@buyong/pi-devin 0.0.0-stage → 0.1.0

package/proto/grpc/binlog/v1/binarylog.proto

@@ -0,0 +1,89 @@
+syntax = "proto3";
+
+package grpc.binarylog.v1;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option java_package = "io.grpc.binarylog.v1";
+option java_outer_classname = "BinaryLogProto";
+option java_multiple_files = true;
+option go_package = "google.golang.org/grpc/binarylog/grpc_binarylog_v1";
+
+message GrpcLogEntry {
+  .google.protobuf.Timestamp timestamp = 1;
+  uint64 call_id = 2;
+  uint64 sequence_id_within_call = 3;
+  GrpcLogEntry.EventType type = 4;
+  GrpcLogEntry.Logger logger = 5;
+  oneof payload {
+    ClientHeader client_header = 6;
+    ServerHeader server_header = 7;
+    Message message = 8;
+    Trailer trailer = 9;
+  }
+  bool payload_truncated = 10;
+  Address peer = 11;
+  enum EventType {
+    EVENT_TYPE_UNKNOWN = 0;
+    EVENT_TYPE_CLIENT_HEADER = 1;
+    EVENT_TYPE_SERVER_HEADER = 2;
+    EVENT_TYPE_CLIENT_MESSAGE = 3;
+    EVENT_TYPE_SERVER_MESSAGE = 4;
+    EVENT_TYPE_CLIENT_HALF_CLOSE = 5;
+    EVENT_TYPE_SERVER_TRAILER = 6;
+    EVENT_TYPE_CANCEL = 7;
+  }
+
+  enum Logger {
+    LOGGER_UNKNOWN = 0;
+    LOGGER_CLIENT = 1;
+    LOGGER_SERVER = 2;
+  }
+
+}
+
+message ClientHeader {
+  Metadata metadata = 1;
+  string method_name = 2;
+  string authority = 3;
+  .google.protobuf.Duration timeout = 4;
+}
+
+message ServerHeader {
+  Metadata metadata = 1;
+}
+
+message Trailer {
+  Metadata metadata = 1;
+  uint32 status_code = 2;
+  string status_message = 3;
+  bytes status_details = 4;
+}
+
+message Message {
+  uint32 length = 1;
+  bytes data = 2;
+}
+
+message Metadata {
+  repeated MetadataEntry entry = 1;
+}
+
+message MetadataEntry {
+  string key = 1;
+  bytes value = 2;
+}
+
+message Address {
+  Address.Type type = 1;
+  string address = 2;
+  uint32 ip_port = 3;
+  enum Type {
+    TYPE_UNKNOWN = 0;
+    TYPE_IPV4 = 1;
+    TYPE_IPV6 = 2;
+    TYPE_UNIX = 3;
+  }
+
+}

package/proto/io/prometheus/client/metrics.proto

@@ -0,0 +1,103 @@
+syntax = "proto2";
+
+package io.prometheus.client;
+
+import "google/protobuf/timestamp.proto";
+
+option java_package = "io.prometheus.client";
+option go_package = "github.com/prometheus/client_model/go;io_prometheus_client";
+
+enum MetricType {
+  COUNTER = 0;
+  GAUGE = 1;
+  SUMMARY = 2;
+  UNTYPED = 3;
+  HISTOGRAM = 4;
+  GAUGE_HISTOGRAM = 5;
+}
+
+message LabelPair {
+  optional string name = 1;
+  optional string value = 2;
+}
+
+message Gauge {
+  optional double value = 1;
+}
+
+message Counter {
+  optional double value = 1;
+  optional Exemplar exemplar = 2;
+  optional .google.protobuf.Timestamp created_timestamp = 3;
+}
+
+message Quantile {
+  optional double quantile = 1;
+  optional double value = 2;
+}
+
+message Summary {
+  optional uint64 sample_count = 1;
+  optional double sample_sum = 2;
+  repeated Quantile quantile = 3;
+  optional .google.protobuf.Timestamp created_timestamp = 4;
+}
+
+message Untyped {
+  optional double value = 1;
+}
+
+message Histogram {
+  optional uint64 sample_count = 1;
+  optional double sample_count_float = 4;
+  optional double sample_sum = 2;
+  repeated Bucket bucket = 3;
+  optional .google.protobuf.Timestamp created_timestamp = 15;
+  optional sint32 schema = 5;
+  optional double zero_threshold = 6;
+  optional uint64 zero_count = 7;
+  optional double zero_count_float = 8;
+  repeated BucketSpan negative_span = 9;
+  repeated sint64 negative_delta = 10;
+  repeated double negative_count = 11;
+  repeated BucketSpan positive_span = 12;
+  repeated sint64 positive_delta = 13;
+  repeated double positive_count = 14;
+  repeated Exemplar exemplars = 16;
+}
+
+message Bucket {
+  optional uint64 cumulative_count = 1;
+  optional double cumulative_count_float = 4;
+  optional double upper_bound = 2;
+  optional Exemplar exemplar = 3;
+}
+
+message BucketSpan {
+  optional sint32 offset = 1;
+  optional uint32 length = 2;
+}
+
+message Exemplar {
+  repeated LabelPair label = 1;
+  optional double value = 2;
+  optional .google.protobuf.Timestamp timestamp = 3;
+}
+
+message Metric {
+  repeated LabelPair label = 1;
+  optional Gauge gauge = 2;
+  optional Counter counter = 3;
+  optional Summary summary = 4;
+  optional Untyped untyped = 5;
+  optional Histogram histogram = 7;
+  optional int64 timestamp_ms = 6;
+}
+
+message MetricFamily {
+  optional string name = 1;
+  optional string help = 2;
+  optional MetricType type = 3;
+  repeated Metric metric = 4;
+  optional string unit = 5;
+}

package/src/core/auth/access.ts

@@ -0,0 +1,6 @@
+import type { JsonObject } from "../types.ts";
+
+export function assertCanInfer(status: JsonObject): void {
+  if (status.canUseCli !== true) throw new Error("Could not confirm that this account may use the CLI.");
+  if (status.dailyQuotaRemainingPercent === 0 || status.weeklyQuotaRemainingPercent === 0) throw new Error("The reported quota is 0, so no inference is run.");
+}

package/src/core/auth/index.ts

@@ -0,0 +1,2 @@
+export { login, loginAccount, createPKCE, DEFAULT_API_SERVER_URL, DEFAULT_WEBAPP_URL, DEFAULT_DEVIN_API_URL } from "./login.ts";
+export type { LoginOptions, LoginFlow } from "./login.ts";

package/src/core/auth/login.ts

@@ -0,0 +1,177 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { awaitWithSignal, ConnectClient, endpoint, RPCError, safeError } from "../protocol/transport.ts";
+import { requiredString, type Credential } from "../types.ts";
+import { exchangeBrowserCode } from "./rest-exchange.ts";
+
+export const DEFAULT_API_SERVER_URL = "https://server.codeium.com";
+export const DEFAULT_WEBAPP_URL = "https://app.devin.ai";
+export const DEFAULT_DEVIN_API_URL = "https://api.devin.ai";
+const EXCHANGE_METHOD = "exa.seat_management_pb.SeatManagementService/ExchangeDevinCLIPKCECode";
+const PKCE_EXCHANGE_METHOD = "exa.seat_management_pb.SeatManagementService/ExchangePKCEAuthorizationCode";
+const PKCE_CODE_PREFIX = "wspkce$";
+const codeForExchange = (code: string) => code.startsWith(PKCE_CODE_PREFIX) ? code.slice(PKCE_CODE_PREFIX.length) : code;
+export type LoginFlow = "browser" | "manual" | "legacy-connect";
+export interface LoginOptions {
+  apiServerURL?: string;
+  webappURL?: string;
+  devinAPIURL?: string;
+  timeoutMs?: number;
+  signal?: AbortSignal;
+  onURL: (url: string, signal: AbortSignal) => void | Promise<void>;
+  /** Receives a one-time authorization code, never an API key or session token. */
+  promptCode?: (signal: AbortSignal) => Promise<string>;
+  fetch?: typeof fetch;
+  encoding?: "proto" | "json";
+  flow?: LoginFlow;
+}
+
+export function createPKCE(): { verifier: string; challenge: string; state: string } {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    state: randomBytes(32).toString("base64url"),
+  };
+}
+
+function matchesState(received: string | null, expected: string): boolean {
+  if (!received) return false;
+  const left = Buffer.from(received), right = Buffer.from(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+function isAuthorizationCode(code: string): boolean {
+  return code.length > 0 && code.length <= 8192 && codeForExchange(code).length > 0
+    && !/[\s\u0000-\u001f\u007f]/.test(code)
+    && !/^(devin-session-token\$|cog_|sk-ws-01-|Bearer |Basic )/.test(code);
+}
+
+/** The new account UI defaults to the REST browser flow. An explicit encoding keeps the legacy Connect path. */
+export function loginAccount(options: LoginOptions): Promise<Credential> {
+  return login({ ...options, flow: options.flow ?? (options.encoding === undefined ? "browser" : "legacy-connect") });
+}
+
+/** Keeps the default Connect contract of the existing shared login(). Storage and opening the browser belong to the caller. */
+export async function login(options: LoginOptions): Promise<Credential> {
+  const flow = options.flow ?? "legacy-connect";
+  if (!["browser", "manual", "legacy-connect"].includes(flow)) throw new Error("Unsupported login flow.");
+  if (options.encoding !== undefined && options.encoding !== "proto" && options.encoding !== "json") throw new Error("The login encoding must be proto or json.");
+  if (flow === "browser" && options.encoding !== undefined) throw new Error("A Connect encoding cannot be used with the REST browser login.");
+  if (flow !== "browser" && options.devinAPIURL !== undefined) throw new Error("The Devin REST login server can only be set for the REST browser flow.");
+  if (flow === "manual" && !options.promptCode) throw new Error("Manual login requires an authorization code prompt.");
+  const apiServerURL = endpoint(options.apiServerURL ?? DEFAULT_API_SERVER_URL);
+  const webappURL = endpoint(options.webappURL ?? DEFAULT_WEBAPP_URL);
+  const devinAPIURL = endpoint(options.devinAPIURL ?? DEFAULT_DEVIN_API_URL);
+  const signal = AbortSignal.any([...(options.signal ? [options.signal] : []), AbortSignal.timeout(options.timeoutMs ?? 300_000)]);
+  signal.throwIfAborted();
+  const pkce = createPKCE();
+  if (flow !== "legacy-connect") pkce.state = randomUUID();
+  let resolveCode!: (code: string) => void, rejectCode!: (error: Error) => void;
+  let hasAcceptedCode = false, authorizationCode = "";
+  let client: ConnectClient | undefined;
+  let redirectURL: string | undefined;
+  const inputController = new AbortController();
+  const inputSignal = AbortSignal.any([signal, inputController.signal]);
+  const codePromise = new Promise<string>((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+  void codePromise.catch(() => {});
+  const acceptCode = (code: string) => {
+    if (hasAcceptedCode || !isAuthorizationCode(code)) return false;
+    hasAcceptedCode = true;
+    authorizationCode = code;
+    resolveCode(code);
+    inputController.abort(new DOMException("Authorization code received.", "AbortError"));
+    return true;
+  };
+  const server = createServer((request, response) => {
+    response.setHeader("Content-Type", "text/plain; charset=utf-8");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+    response.setHeader("Referrer-Policy", "no-referrer");
+    let url: URL;
+    try { url = new URL(request.url ?? "/", "http://127.0.0.1"); }
+    catch { response.writeHead(400).end("Invalid callback URL"); return; }
+    if (request.method !== "GET" || url.pathname !== "/callback") { response.writeHead(404).end("Not found"); return; }
+    if (hasAcceptedCode || !matchesState(url.searchParams.get("state"), pkce.state)) { response.writeHead(400).end("Invalid OAuth state"); return; }
+    if (url.searchParams.has("error")) {
+      hasAcceptedCode = true;
+      response.writeHead(400).end("Login was denied.");
+      rejectCode(new Error("OAuth login was denied."));
+      inputController.abort();
+      return;
+    }
+    if (!acceptCode(url.searchParams.get("code") ?? "")) { response.writeHead(400).end("Missing authorization code"); return; }
+    response.end("Authorization code received. Check the token exchange result in your terminal.");
+  });
+  const onAbort = () => rejectCode(new DOMException(
+    signal.reason?.name === "TimeoutError" ? "OAuth login timed out." : "OAuth login was cancelled.",
+    signal.reason?.name === "TimeoutError" ? "TimeoutError" : "AbortError",
+  ));
+  signal.addEventListener("abort", onAbort, { once: true });
+  try {
+    if (flow !== "manual") {
+      await new Promise<void>((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+      });
+      const address = server.address();
+      if (!address || typeof address === "string") throw new Error("Could not determine the callback port.");
+      redirectURL = `http://127.0.0.1:${address.port}/callback`;
+    }
+    const authorizationURL = new URL(flow === "manual" ? "/devin/account/login" : "/auth/cli/continue", webappURL);
+    authorizationURL.search = new URLSearchParams({
+      redirect_uri: flow === "manual" ? "chisel-show-auth-token" : redirectURL!,
+      state: pkce.state,
+      ...(flow === "manual" ? {} : { prompt: "select_account" }),
+      code_challenge: pkce.challenge, code_challenge_method: "S256",
+    }).toString();
+    signal.throwIfAborted();
+    await awaitWithSignal(Promise.resolve(options.onURL(authorizationURL.href, signal)), signal);
+    if (options.promptCode && !hasAcceptedCode) {
+      void awaitWithSignal(Promise.resolve().then(() => options.promptCode!(inputSignal)), inputSignal).then((value) => {
+        if (hasAcceptedCode || signal.aborted) return;
+        authorizationCode = value.trim(); // Also keeps the raw code out of errors.
+        let code = authorizationCode;
+        if (/^https?:\/\//.test(code)) {
+          const pasted = new URL(code);
+          if (!redirectURL || pasted.origin + pasted.pathname !== redirectURL || !matchesState(pasted.searchParams.get("state"), pkce.state)) {
+            throw new Error("The pasted callback URL or state does not match.");
+          }
+          code = pasted.searchParams.get("code") ?? "";
+        }
+        if (!acceptCode(code)) throw new Error("Enter a valid authorization code. API keys and session tokens are not accepted.");
+      }).catch((error) => { if (!hasAcceptedCode && !signal.aborted) rejectCode(error); });
+    }
+    authorizationCode = await codePromise;
+    signal.throwIfAborted();
+    let sessionToken: string;
+    if (flow === "browser") {
+      sessionToken = await exchangeBrowserCode({ origin: devinAPIURL, code: authorizationCode, verifier: pkce.verifier, signal, fetch: options.fetch });
+    } else {
+      client = new ConnectClient({ baseURL: apiServerURL, timeoutMs: 30_000, fetch: options.fetch });
+      const isWindsurfCode = authorizationCode.startsWith(PKCE_CODE_PREFIX);
+      const method = isWindsurfCode ? PKCE_EXCHANGE_METHOD : EXCHANGE_METHOD;
+      const body = isWindsurfCode ? { authorizationCode: codeForExchange(authorizationCode), codeVerifier: pkce.verifier }
+        : { code: authorizationCode, codeVerifier: pkce.verifier };
+      const exchanged = await client.unary(method, body, signal, { encoding: options.encoding ?? "proto" });
+      if (isWindsurfCode && typeof exchanged.apiServerUrl === "string" && exchanged.apiServerUrl && endpoint(exchanged.apiServerUrl) !== apiServerURL) {
+        throw new Error("The login returned a different API server. Set the target with --api-server-url and sign in again.");
+      }
+      const tokenField = isWindsurfCode ? "apiKey" : "sessionToken";
+      sessionToken = requiredString(exchanged[tokenField], `${method}.${tokenField}`);
+    }
+    return { version: 1, sessionToken, apiServerURL, createdAt: new Date().toISOString() };
+  } catch (error) {
+    const secrets = [authorizationCode, codeForExchange(authorizationCode), pkce.verifier];
+    if (error instanceof RPCError) { error.message = safeError(error, secrets); error.code = safeError(error.code, secrets); throw error; }
+    const failure = new Error(safeError(error, secrets));
+    if (error instanceof Error) failure.name = error.name;
+    throw failure;
+  } finally {
+    inputController.abort();
+    client?.close();
+    signal.removeEventListener("abort", onAbort);
+    server.closeAllConnections();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}

package/src/core/auth/rest-exchange.ts

@@ -0,0 +1,35 @@
+import { createHTTPTransport } from "../protocol/http.ts";
+import { awaitWithSignal, boundedJSON, discardResponse, endpoint, RPCError } from "../protocol/transport.ts";
+import { object, requiredString } from "../types.ts";
+
+const TOKEN_PREFIX = "devin-session-token$";
+
+/** REST authorization code exchange, same as the public client. Never resends or creates a refresh grant. */
+export async function exchangeBrowserCode(options: {
+  origin: string; code: string; verifier: string; signal: AbortSignal; fetch?: typeof fetch;
+}): Promise<string> {
+  const origin = endpoint(options.origin);
+  const signal = AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]);
+  signal.throwIfAborted();
+  const transport = options.fetch ? undefined : createHTTPTransport();
+  try {
+    const response = await awaitWithSignal((options.fetch ?? transport!.fetch)(`${origin}/auth/cli/token`, {
+      method: "POST", redirect: "error", signal,
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ code: options.code, code_verifier: options.verifier }),
+    }), signal, discardResponse);
+    if (!response.ok) {
+      discardResponse(response);
+      throw new RPCError(response.status === 401 ? "unauthenticated" : `http_${response.status}`, "Devin login code exchange failed", response.status);
+    }
+    let body: unknown;
+    try { body = await boundedJSON(response, 64 * 1024, signal); }
+    catch (error) {
+      if (error instanceof SyntaxError) throw new Error("The Devin login response is not valid JSON.");
+      throw error;
+    }
+    const token = requiredString(object(body, "Devin login response").token, "Devin login response.token");
+    if (/[\s\u0000-\u001f\u007f]/.test(token)) throw new Error("The token in the Devin login response has an invalid format.");
+    return token.startsWith(TOKEN_PREFIX) ? token : TOKEN_PREFIX + token;
+  } finally { transport?.close(); }
+}

package/src/core/client.ts

@@ -0,0 +1,153 @@
+import { parseModelCatalog, type ModelCatalog } from "./models/catalog.ts";
+import { createHash } from "node:crypto";
+import { ConnectClient, ASSIGN_MODEL_METHOD, endpoint, type ConnectClientOptions } from "./protocol/transport.ts";
+import { createFingerprintProvider, type FingerprintProvider } from "./protocol/fingerprint.ts";
+import { wireMessages } from "./inference/messages.ts";
+import { object, requiredString, type ChatMessage, type Credential, type JsonObject, type ModelInfo } from "./types.ts";
+
+export const CLIENT_VERSION = "3000.11.92";
+export type MetadataProfile = "agent" | "standalone" | "login";
+const MODEL_DISPLAYS = [
+  "DISPLAY_OPTION_MODEL_ROUTER", "DISPLAY_OPTION_QUICK_REVIEW", "DISPLAY_OPTION_HIDDEN_TOOL",
+  "DISPLAY_OPTION_WIRE_7", "DISPLAY_OPTION_MODERN_AGENT_CHAT",
+];
+
+export interface DevinClientOptions extends Omit<ConnectClientOptions, "baseURL" | "token"> {
+  profile?: MetadataProfile;
+  restBaseURL?: string;
+  fingerprint?: FingerprintProvider;
+}
+
+export class DevinClient {
+  readonly credential: Credential;
+  readonly transport: ConnectClient;
+  readonly profile: MetadataProfile;
+  readonly fingerprint: FingerprintProvider;
+  defaultModelUid?: string;
+  accountIdentityHash?: string;
+  private organizationId?: string;
+  private restBaseURL: string;
+  private readonly hasExplicitRestURL: boolean;
+  constructor(credential: Credential, options: DevinClientOptions = {}) {
+    this.credential = credential;
+    const { profile, fingerprint, restBaseURL, ...transportOptions } = options;
+    const rpcOrigin = endpoint(credential.apiServerURL);
+    const isLoopback = ["localhost", "127.0.0.1", "[::1]"].includes(new URL(rpcOrigin).hostname);
+    this.hasExplicitRestURL = restBaseURL !== undefined;
+    this.restBaseURL = endpoint(restBaseURL ?? (isLoopback ? rpcOrigin : "https://api.devin.ai"));
+    this.profile = profile ?? "agent";
+    this.fingerprint = fingerprint ?? createFingerprintProvider(credential.sessionToken);
+    this.transport = new ConnectClient({ baseURL: credential.apiServerURL, token: credential.sessionToken, ...transportOptions });
+  }
+
+  metadata(options: { profile?: MetadataProfile; includeModelDisplays?: boolean } = {}): JsonObject {
+    const profile = options.profile ?? this.profile;
+    const version = profile === "standalone" ? "0.0.0-dev" : CLIENT_VERSION;
+    return {
+      apiKey: this.credential.sessionToken,
+      ideName: profile === "agent" ? "devin-cli" : "chisel",
+      ideVersion: version,
+      extensionName: "chisel",
+      extensionVersion: version,
+      locale: "en",
+      os: process.platform,
+      ...(profile === "agent" ? { ideType: "chisel" } : {}),
+      ...(options.includeModelDisplays ? { supportedModelDisplays: [...MODEL_DISPLAYS] } : {}),
+      f: this.fingerprint.create(),
+    };
+  }
+
+  async status(signal?: AbortSignal, expectedUserId?: string, profile = this.profile): Promise<JsonObject> {
+    signal?.throwIfAborted();
+    const response = await this.transport.unary(
+      "exa.seat_management_pb.SeatManagementService/GetUserStatus", { metadata: this.metadata({ profile }) }, signal,
+    );
+    const user = object(response.userStatus, "userStatus");
+    if (expectedUserId && user.userId !== expectedUserId) {
+      throw new Error("The signed-in user ID differs from the requested account. Sign in again; no inference was run.");
+    }
+    const plan = object(user.planStatus ?? {}, "planStatus");
+    const info = object(plan.planInfo ?? {}, "planInfo");
+    const devin = object(info.devinInfo ?? {}, "devinInfo");
+    const userId = requiredString(user.userId, "userStatus.userId");
+    this.accountIdentityHash = createHash("sha256").update(`${this.transport.baseURL}\0${userId}`).digest("hex");
+    this.organizationId = typeof devin.orgId === "string" ? devin.orgId : undefined;
+    if (!this.hasExplicitRestURL && typeof devin.apiUrl === "string" && devin.apiUrl) {
+      const candidate = endpoint(devin.apiUrl);
+      if (candidate !== this.restBaseURL && candidate !== this.transport.baseURL) throw new Error("Unverified REST server. Specify it explicitly with --rest-server.");
+      this.restBaseURL = candidate;
+    }
+    const hasQuota = info.billingStrategy === "BILLING_STRATEGY_QUOTA";
+    // Name, email, organization ID and the raw response are not exposed.
+    return {
+      ...(expectedUserId ? { identityVerified: true } : {}),
+      teamsTier: user.teamsTier,
+      canUseCli: info.devinInfo ? devin.canUseCli === true : undefined,
+      billingStrategy: info.billingStrategy,
+      dailyQuotaRemainingPercent: plan.dailyQuotaRemainingPercent ?? (hasQuota ? 0 : undefined),
+      weeklyQuotaRemainingPercent: plan.weeklyQuotaRemainingPercent ?? (hasQuota ? 0 : undefined),
+      dailyQuotaResetAtUnix: plan.dailyQuotaResetAtUnix,
+      weeklyQuotaResetAtUnix: plan.weeklyQuotaResetAtUnix,
+    };
+  }
+
+  async catalog(signal?: AbortSignal): Promise<ModelCatalog> {
+    signal?.throwIfAborted();
+    const response = await this.transport.unary(
+      "exa.api_server_pb.ApiServerService/GetCliModelConfigs", { metadata: this.metadata({ includeModelDisplays: true }) }, signal,
+    );
+    const catalog = parseModelCatalog(response);
+    this.defaultModelUid = catalog.defaultModelUid;
+    return catalog;
+  }
+
+  async models(signal?: AbortSignal): Promise<ModelInfo[]> {
+    return (await this.catalog(signal)).models;
+  }
+
+  async teamSettings(signal?: AbortSignal): Promise<JsonObject> {
+    signal?.throwIfAborted();
+    return this.transport.unary("exa.seat_management_pb.SeatManagementService/GetCliTeamSettings",
+      { metadata: this.metadata({ includeModelDisplays: true }) }, signal);
+  }
+
+  async managedPlugins(signal?: AbortSignal): Promise<JsonObject> {
+    signal?.throwIfAborted();
+    // Only fetches the manifest. This does not mean installing a remote plugin or running its commands is approved.
+    return this.transport.unary("exa.api_server_pb.ApiServerService/GetAccountManagedPlugins", { metadata: this.metadata() }, signal);
+  }
+
+  async assignModel(routerUid: string, cascadeId: string, message: ChatMessage | undefined, signal?: AbortSignal): Promise<{ modelUid: string; assignmentJwt: string }> {
+    signal?.throwIfAborted();
+    const prompt = message ? wireMessages([message])[0] : undefined;
+    if (prompt) delete prompt.promptCacheOptions;
+    const response = await this.transport.unary(ASSIGN_MODEL_METHOD, {
+      metadata: this.metadata(), modelRouterUid: routerUid, cascadeId, ...(prompt ? { chatMessagePrompt: prompt } : {}),
+    }, signal);
+    const assignment = object(response.assignment, "assignment");
+    return {
+      modelUid: requiredString(assignment.modelUid, "assignment.modelUid"),
+      assignmentJwt: message ? requiredString(assignment.assignmentJwt, "assignment.assignmentJwt") : String(assignment.assignmentJwt ?? ""),
+    };
+  }
+
+  async self(signal?: AbortSignal): Promise<JsonObject> {
+    return this.transport.getJSON(this.restBaseURL, "/v3/self", signal);
+  }
+
+  async integrations(signal?: AbortSignal): Promise<JsonObject | undefined> {
+    if (!this.organizationId) return undefined;
+    return this.transport.getJSON(this.restBaseURL, `/v3/organizations/${encodeURIComponent(this.organizationId)}/integrations`, signal);
+  }
+
+  async analytics(events: JsonObject[], signal?: AbortSignal): Promise<void> {
+    signal?.throwIfAborted();
+    if (events.length === 0) return;
+    await this.transport.unary("exa.product_analytics_pb.ProductAnalyticsService/BatchRecordAnalyticsEvents", {
+      events, apiKey: this.credential.sessionToken,
+    }, signal);
+  }
+}
+
+
+export { getModelByUID, selectModel } from "./models/select.ts";

package/src/core/index.ts

@@ -0,0 +1,12 @@
+/** Host-independent API shared by the CLI and Pi. */
+export const CORE_CONTRACT_VERSION = 1;
+export * from "./types.ts";
+export * from "./client.ts";
+export * from "./auth/index.ts";
+export * from "./models/catalog.ts";
+export * from "./inference/chat.ts";
+export * from "./inference/messages.ts";
+export * from "./inference/retry.ts";
+export * from "./inference/state.ts";
+export * from "./protocol/transport.ts";
+export * from "./protocol/fingerprint.ts";