@f5-sales-demo/pi-ai 21.2.0 → 21.4.0

package/README.md

@@ -1047,7 +1047,7 @@ bunx @f5-sales-demo/pi-ai list               # list available providers
 Credentials are saved to `agent.db` in the agent directory. `/login qianfan` opens the Qianfan console and stores the pasted API key.
 
 `login` supports OAuth providers (Anthropic, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
-OpenAI has two credential paths. Use `OPENAI_API_KEY` for usage-based Platform API access. Use `login openai-codex` for ChatGPT Plus/Pro subscription OAuth; SSH/headless terminals automatically receive a short device code, while local desktops use browser PKCE. Use `login openai-codex-browser` to force the callback flow. `login openai` explains the API-key path.
+OpenAI has two credential paths. Use `OPENAI_API_KEY` for usage-based Platform API access. Use `login openai-codex` for ChatGPT Plus/Pro subscription OAuth; SSH/headless terminals automatically receive a short device code, while local desktops use browser PKCE. `login openai` explains the API-key path.
 
 For the current OpenAI-compatible integrations, API-key onboarding covers Together, Moonshot, Qianfan, NVIDIA, NanoGPT, Hugging Face, Venice, Xiaomi, vLLM, LiteLLM, Cloudflare AI Gateway, and Qwen Portal. Ollama is typically local and unauthenticated; set `OLLAMA_API_KEY` only when your Ollama deployment enforces bearer auth.
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "21.2.0",
+	"version": "21.4.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "21.2.0",
+		"@f5-sales-demo/pi-utils": "21.4.0",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -821,13 +821,6 @@ export class AuthStorage {
 					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
 				});
 				break;
-			case "openai-codex-browser":
-				credentials = await loginOpenAICodex({
-					...ctrl,
-					method: "browser",
-					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
-				});
-				break;
 			case "openai":
 				throw new Error("OpenAI uses usage-based API access. Set OPENAI_API_KEY instead of signing in.");
 			case "gitlab-duo":

package/src/cli.ts

@@ -140,21 +140,6 @@ async function login(provider: OAuthProvider): Promise<void> {
 					},
 				});
 				break;
-			case "openai-codex-browser":
-				credentials = await loginOpenAICodex({
-					method: "browser",
-					onAuth(info) {
-						const { url, instructions } = info;
-						console.log(`\nOpen this URL in your browser:\n${url}`);
-						if (instructions) console.log(instructions);
-						console.log();
-					},
-					async onPrompt(p) {
-						return await promptFn(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
-					},
-				});
-				break;
-
 			case "kimi-code":
 				credentials = await loginKimi({
 					onAuth(info) {
@@ -351,7 +336,6 @@ Providers:
   google-gemini-cli Google Gemini CLI
   google-antigravity Antigravity (Gemini 3, Claude, GPT-OSS)
   openai-codex      ChatGPT Plus/Pro (Codex subscription)
-  openai-codex-browser ChatGPT Plus/Pro (explicit browser callback)
   openai            OpenAI Responses API (usage-based; set OPENAI_API_KEY)
   kimi-code         Kimi Code
   kilo              Kilo Gateway

package/src/providers/google-vertex.ts

@@ -104,10 +104,11 @@ export const streamGoogleVertex: StreamFunction<"google-vertex"> = (
 		let rawRequestDump: RawHttpRequestDump | undefined;
 
 		try {
-			const apiKey = resolveApiKey(options);
-			const project = apiKey ? undefined : await resolveGoogleVertexProject(options);
-			const location = apiKey ? undefined : resolveGoogleVertexLocation(options);
-			const client = apiKey ? createClientWithApiKey(model, apiKey) : createClient(model, project!, location!);
+			// Corporate Vertex is deliberately ADC-only.  In particular, do not let the
+			// generic agent API-key plumbing turn this route into Gemini consumer auth.
+			const project = await resolveGoogleVertexProject(options);
+			const location = resolveGoogleVertexLocation(options);
+			const client = createClient(model, project, location);
 			const params = buildGoogleVertexParams(model, context, options);
 			options?.onPayload?.(params);
 			rawRequestDump = {
@@ -115,9 +116,7 @@ export const streamGoogleVertex: StreamFunction<"google-vertex"> = (
 				api: output.api,
 				model: model.id,
 				method: "POST",
-				url: apiKey
-					? `https://aiplatform.googleapis.com/${API_VERSION}/publishers/google/models/${model.id}:streamGenerateContent`
-					: googleVertexRequestUrl(model.id, project!, location!),
+				url: googleVertexRequestUrl(model.id, project, location),
 				body: params,
 			};
 			const googleStream = await client.models.generateContentStream(params);
@@ -342,23 +341,6 @@ function createClient(model: Model<"google-vertex">, project: string, location:
 	});
 }
 
-function createClientWithApiKey(model: Model<"google-vertex">, apiKey: string): GoogleGenAI {
-	return new GoogleGenAI({
-		vertexai: true,
-		apiKey,
-		apiVersion: API_VERSION,
-		httpOptions: buildHttpOptions(model),
-	});
-}
-
-function resolveApiKey(options?: GoogleVertexOptions): string | undefined {
-	// options.apiKey may contain sentinel values like "<authenticated>" or "N/A"
-	// leaked from the agent loop — only use it if it looks like a real API key.
-	const optKey = options?.apiKey;
-	const realKey = optKey && !optKey.startsWith("<") && optKey !== "N/A" ? optKey : undefined;
-	return realKey || $env.GOOGLE_CLOUD_API_KEY;
-}
-
 const defaultProjectRuntime: GoogleVertexProjectRuntime = {
 	readAdcProject,
 	readLocalConfigProject: readConfiguredGcloudProject,
@@ -442,7 +424,10 @@ export async function resolveGoogleVertexProject(
 }
 
 export function resolveGoogleVertexLocation(options?: GoogleVertexOptions): string {
-	return options?.location || $env.GOOGLE_CLOUD_LOCATION || "global";
+	// Gemini 3.7 Flash Corporate is served through the global endpoint only.
+	// Ignore inherited provider/environment locations so a request cannot drift.
+	void options;
+	return "global";
 }
 
 async function readAdcProject(): Promise<string | undefined> {

package/src/stream.ts

@@ -97,15 +97,8 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 			? $pickenv("ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY")
 			: $pickenv("ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"),
 	"gitlab-duo": "GITLAB_TOKEN",
-	// Vertex AI supports either GOOGLE_CLOUD_API_KEY or Application Default Credentials.
-	"google-vertex": () => {
-		if ($env.GOOGLE_CLOUD_API_KEY) {
-			return $env.GOOGLE_CLOUD_API_KEY;
-		}
-		if (hasVertexAdcCredentials()) {
-			return "<authenticated>";
-		}
-	},
+	// Corporate Vertex uses Application Default Credentials only.
+	"google-vertex": () => (hasVertexAdcCredentials() ? "<authenticated>" : undefined),
 	// Amazon Bedrock supports multiple credential sources:
 	// 1. AWS_PROFILE - named profile from ~/.aws/credentials
 	// 2. AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY - standard IAM keys

package/src/utils/oauth/index.ts

@@ -156,13 +156,6 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "ChatGPT Plus/Pro (Codex Subscription)",
 		available: true,
 	},
-	{
-		id: "openai-codex-browser",
-		name: "ChatGPT Plus/Pro (Browser callback)",
-		available: true,
-		canonicalId: "openai-codex",
-		loginOnly: true,
-	},
 	{
 		id: "openai",
 		name: "OpenAI Responses API (usage-based API access)",
@@ -206,14 +199,14 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 	{
 		id: "google-antigravity",
 		name: "Antigravity (Gemini 3, Claude, GPT-OSS)",
+		description: "Optional consumer or non-corporate route",
 		available: true,
 	},
 	{
 		id: "google-antigravity-enterprise",
-		name: "Google Antigravity Enterprise (Gemini 3.6 Flash High)",
+		name: "Google Antigravity Enterprise (Advanced OAuth)",
+		description: "Advanced corporate OAuth route; entitlement-discovered models, not Vertex ADC",
 		available: true,
-		canonicalId: "google-antigravity",
-		loginOnly: true,
 	},
 	{
 		id: "cursor",
@@ -516,7 +509,10 @@ export async function getOAuthApiKey(
 	}
 	// For providers that need request-time credential metadata, return JSON.
 	const needsStructuredApiKey =
-		provider === "github-copilot" || provider === "google-gemini-cli" || provider === "google-antigravity";
+		provider === "github-copilot" ||
+		provider === "google-gemini-cli" ||
+		provider === "google-antigravity" ||
+		provider === "google-antigravity-enterprise";
 	const apiKey = needsStructuredApiKey
 		? JSON.stringify({
 				token: creds.access,

package/src/utils/oauth/openai-codex.ts

@@ -254,16 +254,55 @@ export type OpenAICodexLoginOptions = OAuthController & {
 	method?: OpenAICodexLoginMethod;
 };
 
-export async function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials> {
-	if (resolveOpenAICodexLoginMethod(options.method) === "device") {
-		return loginOpenAICodexDevice(options);
+export type OpenAICodexLoginDependencies = {
+	deviceLogin?: (options: OAuthController) => Promise<OAuthCredentials>;
+	browserLogin?: (options: OAuthController & { originator?: string }) => Promise<OAuthCredentials>;
+};
+
+export class OpenAICodexDeviceUnavailableError extends Error {
+	constructor() {
+		super(
+			"Device-code login is not enabled for this ChatGPT account or workspace. Enable it in ChatGPT security or workspace settings, or continue with browser/manual redirect login.",
+		);
+		this.name = "OpenAICodexDeviceUnavailableError";
 	}
+}
+
+function isDeviceAuthorizationUnavailable(error: unknown): boolean {
+	return error instanceof OpenAICodexDeviceUnavailableError;
+}
+
+async function loginOpenAICodexBrowser(options: OAuthController & { originator?: string }): Promise<OAuthCredentials> {
 	const pkce = await generatePKCE();
 	const originator = options.originator?.trim() || "pi";
 	const flow = new OpenAICodexOAuthFlow(options, pkce, originator);
 	return flow.login();
 }
 
+export async function loginOpenAICodex(
+	options: OpenAICodexLoginOptions,
+	dependencies: OpenAICodexLoginDependencies = {},
+): Promise<OAuthCredentials> {
+	const browserLogin = dependencies.browserLogin ?? loginOpenAICodexBrowser;
+	if (resolveOpenAICodexLoginMethod(options.method) !== "device") {
+		return browserLogin(options);
+	}
+
+	try {
+		return await (dependencies.deviceLogin ?? loginOpenAICodexDevice)(options);
+	} catch (error) {
+		if (!isDeviceAuthorizationUnavailable(error) || !options.onPrompt) throw error;
+		const response = await options.onPrompt({
+			message: "ChatGPT device authorization is unavailable. Continue with browser/manual redirect login? [Y/n]",
+			placeholder: "Press Enter to continue, or type no to cancel",
+			allowEmpty: true,
+		});
+		if (/^(?:n|no)$/i.test(response.trim())) throw new Error("ChatGPT login cancelled");
+		options.onProgress?.("Continuing with browser/manual redirect authentication…");
+		return browserLogin(options);
+	}
+}
+
 export type OpenAICodexDeviceFlowDependencies = {
 	fetch?: typeof fetch;
 	sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
@@ -289,9 +328,7 @@ export async function loginOpenAICodexDevice(
 	});
 	if (!initResponse.ok) {
 		if (initResponse.status === 404) {
-			throw new Error(
-				"Device-code login is not enabled for this ChatGPT account or workspace. Enable it in ChatGPT security or workspace settings, or choose the browser callback login.",
-			);
+			throw new OpenAICodexDeviceUnavailableError();
 		}
 		const detail = formatOpenAICodexTokenEndpointError(initResponse.status, await initResponse.text());
 		throw new Error(`Device authorization initiation failed: ${detail}`);

package/src/utils/oauth/types.ts

@@ -35,7 +35,6 @@ export type OAuthProvider =
 	| "ollama"
 	| "openai"
 	| "openai-codex"
-	| "openai-codex-browser"
 	| "opencode-go"
 	| "opencode-zen"
 	| "parallel"
@@ -75,12 +74,14 @@ export interface OAuthProviderInfo {
 	canonicalId?: OAuthProvider;
 	/** Entry is offered for login but omitted from logout to avoid alias duplicates. */
 	loginOnly?: boolean;
+	/** Short secondary text displayed by interactive login pickers. */
+	description?: string;
+	/** Stable login-menu order; lower values are shown first. */
+	loginOrder?: number;
 }
 
 /** Resolve login-only aliases to the provider ID used by credentials and models. */
 export function canonicalizeOAuthProviderId(provider: string): string {
-	if (provider === "google-antigravity-enterprise") return "google-antigravity";
-	if (provider === "openai-codex-browser") return "openai-codex";
 	return provider;
 }