel(provider as any, modelId as any) as Model<any> | undefined;
+  const model = piModels.getModel(provider, modelId);
 
   if (model) {
     return model;
@@ -250,7 +265,7 @@ function createOpenRouterPassThroughModel(modelId: string): Model<"openai-comple
 }
 
 function knownModelHint(provider: Provider): string {
-  const examples = getModels(provider as any)
+  const examples = piModels.getModels(provider)
     .slice(0, 5)
     .map((model) => model.id);
 

package/src/templates/skills/agentkit-provider/SKILL.md

@@ -34,7 +34,7 @@ secrets: ["OPENAI_API_KEY"],
 Anthropic:
 
 ```ts
-provider: { name: "anthropic", model: "claude-3-5-haiku-latest" },
+provider: { name: "anthropic", model: "claude-haiku-4-5" },
 secrets: ["ANTHROPIC_API_KEY"],
 ```