@bastani/pi-ai 0.9.25-alpha.1 → 0.9.25-alpha.3

package/CHANGELOG.md

@@ -4,6 +4,19 @@ This package is a Bastani fork of `@earendil-works/pi-ai`. Upstream history at t
 
 ## [Unreleased]
 
+## [0.9.25-alpha.3] - 2026-09-30
+
+### Added
+
+- Added Anthropic workload identity federation from the Anthropic SDK environment variables `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_ORGANIZATION_ID`, and `ANTHROPIC_IDENTITY_TOKEN_FILE` (plus optional `ANTHROPIC_SERVICE_ACCOUNT_ID` and `ANTHROPIC_WORKSPACE_ID`). API keys and `ANTHROPIC_AUTH_TOKEN` take precedence ([#10177](https://github.com/earendil-works/pi/issues/10177), [#10242](https://github.com/earendil-works/pi/pull/10242) by [@philfreo](https://github.com/philfreo)).
+- Anthropic subscription login now offers a copy-code method for remote or headless machines, alongside the default browser callback method ([#10194](https://github.com/earendil-works/pi/pull/10194) by [@lucasmeijer](https://github.com/lucasmeijer)).
+
+### Fixed
+
+- Fixed context overflow detection for Z.AI CN endpoint `Prompt exceeds max length` errors ([#10208](https://github.com/earendil-works/pi/issues/10208)).
+- Anthropic `strict: "prefer"` tools now fall back to non-strict mode for unsupported string formats and additional array/object constraints instead of rejecting the request. Supported string length and pattern constraints remain strict ([#9953](https://github.com/earendil-works/pi/issues/9953)).
+- Provider retries now use exponential backoff when `Retry-After` or `retry-after-ms` cannot be parsed as a finite delay ([#9571](https://github.com/earendil-works/pi/issues/9571)).
+
 ## [0.9.25-alpha.1] - 2026-09-29
 
 ### Added

package/NOTICE.md

@@ -6,7 +6,7 @@ monorepo at `packages/ai` and publishes at the same version as `@bastani/atomic`
 
 - Upstream package: [`@earendil-works/pi-ai`](https://www.npmjs.com/package/@earendil-works/pi-ai)
 - Original fork point: `v0.84.2` (`914cf1472e715297caa30db4b9535d534a9eb718`)
-- Applicable Pi AI fixes and generated catalogs synced through audited upstream `main`: `earendil-works/pi@1b347794e2a630e4359f2584f4eea388145d0ddf`. Atomic retains its adaptations and does not enable upstream virtual models.
+- Applicable Pi AI fixes synced through audited upstream `main`: `earendil-works/pi@7a11fe1c723b942fa093edb8b00f051ddb9b6627`, with remaining registry Pi packages at `0.99.2`. Atomic retains its adaptations and does not enable upstream virtual models.
 - Catalog JSON under `src/providers/data/` is generated at build time from models.dev, matching upstream. It is not committed.
 
 Original work is Copyright (c) 2025 Mario Zechner and is licensed under the MIT License.

package/dist/api/anthropic-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAU1C,OAAO,KAAK,EASX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAOb,MAAM,aAAa,CAAC;AAsKrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAoPhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AA6OD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CA2XzE,CAAC;AA4BF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CA8ClF,CAAC"}
+{"version":3,"file":"anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/api/anthropic-messages.ts"],"names":[],"mappings":"AAAA,OAAO,SAAiC,MAAM,mBAAmB,CAAC;AAiBlE,OAAO,KAAK,EASX,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAOb,MAAM,aAAa,CAAC;AAsKrB,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1E,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,SAAS,CAAC;AAoPhE,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACtD;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACnB;AAgSD,eAAO,MAAM,MAAM,EAAE,cAAc,CAAC,oBAAoB,EAAE,gBAAgB,CA6XzE,CAAC;AA4BF,eAAO,MAAM,YAAY,EAAE,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAgDlF,CAAC"}

package/dist/api/anthropic-messages.js

@@ -1,4 +1,5 @@
-import Anthropic from "@anthropic-ai/sdk";
+import Anthropic, {} from "@anthropic-ai/sdk";
+import { ANTHROPIC_FEDERATION_RULE_ID_ENV, ANTHROPIC_IDENTITY_TOKEN_FILE_ENV, ANTHROPIC_ORGANIZATION_ID_ENV, ANTHROPIC_SERVICE_ACCOUNT_ID_ENV, ANTHROPIC_WORKSPACE_ID_ENV, } from "../env-api-keys.js";
 import { calculateCost } from "../models.js";
 import { appendAssistantMessageDiagnostic } from "../utils/diagnostics.js";
 import { assertSupportedDocumentMimeType } from "../utils/document-input.js";
@@ -340,16 +341,58 @@ function hasHeader(headers, name) {
     }
     return false;
 }
-function assertRequestAuth(provider, apiKey, headers) {
-    if (apiKey)
-        return;
-    if (hasHeader(headers, "authorization") ||
+function hasRequestAuth(apiKey, headers) {
+    return (!!apiKey ||
+        hasHeader(headers, "authorization") ||
         hasHeader(headers, "x-api-key") ||
-        hasHeader(headers, "cf-aig-authorization")) {
-        return;
+        hasHeader(headers, "cf-aig-authorization"));
+}
+function assertRequestAuth(provider, apiKey, headers) {
+    if (!hasRequestAuth(apiKey, headers))
+        throw new Error(`No API key for provider: ${provider}`);
+}
+/**
+ * Anthropic SDK client that never runs the SDK's own credential chain
+ * (ANTHROPIC_PROFILE config files, federation env vars). Without this, every
+ * client built with `apiKey: null, authToken: null` for header-owned auth would
+ * also resolve and exchange SDK credentials behind Atomic's auth resolver.
+ */
+class AtomicAnthropic extends Anthropic {
+    _shouldResolveDefaultCredentials() {
+        return false;
     }
-    throw new Error(`No API key for provider: ${provider}`);
 }
+/**
+ * Workload identity federation config from the ANTHROPIC_* variables the
+ * Anthropic SDK documents; the SDK performs the token exchange and refresh.
+ * Only for the anthropic provider, since the exchange is an Anthropic API
+ * endpoint, and only when no key or auth header was resolved.
+ */
+function getAnthropicFederation(model, apiKey, headers, env) {
+    if (model.provider !== "anthropic" || hasRequestAuth(apiKey, headers))
+        return undefined;
+    const federationRuleId = getProviderEnvValue(ANTHROPIC_FEDERATION_RULE_ID_ENV, env);
+    const organizationId = getProviderEnvValue(ANTHROPIC_ORGANIZATION_ID_ENV, env);
+    const identityTokenFile = getProviderEnvValue(ANTHROPIC_IDENTITY_TOKEN_FILE_ENV, env);
+    if (!federationRuleId || !organizationId || !identityTokenFile)
+        return undefined;
+    return {
+        organization_id: organizationId,
+        workspace_id: getProviderEnvValue(ANTHROPIC_WORKSPACE_ID_ENV, env),
+        authentication: {
+            type: "oidc_federation",
+            federation_rule_id: federationRuleId,
+            service_account_id: getProviderEnvValue(ANTHROPIC_SERVICE_ACCOUNT_ID_ENV, env),
+            identity_token: { source: "file", path: identityTokenFile },
+        },
+    };
+}
+/**
+ * The SDK caches the federated access token per client, but a client is created
+ * per request. Keep one client for the current federation config and fetch, and
+ * clone it per request with `withOptions()`, which shares the token cache.
+ */
+let federationClient;
 const ANTHROPIC_MESSAGE_EVENTS = new Set([
     "message_start",
     "message_delta",
@@ -547,7 +590,9 @@ export const stream = (model, context, options) => {
             }
             else {
                 const apiKey = options?.apiKey;
-                assertRequestAuth(model.provider, apiKey, options?.headers);
+                const federation = getAnthropicFederation(model, apiKey, options?.headers, options?.env);
+                if (!federation)
+                    assertRequestAuth(model.provider, apiKey, options?.headers);
                 let copilotDynamicHeaders;
                 if (model.provider === "github-copilot") {
                     const hasImages = hasCopilotVisionInput(normalizedContext.messages);
@@ -562,7 +607,7 @@ export const stream = (model, context, options) => {
                 const created = createClient(model, apiKey, model.reasoning && options?.thinkingEnabled === true && (options.interleavedThinking ?? true), shouldUseFineGrainedToolStreamingBeta(model, context), shouldUseServerSideFallbackBeta(model), options?.headers, options?.fetch, copilotDynamicHeaders, cacheSessionId, getAnthropicCompat(model).supportsMidConvoToolChanges &&
                     getAnthropicCompat(model).supportsMidConvoSystemMessages &&
                     (getInitialSystemMessage(normalizedContext.messages)?.toolsAdded?.length ?? 0) > 0 &&
-                    !hasToolRedefinitions(normalizedContext.messages));
+                    !hasToolRedefinitions(normalizedContext.messages), federation);
                 client = created.client;
                 isOAuth = created.isOAuthToken;
             }
@@ -881,7 +926,9 @@ function mapThinkingLevelToEffort(model, level) {
     }
 }
 export const streamSimple = (model, context, options) => {
-    assertRequestAuth(model.provider, options?.apiKey, options?.headers);
+    if (!getAnthropicFederation(model, options?.apiKey, options?.headers, options?.env)) {
+        assertRequestAuth(model.provider, options?.apiKey, options?.headers);
+    }
     const base = {
         ...buildBaseOptions(model, context, options, options?.apiKey),
         toolChoice: options?.toolChoice,
@@ -916,7 +963,7 @@ export const streamSimple = (model, context, options) => {
 function isOAuthToken(apiKey) {
     return apiKey.includes("sk-ant-oat");
 }
-function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStreamingBeta, useServerSideFallbackBeta, optionsHeaders, fetch, dynamicHeaders, sessionId, useNativeToolChanges = false) {
+function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStreamingBeta, useServerSideFallbackBeta, optionsHeaders, fetch, dynamicHeaders, sessionId, useNativeToolChanges = false, federation) {
     // Adaptive thinking models have interleaved thinking built in, so skip the beta header.
     const needsInterleavedBeta = interleavedThinking && model.compat?.forceAdaptiveThinking !== true;
     const betaFeatures = [];
@@ -942,7 +989,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
     const uniqueBetaFeatures = [...new Set(betaFeatures)];
     // Copilot: Bearer auth, selective betas.
     if (model.provider === "github-copilot") {
-        const client = new Anthropic({
+        const client = new AtomicAnthropic({
             apiKey: null,
             authToken: apiKey ?? null,
             baseURL: model.baseUrl,
@@ -958,7 +1005,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
     }
     // OAuth: Bearer auth, Claude Code identity headers
     if (apiKey && isOAuthToken(apiKey)) {
-        const client = new Anthropic({
+        const client = new AtomicAnthropic({
             apiKey: null,
             authToken: apiKey,
             baseURL: model.baseUrl,
@@ -974,7 +1021,7 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
         });
         return { client, isOAuthToken: true };
     }
-    // API key or header-owned auth.
+    // API key, header-owned auth, or workload identity federation.
     const compat = getAnthropicCompat(model);
     const sessionAffinityHeaders = {};
     if (sessionId && compat.sendSessionAffinityHeaders) {
@@ -986,7 +1033,22 @@ function createClient(model, apiKey, interleavedThinking, useFineGrainedToolStre
         "anthropic-dangerous-direct-browser-access": "true",
         ...(uniqueBetaFeatures.length > 0 ? { "anthropic-beta": uniqueBetaFeatures.join(",") } : {}),
     }, sessionAffinityHeaders, model.headers, optionsHeaders);
-    const client = new Anthropic({
+    if (federation) {
+        const key = JSON.stringify([model.baseUrl, federation]);
+        if (federationClient?.key !== key || federationClient.fetch !== fetch) {
+            const client = new AtomicAnthropic({
+                apiKey: null,
+                authToken: null,
+                config: federation,
+                baseURL: model.baseUrl,
+                dangerouslyAllowBrowser: true,
+                fetch,
+            });
+            federationClient = { key, fetch, client };
+        }
+        return { client: federationClient.client.withOptions({ defaultHeaders }), isOAuthToken: false };
+    }
+    const client = new AtomicAnthropic({
         apiKey: apiKey ?? null,
         authToken: null,
         baseURL: model.baseUrl,