@growthagent/ci 0.2.0 → 0.4.0

package/dist/cli.js

@@ -2,8 +2,8 @@
 
 // src/cli.ts
 import { execFileSync, spawnSync } from "node:child_process";
-import { cpSync, existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path4 from "node:path";
+import { cpSync, existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import path5 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../github/src/app.ts
@@ -235,6 +235,28 @@ function validatePatch(patch, limits = DEFAULT_PATCH_LIMITS) {
   return { ok: true, report: { files, bytes, addedLines } };
 }
 
+// src/provider-config.ts
+import { mkdtempSync as mkdtempSync2, writeFileSync } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import path4 from "node:path";
+var RUN_TOKEN_ENV = "GX_RUN_TOKEN";
+function writeGoogleProviderConfig(model) {
+  const gateway = (process.env.GX_GATEWAY_URL ?? "").replace(/\/$/, "");
+  const dir = mkdtempSync2(path4.join(tmpdir3(), "growth-agent-pi-"));
+  const config = {
+    providers: {
+      "growthagent-google": {
+        baseUrl: `${gateway}/v1beta`,
+        api: "google-generative-ai",
+        apiKey: `$${RUN_TOKEN_ENV}`,
+        models: [{ id: model, name: model, input: ["text"], contextWindow: 1e6 }]
+      }
+    }
+  };
+  writeFileSync(path4.join(dir, "models.json"), JSON.stringify(config, null, 2));
+  return dir;
+}
+
 // src/trust.ts
 var TRUSTED_APP_LOGIN = "growth-agent[bot]";
 function authorIsTrusted(issue, extraLogins = []) {
@@ -340,11 +362,11 @@ function buildPrompt(fields, briefing) {
 }
 
 // src/cli.ts
-var HERE = path4.dirname(fileURLToPath(import.meta.url));
+var HERE = path5.dirname(fileURLToPath(import.meta.url));
 var PATCH_FILE = "growth-agent.patch";
 function assetsDir() {
-  const packaged = path4.join(HERE, "assets", "skills");
-  return existsSync2(packaged) ? packaged : path4.join(HERE, "..", "assets", "skills");
+  const packaged = path5.join(HERE, "assets", "skills");
+  return existsSync2(packaged) ? packaged : path5.join(HERE, "..", "assets", "skills");
 }
 function sh(cmd, args, opts = {}) {
   const r = spawnSync(cmd, args, { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] });
@@ -471,28 +493,25 @@ async function implement() {
   console.log(
     meta.kind === "instrumentation" ? `\u25B8 instrumentation request #${issue.number}` : `\u25B8 change request #${issue.number} \u2014 flag ${meta.flagKey} on ${meta.surface}`
   );
-  const skillsDir = path4.resolve(process.cwd(), ".pi", "skills");
+  const skillsDir = path5.resolve(process.cwd(), ".pi", "skills");
   mkdirSync(skillsDir, { recursive: true });
   cpSync(assetsDir(), skillsDir, { recursive: true });
   const prompt = buildPrompt(meta, extractBriefing(issue.body));
   const provider = process.env.GX_CI_PROVIDER ?? "anthropic";
   const model = process.env.GX_CI_MODEL ?? (provider === "google" ? "gemini-3.7-flash" : "claude-opus-5");
-  if (provider === "google") {
-    console.log(
-      "\u25B8 NOTE: GX_CI_PROVIDER=google routes model traffic directly to Google on your own GEMINI_API_KEY. It is billed by Google to you and is not metered by Growth Agent."
-    );
-  }
   const session = await openSession();
   if (!session.ok) {
     console.error(`Refusing to run the model: ${session.reason}`);
     return 1;
   }
-  console.log(`\u25B8 running pi (${provider}/${model})`);
+  const piProvider = provider === "google" ? "growthagent-google" : provider;
+  const piConfigDir = provider === "google" ? writeGoogleProviderConfig(model) : null;
+  console.log(`\u25B8 running pi (${piProvider}/${model})`);
   let piStatus;
   try {
     const pi = spawnSync(
       "pi",
-      ["-p", prompt, "--provider", provider, "--model", model, "--thinking", "high"],
+      ["-p", prompt, "--provider", piProvider, "--model", model, "--thinking", "high"],
       {
         stdio: ["ignore", "inherit", "inherit"],
         env: {
@@ -501,8 +520,12 @@ async function implement() {
           ANTHROPIC_BASE_URL: process.env.GX_GATEWAY_URL ?? process.env.ANTHROPIC_BASE_URL,
           ANTHROPIC_API_KEY: session.token,
           // The long-lived credential must not survive into the model's
-          // environment, whatever else it might read there.
-          GROWTH_AGENT_TOKEN: ""
+          // environment, whatever else it might read there. Nor may a raw
+          // provider key: everything is spent through the run token.
+          GROWTH_AGENT_TOKEN: "",
+          GEMINI_API_KEY: "",
+          // Only set for the Google path; pi keeps its own default otherwise.
+          ...piConfigDir ? { PI_CODING_AGENT_DIR: piConfigDir, [RUN_TOKEN_ENV]: session.token } : {}
         }
       }
     );
@@ -522,7 +545,7 @@ async function implement() {
     console.error("pi made no changes \u2014 nothing to open a PR for");
     return 2;
   }
-  writeFileSync(PATCH_FILE, patch + "\n", "utf8");
+  writeFileSync2(PATCH_FILE, patch + "\n", "utf8");
   const verdict = validatePatch(patch);
   if (!verdict.ok) {
     console.error(`The produced patch was refused: ${verdict.reason}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growthagent/ci",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "bin": {