@baique/pi-web-sky 0.1.35 → 0.1.36

package/lib/project-tree.test.mjs

@@ -0,0 +1,115 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+const { MAX_PROJECTED_TREE_DEPTH, projectTreeForResponse } = await import("./project-tree.ts");
+
+const msg = (id, role, content) => ({ type: "message", id, parentId: null, timestamp: "t", message: { role, content } });
+const info = (id) => ({ type: "session_info", id, parentId: null, timestamp: "t", name: "x" });
+const model = (id) => ({ type: "model_change", id, parentId: null, timestamp: "t", provider: "test", modelId: "test" });
+const node = (entry, children = []) => ({ entry, children });
+
+function findProjectedNode(nodes, id) {
+  const pending = [...nodes];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (current.entry.id === id) return current;
+    pending.push(...current.children);
+  }
+  return undefined;
+}
+
+test("attaches the first branch message preview to the contracted representative", () => {
+  const arm1Leaf = node(msg("a2", "assistant", "答一"));
+  const arm1 = node(info("s1"), [node(msg("u2", "user", [
+    { type: "text", text: "分支一的问题" },
+    { type: "image", data: "base64-secret", mimeType: "image/png" },
+  ]), [arm1Leaf])]);
+  const arm2 = node(msg("u2b", "user", "分支二的问题"), [node(msg("a2b", "assistant", "答二"))]);
+  const a1 = node(msg("a1", "assistant", "答"), [arm1, arm2]);
+  const root = node(msg("u1", "user", "第一问"), [a1]);
+
+  const [projectedRoot] = projectTreeForResponse([root]);
+  const projectedA1 = projectedRoot.children[0];
+  assert.equal(projectedA1.entry.id, "a1");
+  assert.equal(projectedA1.children[0].entry.id, "a2");
+  assert.deepEqual(projectedA1.children[0].compressedEntryIds, ["s1", "u2"]);
+  assert.deepEqual(projectedA1.children[0].branchPreview, { role: "user", text: "分支一的问题" });
+  assert.equal(projectedA1.children[1].entry.id, "a2b");
+  assert.deepEqual(projectedA1.children[1].compressedEntryIds, ["u2b"]);
+  assert.deepEqual(projectedA1.children[1].branchPreview, { role: "user", text: "分支二的问题" });
+  assert.equal(JSON.stringify(projectedRoot).includes("base64-secret"), false);
+});
+
+test("does not copy thinking or tool payloads from a compressed assistant label source", () => {
+  const assistant = node(msg("a1", "assistant", [
+    { type: "thinking", thinking: "thinking-secret" },
+    { type: "text", text: "可见回答" },
+    { type: "toolCall", id: "tc1", name: "read", arguments: { value: "tool-secret" } },
+  ]), [node(info("leaf1"))]);
+  const sibling = node(msg("u2", "user", "另一个分支"), [node(info("leaf2"))]);
+  const projected = projectTreeForResponse([node(info("root"), [assistant, sibling])]);
+  const leaf = findProjectedNode(projected, "leaf1");
+
+  assert.deepEqual(leaf.branchPreview, { role: "assistant", text: "可见回答" });
+  const serialized = JSON.stringify(projected);
+  assert.equal(serialized.includes("thinking-secret"), false);
+  assert.equal(serialized.includes("tool-secret"), false);
+});
+
+test("carries previews through non-message roots in multi-root trees", () => {
+  const root1 = node(model("m1"), [node(msg("u1", "user", "第一个问题"), [node(msg("a1", "assistant", "回答一"))])]);
+  const root2 = node(info("s2"), [node(msg("u2", "user", "第二个问题"), [node(msg("a2", "assistant", "回答二"))])]);
+  const projected = projectTreeForResponse([root1, root2]);
+
+  assert.deepEqual(projected[0].children[0].branchPreview, { role: "user", text: "第一个问题" });
+  assert.deepEqual(projected[1].children[0].branchPreview, { role: "user", text: "第二个问题" });
+  assert.deepEqual(projected[0].children[0].compressedEntryIds, ["u1"]);
+  assert.deepEqual(projected[1].children[0].compressedEntryIds, ["u2"]);
+});
+
+test("normalizes and bounds preview text and labels image-only messages", () => {
+  const longText = `  第一行\n\n第二行 ${"x".repeat(80)}`;
+  const textArm = node(msg("u1", "user", longText), [node(info("leaf1"))]);
+  const imageArm = node(msg("u2", "user", [{ type: "image", data: "secret-image", mimeType: "image/png" }]), [node(info("leaf2"))]);
+  const projected = projectTreeForResponse([node(info("root"), [textArm, imageArm])]);
+  const textPreview = findProjectedNode(projected, "leaf1").branchPreview;
+  const imagePreview = findProjectedNode(projected, "leaf2").branchPreview;
+
+  assert.equal(textPreview.text.startsWith("第一行 第二行 "), true);
+  assert.equal(textPreview.text.length, 41);
+  assert.equal(textPreview.text.endsWith("…"), true);
+  assert.deepEqual(imagePreview, { role: "user", text: "[image]" });
+  assert.equal(JSON.stringify(projected).includes("secret-image"), false);
+});
+
+test("does not copy unknown message roles into previews", () => {
+  const unknownRole = `unknown-role-${"x".repeat(80)}`;
+  const arm = node(msg("m1", unknownRole, "可见内容"), [node(info("leaf1"))]);
+  const sibling = node(msg("u2", "user", "另一个分支"), [node(info("leaf2"))]);
+  const projected = projectTreeForResponse([node(info("root"), [arm, sibling])]);
+  const preview = findProjectedNode(projected, "leaf1").branchPreview;
+
+  assert.deepEqual(preview, { text: "可见内容" });
+  assert.equal(JSON.stringify(projected).includes("unknown-role-"), false);
+});
+
+test("carries previews through the depth-limit flattening path", () => {
+  let deepArm = node(info("prefix"), [node(msg("deep-user", "user", "深层问题"), [node(info("deep-leaf"))])]);
+  for (let i = 0; i < MAX_PROJECTED_TREE_DEPTH + 2; i++) {
+    deepArm = node(info(`branch-${i}`), [deepArm, node(info(`side-${i}`))]);
+  }
+
+  const projected = projectTreeForResponse([deepArm]);
+  const leaf = findProjectedNode(projected, "deep-leaf");
+  assert.deepEqual(leaf.branchPreview, { role: "user", text: "深层问题" });
+  assert.deepEqual(leaf.compressedEntryIds, ["prefix", "deep-user"]);
+  assert.equal(findProjectedNode(projected, "deep-user"), undefined);
+});
+
+test("linear sessions still project to root + leaf only", () => {
+  const root = node(msg("u1", "user", "第一问"), [node(msg("a1", "assistant", "答"))]);
+  const [projected] = projectTreeForResponse([root]);
+  assert.equal(projected.entry.id, "u1");
+  assert.equal(projected.children.length, 1);
+  assert.equal(projected.children[0].entry.id, "a1");
+});

package/lib/project-tree.ts

@@ -0,0 +1,176 @@
+import type { BranchPreview } from "@/lib/types";
+
+// BranchNavigator still traverses recursively, so keep the response tree shallow.
+export const MAX_PROJECTED_TREE_DEPTH = 200;
+const MAX_BRANCH_PREVIEW_LENGTH = 40;
+
+type ProjectableEntry = {
+  id: string;
+  type: string;
+  message?: unknown;
+};
+
+type ProjectableTreeNode<T> = {
+  entry: ProjectableEntry;
+  children: T[];
+  compressedEntryIds?: string[];
+  branchPreview?: BranchPreview;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function appendPreviewText(current: string, value: unknown): string {
+  if (typeof value !== "string" || current.length > MAX_BRANCH_PREVIEW_LENGTH) return current;
+  const normalized = value.replace(/\s+/g, " ").trim();
+  if (!normalized) return current;
+  const separator = current ? " " : "";
+  const prefix = current + separator;
+  if (prefix.length >= MAX_BRANCH_PREVIEW_LENGTH + 1) {
+    return prefix.slice(0, MAX_BRANCH_PREVIEW_LENGTH + 1);
+  }
+  const remaining = MAX_BRANCH_PREVIEW_LENGTH + 1 - prefix.length;
+  return prefix + normalized.slice(0, remaining);
+}
+
+function previewForEntry(entry: ProjectableEntry): BranchPreview | undefined {
+  if (entry.type !== "message" || !isRecord(entry.message) || typeof entry.message.role !== "string") {
+    return undefined;
+  }
+
+  const content = entry.message.content;
+  let text = "";
+  let hasImage = false;
+  if (typeof content === "string") {
+    text = appendPreviewText(text, content);
+  } else if (Array.isArray(content)) {
+    for (const block of content) {
+      if (!isRecord(block)) continue;
+      if (block.type === "image") hasImage = true;
+      if (block.type === "text") text = appendPreviewText(text, block.text);
+      if (text.length > MAX_BRANCH_PREVIEW_LENGTH) break;
+    }
+  }
+
+  if (text.length > MAX_BRANCH_PREVIEW_LENGTH) {
+    text = text.slice(0, MAX_BRANCH_PREVIEW_LENGTH) + "…";
+  } else if (!text) {
+    text = hasImage
+      ? "[image]"
+      : entry.message.role === "assistant"
+        ? "[assistant]"
+        : "message";
+  }
+
+  const role = entry.message.role === "user" || entry.message.role === "assistant"
+    ? entry.message.role
+    : undefined;
+  return { ...(role ? { role } : {}), text };
+}
+
+/**
+ * Project the session tree into the shallow navigation tree sent to the client.
+ * Keeps roots, branch points, and leaves while contracting single-child chains
+ * without recursive traversal. Contracted entry IDs are attached to the next
+ * visible node so the UI can still recognize an active leaf inside the chain.
+ */
+export function projectTreeForResponse<T extends ProjectableTreeNode<T>>(
+  nodes: T[]
+): T[] {
+  const keep = new Set<T>();
+  const roots = new Set(nodes);
+  const seen = new Set<T>();
+  const stack = [...nodes];
+
+  while (stack.length > 0) {
+    const node = stack.pop()!;
+    if (seen.has(node)) continue;
+    seen.add(node);
+
+    if (
+      roots.has(node) ||
+      node.children.length !== 1
+    ) {
+      keep.add(node);
+    }
+
+    for (const child of node.children) {
+      stack.push(child);
+    }
+  }
+
+  const cloneNode = (node: T, compressedEntryIds?: string[], branchPreview?: BranchPreview): T => ({
+    ...node,
+    children: [],
+    ...(compressedEntryIds?.length ? { compressedEntryIds } : {}),
+    ...(branchPreview ? { branchPreview } : {}),
+  });
+  const projectedRoots = nodes.map((node) => cloneNode(node, undefined, previewForEntry(node.entry)));
+  const tasks = nodes.map((source, index) => ({
+    source,
+    projected: projectedRoots[index],
+    depth: 1,
+  }));
+
+  const appendFlattenedKeptDescendants = (source: T, projectedParent: T) => {
+    const pending = [{
+      node: source,
+      compressedEntryIds: [] as string[],
+      branchPreview: undefined as BranchPreview | undefined,
+    }];
+    const flattenedSeen = new Set<T>();
+
+    while (pending.length > 0) {
+      const { node, compressedEntryIds, branchPreview } = pending.pop()!;
+      if (flattenedSeen.has(node)) continue;
+      flattenedSeen.add(node);
+      const nextPreview = branchPreview ?? previewForEntry(node.entry);
+
+      if (keep.has(node)) {
+        projectedParent.children.push(cloneNode(node, compressedEntryIds, nextPreview));
+      }
+
+      for (let i = node.children.length - 1; i >= 0; i--) {
+        pending.push({
+          node: node.children[i],
+          compressedEntryIds: keep.has(node)
+            ? []
+            : [...compressedEntryIds, node.entry.id],
+          branchPreview: keep.has(node) ? undefined : nextPreview,
+        });
+      }
+    }
+  };
+
+  while (tasks.length > 0) {
+    const { source, projected, depth } = tasks.pop()!;
+
+    for (const sourceChild of source.children) {
+      let child = sourceChild;
+
+      if (depth >= MAX_PROJECTED_TREE_DEPTH) {
+        appendFlattenedKeptDescendants(child, projected);
+        continue;
+      }
+
+      const compressedEntryIds: string[] = [];
+      let branchPreview = previewForEntry(child.entry);
+      while (!keep.has(child) && child.children.length === 1) {
+        compressedEntryIds.push(child.entry.id);
+        child = child.children[0];
+        branchPreview ??= previewForEntry(child.entry);
+      }
+
+      if (!keep.has(child)) {
+        continue;
+      }
+
+      const projectedChild = cloneNode(child, compressedEntryIds, branchPreview);
+      projected.children.push(projectedChild);
+      tasks.push({ source: child, projected: projectedChild, depth: depth + 1 });
+    }
+  }
+
+  return projectedRoots;
+}

package/lib/project-trust.test.mjs

@@ -0,0 +1,117 @@
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { DefaultResourceLoader } from "@earendil-works/pi-coding-agent";
+import {
+  getProjectTrustStatus,
+  projectTrustReloadOptions,
+  trustProject,
+} from "./project-trust.ts";
+
+async function createProjectFixture(t) {
+  const root = await mkdtemp(join(tmpdir(), "pi-web-project-trust-"));
+  const cwd = join(root, "project");
+  const agentDir = join(root, "agent");
+  await mkdir(cwd, { recursive: true });
+  await mkdir(agentDir, { recursive: true });
+  t.after(() => rm(root, { recursive: true, force: true }));
+  return { root, cwd, agentDir };
+}
+
+test("clean projects stay on the normal trusted load path", async (t) => {
+  const { cwd, agentDir } = await createProjectFixture(t);
+
+  assert.deepEqual(getProjectTrustStatus(cwd, agentDir), {
+    requiresTrust: false,
+    trusted: true,
+  });
+  assert.equal(projectTrustReloadOptions(cwd, agentDir), undefined);
+});
+
+test("project extensions execute only after the project is trusted", async (t) => {
+  const { root, cwd, agentDir } = await createProjectFixture(t);
+  const extensionDir = join(cwd, ".pi", "extensions");
+  const marker = join(root, "extension-executed");
+  await mkdir(extensionDir, { recursive: true });
+  await writeFile(
+    join(extensionDir, "probe.js"),
+    `import { writeFileSync } from "node:fs";\nexport default () => { writeFileSync(${JSON.stringify(marker)}, "executed"); };\n`,
+  );
+
+  assert.deepEqual(getProjectTrustStatus(cwd, agentDir), {
+    requiresTrust: true,
+    trusted: false,
+  });
+
+  const restrictedLoader = new DefaultResourceLoader({ cwd, agentDir });
+  await restrictedLoader.reload(projectTrustReloadOptions(cwd, agentDir));
+  assert.equal(existsSync(marker), false);
+  assert.equal(restrictedLoader.getExtensions().extensions.length, 0);
+
+  assert.deepEqual(trustProject(cwd, agentDir), {
+    requiresTrust: true,
+    trusted: true,
+  });
+
+  const trustedLoader = new DefaultResourceLoader({ cwd, agentDir });
+  await trustedLoader.reload(projectTrustReloadOptions(cwd, agentDir));
+  assert.equal(existsSync(marker), true);
+  assert.equal(trustedLoader.getExtensions().extensions.length, 1);
+});
+
+test("the reload resolver reads the latest persisted trust decision", async (t) => {
+  const { cwd, agentDir } = await createProjectFixture(t);
+  await mkdir(join(cwd, ".pi", "extensions"), { recursive: true });
+
+  const reloadOptions = projectTrustReloadOptions(cwd, agentDir);
+  assert.ok(reloadOptions);
+  assert.equal(await reloadOptions.resolveProjectTrust(), false);
+
+  trustProject(cwd, agentDir);
+  assert.equal(await reloadOptions.resolveProjectTrust(), true);
+});
+
+test("all project resource loaders and reloads enforce project trust", async () => {
+  const rpcSource = await readFile(new URL("./rpc-manager.ts", import.meta.url), "utf8");
+  const modelsSource = await readFile(new URL("../app/api/models/route.ts", import.meta.url), "utf8");
+  const skillsSource = await readFile(new URL("./skills-service.ts", import.meta.url), "utf8");
+  const skillsInstallSource = await readFile(new URL("../app/api/skills/install/route.ts", import.meta.url), "utf8");
+  const pluginsSource = await readFile(new URL("../app/api/plugins/route.ts", import.meta.url), "utf8");
+
+  assert.match(rpcSource, /const sessionCwd = sessionManager\.getCwd\(\)/);
+  assert.match(rpcSource, /projectTrustReloadOptions\(sessionCwd, agentDir\)/);
+  assert.match(rpcSource, /resourceLoaderReloadOptions: trustReloadOptions/);
+  assert.equal(
+    Array.from(rpcSource.matchAll(/this\.syncProjectTrust\(\);\s*await this\.inner\.reload/g)).length,
+    2,
+  );
+
+  assert.match(modelsSource, /projectTrustReloadOptions\(cwd, agentDir\)/);
+  assert.match(modelsSource, /resourceLoaderReloadOptions: trustReloadOptions/);
+  assert.match(skillsSource, /loader\.reload\(projectTrustReloadOptions\(cwd, agentDir\)\)/);
+  assert.match(pluginsSource, /projectTrusted: projectTrust\.trusted/);
+  assert.match(
+    skillsInstallSource,
+    /getProjectTrustStatus\(cwd, getAgentDir\(\)\)\.trusted/,
+  );
+  assert.equal(
+    Array.from(pluginsSource.matchAll(/projectTrusted: projectTrust\.trusted/g)).length,
+    2,
+  );
+  assert.match(pluginsSource, /scope === "project" && !projectTrust\.trusted/);
+});
+
+test("the trust API invalidates cached models and restricted runtimes", async () => {
+  const source = await readFile(new URL("../app/api/project-trust/route.ts", import.meta.url), "utf8");
+  const rpcSource = await readFile(new URL("./rpc-manager.ts", import.meta.url), "utf8");
+
+  assert.match(source, /trustProject\(result\.cwd, agentDir\)/);
+  assert.match(source, /invalidateModelsCache\(\)/);
+  assert.match(source, /destroyRpcSessionsForCwd\(result\.cwd\)/);
+  assert.match(source, /hasBusyRpcSessionForCwd\(result\.cwd\)/);
+  assert.match(rpcSource, /trackStartingSession\(sessionCwd\)/);
+  assert.match(rpcSource, /realpathSync\(resolvedCwd\)/);
+});

package/lib/project-trust.ts

@@ -0,0 +1,48 @@
+import { hasTrustRequiringProjectResources, ProjectTrustStore } from "@earendil-works/pi-coding-agent";
+import type { ProjectTrustStatus } from "./api-types";
+
+export function getProjectTrustStatus(cwd: string, agentDir: string): ProjectTrustStatus {
+  const requiresTrust = Boolean(cwd) && hasTrustRequiringProjectResources(cwd);
+  if (!requiresTrust) return { requiresTrust: false, trusted: true };
+
+  const trustStore = new ProjectTrustStore(agentDir);
+  return {
+    requiresTrust: true,
+    trusted: trustStore.get(cwd) === true,
+  };
+}
+
+export function trustProject(cwd: string, agentDir: string): ProjectTrustStatus {
+  const status = getProjectTrustStatus(cwd, agentDir);
+  if (!status.requiresTrust) return status;
+
+  new ProjectTrustStore(agentDir).set(cwd, true);
+  return { requiresTrust: true, trusted: true };
+}
+
+/**
+ * Reload options that gate project-local, trust-requiring resources — a
+ * repository's `.pi/extensions`, project `.pi/settings.json` extension
+ * entries, and `.agents/skills` — behind the SDK's project-trust store.
+ *
+ * Pi Web *executes* project extensions when it builds session services: their
+ * factory runs on import and their `session_start` handlers run on startup.
+ * Without a trust gate, merely opening an untrusted repository in Pi Web runs
+ * repository-controlled code locally (issue #236). The SDK's resource loader
+ * only imports project extensions once `resolveProjectTrust` resolves true, so
+ * denying trust keeps them dormant.
+ *
+ * Pi Web and the `pi` CLI share the same trust store. Projects with gated
+ * resources default to untrusted until either client records a trust decision.
+ * Returns `undefined` when the project has no trust-requiring resources,
+ * leaving ordinary projects on their existing load path.
+ */
+export function projectTrustReloadOptions(
+  cwd: string,
+  agentDir: string,
+): { resolveProjectTrust: () => Promise<boolean> } | undefined {
+  const status = getProjectTrustStatus(cwd, agentDir);
+  if (!status.requiresTrust) return undefined;
+  const trustStore = new ProjectTrustStore(agentDir);
+  return { resolveProjectTrust: async () => trustStore.get(cwd) === true };
+}

package/lib/prompt-recovery.test.mjs

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createJiti } from "jiti";
+
+const { userMessageKey } = await createJiti(import.meta.url).import("./prompt-recovery.ts");
+
+function textMessage(content) {
+  return { role: "user", content, timestamp: 1 };
+}
+
+test("builds stable keys for matching optimistic text messages", () => {
+  assert.equal(userMessageKey(textMessage("repeat this")), userMessageKey(textMessage("repeat this")));
+  assert.notEqual(userMessageKey(textMessage("first")), userMessageKey(textMessage("second")));
+});
+
+test("includes attached images in optimistic message keys", () => {
+  const submitted = {
+    role: "user",
+    content: [
+      { type: "text", text: "inspect" },
+      { type: "image", source: { type: "base64", media_type: "image/png", data: "AQID" } },
+    ],
+    timestamp: 1,
+  };
+  const differentImage = {
+    ...submitted,
+    content: [
+      { type: "text", text: "inspect" },
+      { type: "image", source: { type: "base64", media_type: "image/png", data: "BAUG" } },
+    ],
+  };
+  assert.notEqual(userMessageKey(submitted), userMessageKey(differentImage));
+});

package/lib/prompt-recovery.ts

@@ -0,0 +1,47 @@
+import type { AgentMessage } from "@/lib/types";
+
+function extractMessageText(message: Partial<AgentMessage>): string {
+  const content = (message as { content?: unknown }).content;
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content
+    .map((block) =>
+      block && typeof block === "object"
+        && (block as { type?: string }).type === "text"
+        && typeof (block as { text?: unknown }).text === "string"
+        ? (block as { text: string }).text
+        : "")
+    .filter(Boolean)
+    .join("\n");
+}
+
+function imageSignature(block: unknown): string {
+  if (!block || typeof block !== "object" || (block as { type?: unknown }).type !== "image") return "";
+  const source = (block as { source?: unknown }).source;
+  if (source && typeof source === "object") {
+    const src = source as { type?: unknown; media_type?: unknown; data?: unknown; url?: unknown };
+    return [
+      src.type === "url" ? "url" : "base64",
+      typeof src.media_type === "string" ? src.media_type : "",
+      typeof src.data === "string" ? src.data : "",
+      typeof src.url === "string" ? src.url : "",
+    ].join(":");
+  }
+  const flat = block as { data?: unknown; mimeType?: unknown };
+  return [
+    "base64",
+    typeof flat.mimeType === "string" ? flat.mimeType : "",
+    typeof flat.data === "string" ? flat.data : "",
+    "",
+  ].join(":");
+}
+
+export function userMessageKey(message: Partial<AgentMessage>): string {
+  const content = (message as { content?: unknown }).content;
+  if (typeof content === "string") return JSON.stringify({ text: content, images: [] });
+  if (!Array.isArray(content)) return JSON.stringify({ text: "", images: [] });
+  return JSON.stringify({
+    text: extractMessageText(message),
+    images: content.map(imageSignature).filter(Boolean),
+  });
+}

package/lib/provider-api-key-route.test.mjs

@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+
+test("API key saves do not use ModelRuntime.login's network refresh", async () => {
+  const source = await readFile(new URL("../app/api/auth/api-key/[provider]/route.ts", import.meta.url), "utf-8");
+
+  assert.doesNotMatch(source, /modelRuntime\.login\(/);
+  assert.match(source, /apiKeyAuth\.login\(/);
+  assert.match(source, /signal:\s*req\.signal/);
+  assert.match(source, /storeProviderCredential\(provider, credential\)/);
+});

package/lib/provider-credential-store.test.mjs

@@ -0,0 +1,126 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { createJiti } from "jiti";
+import lockfile from "proper-lockfile";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+
+const { removeStoredCredentialIfType, storeProviderCredential } = await createJiti(import.meta.url)
+  .import("./provider-credential-store.ts");
+
+async function withAuthFile(data, run) {
+  const dir = await mkdtemp(join(tmpdir(), "pi-web-provider-auth-"));
+  const authPath = join(dir, "auth.json");
+  await writeFile(authPath, JSON.stringify(data, null, 2), { mode: 0o600 });
+  try {
+    await run(authPath);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+async function readAuthFile(authPath) {
+  return JSON.parse(await readFile(authPath, "utf-8"));
+}
+
+test("removes only the expected credential type and preserves other providers", async () => {
+  await withAuthFile({
+    anthropic: { type: "api_key", key: "secret" },
+    openai: { type: "api_key", key: "other" },
+  }, async (authPath) => {
+    assert.deepEqual(
+      await removeStoredCredentialIfType("anthropic", "api_key", authPath),
+      { status: "removed" },
+    );
+    assert.deepEqual(await readAuthFile(authPath), {
+      openai: { type: "api_key", key: "other" },
+    });
+  });
+});
+
+test("stores a provider credential while preserving other providers", async () => {
+  await withAuthFile({
+    anthropic: { type: "oauth", access: "old-token" },
+    openai: { type: "api_key", key: "other" },
+  }, async (authPath) => {
+    await storeProviderCredential(
+      "anthropic",
+      { type: "api_key", key: "replacement" },
+      authPath,
+    );
+
+    assert.deepEqual(await readAuthFile(authPath), {
+      anthropic: { type: "api_key", key: "replacement" },
+      openai: { type: "api_key", key: "other" },
+    });
+  });
+});
+
+test("a stale API-key delete cannot remove a newly stored OAuth credential", async () => {
+  await withAuthFile({
+    anthropic: { type: "api_key", key: "old" },
+  }, async (authPath) => {
+    const release = await lockfile.lock(authPath, { stale: 30_000 });
+    const removal = removeStoredCredentialIfType("anthropic", "api_key", authPath);
+
+    await writeFile(authPath, JSON.stringify({
+      anthropic: { type: "oauth", access: "new-token", expires: Date.now() + 60_000 },
+    }, null, 2), { mode: 0o600 });
+    await release();
+
+    assert.deepEqual(await removal, {
+      status: "type_mismatch",
+      storedType: "oauth",
+    });
+    assert.equal((await readAuthFile(authPath)).anthropic.access, "new-token");
+  });
+});
+
+test("missing credentials are a successful no-op", async () => {
+  await withAuthFile({}, async (authPath) => {
+    assert.deepEqual(
+      await removeStoredCredentialIfType("anthropic", "oauth", authPath),
+      { status: "not_found" },
+    );
+    assert.deepEqual(await readAuthFile(authPath), {});
+  });
+});
+
+test("saving and removing an API key updates the SDK authentication status", async () => {
+  await withAuthFile({}, async (authPath) => {
+    const providerId = "pi-web-auth-status-test";
+
+    await storeProviderCredential(
+      providerId,
+      { type: "api_key", key: "test-secret" },
+      authPath,
+    );
+    let runtime = await ModelRuntime.create({ authPath, modelsPath: null });
+    assert.deepEqual(runtime.getProviderAuthStatus(providerId), {
+      configured: true,
+      source: "stored",
+    });
+    assert.deepEqual(await runtime.listCredentials(), [
+      { providerId, type: "api_key" },
+    ]);
+
+    await storeProviderCredential(
+      providerId,
+      { type: "api_key", key: "replacement-secret" },
+      authPath,
+    );
+    runtime = await ModelRuntime.create({ authPath, modelsPath: null });
+    assert.equal(runtime.getProviderAuthStatus(providerId).configured, true);
+    assert.equal((await readAuthFile(authPath))[providerId].key, "replacement-secret");
+
+    assert.deepEqual(
+      await removeStoredCredentialIfType(providerId, "api_key", authPath),
+      { status: "removed" },
+    );
+    runtime = await ModelRuntime.create({ authPath, modelsPath: null });
+    assert.deepEqual(runtime.getProviderAuthStatus(providerId), { configured: false });
+    assert.deepEqual(await runtime.listCredentials(), []);
+  });
+});