@f5-sales-demo/xcsh 21.2.0 → 21.4.0

package/src/modes/controllers/login-options.ts

@@ -0,0 +1,21 @@
+import { getOAuthProviders, type OAuthProviderInfo } from "@f5-sales-demo/pi-ai";
+
+export type LoginOption = OAuthProviderInfo & { kind: "local" | "oauth" };
+
+/**
+ * The login menu is broader than OAuth. Keep local setup routes here instead
+ * of pretending they are OAuth providers (and therefore credential storage).
+ */
+export function getLoginOptions(): LoginOption[] {
+	return [
+		{
+			id: "google-vertex",
+			kind: "local",
+			name: "Google Cloud Vertex AI (Corporate)",
+			description: "Corporate Google Cloud account · ADC · Gemini 3.7 Flash HIGH",
+			available: true,
+			loginOrder: -100,
+		},
+		...getOAuthProviders().map(provider => ({ ...provider, kind: "oauth" as const })),
+	];
+}

package/src/modes/controllers/selector-controller.ts

@@ -75,18 +75,26 @@ import {
 import { type LoginRecoveryAction, type LoginRecoveryRequest, runLiteLLMLoginFlow } from "./litellm-login-flow";
 import { commitLiteLLMLogin } from "./litellm-login-transaction";
 import {
+	applyModelAfterLogin,
 	applyOAuthLoginModel,
 	GOOGLE_ANTIGRAVITY_LOGIN_MODEL_CHOICE,
+	GOOGLE_VERTEX_LOGIN_MODEL_CHOICE,
 	LITELLM_LOGIN_MODEL_CHOICES,
 	type LiteLLMLoginModelChoice,
 	type LoginModelChoice,
 } from "./login-model";
+import {
+	defaultVertexLoginRuntime,
+	detectVertexProject,
+	isHeadlessTerminal,
+	validateVertexLogin,
+	vertexFailureGuidance,
+} from "./vertex-login-flow";
 import { runVllmLoginFlow } from "./vllm-login-flow";
 import { commitVllmLogin } from "./vllm-login-transaction";
 
 const CALLBACK_SERVER_PROVIDERS = new Set<OAuthProvider>([
 	"anthropic",
-	"openai-codex-browser",
 	"gitlab-duo",
 	"google-gemini-cli",
 	"google-antigravity",
@@ -1210,6 +1218,10 @@ export class SelectorController {
 	}
 
 	async #handleOAuthLogin(providerId: string): Promise<void> {
+		if (providerId === "google-vertex") {
+			await this.#handleVertexLogin();
+			return;
+		}
 		if (providerId === "openai") {
 			this.#showOpenAIApiKeyGuidance();
 			return;
@@ -1225,8 +1237,7 @@ export class SelectorController {
 		this.ctx.showStatus(`Logging in to ${providerId}…`);
 		const manualInput = this.ctx.oauthManualInput;
 		const useManualInput =
-			CALLBACK_SERVER_PROVIDERS.has(providerId as OAuthProvider) ||
-			(providerId === "openai-codex" && resolveOpenAICodexLoginMethod() === "browser");
+			CALLBACK_SERVER_PROVIDERS.has(providerId as OAuthProvider) || providerId === "openai-codex";
 		const shouldOpenBrowser = providerId !== "openai-codex" || resolveOpenAICodexLoginMethod() === "browser";
 		const loginCallbacks = {
 			onAuth: (info: { url: string; instructions?: string }) => {
@@ -1339,6 +1350,59 @@ export class SelectorController {
 		}
 	}
 
+	/** Corporate Vertex uses local ADC, never OAuth storage or a consumer API-key fallback. */
+	async #handleVertexLogin(): Promise<void> {
+		const runtime = defaultVertexLoginRuntime;
+		try {
+			const detected = await detectVertexProject(runtime);
+			const proposed = await this.#promptLoginValue({
+				message: detected
+					? `Vertex AI project: ${detected.id} (${detected.source}). Press Enter to confirm, or type another project.`
+					: "Vertex AI project ID (required; Esc cancels):",
+				placeholder: detected?.id,
+				allowEmpty: true,
+			});
+			const project = proposed.trim() || detected?.id;
+			if (!project) {
+				this.ctx.showStatus("Vertex AI login cancelled. Existing configuration unchanged.");
+				return;
+			}
+
+			try {
+				this.ctx.showStatus("Validating Vertex AI Application Default Credentials and Gemini 3.7 Flash access…");
+				await validateVertexLogin(runtime, project);
+			} catch (error) {
+				const action = await this.#showLoginRecovery(
+					{ stage: "validation", error: vertexFailureGuidance(error, project), canEdit: true },
+					"Google Cloud Vertex AI",
+					"Sign in with gcloud",
+				);
+				if (action === "cancel") {
+					this.ctx.showStatus("Vertex AI login cancelled. Existing configuration unchanged.");
+					return;
+				}
+				if (action === "edit") {
+					await runtime.loginApplicationDefault(isHeadlessTerminal(runtime.environment));
+				}
+				await validateVertexLogin(runtime, project);
+			}
+
+			const applied = await applyModelAfterLogin(this.ctx.session, GOOGLE_VERTEX_LOGIN_MODEL_CHOICE);
+			if (!applied) throw new Error("Gemini 3.7 Flash is unavailable in the local Vertex model registry");
+			this.ctx.session.settings.set("providers.vertexProject", project);
+			this.ctx.session.settings.set("providers.vertexLocation", "global");
+			this.ctx.statusLine.invalidate();
+			this.ctx.updateEditorBorderColor();
+			this.ctx.showStatus("Vertex AI configured: google-vertex/gemini-3.7-flash:high (global)");
+		} catch (error) {
+			if (error instanceof LoginPromptCancelled) {
+				this.ctx.showStatus("Vertex AI login cancelled. Existing configuration unchanged.");
+				return;
+			}
+			this.ctx.showError(`Vertex AI login failed: ${vertexFailureGuidance(error)}`);
+		}
+	}
+
 	#showOpenAIApiKeyGuidance(): void {
 		this.ctx.chatContainer.addChild(new Spacer(1));
 		this.ctx.chatContainer.addChild(

package/src/modes/controllers/vertex-login-flow.ts

@@ -0,0 +1,109 @@
+import * as os from "node:os";
+import * as path from "node:path";
+import { $ } from "bun";
+
+export const VERTEX_LOGIN_MODEL = "gemini-3.7-flash";
+export const VERTEX_LOGIN_LOCATION = "global";
+
+export type VertexProjectSource = "environment" | "adc" | "gcloud";
+export interface VertexProject {
+	id: string;
+	source: VertexProjectSource;
+}
+export interface VertexLoginRuntime {
+	environment: Record<string, string | undefined>;
+	readAdcProject(): Promise<string | undefined>;
+	readGcloudProject(): Promise<string | undefined>;
+	applicationDefaultAccessToken(): Promise<string | undefined>;
+	loginApplicationDefault(headless: boolean): Promise<void>;
+	validateModel(project: string, location: string, accessToken: string): Promise<void>;
+}
+
+function clean(value: string | undefined): string | undefined {
+	const result = value?.trim();
+	return result || undefined;
+}
+
+/** Resolve the project in the same precedence order users see in the wizard. */
+export async function detectVertexProject(runtime: VertexLoginRuntime): Promise<VertexProject | undefined> {
+	const environmentProject =
+		clean(runtime.environment.GOOGLE_CLOUD_PROJECT) ?? clean(runtime.environment.GCLOUD_PROJECT);
+	if (environmentProject) return { id: environmentProject, source: "environment" };
+	const adcProject = clean(await runtime.readAdcProject());
+	if (adcProject) return { id: adcProject, source: "adc" };
+	const gcloudProject = clean(await runtime.readGcloudProject());
+	return gcloudProject ? { id: gcloudProject, source: "gcloud" } : undefined;
+}
+
+export function isHeadlessTerminal(environment: Record<string, string | undefined>): boolean {
+	return Boolean(environment.CLOUD_SHELL || environment.SSH_CONNECTION || !environment.DISPLAY);
+}
+
+export function vertexFailureGuidance(error: unknown, project?: string): string {
+	const message = error instanceof Error ? error.message : String(error);
+	const projectArg = project ? ` --project ${project}` : "";
+	if (/credential|unauthenticated|login|access token/i.test(message)) {
+		return "Application Default Credentials are required. Run `gcloud auth application-default login`.";
+	}
+	if (/billing/i.test(message)) return `Enable billing for the selected project:${projectArg}`;
+	if (/serviceusage|api.*disabled|not.*enabled/i.test(message)) {
+		return `Enable Vertex AI: \`gcloud services enable aiplatform.googleapis.com${projectArg}\`.`;
+	}
+	if (/permission|iam|forbidden|403/i.test(message)) {
+		return "Ask a project administrator for Vertex AI User access and Gemini model access in global.";
+	}
+	return `Vertex AI could not access ${VERTEX_LOGIN_MODEL} in global: ${message}`;
+}
+
+export async function validateVertexLogin(runtime: VertexLoginRuntime, project: string): Promise<void> {
+	const accessToken = await runtime.applicationDefaultAccessToken();
+	if (!accessToken) throw new Error("Application Default Credentials are unavailable");
+	await runtime.validateModel(project, VERTEX_LOGIN_LOCATION, accessToken);
+}
+
+export const defaultVertexLoginRuntime: VertexLoginRuntime = {
+	environment: Bun.env,
+	async readAdcProject() {
+		try {
+			const credentialsPath =
+				Bun.env.GOOGLE_APPLICATION_CREDENTIALS ??
+				path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+			const credentials = (await Bun.file(credentialsPath).json()) as { project_id?: unknown };
+			return typeof credentials.project_id === "string" ? clean(credentials.project_id) : undefined;
+		} catch {
+			return undefined;
+		}
+	},
+	async readGcloudProject() {
+		try {
+			return clean(await $`gcloud config get-value project`.quiet().text());
+		} catch {
+			return undefined;
+		}
+	},
+	async applicationDefaultAccessToken() {
+		try {
+			return clean(await $`gcloud auth application-default print-access-token`.quiet().text());
+		} catch {
+			return undefined;
+		}
+	},
+	async loginApplicationDefault(headless) {
+		if (headless) await $`gcloud auth application-default login --no-launch-browser`;
+		else await $`gcloud auth application-default login`;
+	},
+	async validateModel(project, location, accessToken) {
+		const response = await fetch(
+			`https://aiplatform.googleapis.com/v1/projects/${encodeURIComponent(project)}/locations/${location}/publishers/google/models/${VERTEX_LOGIN_MODEL}:generateContent`,
+			{
+				method: "POST",
+				headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+				body: JSON.stringify({
+					contents: [{ role: "user", parts: [{ text: "Reply with OK." }] }],
+					generationConfig: { maxOutputTokens: 8 },
+				}),
+			},
+		);
+		if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
+	},
+};

package/src/routing/subscription-profiles.ts

@@ -39,7 +39,7 @@ export const SUBSCRIPTION_ROUTING_PROFILES: Readonly<Record<SubscriptionProfileI
 		provider: "openai-codex",
 		roles: {
 			smol: "openai-codex/gpt-5.6-luna:low",
-			default: "openai-codex/gpt-5.6-terra:medium",
+			default: "openai-codex/gpt-5.6-sol:medium",
 			slow: "openai-codex/gpt-5.6-sol:high",
 			plan: "openai-codex/gpt-5.6-sol:high",
 		},

package/src/sdk.ts

@@ -7,7 +7,7 @@ import {
 	INTENT_FIELD,
 	type ThinkingLevel,
 } from "@f5-sales-demo/pi-agent-core";
-import type { Message, Model } from "@f5-sales-demo/pi-ai";
+import { type Message, type Model, streamSimple } from "@f5-sales-demo/pi-ai";
 import {
 	getOpenAICodexTransportDetails,
 	prewarmOpenAICodexResponses,
@@ -1843,6 +1843,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			preferWebsockets: preferOpenAICodexWebsockets,
 			getToolContext: tc => toolContextStore.getContext(tc),
 			getApiKey: async provider => {
+				// Vertex AI authenticates with ADC inside its provider transport; it must
+				// not borrow a Gemini API key or OAuth token from another Google route.
+				if (provider === "google-vertex") return undefined;
 				// Use the provider-facing session id for sticky credential selection so cache keys
 				// and provider auth affinity stay aligned across fresh benchmark sessions.
 				const key = await modelRegistry.getApiKeyForProvider(provider, providerSessionId);
@@ -1851,6 +1854,16 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				}
 				return key;
 			},
+			streamFn: (requestModel, context, requestOptions) => {
+				if (requestModel.provider !== "google-vertex") return streamSimple(requestModel, context, requestOptions);
+				const project = settings.get("providers.vertexProject");
+				const location = settings.get("providers.vertexLocation");
+				return streamSimple(requestModel, context, {
+					...requestOptions,
+					...(project ? { project } : undefined),
+					...(location ? { location } : undefined),
+				});
+			},
 			cursorExecHandlers,
 			transformToolCallArguments: (args, _toolName) => {
 				let result = args;

package/src/slash-commands/builtin-registry.ts

@@ -1,7 +1,6 @@
 import * as os from "node:os";
 import * as path from "node:path";
 
-import { getOAuthProviders } from "@f5-sales-demo/pi-ai";
 import type { AutocompleteItem } from "@f5-sales-demo/pi-tui";
 import { getConfigDirName, isEnoent, t } from "@f5-sales-demo/pi-utils";
 import { invalidate as invalidateFsCache } from "../capability/fs";
@@ -22,6 +21,7 @@ import {
 } from "../extensibility/plugins/marketplace";
 import { parseMarketplaceCatalog } from "../extensibility/plugins/marketplace/fetcher";
 import { setupTool } from "../extensibility/plugins/marketplace/prerequisites";
+import { getLoginOptions } from "../modes/controllers/login-options";
 import type { InteractiveModeContext } from "../modes/types";
 import { ContextService } from "../services/xcsh-context";
 import { parseMarketplaceInstallArgs, parsePluginScopeArgs } from "./marketplace-install-parser";
@@ -669,7 +669,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<BuiltinSlashCommandSpec> = [
 			const manualInput = runtime.ctx.oauthManualInput;
 			const args = command.args.trim();
 			if (args.length > 0) {
-				const matchedProvider = getOAuthProviders().find(provider => provider.id === args);
+				const matchedProvider = getLoginOptions().find(provider => provider.id === args);
 				if (matchedProvider) {
 					if (manualInput.hasPending()) {
 						const pendingProvider = manualInput.pendingProviderId;