@jameslovespancakes/pi-plus 1.0.15 → 1.0.17

package/src/domains/subscriptions/accounts.ts

@@ -42,8 +42,8 @@ function bridge(pi: ExtensionAPI, ctx: any): AccountContext {
     hasUI: ctx.hasUI,
     signal: ctx.signal,
     ui: {
-      input: (title, placeholder) => ctx.ui.input(title, placeholder),
-      select: (title, options) => ctx.ui.select(title, options),
+      input: (title, placeholder, options) => ctx.ui.input(title, placeholder, options),
+      select: (title, options, dialog) => ctx.ui.select(title, options, dialog),
       confirm: (title, message) => ctx.ui.confirm(title, message),
       notify: (message, type) => ctx.ui.notify(message, type ?? "info"),
     },

package/src/domains/subscriptions/footer.ts

@@ -6,7 +6,7 @@ import { formatTokens, sanitize } from "../../ui/format.ts";
 
 /** Compact session footer with shared subscription usage bars. */
 
-const SUBSCRIPTION_PROVIDERS = new Set(["anthropic", "openai-codex", "kimi-coding", "xai"]);
+const SUBSCRIPTION_PROVIDERS = new Set(["anthropic", "openai-codex", "gemini", "kimi-coding", "xai"]);
 
 interface SessionTotals {
   input: number;

package/src/domains/subscriptions/index.ts

@@ -2,6 +2,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { registerAccountProvider } from "../../core/accounts/registry.ts";
 import { anthropicAccounts } from "./providers/anthropic.ts";
 import { codexAccounts, CODEX_SPEC } from "./providers/codex.ts";
+import { geminiAccounts, GEMINI_SPEC } from "./providers/gemini.ts";
 import { kimiAccounts, KIMI_SPEC, xaiAccounts, XAI_SPEC } from "./providers/hosted.ts";
 import { registerPooledOAuthProvider } from "./providers/oauth-pool.ts";
 import { registerAnthropicProvider } from "./provider.ts";
@@ -11,12 +12,13 @@ import { registerFooter } from "./footer.ts";
 
 /** Registers subscription providers, pooled accounts, routing, and usage UI. */
 export default function subscriptions(pi: ExtensionAPI) {
-  for (const provider of [anthropicAccounts, codexAccounts, kimiAccounts, xaiAccounts]) {
+  for (const provider of [anthropicAccounts, codexAccounts, geminiAccounts, kimiAccounts, xaiAccounts]) {
     registerAccountProvider(provider);
   }
 
   registerAnthropicProvider(pi);
   registerPooledOAuthProvider(pi, CODEX_SPEC);
+  registerPooledOAuthProvider(pi, GEMINI_SPEC);
   registerPooledOAuthProvider(pi, KIMI_SPEC);
   registerPooledOAuthProvider(pi, XAI_SPEC);
 

package/src/domains/subscriptions/provider.ts

@@ -1,13 +1,15 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { authorize, exchange, refreshToken } from "../../core/anthropic/oauth.ts";
 import {
-  billingHeader, clientIdentityHeaders, firstUserText, prependPromptBlock, signRequestBody, splitSystemPrompt,
+  billingHeader, clientIdentityHeaders, firstUserText, identityBetas, prependPromptBlock, signRequestBody,
+  splitSystemPrompt,
 } from "../../core/anthropic/client-identity.ts";
 import {
   anthropicAccountIdentity,
   cachedAnthropicAccountIdentity,
 } from "../../core/anthropic/identity.ts";
-import { ANTHROPIC_MODELS } from "../../core/anthropic/models.ts";
+import { catalogIsStale, refreshAnthropicCatalog } from "../../core/anthropic/catalog.ts";
+import { ANTHROPIC_MODELS, buildAnthropicModels, type ModelSpec } from "../../core/anthropic/models.ts";
 import {
   ACCESS_REFRESH_INTERVAL_MS,
   applyQuotaHeaders,
@@ -17,6 +19,7 @@ import {
   MAIN_ACCOUNT_ID, familyForModel, selectAccount, type Candidate,
 } from "../../core/anthropic/routing.ts";
 import { getRoutingMode, loadAccounts, saveAccount } from "../../core/anthropic/store.ts";
+import { refreshAbortSignal } from "../../core/accounts/routing.ts";
 
 /**
  * Anthropic uses pi's Messages API client with per-request account routing.
@@ -31,9 +34,12 @@ function isAnthropicMessagesPayload(payload: any): boolean {
   if ("instructions" in payload || "input" in payload) return false;
   if (!Array.isArray(payload.messages)) return false;
   const model = typeof payload.model === "string" ? payload.model.toLowerCase() : "";
-  return model.startsWith("claude") || ANTHROPIC_MODELS.some((m: any) => m.id === payload.model);
+  return model.startsWith("claude") || registeredModels.some((m) => m.id === payload.model);
 }
 
+/** The catalogue currently registered; replaced when discovery finds a new model. */
+let registeredModels: ModelSpec[] = ANTHROPIC_MODELS;
+
 let lastSelected: { id: string; at: number } | undefined;
 const accountLastUsed = new Map<string, number>();
 
@@ -114,12 +120,40 @@ async function login(callbacks: any) {
   return { access: result.access, refresh: result.refresh, expires: result.expires };
 }
 
-export function registerAnthropicProvider(pi: ExtensionAPI): void {
+/**
+ * Asks Anthropic which models this subscription can actually use.
+ *
+ * pi's catalogue is generated at build time, so a newly shipped model is
+ * missing until pi is upgraded. Discovery is best-effort and off the request
+ * path: a failure leaves the bundled catalogue in place, which is exactly the
+ * behaviour without this function.
+ */
+async function discoverModels(pi: ExtensionAPI, ctx: any, force = false): Promise<void> {
+  if (!force && !catalogIsStale()) return;
+  try {
+    const resolved = await ctx.modelRegistry?.getProviderAuth?.("anthropic");
+    if (!resolved?.auth) return;
+
+    const added = await refreshAnthropicCatalog(
+      { ...resolved.auth, source: resolved.source },
+      refreshAbortSignal(ctx.signal),
+    );
+    if (added.length === 0) return;
+
+    registeredModels = buildAnthropicModels();
+    registerProvider(pi);
+    ctx.ui?.notify?.(`New Anthropic models available: ${added.join(", ")}`, "info");
+  } catch {
+    // Offline, rate limited, or an expired credential: keep what we have.
+  }
+}
+
+function registerProvider(pi: ExtensionAPI): void {
   pi.registerProvider("anthropic", {
     name: "Anthropic",
     baseUrl: "https://api.anthropic.com",
     api: "anthropic-messages",
-    models: ANTHROPIC_MODELS,
+    models: registeredModels,
     // Required for subscription billing. See client-identity.ts.
     headers: clientIdentityHeaders(),
     oauth: {
@@ -133,6 +167,26 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
       getApiKey: (credentials: any) => routeAccessToken(credentials.access),
     },
   });
+}
+
+export function registerAnthropicProvider(pi: ExtensionAPI): void {
+  registerProvider(pi);
+
+  pi.registerCommand("models-refresh", {
+    description: "Re-ask subscription providers which models your accounts can use",
+    handler: async (_args, ctx: any) => {
+      await discoverModels(pi, ctx, true);
+      // Live catalogues (Gemini's, pi's remote ones) answer pi's own
+      // refresh; `force` bypasses their freshness windows.
+      const result = await ctx.modelRegistry?.refresh?.({ force: true }).catch(() => undefined);
+      const failed = [...(result?.errors?.keys?.() ?? [])];
+      ctx.ui.notify(
+        `${registeredModels.length} Anthropic models available.`
+          + (failed.length > 0 ? ` Could not refresh: ${failed.join(", ")}.` : " Other catalogues refreshed."),
+        failed.length > 0 ? "warning" : "info",
+      );
+    },
+  });
 
   /** Rebuilds the Anthropic prompt, then signs the final body. */
   pi.on("before_provider_request", async (event: any) => {
@@ -154,7 +208,10 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
       ...(split.systemText ? [{ type: "text", text: split.systemText }] : []),
     ];
 
-    const signed = await signRequestBody(JSON.stringify({ ...payload, system, messages }));
+    // Union, not replacement: pi's betas authorise fields pi itself emits.
+    const betas = identityBetas(payload, Array.isArray(payload.betas) ? payload.betas : []);
+
+    const signed = await signRequestBody(JSON.stringify({ ...payload, betas, system, messages }));
     return JSON.parse(signed);
   });
 
@@ -190,9 +247,11 @@ export function registerAnthropicProvider(pi: ExtensionAPI): void {
     void refreshAllQuota().catch(() => {});
   });
 
-  pi.on("session_start", async () => {
+  pi.on("session_start", async (_event: any, ctx: any) => {
     startRefreshLoop();
     void refreshAllQuota().catch(() => {});
+    // Off the request path and TTL-gated, so this is one call a day at most.
+    void discoverModels(pi, ctx).catch(() => {});
   });
 
   pi.on("session_shutdown", async () => {

package/src/domains/subscriptions/providers/builtin.ts

@@ -0,0 +1,19 @@
+import type { Api, Provider } from "@earendil-works/pi-ai";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+
+/**
+ * One of pi's own providers, from the host's copy of pi-ai.
+ *
+ * pi hands extensions its pi-ai through a fixed set of entry points (the
+ * package root, `compat`, `oauth` and `providers/all`) and installs packages
+ * without their peers. A deep import such as `pi-ai/providers/openai-codex`
+ * therefore has no copy to resolve against on a clean install, and wherever a
+ * stray copy does exist it is a different version from the host — the exact
+ * way stale provider definitions have dropped tools before.
+ * `providers/all` is always the host's, so providers come from here.
+ */
+export function builtinProvider<TApi extends Api>(id: string): Provider<TApi> {
+  const provider = builtinProviders().find((candidate) => candidate.id === id);
+  if (!provider) throw new Error(`This version of pi has no built-in "${id}" provider.`);
+  return provider as unknown as Provider<TApi>;
+}

package/src/domains/subscriptions/providers/codex.ts

@@ -1,5 +1,4 @@
 import type { OAuthCredential } from "@earendil-works/pi-ai";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { RoutingMode } from "../../../core/accounts/registry.ts";
 import { normalizeRoutingMode, type AccountQuotaState } from "../../../core/accounts/routing.ts";
@@ -13,6 +12,7 @@ import {
   saveCodexAccounts,
   type CodexAccount,
 } from "../../../core/codex/store.ts";
+import { builtinProvider } from "./builtin.ts";
 import {
   chooseCredential,
   createPooledOAuthAdapter,
@@ -146,7 +146,7 @@ function markCodexRateLimited(accountId: string, headers: Record<string, string>
 export const CODEX_SPEC: PooledOAuthProviderSpec<"openai-codex-responses"> = {
   id: "openai-codex",
   label: "Codex",
-  createProvider: openaiCodexProvider,
+  createProvider: () => builtinProvider("openai-codex"),
   store: CODEX_STORE,
   addPrompt: "Sign in with a DIFFERENT ChatGPT account in the browser. Continue?",
   describeAccount: (account) => describePlan(account as PooledOAuthAccount & CodexAccount),

package/src/domains/subscriptions/providers/gemini.ts

@@ -0,0 +1,111 @@
+import { createProvider, type Api, type Model, type Provider, type RefreshModelsContext } from "@earendil-works/pi-ai";
+import { GEMINI_ENDPOINT, fetchAvailableModels } from "../../../core/gemini/client.ts";
+import { credentialEmail, decodeApiKey } from "../../../core/gemini/credentials.ts";
+import {
+  GEMINI_API,
+  GEMINI_PROVIDER,
+  STATIC_MODELS,
+  buildCatalog,
+  withStaticModels,
+  type GeminiModel,
+} from "../../../core/gemini/models.ts";
+import { geminiOAuth, requestProjectId } from "../../../core/gemini/oauth.ts";
+import { geminiApi } from "../../../core/gemini/stream.ts";
+import { createPooledOAuthAdapter, type PooledOAuthProviderSpec } from "./oauth-pool.ts";
+
+/**
+ * Gemini adapter.
+ *
+ * pi has no provider for Google's Antigravity backend, so this one is built
+ * with pi's own `createProvider` and joins the same pooled serving path as
+ * every other subscription: one `routedAuth`, one bounded refresh, one quota
+ * observer, and `/accounts` management for free.
+ *
+ * The catalogue is live. pi already refreshes provider catalogues at startup,
+ * on login and when the model picker opens; this answers those refreshes from
+ * `fetchAvailableModels`, so a newly enabled model becomes selectable without
+ * a pi-plus release. The wrapper mirrors pi's own `withRemoteCatalog`:
+ * restore the stored list, honour a freshness window, and never lose the
+ * last known catalogue to a failed fetch.
+ */
+
+/** pi refreshes whenever the picker opens; the backend's list changes far less often. */
+export const CATALOG_TTL_MS = 4 * 60 * 60_000;
+
+async function discover(context: RefreshModelsContext): Promise<GeminiModel[] | undefined> {
+  const credential = context.credential;
+  if (credential?.type !== "oauth" || !credential.access) return undefined;
+  const runtimeModels = await fetchAvailableModels(credential.access, requestProjectId(credential), context.signal);
+  return Object.keys(runtimeModels).length > 0 ? buildCatalog(runtimeModels) : undefined;
+}
+
+export function withLiveCatalog(base: Provider<typeof GEMINI_API>): Provider<typeof GEMINI_API> {
+  let catalog: readonly GeminiModel[] = base.getModels();
+
+  return {
+    ...base,
+    getModels: () => catalog,
+
+    async refreshModels(context) {
+      const stored = context.stored;
+      const restored = withStaticModels((stored?.models ?? []) as Model<Api>[]);
+      if (!(await context.publish({ update: () => { catalog = restored; } }))) return;
+
+      if (!context.allowNetwork || context.signal.aborted) return;
+      const checkedAt = stored?.checkedAt;
+      if (!context.force && checkedAt !== undefined && Date.now() - checkedAt < CATALOG_TTL_MS) return;
+
+      try {
+        const discovered = await discover(context);
+        if (!discovered || context.signal.aborted) return;
+        await context.publish({
+          persist: { models: discovered, checkedAt: Date.now() },
+          update: () => { catalog = discovered; },
+        });
+      } catch (error) {
+        // The last known catalogue stays in place. Only an explicit refresh
+        // reports the failure; a background one is not worth interrupting for.
+        if (context.force) throw error;
+      }
+    },
+  };
+}
+
+export function createGeminiProvider(): Provider<typeof GEMINI_API> {
+  return withLiveCatalog(createProvider({
+    id: GEMINI_PROVIDER,
+    name: "Gemini",
+    baseUrl: GEMINI_ENDPOINT,
+    auth: { oauth: geminiOAuth },
+    models: STATIC_MODELS,
+    api: geminiApi(),
+  }));
+}
+
+export const GEMINI_SPEC: PooledOAuthProviderSpec<typeof GEMINI_API> = {
+  id: GEMINI_PROVIDER,
+  label: "Gemini",
+  createProvider: createGeminiProvider,
+  addPrompt: "Sign in with a DIFFERENT Google account in the browser. Continue?",
+  // Google issues opaque `ya29.` tokens with no readable claims, so the
+  // email discovered at login is what recognises a duplicate sign-in.
+  identityOfCredential: (credential) => {
+    const email = credentialEmail(credential);
+    return email ? `email:${email.toLowerCase()}` : undefined;
+  },
+  describeAccount: (account) => {
+    const email = credentialEmail(account);
+    const name = account.label || account.id.slice(0, 8);
+    return email ? `${name} (${email})` : name;
+  },
+  accessTokenOf: (apiKey) => {
+    try {
+      return decodeApiKey(apiKey).token;
+    } catch {
+      // Quota attribution is telemetry; an unreadable key is not an error here.
+      return undefined;
+    }
+  },
+};
+
+export const geminiAccounts = createPooledOAuthAdapter(GEMINI_SPEC);

package/src/domains/subscriptions/providers/hosted.ts

@@ -1,17 +1,16 @@
-import { kimiCodingProvider } from "@earendil-works/pi-ai/providers/kimi-coding";
-import { xaiProvider } from "@earendil-works/pi-ai/providers/xai";
+import { builtinProvider } from "./builtin.ts";
 import { createPooledOAuthAdapter, type PooledOAuthProviderSpec } from "./oauth-pool.ts";
 
 export const KIMI_SPEC: PooledOAuthProviderSpec<"anthropic-messages"> = {
   id: "kimi-coding",
   label: "Kimi",
-  createProvider: kimiCodingProvider,
+  createProvider: () => builtinProvider("kimi-coding"),
 };
 
 export const XAI_SPEC: PooledOAuthProviderSpec<"openai-responses"> = {
   id: "xai",
   label: "Grok",
-  createProvider: xaiProvider,
+  createProvider: () => builtinProvider("xai"),
 };
 
 export const kimiAccounts = createPooledOAuthAdapter(KIMI_SPEC);

package/src/domains/subscriptions/providers/oauth-pool.ts

@@ -27,6 +27,20 @@ export interface PooledOAuthProviderSpec<TApi extends Api> {
   describeAccount?(account: PooledOAuthAccount): string;
   /** Stable identity used to reject a duplicate login. Defaults to JWT claims. */
   identityOf?(access: string): string | undefined;
+  /**
+   * Identity read from the whole credential rather than the access token.
+   * Providers that issue opaque tokens (Google hands out `ya29.` strings with
+   * no readable claims) have no identity inside the token at all, so a stable
+   * value discovered at login — an email, say — is stored alongside it and
+   * read back here. Takes precedence over `identityOf` when present.
+   */
+  identityOfCredential?(credential: OAuthCredential): string | undefined;
+  /**
+   * Recovers the access token from what `toAuth()` put in `options.apiKey`,
+   * for providers that encode more than the token there. Without it, quota
+   * observed on a response cannot be attributed to the account that served it.
+   */
+  accessTokenOf?(apiKey: string): string | undefined;
   /**
    * Records a response's quota signal against an account. Defaults to the
    * generic `x-ratelimit-*` reader; providers with their own headers (Codex
@@ -72,15 +86,17 @@ async function authenticate<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi
   return oauthFor(spec).login({
     signal,
     notify: (event) => { void notifyAuthEvent(ctx, event); },
+    // `prompt.signal` lets a flow retract a prompt, e.g. the paste box once
+    // the browser callback has already answered it.
     prompt: async (prompt) => {
       if (prompt.type === "select") {
         const labels = prompt.options.map((option) => option.label);
-        const selected = await ctx.ui.select(prompt.message, labels);
+        const selected = await ctx.ui.select(prompt.message, labels, { signal: prompt.signal });
         const index = selected ? labels.indexOf(selected) : -1;
         if (index < 0) throw new Error("Login cancelled.");
         return prompt.options[index].id;
       }
-      const value = await ctx.ui.input(prompt.message, prompt.placeholder);
+      const value = await ctx.ui.input(prompt.message, prompt.placeholder, { signal: prompt.signal });
       if (!value) throw new Error("Login cancelled.");
       return value;
     },
@@ -95,12 +111,20 @@ function identityFor<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, acce
   return (spec.identityOf ?? oauthIdentity)(access);
 }
 
+/** Credential-wide identity where the provider has one, else the token's. */
+function credentialIdentity<TApi extends Api>(
+  spec: PooledOAuthProviderSpec<TApi>,
+  credential: OAuthCredential,
+): string | undefined {
+  return spec.identityOfCredential?.(credential) ?? identityFor(spec, credential.access);
+}
+
 function duplicateAccount<TApi extends Api>(
   spec: PooledOAuthProviderSpec<TApi>,
   credential: OAuthCredential,
   excludeId?: string,
 ): PooledOAuthAccount | undefined {
-  const identity = identityFor(spec, credential.access);
+  const identity = credentialIdentity(spec, credential);
   return storeFor(spec).load().accounts.find((account) =>
     account.id !== excludeId && (identity ? account.identity === identity : account.access === credential.access));
 }
@@ -114,7 +138,7 @@ export function createPooledOAuthAdapter<TApi extends Api>(spec: PooledOAuthProv
 
     async list(): Promise<ManagedAccount[]> {
       return store().load().accounts.map((account) => {
-        const identity = account.identity ?? identityFor(spec, account.access);
+        const identity = account.identity ?? credentialIdentity(spec, account);
         return {
           id: account.id,
           label: accountLabel(spec, account),
@@ -140,7 +164,7 @@ export function createPooledOAuthAdapter<TApi extends Api>(spec: PooledOAuthProv
         id: randomUUID(),
         label,
         enabled: true,
-        identity: identityFor(spec, credential.access),
+        identity: credentialIdentity(spec, credential),
         addedAt: Date.now(),
       });
       return label;
@@ -158,7 +182,7 @@ export function createPooledOAuthAdapter<TApi extends Api>(spec: PooledOAuthProv
       store().saveAccount({
         ...account,
         ...credential,
-        identity: identityFor(spec, credential.access),
+        identity: credentialIdentity(spec, credential),
       });
       return account.label;
     },
@@ -264,7 +288,7 @@ export function registerPooledOAuthProvider<TApi extends Api>(pi: ExtensionAPI,
     ...options,
     onResponse: async (response: { status: number; headers: Record<string, string> }, model: unknown) => {
       try {
-        recordQuotaResponse(spec, requestAccessToken(options), response.status, response.headers);
+        recordQuotaResponse(spec, requestAccessToken(spec, options), response.status, response.headers);
       } catch {
         // Quota accounting is telemetry; it must never fail the response.
       }
@@ -286,8 +310,10 @@ export function registerPooledOAuthProvider<TApi extends Api>(pi: ExtensionAPI,
   });
 }
 
-function requestAccessToken(options: any): string | undefined {
-  if (typeof options?.apiKey === "string") return options.apiKey;
+function requestAccessToken<TApi extends Api>(spec: PooledOAuthProviderSpec<TApi>, options: any): string | undefined {
+  if (typeof options?.apiKey === "string") {
+    return spec.accessTokenOf ? spec.accessTokenOf(options.apiKey) : options.apiKey;
+  }
   const headers = options?.headers;
   if (!headers || typeof headers !== "object") return undefined;
   const authorization = Object.entries(headers).find(([key]) => key.toLowerCase() === "authorization")?.[1];