@baique/pi-web-sky 0.1.35 → 0.1.37

package/lib/provider-credential-store.ts

@@ -0,0 +1,114 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import type { Credential } from "@earendil-works/pi-ai";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import lockfile from "proper-lockfile";
+import type { ProviderCredentialType } from "@/lib/provider-listing";
+
+const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8" as const, mode: 0o600 };
+
+export type CredentialRemovalResult =
+  | { status: "removed" }
+  | { status: "not_found" }
+  | { status: "type_mismatch"; storedType: string };
+
+function ensureAuthFile(authPath: string): void {
+  const parent = dirname(authPath);
+  if (!existsSync(parent)) mkdirSync(parent, { recursive: true, mode: 0o700 });
+  if (!existsSync(authPath)) {
+    writeFileSync(authPath, "{}", AUTH_FILE_WRITE_OPTIONS);
+    chmodSync(authPath, 0o600);
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+async function updateStoredCredentials<T>(
+  authPath: string,
+  update: (credentials: Record<string, unknown>) => { result: T; changed: boolean },
+): Promise<T> {
+  ensureAuthFile(authPath);
+
+  let lockCompromisedError: Error | undefined;
+  const release = await lockfile.lock(authPath, {
+    retries: {
+      retries: 10,
+      factor: 2,
+      minTimeout: 100,
+      maxTimeout: 10_000,
+      randomize: true,
+    },
+    stale: 30_000,
+    onCompromised: (error) => {
+      lockCompromisedError = error;
+    },
+  });
+
+  const throwIfCompromised = () => {
+    if (lockCompromisedError) throw lockCompromisedError;
+  };
+
+  try {
+    throwIfCompromised();
+    const parsed: unknown = JSON.parse(readFileSync(authPath, "utf-8"));
+    if (!isRecord(parsed)) throw new Error("Invalid auth.json: expected an object");
+
+    const { result, changed } = update(parsed);
+    if (changed) {
+      throwIfCompromised();
+      writeFileSync(authPath, JSON.stringify(parsed, null, 2), AUTH_FILE_WRITE_OPTIONS);
+      chmodSync(authPath, 0o600);
+      throwIfCompromised();
+    }
+    return result;
+  } finally {
+    try {
+      await release();
+    } catch {
+      // The compromised-lock error above is more useful than an unlock error.
+    }
+  }
+}
+
+/** Store a provider credential without triggering a model-catalog refresh. */
+export function storeProviderCredential(
+  providerId: string,
+  credential: Credential,
+  authPath = join(getAgentDir(), "auth.json"),
+): Promise<void> {
+  return updateStoredCredentials(authPath, (credentials) => {
+    credentials[providerId] = credential;
+    return { result: undefined, changed: true };
+  });
+}
+
+/**
+ * Removes a provider credential only when its current stored type matches.
+ *
+ * The comparison and write share the same proper-lockfile lock used by pi's
+ * AuthStorage, so a concurrent login cannot be deleted by a stale UI request.
+ */
+export async function removeStoredCredentialIfType(
+  providerId: string,
+  expectedType: ProviderCredentialType,
+  authPath = join(getAgentDir(), "auth.json"),
+): Promise<CredentialRemovalResult> {
+  return updateStoredCredentials<CredentialRemovalResult>(authPath, (credentials) => {
+    if (!Object.hasOwn(credentials, providerId)) {
+      return { result: { status: "not_found" }, changed: false };
+    }
+
+    const credential = credentials[providerId];
+    const storedType = isRecord(credential) && typeof credential.type === "string"
+      ? credential.type
+      : "unknown";
+    if (storedType !== expectedType) {
+      return { result: { status: "type_mismatch", storedType }, changed: false };
+    }
+
+    delete credentials[providerId];
+    return { result: { status: "removed" }, changed: true };
+  });
+}

package/lib/provider-listing-runtime.ts

@@ -0,0 +1,37 @@
+import type { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import type { ProviderCredentialType, ProviderListingInput } from "@/lib/provider-listing";
+
+/**
+ * Adapter between `ModelRuntime` and the pure listing helpers in
+ * `lib/provider-listing.ts`.
+ */
+export async function collectProviderListingInputs(
+  modelRuntime: ModelRuntime,
+): Promise<ProviderListingInput[]> {
+  const models = modelRuntime.getModels();
+
+  const credentialTypes = new Map<string, ProviderCredentialType>();
+  try {
+    for (const credential of await modelRuntime.listCredentials()) {
+      if (credential.type === "api_key" || credential.type === "oauth") {
+        credentialTypes.set(credential.providerId, credential.type);
+      }
+    }
+  } catch {
+    // A damaged auth.json must not empty the provider list; fall back to the
+    // per-provider auth status only.
+  }
+
+  return modelRuntime.getProviders().map((provider) => ({
+    id: provider.id,
+    name: provider.name,
+    hasApiKeyLogin: Boolean(provider.auth.apiKey?.login),
+    hasOAuth: Boolean(provider.auth.oauth),
+    ...(provider.auth.oauth?.name ? { oauthName: provider.auth.oauth.name } : {}),
+    status: modelRuntime.getProviderAuthStatus(provider.id),
+    ...(credentialTypes.has(provider.id)
+      ? { credentialType: credentialTypes.get(provider.id) }
+      : {}),
+    modelCount: models.filter((model) => model.provider === provider.id).length,
+  }));
+}

package/lib/provider-listing.test.mjs

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+async function loadSubject() {
+  try {
+    const { createJiti } = await import("jiti");
+    return createJiti(import.meta.url).import("./provider-listing.ts");
+  } catch {
+    return import("./provider-listing.ts");
+  }
+}
+
+const { buildApiKeyProviderList, buildOAuthProviderList } = await loadSubject();
+
+const provider = (overrides) => ({
+  id: "anthropic",
+  name: "Anthropic",
+  hasApiKeyLogin: true,
+  hasOAuth: true,
+  oauthName: "Anthropic (Claude Pro/Max)",
+  status: { configured: false },
+  modelCount: 12,
+  ...overrides,
+});
+
+test("lists an API-key-configured dual-auth provider in the API-key list (#309)", () => {
+  const providers = [provider({ status: { configured: true, source: "stored" }, credentialType: "api_key" })];
+
+  const apiKey = buildApiKeyProviderList(providers);
+  assert.deepEqual(apiKey, [{
+    id: "anthropic",
+    displayName: "Anthropic",
+    configured: true,
+    source: "stored",
+    modelCount: 12,
+    supportsOAuth: true,
+  }]);
+
+  // …and only as a not-logged-in entry in the OAuth list, so it renders once.
+  const oauth = buildOAuthProviderList(providers);
+  assert.equal(oauth.length, 1);
+  assert.equal(oauth[0].loggedIn, false);
+  assert.equal(oauth[0].name, "Anthropic (Claude Pro/Max)");
+  assert.equal(oauth[0].supportsApiKey, true);
+});
+
+test("an OAuth-authenticated provider counts as configured only in the OAuth list", () => {
+  const providers = [provider({ status: { configured: true, source: "stored" }, credentialType: "oauth" })];
+
+  assert.deepEqual(buildApiKeyProviderList(providers).map((p) => [p.id, p.configured, p.source]), [
+    ["anthropic", false, undefined],
+  ]);
+  assert.deepEqual(buildOAuthProviderList(providers).map((p) => [p.id, p.loggedIn]), [["anthropic", true]]);
+});
+
+test("switching auth method moves the provider between lists in both directions", () => {
+  // API key → OAuth: the API-key row goes inactive as the OAuth row lights up.
+  const afterOAuthLogin = [provider({ status: { configured: true, source: "stored" }, credentialType: "oauth" })];
+  assert.equal(buildApiKeyProviderList(afterOAuthLogin)[0].configured, false);
+  assert.equal(buildOAuthProviderList(afterOAuthLogin)[0].loggedIn, true);
+
+  // OAuth → API key: and back again.
+  const afterKeySaved = [provider({ status: { configured: true, source: "stored" }, credentialType: "api_key" })];
+  assert.equal(buildApiKeyProviderList(afterKeySaved)[0].configured, true);
+  assert.equal(buildOAuthProviderList(afterKeySaved)[0].loggedIn, false);
+});
+
+test("environment-provided keys are reported as configured", () => {
+  const providers = [provider({ id: "openai", name: "OpenAI", hasOAuth: false, oauthName: undefined, status: { configured: true, source: "environment" } })];
+
+  const apiKey = buildApiKeyProviderList(providers);
+  assert.equal(apiKey[0].configured, true);
+  assert.equal(apiKey[0].source, "environment");
+  assert.equal(apiKey[0].supportsOAuth, false);
+  assert.deepEqual(buildOAuthProviderList(providers), []);
+});
+
+test("custom models.json providers stay out of the API-key list", () => {
+  const providers = [
+    provider({ id: "acme-gateway", name: "acme-gateway", hasOAuth: false, oauthName: undefined, status: { configured: true, source: "models_json_key" } }),
+    provider({ id: "acme-cmd", name: "acme-cmd", hasOAuth: false, oauthName: undefined, status: { configured: true, source: "models_json_command" } }),
+  ];
+
+  assert.deepEqual(buildApiKeyProviderList(providers), []);
+});
+
+test("providers without an API-key login method are excluded", () => {
+  const providers = [provider({ id: "subscription-only", name: "Subscription Only", hasApiKeyLogin: false, oauthName: undefined })];
+
+  assert.deepEqual(buildApiKeyProviderList(providers), []);
+  assert.deepEqual(buildOAuthProviderList(providers).map((p) => p.name), ["Subscription Only"]);
+});
+
+test("keeps friendlier OAuth labels and falls back to the provider name", () => {
+  const providers = [
+    // openai-codex is OAuth-only in the pinned SDK — the label map still covers it.
+    provider({ id: "openai-codex", name: "OpenAI Codex", hasApiKeyLogin: false, oauthName: "Sign in with ChatGPT" }),
+    provider({ id: "github-copilot", name: "GitHub Copilot Provider", oauthName: "Copilot" }),
+    provider({ id: "xai", name: "xAI", oauthName: undefined }),
+  ];
+
+  assert.deepEqual(buildOAuthProviderList(providers).map((p) => p.name), [
+    "ChatGPT Plus/Pro",
+    "GitHub Copilot",
+    "xAI",
+  ]);
+});
+
+test("duplicate provider ids are collapsed", () => {
+  const providers = [provider({}), provider({ status: { configured: true, source: "stored" }, credentialType: "api_key" })];
+
+  assert.deepEqual(buildApiKeyProviderList(providers).map((p) => [p.id, p.configured]), [["anthropic", false]]);
+  assert.equal(buildOAuthProviderList(providers).length, 1);
+});

package/lib/provider-listing.ts

@@ -0,0 +1,118 @@
+/**
+ * Provider listing for the Models panel.
+ *
+ * Providers are listed by the auth methods they actually declare, not by a
+ * hardcoded id list. Anthropic and GitHub Copilot (and kimi-coding, openrouter,
+ * radius, xai) declare both an API key and OAuth; hardcoding them as "OAuth
+ * only" hid them from the API-key endpoint, while the OAuth endpoint separately
+ * excluded Anthropic, so a configured Anthropic account appeared in neither list
+ * (#309). Which providers are dual-auth is a property of the SDK's provider
+ * definitions and changes between releases — read it from `auth`, never assume
+ * it from an id.
+ */
+
+/** Credential kinds pi stores in `auth.json`. */
+export type ProviderCredentialType = "api_key" | "oauth";
+
+/** Auth status sources that mean "this key comes from models.json". */
+const CUSTOM_PROVIDER_SOURCES = new Set(["models_json_key", "models_json_command"]);
+
+/** Friendlier names for OAuth entries whose provider name is not self-explanatory. */
+const OAUTH_DISPLAY_NAMES: Record<string, string> = {
+  "openai-codex": "ChatGPT Plus/Pro",
+  "github-copilot": "GitHub Copilot",
+};
+
+export interface ProviderListingInput {
+  id: string;
+  /** Provider display name (`provider.name`). */
+  name: string;
+  /** True when the provider declares an API-key login method. */
+  hasApiKeyLogin: boolean;
+  /** True when the provider declares an OAuth login method. */
+  hasOAuth: boolean;
+  /** Label of the OAuth method, e.g. "Anthropic (Claude Pro/Max)". */
+  oauthName?: string;
+  /** Result of `ModelRuntime.getProviderAuthStatus()`. */
+  status: { configured: boolean; source?: string };
+  /** Type of the credential stored for this provider, when there is one. */
+  credentialType?: ProviderCredentialType;
+  modelCount: number;
+}
+
+export interface ApiKeyProviderListing {
+  id: string;
+  displayName: string;
+  configured: boolean;
+  source?: string;
+  modelCount: number;
+  /** True when the same provider can also be authenticated with OAuth. */
+  supportsOAuth: boolean;
+}
+
+export interface OAuthProviderListing {
+  id: string;
+  name: string;
+  usesCallbackServer: boolean;
+  loggedIn: boolean;
+  /** True when the same provider can also be authenticated with an API key. */
+  supportsApiKey: boolean;
+}
+
+function dedupeById(providers: readonly ProviderListingInput[]): ProviderListingInput[] {
+  const seen = new Set<string>();
+  const result: ProviderListingInput[] = [];
+  for (const provider of providers) {
+    if (seen.has(provider.id)) continue;
+    seen.add(provider.id);
+    result.push(provider);
+  }
+  return result;
+}
+
+/**
+ * Providers that can be authenticated with an API key.
+ *
+ * Custom `models.json` providers are excluded because the Models panel already
+ * renders them from `models.json` itself. A provider currently authenticated
+ * with an OAuth credential is reported as not configured here, so it is listed
+ * once — in the OAuth list — instead of twice.
+ */
+export function buildApiKeyProviderList(
+  providers: readonly ProviderListingInput[],
+): ApiKeyProviderListing[] {
+  const result: ApiKeyProviderListing[] = [];
+  for (const provider of dedupeById(providers)) {
+    if (!provider.hasApiKeyLogin) continue;
+    if (provider.status.source && CUSTOM_PROVIDER_SOURCES.has(provider.status.source)) continue;
+
+    const configured = provider.status.configured && provider.credentialType !== "oauth";
+    result.push({
+      id: provider.id,
+      displayName: provider.name,
+      configured,
+      ...(configured && provider.status.source ? { source: provider.status.source } : {}),
+      modelCount: provider.modelCount,
+      supportsOAuth: provider.hasOAuth,
+    });
+  }
+  return result;
+}
+
+/** Providers that can be authenticated with OAuth. */
+export function buildOAuthProviderList(
+  providers: readonly ProviderListingInput[],
+): OAuthProviderListing[] {
+  const result: OAuthProviderListing[] = [];
+  for (const provider of dedupeById(providers)) {
+    if (!provider.hasOAuth) continue;
+    result.push({
+      id: provider.id,
+      name: OAUTH_DISPLAY_NAMES[provider.id] ?? provider.oauthName ?? provider.name,
+      usesCallbackServer: false,
+      loggedIn: provider.credentialType === "oauth",
+      supportsApiKey: provider.hasApiKeyLogin,
+    });
+  }
+  return result;
+}

package/lib/provider-services.ts

@@ -0,0 +1,64 @@
+import { stat } from "fs/promises";
+import { resolve } from "path";
+import {
+  createAgentSessionServices,
+  getAgentDir,
+  type AgentSessionServices,
+} from "@earendil-works/pi-coding-agent";
+import { getAllowedFileRoots, isExistingFilePathAllowed } from "@/lib/file-access";
+import { projectTrustReloadOptions } from "@/lib/project-trust";
+
+/** Error with an HTTP status, thrown by createProviderServices on bad input. */
+export class ProviderServicesError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/**
+ * Create cwd-bound runtime services for the provider/auth listings.
+ *
+ * The Models panel must see exactly the providers the model selector sees.
+ * Extension-registered providers (e.g. `pi-commandcode-provider`'s
+ * "commandcode") are only loaded by `createAgentSessionServices()` — a bare
+ * `ModelRuntime.create()` skips the resource loader, so extension providers
+ * silently vanished from the auth lists while their models stayed visible.
+ *
+ * cwd is optional: when provided it must be an existing, allowed directory and
+ * the services honor its project-trust state (same as the model list). When
+ * omitted, services are created against the agent dir so globally-installed
+ * extensions still load while project extensions stay out.
+ */
+export async function createProviderServices(
+  cwd?: string,
+): Promise<{ services: AgentSessionServices; cwd: string }> {
+  const agentDir = getAgentDir();
+  const resolvedCwd = cwd ? resolve(cwd) : agentDir;
+
+  if (cwd) {
+    try {
+      const cwdStat = await stat(resolvedCwd);
+      if (!cwdStat.isDirectory()) {
+        throw new ProviderServicesError(400, `Directory does not exist: ${resolvedCwd}`);
+      }
+    } catch (error) {
+      if (error instanceof ProviderServicesError) throw error;
+      throw new ProviderServicesError(400, `Directory does not exist: ${resolvedCwd}`);
+    }
+    const allowedRoots = await getAllowedFileRoots();
+    if (!isExistingFilePathAllowed(resolvedCwd, allowedRoots)) {
+      throw new ProviderServicesError(403, "Access denied");
+    }
+  }
+
+  const trustOptions = projectTrustReloadOptions(resolvedCwd, agentDir);
+  const services = await createAgentSessionServices({
+    cwd: resolvedCwd,
+    agentDir,
+    ...(trustOptions ? { resourceLoaderReloadOptions: trustOptions } : {}),
+  });
+  return { services, cwd: resolvedCwd };
+}