@nmzpy/pi-ember-stack 0.1.1 → 0.1.2

package/ATTRIBUTION.md

@@ -1,9 +1,14 @@
 # Attribution
 
-`src/subagent/extensions/` and the upstream bundled agent files were vendored
+`plugins/subagent/extensions/` and the upstream bundled agent files were vendored
 from `@bacnh85/pi-subagent` version `0.5.0`.
 
 The upstream package declares the MIT license. The vendored subtree retains
-that license in `src/subagent/LICENSE`, along with the original README, agent
+that license in `plugins/subagent/LICENSE`, along with the original README, agent
 format documentation, bundled roles, package version, and attribution.
 Upstream project: <https://github.com/bacnh85/pi-extensions>.
+
+`plugins/devin-auth/` was vendored from `pi-devin-auth` version `0.1.2`,
+maintained by `nmzpy`. Its original MIT license and documentation are retained
+in that plugin directory. Upstream project:
+<https://github.com/nmzpy/pi-devin-auth>.

package/README.md

@@ -1,69 +1,90 @@
-# pi-ember-stack
-
-The Ember-owned pi package. It installs the complete Ember agent workflow as
-one package:
-
-- Primary modes: `/coder`, `/architect`, `/doctor`, `/orchestrator`, and
-  `/ui-doctor`.
-- Inline `questionnaire` UI for decision-oriented questions. Agents are told to
-  prefer it when they need a user choice.
-- A compact native `edit` renderer that shows the filename and a single
-  `+N / -N` result row.
-- Vendored subagent support with bundled `coder` and `architect` definitions,
-  plus the upstream bundled roles.
-- A self-contained `Ctrl+Space` mode-cycle shortcut and a footer showing the
-  active mode, model, and thinking variant.
-
-## Project setup
-
-The Ember repository contains a project-local `.pi/settings.json` entry for:
-
-```json
-"npm:@nmzpy/pi-ember-stack@0.1.0"
-```
-
-On a new clone, start pi from the project directory. Pi will ask for a
-one-time project trust decision before it installs the package into the
-project-local `.pi/npm/` directory. The same decision can be approved
-non-interactively with:
-
-```text
-pi --approve
-```
-
-Project trust is intentionally a user decision; a repository cannot safely
-bypass it. After trust, normal startup is just `pi` from the Ember directory.
-
-When a new version is intentionally released, update the pinned version in
-the project settings and run:
-
-```text
-pi update --extensions
-```
-
-Third-party utilities such as pi-fff, image paste, and Devin authentication
-remain separate package entries. Credentials and provider secrets stay in the
-machine-local pi configuration and are not part of this repository.
-
-## Development
-
-The package entrypoint is `src/pi-ember-stack.ts`. The vendored subagent
-entrypoint is `src/subagent/extensions/index.ts`; all bundled agent files are
-under `src/subagent/agents/`.
-
-Run the package typecheck with:
-
-```text
-npm install
-npm run typecheck
-```
-
-## Release
-
-Run `./gacp.sh --release` to bump the patch version, typecheck, commit, tag,
-push, and publish the package to npm. This only publishes the package; update
-Ember's pinned package version separately when you want the project to install it.
-
-The package is cross-platform: bundled paths are resolved from `import.meta.url`
-and do not depend on a Windows home directory or the current working
-directory.
+# pi-ember-stack
+
+The Ember-owned pi package. It installs the complete Ember agent workflow as
+one package:
+
+- Primary modes: `/coder`, `/architect`, `/doctor`, `/orchestrator`, and
+  `/ui-doctor`.
+- Inline `questionnaire` UI for decision-oriented questions. Agents are told to
+  prefer it when they need a user choice.
+- A compact native `edit` renderer that shows the filename and a single
+  `+N / -N` result row.
+- Vendored subagent support with bundled `coder` and `architect` definitions,
+  plus the upstream bundled roles.
+- Bundled Devin auth/provider support, including OAuth, model catalog refresh,
+  and streaming transport.
+- A self-contained `Ctrl+Space` mode-cycle shortcut and a footer showing the
+  active mode, model, and thinking variant.
+
+## Plugin registry
+
+The package has one top-level pi extension which dispatches to the internal
+plugins under `plugins/`. Ember projects enable them in `.pi/ember-stack.json`:
+
+```json
+{
+  "plugins": ["ember", "subagent", "devin-auth"]
+}
+```
+
+Remove a plugin ID to disable it, or use `/stack-plugins` to toggle one from
+the TUI. Restart pi after changing the list. The available plugins are:
+
+- `ember`: modes, questionnaire, footer, and compact edit rendering.
+- `subagent`: bundled subagent tool and agent definitions.
+- `devin-auth`: Devin provider, OAuth, catalog refresh, and streaming.
+
+## Project setup
+
+The Ember repository contains a project-local `.pi/settings.json` entry for:
+
+```json
+"npm:@nmzpy/pi-ember-stack@0.1.2"
+```
+
+On a new clone, start pi from the project directory. Pi will ask for a
+one-time project trust decision before it installs the package into the
+project-local `.pi/npm/` directory. The same decision can be approved
+non-interactively with:
+
+```text
+pi --approve
+```
+
+Project trust is intentionally a user decision; a repository cannot safely
+bypass it. After trust, normal startup is just `pi` from the Ember directory.
+
+When a new version is intentionally released, update the pinned version in
+the project settings and run:
+
+```text
+pi update --extensions
+```
+
+Third-party utilities such as pi-fff and image paste remain separate package
+entries. Devin auth is now bundled as a stack plugin, but credentials and
+provider secrets stay in the machine-local pi configuration and are not part
+of this repository.
+
+## Development
+
+The package entrypoint is `plugins/index.ts`. Ember functionality is under
+`plugins/ember/`, subagents and bundled agents are under `plugins/subagent/`,
+and Devin auth is under `plugins/devin-auth/`.
+
+Run the package typecheck with:
+
+```text
+npm install
+npm run typecheck
+```
+
+## Release
+
+Run `./gacp.sh --release` to bump the patch version, typecheck, commit, tag,
+push, and publish the package to npm. This only publishes the package; update
+Ember's pinned package version separately when you want the project to install it.
+
+The package is cross-platform: bundled paths are resolved from `import.meta.url`
+and do not depend on a Windows home directory or the current working
+directory.

package/package.json

@@ -1,50 +1,49 @@
-{
-  "name": "@nmzpy/pi-ember-stack",
-  "version": "0.1.1",
-  "description": "Ember's primary modes, questionnaire UI, compact edit renderer, and subagents for pi",
-  "type": "module",
-  "license": "MIT",
-  "keywords": [
-    "pi-package",
-    "pi-extension",
-    "ember"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/nmzpy/pi-ember-stack.git"
-  },
-  "bugs": {
-    "url": "https://github.com/nmzpy/pi-ember-stack/issues"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit"
-  },
-  "files": [
-    "README.md",
-    "ATTRIBUTION.md",
-    "tsconfig.json",
-    "src"
-  ],
-  "pi": {
-    "extensions": [
-      "./src/pi-ember-stack.ts",
-      "./src/subagent/extensions/index.ts"
-    ]
-  },
-  "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-agent-core": "*",
-    "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*",
-    "typebox": "*"
-  },
-  "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.6",
-    "@earendil-works/pi-agent-core": "^0.80.6",
-    "@earendil-works/pi-coding-agent": "^0.80.6",
-    "@earendil-works/pi-tui": "^0.80.6",
-    "@types/node": "^20.19.43",
-    "typebox": "^1.3.1",
-    "typescript": "^5.9.3"
-  }
-}
+{
+  "name": "@nmzpy/pi-ember-stack",
+  "version": "0.1.2",
+  "description": "Ember's configurable pi plugin stack with modes, questionnaire, compact edits, subagents, and Devin auth",
+  "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "pi-package",
+    "pi-extension",
+    "ember"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nmzpy/pi-ember-stack.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nmzpy/pi-ember-stack/issues"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "files": [
+    "README.md",
+    "ATTRIBUTION.md",
+    "tsconfig.json",
+    "plugins"
+  ],
+  "pi": {
+    "extensions": [
+      "./plugins/index.ts"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-agent-core": "*",
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "^0.80.6",
+    "@earendil-works/pi-agent-core": "^0.80.6",
+    "@earendil-works/pi-coding-agent": "^0.80.6",
+    "@earendil-works/pi-tui": "^0.80.6",
+    "@types/node": "^20.19.43",
+    "typebox": "^1.3.1",
+    "typescript": "^5.9.3"
+  }
+}

package/plugins/devin-auth/AGENTS.md

@@ -0,0 +1,63 @@
+# AGENTS.md — pi-devin-auth
+
+## Overview
+
+A [pi](https://pi.dev) coding agent extension that registers the `devin` provider (Cognition / Windsurf) with OAuth login and native streaming. Reuses the cloud-direct gRPC layer from `opencode-windsurf-auth`.
+
+## Architecture
+
+```
+extensions/index.ts          # pi extension entry — registerProvider("devin", { oauth, streamSimple, models })
+src/oauth/
+  login.ts                   # ADAPTED — pi OAuthLoginCallbacks (manual-paste flow)
+  register-user.ts           # COPIED verbatim — RegisterUser RPC at register.windsurf.com
+  types.ts                   # COPIED verbatim — WindsurfRegion, DEFAULT_REGION
+src/cloud-direct/            # COPIED verbatim — gRPC to server.codeium.com
+  auth.ts                    #   GetUserJwt (short-lived JWT mint + in-memory cache)
+  chat.ts                    #   GetChatMessage streaming (Connect-RPC + manual protobuf)
+  catalog.ts                 #   GetCascadeModelConfigs (per-account model catalog)
+  metadata.ts                #   Metadata proto builder
+  wire.ts                    #   Protobuf + Connect-streaming envelope helpers
+  index.ts                   #   Public re-exports
+src/context-map.ts           # NEW — pi Message[]/Tool[] -> ChatHistoryItem[]/ToolDef[]
+src/stream.ts                # NEW — streamDevin: streamSimple impl (CloudChatEvent -> pi events)
+src/models.ts                # NEW — dynamic catalog -> ProviderModelConfig[] + fallback
+```
+
+## Build & Test
+
+```bash
+npm install          # install deps
+npx tsc --noEmit     # typecheck
+npm test             # run unit tests (bun test or node --test)
+```
+
+pi loads extensions via jiti (no build step needed for runtime use).
+
+## Key Design Decisions
+
+1. **Native streamSimple** (Option B): No background proxy. `streamDevin()` calls `streamChatEvents()` directly and emits pi's `AssistantMessageEventStream` events.
+2. **Manual-paste OAuth**: pi's `OAuthLoginCallbacks` doesn't support loopback servers. We use `redirect_uri=show-auth-token` so the Windsurf SPA renders the token for the user to paste via `callbacks.onPrompt()`.
+3. **Non-expiring token shape**: Windsurf's `RegisterUser` returns a long-lived `api_key` with no refresh token. We set `OAuthCredentials = { refresh: "", access: apiKey, expires: now + 365 days }`. `refreshToken()` is a no-op.
+4. **Dynamic model catalog**: Fetched from `GetCascadeModelConfigs` via `oauth.modifyModels()` after login. Static fallback for offline.
+5. **In-memory JWT cache only**: No disk persistence for the short-lived `user_jwt`. Re-mint cost (~200ms) is negligible.
+
+## Token Shapes
+
+- **firebaseIdToken**: Short-lived JWT from Auth0 browser sign-in. Exchanged via RegisterUser, then discarded.
+- **api_key**: Long-lived credential from RegisterUser. Format: `devin-session-token$<JWT>`. Used as `Metadata.api_key` in every gRPC call. Stored by pi in `~/.pi/agent/auth.json`.
+- **user_jwt**: Short-lived (~24 min) JWT minted from `GetUserJwt`. Cached in-memory per (apiKey, host). Required alongside api_key for chat RPCs.
+
+## Cloud-Direct gRPC
+
+All RPCs hit `https://server.codeium.com` over HTTPS with Connect-RPC framing:
+- `GetUserJwt` — unary, `application/proto`
+- `GetCascadeModelConfigs` — unary, `application/proto`
+- `GetChatMessage` — streaming, `application/connect+proto` (gzip-compressed frames)
+
+Manual protobuf encoding (no protobuf library). Field numbers hardcoded from mitm captures of Windsurf's language_server traffic.
+
+## Related
+
+- [opencode-windsurf-auth](https://github.com/rsvedant/opencode-windsurf-auth) — the opencode plugin this is derived from
+- [pi custom-provider docs](https://pi.dev/docs/latest/custom-provider)

package/plugins/devin-auth/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nmzpy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/plugins/devin-auth/README.md

@@ -0,0 +1,56 @@
+# pi-devin-auth
+
+A [pi](https://pi.dev) coding agent extension that adds the **Devin** (Cognition / Windsurf) provider with browser-based OAuth login and native streaming.
+
+## Installation in pi-ember-stack
+
+This implementation is bundled by `@nmzpy/pi-ember-stack` and enabled through
+the project's `.pi/ember-stack.json` plugin list. Toggle it with `/stack-plugins`
+or remove `devin-auth` from that list, then restart pi.
+
+### Manual / local development
+
+```bash
+pi -e ./extensions/index.ts
+```
+
+Or copy `extensions/index.ts` into `~/.pi/agent/extensions/` for auto-discovery.
+
+## Usage
+
+### Login
+
+```
+/login devin
+```
+
+This opens `https://windsurf.com/windsurf/signin` in your browser. After signing in, the page displays an auth token — paste it into the pi prompt. The extension exchanges it for a long-lived Devin API key via `register.windsurf.com`.
+
+### Select a model
+
+```
+/model devin/swe-1-6
+```
+
+### Logout
+
+```
+/logout devin
+```
+
+## How it works
+
+```
+pi  --login-->  windsurf.com (Auth0)  --token-->  register.windsurf.com (RegisterUser)  --api_key-->  ~/.pi/agent/auth.json
+pi  --chat-->   streamDevin()  -->  cloud-direct/streamChatEvents()  -->  server.codeium.com (GetChatMessage gRPC)  -->  pi events
+```
+
+The extension reuses the battle-tested cloud-direct gRPC layer from [opencode-windsurf-auth](https://github.com/rsvedant/opencode-windsurf-auth) and wraps it in pi's native `streamSimple` + `oauth` extension API.
+
+## Models
+
+Models are fetched dynamically from Cognition's `GetCascadeModelConfigs` RPC after login, so the list always reflects what your account tier can access. A static fallback set is included for offline use.
+
+## License
+
+MIT

package/plugins/devin-auth/extensions/index.ts

@@ -0,0 +1,141 @@
+/**
+ * pi extension entry point for the Devin (Cognition) provider.
+ *
+ * Registers the `devin` provider with pi's ExtensionAPI, wiring up:
+ *  - OAuth login via Windsurf's browser sign-in flow (`loginDevin`)
+ *  - A no-op token refresh (Windsurf api_keys are long-lived)
+ *  - Live model catalog fetch from Cognition's GetCascadeModelConfigs
+ *    after login, filtered to 11 wanted model families
+ *  - `/devin-refresh` command to manually re-fetch the catalog
+ *  - `/devin-status` command to check auth state
+ *  - `session_start` auto-fetch when already logged in
+ *  - Streaming chat completions through Devin Cloud (`streamDevin`)
+ *
+ * The provider uses `streamSimple` — no background proxy. All routing
+ * and auth are handled internally via the OAuth-issued api_key.
+ */
+
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+import type {
+    Api,
+    Model,
+    OAuthCredentials,
+    OAuthLoginCallbacks,
+} from '@earendil-works/pi-ai';
+import { streamDevin } from '../src/stream.js';
+import { loginDevin } from '../src/oauth/login.js';
+import { buildLiveModels, FALLBACK_MODELS, DEFAULT_HOST } from '../src/models.js';
+import { getCachedCatalog, clearCachedCatalog } from '../src/cloud-direct/catalog.js';
+import { DEFAULT_REGION } from '../src/oauth/types.js';
+
+const PROVIDER_ID = 'devin';
+const PROVIDER_NAME = 'Devin (Cognition)';
+const OAUTH_NAME = 'Devin (Cognition / Windsurf)';
+const API_IDENTIFIER = 'devin-cloud';
+// pi requires baseUrl when models are defined, even with streamSimple.
+// streamSimple ignores this — it routes internally — but the field must be present.
+const PLACEHOLDER_BASE_URL = DEFAULT_HOST;
+
+let _pi: ExtensionAPI | null = null;
+
+function registerDevinProvider(pi: ExtensionAPI, models: typeof FALLBACK_MODELS): void {
+    pi.registerProvider(PROVIDER_ID, {
+        name: PROVIDER_NAME,
+        api: API_IDENTIFIER,
+        baseUrl: PLACEHOLDER_BASE_URL,
+        models,
+        oauth: {
+            name: OAUTH_NAME,
+            async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+                const credentials = await loginDevin(callbacks, DEFAULT_REGION);
+                if (_pi) {
+                    try {
+                        clearCachedCatalog();
+                        const catalog = await getCachedCatalog(
+                            credentials.access,
+                            DEFAULT_HOST,
+                        );
+                        const liveModels = buildLiveModels(catalog);
+                        registerDevinProvider(_pi, liveModels);
+                    } catch {
+                        // keep static models if catalog fetch fails
+                    }
+                }
+                return credentials;
+            },
+            async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
+                return credentials;
+            },
+            getApiKey(credentials: OAuthCredentials): string {
+                return credentials.access;
+            },
+            modifyModels(models: Model<Api>[]): Model<Api>[] {
+                return models;
+            },
+        },
+        streamSimple: streamDevin,
+    });
+}
+
+export default async function (pi: ExtensionAPI): Promise<void> {
+    _pi = pi;
+
+    registerDevinProvider(pi, FALLBACK_MODELS);
+
+    pi.on('session_start', async (_event, ctx) => {
+        try {
+            const apiKey = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
+            if (apiKey && _pi) {
+                const catalog = await getCachedCatalog(apiKey, DEFAULT_HOST);
+                const liveModels = buildLiveModels(catalog);
+                registerDevinProvider(_pi, liveModels);
+            }
+        } catch {
+            // keep static models
+        }
+    });
+
+    pi.registerCommand('devin-refresh', {
+        description: 'Refresh Devin model catalog from Cognition',
+        handler: async (_args, ctx) => {
+            const apiKey = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
+            if (!apiKey) {
+                ctx.ui.notify(
+                    'Devin: not signed in. Run /login devin',
+                    'warning',
+                );
+                return;
+            }
+            clearCachedCatalog();
+            try {
+                const catalog = await getCachedCatalog(apiKey, DEFAULT_HOST);
+                const liveModels = buildLiveModels(catalog);
+                registerDevinProvider(pi, liveModels);
+                ctx.ui.notify(
+                    `Devin: refreshed ${liveModels.length} models.`,
+                    'info',
+                );
+            } catch (e) {
+                ctx.ui.notify(
+                    `Devin: refresh error - ${e instanceof Error ? e.message : String(e)}`,
+                    'error',
+                );
+            }
+        },
+    });
+
+    pi.registerCommand('devin-status', {
+        description: 'Show Devin auth status',
+        handler: async (_args, ctx) => {
+            const apiKey = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
+            ctx.ui.notify(
+                apiKey ? 'Devin: authenticated' : 'Devin: not signed in. Run /login devin',
+                apiKey ? 'info' : 'warning',
+            );
+        },
+    });
+
+    pi.on('session_shutdown', async () => {
+        _pi = null;
+    });
+}