@jameslovespancakes/pi-plus 1.0.6 → 1.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jameslovespancakes/pi-plus",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "type": "module",
   "description": "Consolidated pi extensions: Claude subscription accounts and quota HUD, benchmark-driven model catalog and billing policy, live agent board, and capacity-gated remote test workers.",
   "license": "MIT",
@@ -24,11 +24,9 @@
   },
   "files": [
     "src",
+    "!src/core/anthropic/vendor/README.md",
     "server",
     "config/skills",
-    "config/pi-plus.example.json",
-    "images",
-    "CHANGELOG.md",
     "README.md",
     "LICENSE"
   ],

package/CHANGELOG.md

@@ -1,130 +0,0 @@
-# Changelog
-
-All notable changes to this project are documented here.
-
-The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and versions follow an odometer scheme: patch rolls into minor at 100, minor
-rolls into major at 10.
-
-## [Unreleased]
-
-## [1.0.6] - 2026-09-19
-
-### Fixed
-
-- The build badge reads the release workflow instead of the CI workflow. A
-  `workflow_call` run is attributed to the caller, so CI had no runs of its own
-  on main and its badge showed "no status". The release workflow contains the
-  same lint, typecheck and test job, so the badge cannot be green unless those
-  passed.
-
-## [1.0.5] - 2026-09-19
-
-### Changed
-
-- The README shows each interface as text rather than a screenshot. The blocks
-  are generated from the real renderers with dummy data, so they cannot drift
-  from the code the way the screenshots had, and they stay readable in a
-  terminal, a diff and on npm.
-
-### Removed
-
-- The five demo screenshots. Only the project mark remains, which takes the
-  published package from 489KB to 375KB.
-
-
-## [1.0.4] - 2026-09-19
-
-### Changed
-
-- The README leads with the mark alone instead of repeating the name beneath
-  it, and credits the Anthropic provider correctly: it was adopted from
-  `@cortexkit/pi-anthropic-auth` and has since been reimplemented here.
-
-### Added
-
-- A disclaimer covering provider terms of service.
-
-## [1.0.3] - 2026-09-19
-
-### Added
-
-- A `CHANGELOG.md`, and GitHub releases whose notes are generated from it.
-  `scripts/changelog.mjs --promote` retitles `## [Unreleased]` as the new
-  version at release time, so entries are written without needing to know the
-  next version number.
-
-## [1.0.2] - 2026-09-19
-
-### Fixed
-
-- Release tags now reach the remote. `git tag` creates a lightweight tag and
-  `git push --follow-tags` pushes only annotated ones, so every tag was
-  silently dropped while the job still reported success.
-- The release job name no longer renders twice. GitHub prefixes a reusable
-  workflow's job name with the caller's, so naming both produced
-  `Lint / Typecheck / Tests / Lint / Typecheck / Tests`.
-
-## [1.0.1] - 2026-09-19
-
-### Added
-
-- Releases are gated on lint, typecheck and tests as a separate job.
-  Publishing cannot begin unless every check passes, rather than relying on
-  step ordering inside one job.
-
-### Changed
-
-- CI and release run on Node 24, which ships the npm 11.5.1+ required for
-  trusted publishing.
-- `actions/checkout` and `actions/setup-node` upgraded to v5; v4 targets the
-  deprecated Node 20 runtime.
-
-## [1.0.0] - 2026-09-19
-
-First published release.
-
-### Added
-
-- **Subscription accounts.** Multiple Anthropic and Codex subscriptions in one
-  pool, with quota-aware routing. `/accounts` lists every provider's accounts
-  and toggles them in place; `/accounts add` and `/accounts rename` run as
-  wizards.
-- **Codex multi-account.** PKCE OAuth, per-account quota from `x-codex-*`
-  response headers, and duplicate detection by ChatGPT account id so two
-  entries cannot share one quota pool.
-- **Quota from response headers.** Anthropic reports utilisation on every
-  reply, so the account serving traffic refreshes at no request cost. Idle
-  accounts are polled at most once per 10 minutes, triggered by sending a
-  message rather than a timer.
-- **Usage HUD.** Pooled 5h, weekly and per-model tiers for Claude, and 5h and
-  weekly for Codex, served from cached snapshots.
-- **Model catalogue and billing policy.** `/models`, `/model-info` and
-  `/provider` with benchmark-driven selection and an approval gate.
-- **Agent board.** `/board` for live cross-agent messaging.
-- **Remote workers.** `/remote` for capacity-gated test and build workers.
-- **Own the Anthropic provider.** OAuth, routing, quota and client identity
-  are implemented in this repository rather than pulled from a dependency.
-
-### Fixed
-
-- The account list and `/usage` both returned empty because they still
-  imported a package that had been removed during the provider extraction.
-  The failure was swallowed, so it looked like "no accounts" rather than an
-  error.
-- Cached usage rows omitted `checkedAt`, so freshness checks discarded every
-  one and the HUD read `unknown/stale` with no bars.
-- The provider picker redrew the whole screen on each toggle. It now updates
-  in place inside pi's own inline chrome.
-- Scoped per-model limits were labelled from Anthropic's internal id, which
-  truncated to `claude` and named neither the window nor the model. They now
-  show the model family, for example `Fable`.
-
-[Unreleased]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.6...HEAD
-[1.0.6]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.5...v1.0.6
-[1.0.5]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.4...v1.0.5
-[1.0.4]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.3...v1.0.4
-[1.0.3]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.2...v1.0.3
-[1.0.2]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.1...v1.0.2
-[1.0.1]: https://github.com/jameslovespancakes/pi-plus/compare/v1.0.0...v1.0.1
-[1.0.0]: https://github.com/jameslovespancakes/pi-plus/releases/tag/v1.0.0

package/config/pi-plus.example.json

@@ -1,60 +0,0 @@
-{
-  "env": {
-    "ARTIFICIAL_ANALYSIS_API_KEY": "<artificial-analysis-api-key>",
-    "AGENT_BOARD_URL": "ws://<board-host>:8787/ws",
-    "AGENT_BOARD_TOKEN": "<agent-board-token>",
-    "AGENT_BOARD_NAME": "you"
-  },
-  "policy": {
-    "autoApprove": [
-      "anthropic/*",
-      "openai-codex/*",
-      "openrouter/stealth/union-alpha"
-    ],
-    "requireApproval": [
-      "openrouter/*",
-      "google/*",
-      "openai/*",
-      "xai/*"
-    ],
-    "deny": []
-  },
-  "remote": {
-    "injectStatus": true,
-    "defaults": {
-      "cpuBlockPercent": 90,
-      "gpuBlockPercent": 90,
-      "gpuMemoryBlockPercent": 90,
-      "memoryBlockPercent": 90,
-      "minimumFreeDiskGB": 10,
-      "statusCacheSeconds": 30,
-      "retentionHours": 24
-    },
-    "workers": [
-      {
-        "name": "mac-mini",
-        "ssh": "mac-mini",
-        "root": "~/remote_tests",
-        "nice": 10,
-        "tags": [
-          "macos",
-          "arm64",
-          "gpu",
-          "metal"
-        ]
-      },
-      {
-        "name": "hyperion",
-        "ssh": "hyperion",
-        "root": "~/remote_tests",
-        "nice": 10,
-        "tags": [
-          "linux",
-          "x64",
-          "gpu",
-          "cuda"
-        ]
-      }
-    ]
-  }
-}

package/images/pi-plus.svg

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 800">
-  <!-- Original Pi logo paths, unchanged -->
-  <path fill="#F09082" d="M165.29 165.29H517.36V400H400V282.65H165.29Z"/>
-  <path fill="#4D9ABF" d="M165.29 282.65H282.65V400H400V517.36H282.65V634.72H165.29Z"/>
-  <path fill="#F1BE58" d="M517.36 400H634.72V634.72H517.36Z"/>
-
-  <!-- Plus mark, matching the logo's square/pixel geometry -->
-  <path fill="#F09082" d="M697.84 223.97H736.96V263.09H776.08V302.21H736.96V341.33H697.84V302.21H658.72V263.09H697.84Z"/>
-</svg>

package/src/core/anthropic/vendor/README.md

@@ -1,36 +0,0 @@
-# Vendored: xxhash-wasm
-
-`xxhash-wasm.js` is the ESM build of [xxhash-wasm](https://github.com/jungomi/xxhash-wasm),
-MIT licensed (see `xxhash-wasm.LICENSE.md`), copied in verbatim.
-
-## Why vendored rather than depended on
-
-The billing checksum in `../client-identity.ts` needs xxHash64. Two things were
-tried before this:
-
-1. **A hand-written BigInt implementation.** It produced correct values for
-   empty and very short inputs and wrong values for everything longer. Four
-   separate bugs were found and fixed, each time with the output still wrong.
-   Guessing further at a hash function was not converging.
-2. **`xxhash-wasm` as an npm dependency.** Rejected: the point of the extraction
-   is that no unaudited package sits in the auth path.
-
-Vendoring gets both: the algorithm is known-correct, and the code lives in this
-repository with no install-time dependency.
-
-## What this is
-
-A single self-contained ~11 KB `.js` file with the compiled WebAssembly inlined
-as a byte array. It is not fetched, built, or downloaded at runtime. The only
-import is the file itself.
-
-## Regenerating
-
-```sh
-npm pack xxhash-wasm@<version>
-tar -xzf xxhash-wasm-*.tgz
-cp package/esm/xxhash-wasm.js src/core/anthropic/vendor/
-```
-
-Record the version when you do. The current copy came from `xxhash-wasm` as
-installed by pi's own tree on 2026-09-19.

package/src/vendor/anthropic.ts

@@ -1,109 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-
-/**
- * The single import point for `@cortexkit/anthropic-auth-core`.
- *
- * Nothing else in this repo may reach into the pi-managed npm tree. The old
- * code hardcoded `../npm/node_modules/@cortexkit/...` relative to the
- * extension file, which broke whenever an extension moved directory depth.
- * Resolving from the agent dir at runtime makes placement irrelevant.
- */
-
-function agentDir(): string {
-  return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
-}
-
-function coreEntry(): string {
-  return pathToFileURL(
-    join(agentDir(), "npm", "node_modules", "@cortexkit", "anthropic-auth-core", "dist", "index.js"),
-  ).href;
-}
-
-export interface AnthropicAccount {
-  id: string;
-  label?: string;
-  type: string;
-  enabled?: boolean;
-  access?: string;
-  refresh?: string;
-  expires?: number;
-  addedAt?: number;
-  lastRefreshedAt?: number;
-  authLineageId?: string;
-}
-
-export interface AccountStorage {
-  accounts: AnthropicAccount[];
-}
-
-interface AnthropicCore {
-  addAccountPersistent(account: AnthropicAccount, path: string): Promise<void>;
-  loadAccounts(path: string): Promise<AccountStorage | undefined>;
-  authorize(mode: string): Promise<{ url: string; verifier: string; redirectUri: string; state: string }>;
-  exchange(
-    callback: string,
-    verifier: string,
-    redirectUri: string,
-    state: string,
-  ): Promise<{ type: string; access: string; refresh: string; expires: number }>;
-  refreshClaudeOAuthToken(options: {
-    refreshToken: string;
-    maxRetries?: number;
-    fetchImpl?: typeof fetch;
-  }): Promise<{ access: string; refresh: string; expires: number }>;
-  getRoutingMode(storage: unknown): string;
-  setRoutingMode(mode: string, path: string): Promise<unknown>;
-}
-
-let cached: Promise<AnthropicCore> | undefined;
-
-/** Lazily loads and memoizes the vendor core module. */
-export function core(): Promise<AnthropicCore> {
-  cached ??= import(coreEntry()).then((module) => module as unknown as AnthropicCore).catch((error) => {
-    cached = undefined;
-    throw new Error(
-      `@cortexkit/anthropic-auth-core is unavailable (${error instanceof Error ? error.message : String(error)}). `
-      + "Reinstall with: pi package add @cortexkit/pi-anthropic-auth",
-    );
-  });
-  return cached;
-}
-
-/** Where the multi-account OAuth store lives. */
-export function accountStoragePath(): string {
-  return process.env.PI_ANTHROPIC_AUTH_FILE ?? join(agentDir(), "anthropic-auth.json");
-}
-
-export async function loadAccounts(): Promise<AccountStorage | undefined> {
-  return (await core()).loadAccounts(accountStoragePath());
-}
-
-export async function saveAccount(account: AnthropicAccount): Promise<void> {
-  return (await core()).addAccountPersistent(account, accountStoragePath());
-}
-
-export async function refreshToken(
-  refreshTokenValue: string,
-  options: { maxRetries?: number; timeoutMs?: number } = {},
-): Promise<{ access: string; refresh: string; expires: number }> {
-  const { refreshClaudeOAuthToken } = await core();
-  return refreshClaudeOAuthToken({
-    refreshToken: refreshTokenValue,
-    maxRetries: options.maxRetries,
-    fetchImpl: options.timeoutMs
-      ? (input, init) => fetch(input, { ...init, signal: AbortSignal.timeout(options.timeoutMs!) })
-      : undefined,
-  });
-}
-
-export async function routingMode(): Promise<string> {
-  const { getRoutingMode } = await core();
-  return getRoutingMode(await loadAccounts());
-}
-
-export async function setRoutingMode(mode: "sticky-balanced" | "main-first"): Promise<string> {
-  const { setRoutingMode: apply, getRoutingMode } = await core();
-  return getRoutingMode(await apply(mode, accountStoragePath()));
-}