@byok-sdk/keys 0.4.3 → 0.5.0

package/README.md

@@ -1,5 +1,41 @@
 # @byok-sdk/keys
 
+Pi launcher configuration in the unpublished 0.5.0 candidate is explicit.
+Set `pi_model` on `ProviderRegistry.configure` for profiles used by Pi:
+
+```ts
+const pi_model = {
+  contextWindow: 1_000_000,
+  maxTokens: 131_072,
+  reasoning: true,
+  thinkingLevel: 'low',
+  thinkingLevelMap: {
+    off: null, minimal: null, low: 'low', medium: null,
+    high: 'high', xhigh: null, max: 'max',
+  },
+  compat: {
+    supportsStore: false, supportsDeveloperRole: false,
+    supportsReasoningEffort: true, supportsUsageInStreaming: true,
+    maxTokensField: 'max_tokens', thinkingFormat: 'zai', zaiToolStream: true,
+  },
+} satisfies PiModelConfig;
+```
+
+These illustrate declared GLM-5.3-Flash/Pi model settings, not Host input budgets
+or automatic defaults. Import `PiModelConfig` from this package. The bounded
+`PiModelConfigSchema` rejects unknown fields, incomplete level maps and
+unsupported selected levels; it accepts no identity, URL, header or secret.
+Use the exact provider's authoritative configuration. Missing `pi_model`
+permits direct provider transports but rejects Pi admission and launch.
+Configuration changes alter the profile hash and registry revision, fencing
+stale tasks before credential access. The launcher projects the selected
+thinking level through its own argv, not delegated overrides.
+
+The SQLite profile schema changes in this candidate. Existing stores are
+rejected and preserved: explicitly provision a separate current-schema store
+after reviewing the old configuration. Do not delete an old store or infer its
+missing model settings. No live-store conversion is performed by the SDK.
+
 Key-based BYOK: a validated provider profile, credential-backed auth headers, and
 direct transports to OpenAI-compatible and Anthropic providers.
 

package/dist/bin/pi-provider-launcher.js

@@ -2,7 +2,7 @@
 import { spawn } from 'child_process';
 import { promises, mkdirSync, existsSync, chmodSync } from 'fs';
 import os from 'os';
-import path2, { dirname } from 'path';
+import path2, { isAbsolute, dirname } from 'path';
 import { z } from 'zod';
 import { createHash } from 'crypto';
 import { createRequire } from 'module';
@@ -193,6 +193,54 @@ function isPrivateNetworkLiteral(hostname) {
   }
   return parts[0] === 10 || parts[0] === 127 || parts[0] === 169 && parts[1] === 254 || parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31 || parts[0] === 192 && parts[1] === 168;
 }
+var PI_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+var effort = z.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/u).nullable();
+var PiModelConfigSchema = z.object({
+  contextWindow: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  maxTokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  reasoning: z.boolean(),
+  thinkingLevel: z.enum(PI_THINKING_LEVELS),
+  thinkingLevelMap: z.object({
+    off: effort,
+    minimal: effort,
+    low: effort,
+    medium: effort,
+    high: effort,
+    xhigh: effort,
+    max: effort
+  }).strict(),
+  compat: z.object({
+    supportsStore: z.boolean().optional(),
+    supportsDeveloperRole: z.boolean().optional(),
+    supportsReasoningEffort: z.boolean().optional(),
+    supportsUsageInStreaming: z.boolean().optional(),
+    maxTokensField: z.enum(["max_completion_tokens", "max_tokens"]).optional(),
+    thinkingFormat: z.enum([
+      "openai",
+      "openrouter",
+      "deepseek",
+      "together",
+      "baseten",
+      "zai",
+      "qwen",
+      "chat-template",
+      "qwen-chat-template",
+      "string-thinking",
+      "ant-ling"
+    ]).optional(),
+    zaiToolStream: z.boolean().optional()
+  }).strict()
+}).strict().superRefine((config, ctx) => {
+  if (config.maxTokens > config.contextWindow) {
+    ctx.addIssue({ code: "custom", path: ["maxTokens"], message: "Pi maximum output cannot exceed its context window" });
+  }
+  if (config.reasoning && config.thinkingLevelMap[config.thinkingLevel] === null) {
+    ctx.addIssue({ code: "custom", path: ["thinkingLevel"], message: "Pi thinking level is not supported by the declared model" });
+  }
+  if (!config.reasoning && config.thinkingLevel !== "off") {
+    ctx.addIssue({ code: "custom", path: ["thinkingLevel"], message: "Non-reasoning Pi models require thinking off" });
+  }
+});
 
 // src/provider-profile.ts
 var PROVIDER_PROFILE_REF_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u;
@@ -251,6 +299,8 @@ var ModelProviderProfileSchema = z.object({
   enabled: z.boolean(),
   kind: z.literal("model"),
   model: boundedString("model", 160),
+  // Direct transports do not use Pi; Pi admission requires this explicit configuration.
+  pi_model: PiModelConfigSchema.optional(),
   profile_ref: ProviderProfileRefSchema,
   provider_kind: z.enum(MODEL_PROVIDER_KINDS),
   updated_at: isoTimestamp("updated_at")
@@ -309,6 +359,7 @@ function exactProviderProfileBinding(profileInput, requiredCapabilities = profil
     capabilities: normalizedCapabilities,
     kind: profile.kind,
     model: profile.model,
+    ...profile.pi_model === void 0 ? {} : { pi_model: profile.pi_model },
     profile_ref: profile.profile_ref,
     provider_kind: profile.provider_kind
   });
@@ -539,13 +590,12 @@ function assertKeychainPath(keychainPath) {
   }
   return keychainPath;
 }
-
-// src/pi-provider-projection.ts
 var PI_PROJECTED_KEY_ENV = "PI_PROVIDER_API_KEY";
 function piProjectionProviderId(profileRef) {
   return `byok-sdk-${profileRef}`;
 }
 function buildPiProviderProjection(profile) {
+  const { thinkingLevel: _, ...modelSettings } = requirePiModelConfig(profile);
   const projectedProviderId = piProjectionProviderId(profile.profile_ref);
   return {
     providers: {
@@ -556,6 +606,7 @@ function buildPiProviderProjection(profile) {
         ...profile.auth_mode === "bearer" ? { authHeader: true } : {},
         models: [
           {
+            ...modelSettings,
             id: profile.model,
             name: profile.display_name,
             input: [
@@ -569,10 +620,27 @@ function buildPiProviderProjection(profile) {
   };
 }
 function buildPiProviderArgs(profile, delegatedArgs) {
+  const config = requirePiModelConfig(profile);
+  if (delegatedArgs.length > 128) throw new Error("Pi launcher delegated argument limit exceeded");
   let modeCount = 0;
+  let extensionCount = 0;
+  const singleFlags = /* @__PURE__ */ new Set();
   for (let index = 0; index < delegatedArgs.length; index += 1) {
     const flag = delegatedArgs[index];
+    if (typeof flag !== "string" || /[\u0000\r\n]/u.test(flag)) throw new Error("Pi launcher argument must be single-line");
+    if (flag !== "--extension") {
+      if (singleFlags.has(flag)) throw new Error(`Pi launcher duplicate argument ${flag}`);
+      singleFlags.add(flag);
+    }
     if (flag === "--no-tools") continue;
+    if (flag === "--extension") {
+      const value = delegatedArgs[++index];
+      if (typeof value !== "string" || !isAbsolute(value) || /[\u0000\r\n]/u.test(value)) {
+        throw new Error("Pi launcher --extension requires an absolute single-line path");
+      }
+      if (++extensionCount > 16) throw new Error("Pi launcher extension limit exceeded");
+      continue;
+    }
     if (flag === "--mode") {
       modeCount += 1;
       const value = delegatedArgs[index + 1];
@@ -582,7 +650,7 @@ function buildPiProviderArgs(profile, delegatedArgs) {
     }
     if (flag === "--session" || flag === "--tools" || flag === "--exclude-tools") {
       const value = delegatedArgs[index + 1];
-      if (!value || value.startsWith("--")) {
+      if (!value || value.startsWith("--") || /[\u0000\r\n]/u.test(value)) {
         throw new Error(`${flag} requires a value`);
       }
       index += 1;
@@ -591,14 +659,23 @@ function buildPiProviderArgs(profile, delegatedArgs) {
     throw new Error(`Pi launcher does not allow delegated argument ${flag ?? "<missing>"}`);
   }
   if (modeCount !== 1) throw new Error("Pi launcher requires exactly one --mode rpc");
+  if (singleFlags.has("--no-tools") && singleFlags.has("--tools")) {
+    throw new Error("Pi launcher cannot combine --no-tools and --tools");
+  }
   return [
     ...delegatedArgs,
     "--provider",
     piProjectionProviderId(profile.profile_ref),
     "--model",
-    profile.model
+    profile.model,
+    "--thinking",
+    config.thinkingLevel
   ];
 }
+function requirePiModelConfig(profile) {
+  if (profile.pi_model === void 0) throw new Error("Pi execution requires explicit pi_model configuration");
+  return PiModelConfigSchema.parse(profile.pi_model);
+}
 
 // src/pi-provider-launcher-core.ts
 var PI_CHILD_BASE_ENV_NAMES = [
@@ -637,6 +714,7 @@ function parsePiProviderLauncherOptions(args) {
   const piArgs = separator < 0 ? [] : args.slice(separator + 1);
   const allowedFlags = /* @__PURE__ */ new Set([
     "--pi-bin",
+    "--pi-entry",
     "--profile-db",
     "--provider",
     "--model",
@@ -725,7 +803,12 @@ function parsePiProviderLauncherOptions(args) {
       requiredCapabilities: parsedCapabilities.data
     };
   }
+  const piEntry = values.get("--pi-entry");
+  if (piEntry !== void 0 && (!path2.isAbsolute(piEntry) || /[\u0000\r\n]/u.test(piEntry))) {
+    throw new Error("--pi-entry requires an absolute single-line path");
+  }
   return {
+    ...piEntry === void 0 ? {} : { piEntry },
     piBin: required("--pi-bin"),
     profileDbPath,
     profileRef: profileRef.data,
@@ -770,11 +853,18 @@ function buildPiProviderChildEnvironment(options) {
     const isPrefixed = platform === "win32" ? platformName.startsWith("LC_") || platformName.startsWith("XDG_") : name.startsWith("LC_") || name.startsWith("XDG_");
     if (isExact || isPrefixed) result[name] = value;
   }
+  const mcpPath = options.ambient.BYOK_PI_MCP_CONFIG_PATH;
+  if (mcpPath !== void 0) {
+    if (!path2.isAbsolute(mcpPath) || /[\u0000\r\n]/u.test(mcpPath)) throw new Error("BYOK_PI_MCP_CONFIG_PATH must be an absolute single-line path");
+    result.BYOK_PI_MCP_CONFIG_PATH = mcpPath;
+  }
+  const permissionMode = options.ambient.BYOK_PI_PERMISSION_MODE;
+  if (permissionMode !== void 0) {
+    if (permissionMode !== "auto" && permissionMode !== "readonly") throw new Error("BYOK_PI_PERMISSION_MODE must be auto or readonly");
+    result.BYOK_PI_PERMISSION_MODE = permissionMode;
+  }
   result.PI_CODING_AGENT_DIR = options.projectionDir;
   result.PI_CODING_AGENT_SESSION_DIR = options.sessionDir;
-  if (options.secret !== void 0) {
-    result[PI_PROJECTED_KEY_ENV] = options.secret;
-  }
   return result;
 }
 async function ensurePiSessionDirectory(sessionDir) {
@@ -878,6 +968,7 @@ CREATE TABLE IF NOT EXISTS provider_profile (
   base_url      TEXT NOT NULL,
   auth_mode     TEXT NOT NULL CHECK (auth_mode IN (${sqlList(PROVIDER_AUTH_MODES)})),
   model         TEXT NOT NULL,
+  pi_model      TEXT,
   capabilities  TEXT NOT NULL,
   enabled       INTEGER NOT NULL CHECK (enabled IN (0, 1)),
   created_at    TEXT NOT NULL,
@@ -896,7 +987,7 @@ function assertProviderProfileSchemaIsCurrent(database, path4) {
   if (normalizeTableDdl(stored) === normalizeTableDdl(SCHEMA)) return;
   throw new ByokKeysError(
     "PROVIDER_STORE_SCHEMA_STALE",
-    `Provider profile store at ${path4} was created by a different @byok-sdk/keys schema; recreate the store file to continue`
+    `Provider profile store at ${path4} was created by a different @byok-sdk/keys schema; preserve this store and explicitly provision a separate current-schema store before continuing`
   );
 }
 var ENABLED_INDEX = `
@@ -978,8 +1069,8 @@ var SqliteProviderProfileStore = class {
       this.#database.prepare(
         `INSERT INTO provider_profile (
              profile_ref, provider_kind, kind, adapter, display_name, base_url,
-             auth_mode, model, capabilities, enabled, created_at, updated_at
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+             auth_mode, model, pi_model, capabilities, enabled, created_at, updated_at
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT(profile_ref) DO UPDATE SET
              provider_kind = excluded.provider_kind,
              adapter = excluded.adapter,
@@ -987,6 +1078,7 @@ var SqliteProviderProfileStore = class {
              base_url = excluded.base_url,
              auth_mode = excluded.auth_mode,
              model = excluded.model,
+             pi_model = excluded.pi_model,
              capabilities = excluded.capabilities,
              enabled = excluded.enabled,
              updated_at = excluded.updated_at`
@@ -999,6 +1091,7 @@ var SqliteProviderProfileStore = class {
         validated.base_url,
         validated.auth_mode,
         validated.model,
+        validated.pi_model === void 0 ? null : JSON.stringify(validated.pi_model),
         JSON.stringify(validated.capabilities),
         validated.enabled ? 1 : 0,
         validated.created_at,
@@ -1037,6 +1130,7 @@ function parseRow(row) {
   }
   return parseModelProviderProfile({
     ...row,
+    pi_model: row.pi_model === null ? void 0 : JSON.parse(row.pi_model),
     capabilities,
     enabled: row.enabled === 1
   });
@@ -1357,31 +1451,32 @@ async function run(options) {
     if (options.expectedBinding !== void 0) {
       assertExactProviderProfileBinding(profile, options.expectedBinding);
     }
+    const projection = buildPiProviderProjection(profile);
     if (options.validateOnly) return 0;
-    const secret = await resolvePiProviderSecret(
-      profile,
-      () => createSecretStore(
-        options.secretServicePrefix,
-        options.macosKeychainPath
-      )
-    );
+    const childArgs = buildPiProviderArgs(profile, options.piArgs);
     projectionDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-pi-provider-"));
     await promises.chmod(projectionDir, 448).catch(() => {
     });
     await ensurePiSessionDirectory(options.sessionDir);
+    const childEnv = buildPiProviderChildEnvironment({
+      ambient: process.env,
+      projectionDir,
+      sessionDir: options.sessionDir,
+      secret: void 0
+    });
+    const secret = await resolvePiProviderSecret(
+      profile,
+      () => createSecretStore(options.secretServicePrefix, options.macosKeychainPath)
+    );
+    if (secret !== void 0) childEnv[PI_PROJECTED_KEY_ENV] = secret;
     await promises.writeFile(
       path2.join(projectionDir, "models.json"),
-      `${JSON.stringify(buildPiProviderProjection(profile))}
+      `${JSON.stringify(projection)}
 `,
       { mode: 384 }
     );
-    const child = spawn(options.piBin, buildPiProviderArgs(profile, options.piArgs), {
-      env: buildPiProviderChildEnvironment({
-        ambient: process.env,
-        projectionDir,
-        sessionDir: options.sessionDir,
-        secret
-      }),
+    const child = spawn(options.piBin, [...options.piEntry === void 0 ? [] : [options.piEntry], ...childArgs], {
+      env: childEnv,
       stdio: "inherit"
     });
     const forward = (signal) => {