@meetopenbot/pi 0.0.3 → 0.1.0

package/README.md

@@ -22,13 +22,21 @@ plugins:
       tools: read,bash,edit,write,grep,find,ls
 ```
 
+## Auth
+
+On cloud, `authMode: credits` (the default) uses your workspace credit balance via OpenBot for `openai`, `anthropic`, and `deepseek`. For BYOK, set `authMode: byok` and add the matching provider key under workspace settings (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `DEEPSEEK_API_KEY`, or `GEMINI_API_KEY`).
+
+Locally, Pi always uses BYOK from environment variables or `~/.pi/agent/auth.json`.
+
+Credits does not cover Google Gemini — Pi uses Gemini's native API, while OpenBot Credits proxies the OpenAI-compatible Gemini surface. Use openai/anthropic/deepseek on credits, or switch to BYOK for Gemini.
+
 ## Configuration
 
 | Option | Description |
 |--------|-------------|
-| `cwd` | Working directory for Pi tools and resource discovery. Defaults to the OpenBot channel `cwd`, then `process.cwd()`. |
+| `authMode` | Cloud only: `credits` (default) or `byok`. |
 | `agentDir` | Pi config directory (credentials, settings, sessions). Default: `~/.pi/agent`. |
-| `provider` | Model provider (e.g. `anthropic`, `openai`). |
+| `provider` | Model provider (e.g. `anthropic`, `openai`, `deepseek`). |
 | `model` | Model id (e.g. `claude-opus-4-5`). |
 | `thinkingLevel` | Extended thinking: `off`, `minimal`, `low`, `medium`, `high`, `xhigh`. |
 | `tools` | Comma-separated built-in tools to enable. |
@@ -36,13 +44,7 @@ plugins:
 | `noTools` | `all` or `builtin` to disable tools. |
 | `systemPrompt` | Override Pi's system prompt for this agent. |
 
-## API Keys
-
-Pi resolves credentials via `AuthStorage` (see [Pi SDK docs](https://pi.dev/docs/latest/sdk)):
-
-1. Runtime overrides
-2. `~/.pi/agent/auth.json`
-3. Environment variables (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, etc.)
+Working directory always comes from the OpenBot channel `cwd`.
 
 ## Sessions
 

package/dist/cloud-mode.js

@@ -0,0 +1,10 @@
+/** True when this runtime is a platform-managed cloud deployment. */
+export const isCloudMode = () => process.env.OPENBOT_CLOUD_MODE === '1';
+/** Default auth mode: Credits on cloud, BYOK locally. */
+export const defaultAuthMode = () => (isCloudMode() ? 'credits' : 'byok');
+export function resolveAuthMode(config) {
+    if (config.authMode === 'byok' || config.authMode === 'credits') {
+        return config.authMode;
+    }
+    return defaultAuthMode();
+}

package/dist/config.js

@@ -1,3 +1,4 @@
+import { resolveAuthMode } from './cloud-mode.js';
 const THINKING_LEVELS = new Set([
     'off',
     'minimal',
@@ -8,19 +9,21 @@ const THINKING_LEVELS = new Set([
 ]);
 export const resolveConfig = (context, channelCwd) => {
     const config = context.config;
-    const thinkingLevel = config.thinkingLevel && THINKING_LEVELS.has(config.thinkingLevel)
+    const thinkingLevel = typeof config.thinkingLevel === 'string' && THINKING_LEVELS.has(config.thinkingLevel)
         ? config.thinkingLevel
         : undefined;
+    const asString = (value) => typeof value === 'string' && value.trim() ? value.trim() : undefined;
     return {
-        cwd: channelCwd || config.cwd,
-        agentDir: config.agentDir,
-        provider: config.provider?.trim() || undefined,
-        model: config.model?.trim() || undefined,
+        cwd: channelCwd || process.cwd(),
+        agentDir: asString(config.agentDir),
+        provider: asString(config.provider),
+        model: asString(config.model),
         thinkingLevel,
-        tools: config.tools?.trim() || undefined,
-        excludeTools: config.excludeTools?.trim() || undefined,
-        noTools: config.noTools,
-        systemPrompt: config.systemPrompt?.trim() || undefined,
+        tools: asString(config.tools),
+        excludeTools: asString(config.excludeTools),
+        noTools: config.noTools === 'all' || config.noTools === 'builtin' ? config.noTools : undefined,
+        systemPrompt: asString(config.systemPrompt),
+        authMode: resolveAuthMode(config),
     };
 };
 export const parseToolList = (value) => {

package/dist/credits-auth.js

@@ -0,0 +1,90 @@
+export const INTEGRATIONS_TOKEN_HEADER = 'x-openbot-integrations-token';
+export const CREDITS_API_KEY_PLACEHOLDER = 'openbot-credits';
+/**
+ * Gateway paths matching each Pi provider's default base URL shape:
+ * - openai models use `https://api.openai.com/v1`
+ * - anthropic models use `https://api.anthropic.com` (SDK appends `/v1`)
+ * - deepseek is OpenAI-compat; `/v1` keeps metering on `/v1/chat/completions`
+ *
+ * Google Gemini is omitted: Pi speaks the native Generative Language API, while
+ * the credits gateway only proxies Gemini's OpenAI-compatible surface.
+ */
+export const CREDITS_PROVIDERS = [
+    { id: 'openai', basePath: 'openai/v1', envVar: 'OPENAI_API_KEY' },
+    { id: 'anthropic', basePath: 'anthropic', envVar: 'ANTHROPIC_API_KEY' },
+    { id: 'deepseek', basePath: 'deepseek/v1', envVar: 'DEEPSEEK_API_KEY' },
+];
+const CREDITS_PROVIDER_IDS = new Set(CREDITS_PROVIDERS.map((provider) => provider.id));
+export function isCreditsProvider(provider) {
+    return CREDITS_PROVIDER_IDS.has(provider);
+}
+/** Cloud host injects these when routing LLM calls through OpenBot Credits. */
+export function resolveCreditsAuthConfig() {
+    const baseUrl = process.env.OPENBOT_INTEGRATIONS_BASE_URL?.trim();
+    const token = process.env.OPENBOT_INTEGRATIONS_TOKEN?.trim();
+    if (!baseUrl || !token)
+        return undefined;
+    return { baseUrl: baseUrl.replace(/\/$/, ''), token };
+}
+export function creditsProviderBaseUrl(config, provider) {
+    const match = CREDITS_PROVIDERS.find((entry) => entry.id === provider);
+    if (!match) {
+        throw new Error(`Unsupported credits provider: ${provider}`);
+    }
+    return `${config.baseUrl}/${match.basePath}`;
+}
+export function applyCreditsProviders(modelRegistry, authStorage, config) {
+    const apiKey = config.token || CREDITS_API_KEY_PLACEHOLDER;
+    const headers = { [INTEGRATIONS_TOKEN_HEADER]: config.token };
+    for (const provider of CREDITS_PROVIDERS) {
+        modelRegistry.registerProvider(provider.id, {
+            baseUrl: creditsProviderBaseUrl(config, provider.id),
+            headers,
+        });
+        authStorage.setRuntimeApiKey(provider.id, apiKey);
+    }
+}
+export function isCreditsErrorMessage(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes('insufficient_credits') ||
+        lower.includes('insufficient credits') ||
+        lower.includes('402'));
+}
+export function isAuthErrorMessage(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes('api key') ||
+        lower.includes('apikey') ||
+        lower.includes('401') ||
+        lower.includes('unauthorized') ||
+        lower.includes('authentication') ||
+        lower.includes('not logged in') ||
+        lower.includes('login'));
+}
+export function isIntegrationsProviderError(message) {
+    const lower = message.toLowerCase();
+    return (lower.includes('provider api key not configured') ||
+        (lower.includes('503') && lower.includes('provider')));
+}
+export const CREDITS_NOT_CONFIGURED_MESSAGE = 'OpenBot Credits is not configured on this runtime. The cloud host must set OPENBOT_INTEGRATIONS_BASE_URL and OPENBOT_INTEGRATIONS_TOKEN (try redeploying the workspace).';
+export const CREDITS_PROVIDER_UNAVAILABLE_MESSAGE = 'OpenBot Credits could not reach the model provider — the platform provider API key is not configured yet. Try again later or switch this agent to BYOK mode.';
+export const CREDITS_AUTH_FAILED_MESSAGE = 'Pi could not authenticate via OpenBot Credits. Check your workspace credit balance in settings, or switch this agent to BYOK mode.';
+export function creditsErrorMessage(message) {
+    if (isIntegrationsProviderError(message)) {
+        return CREDITS_PROVIDER_UNAVAILABLE_MESSAGE;
+    }
+    if (isCreditsErrorMessage(message)) {
+        return 'Insufficient workspace credits. Add credits in workspace settings or switch this agent to BYOK mode.';
+    }
+    if (isAuthErrorMessage(message))
+        return CREDITS_AUTH_FAILED_MESSAGE;
+    return undefined;
+}
+export function remapPiError(message, authMode) {
+    if (authMode !== 'credits')
+        return message;
+    return creditsErrorMessage(message) ?? message;
+}
+export function unsupportedCreditsProviderMessage(provider) {
+    return (`OpenBot Credits does not support the "${provider}" provider. ` +
+        'Use openai, anthropic, or deepseek, or switch this agent to BYOK mode.');
+}

package/dist/index.js

@@ -1,8 +1,64 @@
 import { agentOutput, buildDiffWidget, definePlugin, diffFileFromMutationTool, resolveRunDiffFiles, shouldHandleInvoke, snapshotWorkspace, toolTraceWidget, uiWidget, } from '@meetopenbot/plugin-sdk';
+import { isCloudMode } from './cloud-mode.js';
 import { resolveConfig } from './config.js';
+import { isAuthErrorMessage, remapPiError, } from './credits-auth.js';
 import { formatPiError, formatToolResult } from './format.js';
-import { getOrCreatePiSession } from './session.js';
+import { disposePiSessionsForThread, getOrCreatePiSession } from './session.js';
 import { streamPiPrompt } from './stream.js';
+const BYOK_PROVIDERS = {
+    anthropic: {
+        envVar: 'ANTHROPIC_API_KEY',
+        label: 'Anthropic',
+        placeholder: 'sk-ant-...',
+    },
+    openai: {
+        envVar: 'OPENAI_API_KEY',
+        label: 'OpenAI',
+        placeholder: 'sk-...',
+    },
+    deepseek: {
+        envVar: 'DEEPSEEK_API_KEY',
+        label: 'DeepSeek',
+        placeholder: 'sk-...',
+    },
+    google: {
+        envVar: 'GEMINI_API_KEY',
+        label: 'Google Gemini',
+        placeholder: 'AIza...',
+    },
+};
+const resolveByokProvider = (provider) => BYOK_PROVIDERS[provider ?? ''] ?? BYOK_PROVIDERS.openai;
+const buildApiKeyWidget = (agentId, threadId, reason, provider) => {
+    const byok = resolveByokProvider(provider);
+    return uiWidget({
+        agentId,
+        threadId,
+        widget: {
+            kind: 'form',
+            widgetId: `pi_api_key_request_${Date.now()}`,
+            title: `${byok.label} API Key Required`,
+            description: `Pi could not authenticate (${reason}). ` +
+                `Provide a ${byok.label} API key to continue. ` +
+                'The key is stored as a workspace variable on your machine and never leaves your local runtime.',
+            fields: [
+                {
+                    id: 'apiKey',
+                    label: 'API Key',
+                    type: 'password',
+                    placeholder: byok.placeholder,
+                    required: true,
+                },
+            ],
+            submitLabel: 'Save API Key',
+            metadata: {
+                type: 'api_key_request',
+                provider: provider && BYOK_PROVIDERS[provider] ? provider : 'openai',
+                envVar: byok.envVar,
+                source: 'pi',
+            },
+        },
+    });
+};
 export default definePlugin({
     id: 'pi',
     name: 'Pi',
@@ -10,17 +66,23 @@ export default definePlugin({
     configSchema: {
         type: 'object',
         properties: {
-            cwd: {
-                type: 'string',
-                description: 'Working directory for Pi tools and resource discovery.',
-            },
+            ...(isCloudMode()
+                ? {
+                    authMode: {
+                        type: 'string',
+                        description: 'Credits — use your workspace credit balance via OpenBot. BYOK — bring your own provider API key.',
+                        enum: ['credits', 'byok'],
+                        default: 'credits',
+                    },
+                }
+                : {}),
             agentDir: {
                 type: 'string',
                 description: 'Pi config directory (default: ~/.pi/agent).',
             },
             provider: {
                 type: 'string',
-                description: 'Model provider (e.g. anthropic, openai).',
+                description: 'Model provider (e.g. anthropic, openai, deepseek).',
             },
             model: {
                 type: 'string',
@@ -67,6 +129,17 @@ export default definePlugin({
             }
             const channelCwd = handlerCtx.state.channelDetails?.cwd;
             const config = resolveConfig(context, channelCwd);
+            const fail = function* (message) {
+                const mapped = remapPiError(message, config.authMode);
+                if (config.authMode === 'byok' && isAuthErrorMessage(message)) {
+                    yield buildApiKeyWidget(context.agentId, threadId, mapped, config.provider);
+                }
+                yield agentOutput({
+                    agentId: context.agentId,
+                    content: `**Pi error:** ${mapped}`,
+                    threadId,
+                });
+            };
             try {
                 const { session } = await getOrCreatePiSession({
                     config,
@@ -137,11 +210,15 @@ export default definePlugin({
                                 }),
                             });
                             break;
-                        case 'text':
+                        case 'text': {
+                            const content = chunk.content.startsWith('**Pi error:** ')
+                                ? `**Pi error:** ${remapPiError(chunk.content.slice('**Pi error:** '.length), config.authMode)}`
+                                : chunk.content;
                             if (fullTextContent)
                                 fullTextContent += '\n\n';
-                            fullTextContent += chunk.content;
+                            fullTextContent += content;
                             break;
+                        }
                     }
                 }
                 if (fullTextContent.trim()) {
@@ -167,10 +244,54 @@ export default definePlugin({
                 }
             }
             catch (error) {
+                yield* fail(formatPiError(error));
+            }
+        });
+        builder.on('client:ui:widget:response', async function* (event, handlerCtx) {
+            const { metadata, values, widgetId } = event.data ?? {};
+            if (!metadata || metadata.type !== 'api_key_request')
+                return;
+            if (metadata.source !== 'pi')
+                return;
+            const apiKey = values?.apiKey;
+            if (typeof apiKey !== 'string' || !apiKey)
+                return;
+            const envVar = typeof metadata.envVar === 'string' ? metadata.envVar : 'OPENAI_API_KEY';
+            const storage = context.storage;
+            if (!storage) {
+                yield agentOutput({
+                    agentId: context.agentId,
+                    content: '[pi] no storage available; cannot persist API key.',
+                    threadId: handlerCtx.state.threadId,
+                });
+                return;
+            }
+            try {
+                await storage.createVariable({ key: envVar, value: apiKey, secret: true });
+                process.env[envVar] = apiKey;
+                disposePiSessionsForThread(handlerCtx.state);
+                yield uiWidget({
+                    agentId: context.agentId,
+                    widget: {
+                        widgetId: widgetId ?? `pi_api_key_saved_${Date.now()}`,
+                        kind: 'message',
+                        title: 'API Key Saved',
+                        body: `Saved ${envVar} as a workspace variable. You can now continue the conversation.`,
+                        state: 'submitted',
+                    },
+                });
+                yield agentOutput({
+                    agentId: context.agentId,
+                    content: `Saved ${envVar} to workspace variables. Re-send your last message to retry.`,
+                    threadId: handlerCtx.state.threadId,
+                });
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
                 yield agentOutput({
                     agentId: context.agentId,
-                    content: `**Pi error:** ${formatPiError(error)}`,
-                    threadId,
+                    content: `[pi] failed to save API key: ${errorMessage}`,
+                    threadId: handlerCtx.state.threadId,
                 });
             }
         });

package/dist/session.js

@@ -1,8 +1,12 @@
 import { AuthStorage, createAgentSession, DefaultResourceLoader, getAgentDir, ModelRegistry, SessionManager, SettingsManager, } from '@earendil-works/pi-coding-agent';
 import { parseToolList } from './config.js';
+import { applyCreditsProviders, CREDITS_NOT_CONFIGURED_MESSAGE, isCreditsProvider, resolveCreditsAuthConfig, unsupportedCreditsProviderMessage, } from './credits-auth.js';
 import { persistPiState, readPersistedState } from './state.js';
 const sessionCache = new Map();
-const buildSessionKey = (state) => state.threadId ? `${state.channelId}:${state.threadId}` : state.channelId;
+const buildSessionKey = (state, config) => {
+    const scope = state.threadId ? `${state.channelId}:${state.threadId}` : state.channelId;
+    return `${scope}:${config.authMode}`;
+};
 const resolveModel = async (config, modelRegistry) => {
     if (config.provider && config.model) {
         return modelRegistry.find(config.provider, config.model) ?? undefined;
@@ -12,24 +16,32 @@ const resolveModel = async (config, modelRegistry) => {
 };
 export const getOrCreatePiSession = async (args) => {
     const { config, state, storage } = args;
-    const sessionKey = buildSessionKey(state);
+    const sessionKey = buildSessionKey(state, config);
     const cached = sessionCache.get(sessionKey);
     if (cached)
         return cached;
+    if (config.authMode === 'credits' && config.provider && !isCreditsProvider(config.provider)) {
+        throw new Error(unsupportedCreditsProviderMessage(config.provider));
+    }
     const cwd = config.cwd || process.cwd();
     const agentDir = config.agentDir || getAgentDir();
     const persisted = readPersistedState(state);
     const authStorage = AuthStorage.create(`${agentDir}/auth.json`);
     const modelRegistry = ModelRegistry.create(authStorage, `${agentDir}/models.json`);
+    if (config.authMode === 'credits') {
+        const credits = resolveCreditsAuthConfig();
+        if (!credits) {
+            throw new Error(CREDITS_NOT_CONFIGURED_MESSAGE);
+        }
+        applyCreditsProviders(modelRegistry, authStorage, credits);
+    }
     const model = await resolveModel(config, modelRegistry);
     const settingsManager = SettingsManager.create(cwd, agentDir);
     const loader = new DefaultResourceLoader({
         cwd,
         agentDir,
         settingsManager,
-        ...(config.systemPrompt
-            ? { systemPromptOverride: () => config.systemPrompt }
-            : {}),
+        ...(config.systemPrompt ? { systemPromptOverride: () => config.systemPrompt } : {}),
     });
     await loader.reload();
     const sessionManager = persisted.sessionFile
@@ -66,3 +78,10 @@ export const disposePiSession = (sessionKey) => {
     cached.session.dispose();
     sessionCache.delete(sessionKey);
 };
+export const disposePiSessionsForThread = (state) => {
+    const prefix = state.threadId ? `${state.channelId}:${state.threadId}:` : `${state.channelId}:`;
+    for (const key of sessionCache.keys()) {
+        if (key.startsWith(prefix))
+            disposePiSession(key);
+    }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meetopenbot/pi",
-  "version": "0.0.3",
+  "version": "0.1.0",
   "description": "OpenBot agent plugin powered by the Pi coding agent SDK.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json && node ../../scripts/write-plugin-declaration.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "node --experimental-strip-types --test src/diff.test.ts",
+    "test": "node --experimental-strip-types --test src/*.test.ts",
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
   }
 }