@nmzpy/pi-ember-stack 0.1.1 → 0.1.3

package/plugins/devin-auth/src/models.ts

@@ -0,0 +1,236 @@
+/**
+ * Model list for the Devin (Cognition) provider.
+ *
+ * Two paths:
+ *   1. {@link FALLBACK_MODELS} — 11 static entries shown before login or
+ *      when the live catalog fetch fails. Carries real pricing.
+ *   2. {@link buildLiveModels} — filters the live `GetCascadeModelConfigs`
+ *      catalog to the 11 model families we care about, stamping each entry
+ *      with pricing/metadata from {@link MODEL_OVERRIDES}.
+ *
+ * The catalog only carries `modelUid`, `label`, and `disabled` — it does
+ * NOT include context window, max output tokens, reasoning capability, or
+ * pricing. We supply all of those from {@link MODEL_OVERRIDES}, keyed by
+ * prefix so variants (e.g. `claude-opus-4-8-medium`, `gpt-5-6-sol-low`)
+ * inherit the correct metadata from their parent family.
+ */
+
+import type { ProviderModelConfig } from '@earendil-works/pi-coding-agent';
+import type { CacheEntry } from './cloud-direct/index.js';
+
+/** Default Cognition/Codeium host. */
+const DEFAULT_HOST = 'https://server.codeium.com';
+
+/**
+ * Prefixes of the 11 model families we want from the live catalog.
+ * Prefix matching catches variants (e.g. `swe-1-7-lightning`,
+ * `gpt-5-6-sol-low`, `claude-opus-4-8-high`).
+ */
+export const WANTED_PREFIXES: readonly string[] = [
+    'swe-1-7',
+    'gpt-5-6-sol',
+    'gpt-5-6-luna',
+    'gpt-5-6-terra',
+    'claude-opus-4-8',
+    'claude-fable-5',
+    'claude-sonnet-5',
+    'glm-5-2',
+    'kimi-k2-7',
+    'grok-4-5',
+];
+
+function matchesWantedPrefix(uid: string): boolean {
+    for (const prefix of WANTED_PREFIXES) {
+        if (uid === prefix || uid.startsWith(prefix + '-') || uid.startsWith(prefix + '_')) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Per-model metadata + pricing, keyed by prefix.
+ *
+ * All prices are per million tokens (USD). Used by both
+ * {@link FALLBACK_MODELS} and {@link buildLiveModels} so there is a single
+ * source of truth for pricing.
+ */
+interface ModelMeta {
+    contextWindow: number;
+    maxTokens: number;
+    reasoning: boolean;
+    input: ('text' | 'image')[];
+    cost: {
+        input: number;
+        output: number;
+        cacheRead: number;
+        cacheWrite: number;
+    };
+}
+
+const MODEL_META: Map<string, ModelMeta> = new Map([
+    ['swe-1-7', {
+        contextWindow: 256_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    }],
+    ['swe-1-7-lightning', {
+        contextWindow: 256_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 2.50, output: 12.50, cacheRead: 0.25, cacheWrite: 3.13 },
+    }],
+    ['gpt-5-6-sol', {
+        contextWindow: 1_050_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 5.00, output: 30.00, cacheRead: 0.50, cacheWrite: 6.25 },
+    }],
+    ['gpt-5-6-luna', {
+        contextWindow: 1_050_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 1.00, output: 6.00, cacheRead: 0.10, cacheWrite: 1.25 },
+    }],
+    ['gpt-5-6-terra', {
+        contextWindow: 1_050_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 2.50, output: 15.00, cacheRead: 0.25, cacheWrite: 3.13 },
+    }],
+    ['claude-opus-4-8', {
+        contextWindow: 200_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 5.00, output: 25.00, cacheRead: 0.50, cacheWrite: 6.25 },
+    }],
+    ['claude-fable-5', {
+        contextWindow: 1_000_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 10.00, output: 50.00, cacheRead: 1.00, cacheWrite: 12.50 },
+    }],
+    ['claude-sonnet-5', {
+        contextWindow: 200_000,
+        maxTokens: 64_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 3.00, output: 15.00, cacheRead: 0.30, cacheWrite: 3.75 },
+    }],
+    ['glm-5-2', {
+        contextWindow: 1_000_000,
+        maxTokens: 131_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 0.70, output: 2.20, cacheRead: 0.26, cacheWrite: 0.88 },
+    }],
+    ['kimi-k2-7', {
+        contextWindow: 256_000,
+        maxTokens: 256_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 0.95, output: 4.00, cacheRead: 0.19, cacheWrite: 1.19 },
+    }],
+    ['grok-4-5', {
+        contextWindow: 500_000,
+        maxTokens: 128_000,
+        reasoning: true,
+        input: ['text', 'image'],
+        cost: { input: 2.00, output: 6.00, cacheRead: 0.50, cacheWrite: 2.50 },
+    }],
+]);
+
+/**
+ * Find the best-matching metadata for a UID by longest-prefix match
+ * against {@link MODEL_META}. This lets `swe-1-7-lightning` match the
+ * `swe-1-7-lightning` entry (specific) and `gpt-5-6-sol-low` match the
+ * `gpt-5-6-sol` entry (parent family).
+ */
+function findMeta(uid: string): ModelMeta | undefined {
+    let best: { key: string; meta: ModelMeta } | null = null;
+    for (const [key, meta] of MODEL_META) {
+        if (uid === key || uid.startsWith(key + '-') || uid.startsWith(key + '_')) {
+            if (!best || key.length > best.key.length) {
+                best = { key, meta };
+            }
+        }
+    }
+    return best?.meta;
+}
+
+/** Conservative defaults for catalog UIDs not in the override table. */
+const DEFAULT_META: ModelMeta = {
+    contextWindow: 256_000,
+    maxTokens: 128_000,
+    reasoning: true,
+    input: ['text', 'image'],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+};
+
+function makeModel(id: string, name: string, meta: ModelMeta): ProviderModelConfig {
+    return {
+        id,
+        name,
+        reasoning: meta.reasoning,
+        input: meta.input,
+        cost: meta.cost,
+        contextWindow: meta.contextWindow,
+        maxTokens: meta.maxTokens,
+    };
+}
+
+/**
+ * Static fallback list — 11 models with real pricing.
+ * Shown before login or when the live catalog fetch fails.
+ */
+export const FALLBACK_MODELS: ProviderModelConfig[] = [
+    makeModel('swe-1-7', 'SWE-1.7', MODEL_META.get('swe-1-7')!),
+    makeModel('swe-1-7-lightning', 'SWE-1.7 Lightning', MODEL_META.get('swe-1-7-lightning')!),
+    makeModel('gpt-5-6-sol', 'GPT-5.6 Sol', MODEL_META.get('gpt-5-6-sol')!),
+    makeModel('gpt-5-6-luna', 'GPT-5.6 Luna', MODEL_META.get('gpt-5-6-luna')!),
+    makeModel('gpt-5-6-terra', 'GPT-5.6 Terra', MODEL_META.get('gpt-5-6-terra')!),
+    makeModel('claude-opus-4-8', 'Claude Opus 4.8', MODEL_META.get('claude-opus-4-8')!),
+    makeModel('claude-fable-5', 'Claude Fable 5', MODEL_META.get('claude-fable-5')!),
+    makeModel('claude-sonnet-5', 'Claude Sonnet 5', MODEL_META.get('claude-sonnet-5')!),
+    makeModel('glm-5-2', 'GLM-5.2', MODEL_META.get('glm-5-2')!),
+    makeModel('kimi-k2-7', 'Kimi K2.7', MODEL_META.get('kimi-k2-7')!),
+    makeModel('grok-4-5', 'Grok 4.5', MODEL_META.get('grok-4-5')!),
+];
+
+/**
+ * Build the model list from a live catalog response.
+ *
+ * Filters to the 11 wanted families via {@link WANTED_PREFIXES}, skips
+ * disabled entries, and stamps each with pricing/metadata from
+ * {@link MODEL_META}. Falls back to {@link FALLBACK_MODELS} when the
+ * catalog is null, empty, or contains none of our wanted models.
+ */
+export function buildLiveModels(catalog: CacheEntry | null): ProviderModelConfig[] {
+    if (!catalog || catalog.byUid.size === 0) {
+        return FALLBACK_MODELS;
+    }
+
+    const models: ProviderModelConfig[] = [];
+    for (const entry of catalog.byUid.values()) {
+        if (entry.disabled) continue;
+        if (!matchesWantedPrefix(entry.modelUid)) continue;
+        const meta = findMeta(entry.modelUid) ?? DEFAULT_META;
+        models.push(makeModel(entry.modelUid, entry.label || entry.modelUid, meta));
+    }
+
+    if (models.length === 0) {
+        return FALLBACK_MODELS;
+    }
+
+    return models;
+}
+
+export { DEFAULT_HOST };

package/plugins/devin-auth/src/oauth/login.ts

@@ -0,0 +1,95 @@
+/**
+ * Drive a browser-based Windsurf sign-in via pi's `OAuthLoginCallbacks`.
+ *
+ * Flow:
+ *   1. Build an Auth0 implicit-grant URL (`response_type=token`) pointing at
+ *      Windsurf's SPA sign-in page with `redirect_uri=show-auth-token`. That
+ *      special redirect tells the SPA to render the resulting access token in
+ *      a `<code>` block on screen instead of redirecting away — the user
+ *      copies it manually.
+ *   2. `callbacks.onAuth({ url })` opens the browser.
+ *   3. `callbacks.onPrompt(...)` collects the pasted token. That pasted value
+ *      IS the Firebase ID token (the `access_token` from the OAuth fragment).
+ *   4. `registerUser(pasted, region)` exchanges it for a long-lived API key.
+ *   5. We wrap the key in `OAuthCredentials` and return it.
+ *
+ * Why manual paste instead of a loopback redirect? pi's `OAuthLoginCallbacks`
+ * surface no way to spin up a local HTTP server or read a redirect — the only
+ * inputs we get back are `onPrompt` (free text) and `onSelect` (pick from a
+ * list). The `show-auth-token` redirect + manual paste is the same trick the
+ * opencode-windsurf-auth CLI uses for headless / SSH environments, and it is
+ * the only shape that fits pi's callback contract.
+ */
+
+import * as crypto from 'crypto';
+import type { OAuthCredentials, OAuthLoginCallbacks } from '@earendil-works/pi-ai';
+import { registerUser } from './register-user.js';
+import { DEFAULT_REGION, type WindsurfRegion } from './types.js';
+
+/** One year in milliseconds — the API key is effectively non-expiring. */
+const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+
+/**
+ * Build the Auth0 implicit-grant URL for Windsurf's SPA sign-in page.
+ *
+ * Mirrors the params the opencode-windsurf-auth flow sends:
+ *   - `response_type=token`  -> Auth0 returns the access token in the URL
+ *     fragment (implicit grant, no client secret).
+ *   - `redirect_uri=show-auth-token` -> the SPA's special route that renders
+ *     the token on-screen for manual copy instead of bouncing elsewhere.
+ *   - `state` -> random UUID, guards CSRF on the browser round-trip. We do
+ *     not validate it server-side (we never receive the redirect), but
+ *     Auth0 requires it and echoing it back is good hygiene.
+ *   - `prompt=login` -> force a fresh Auth0 login screen even if the user
+ *     has an SSO session, so they can pick a different account.
+ */
+function buildSignInUrl(region: WindsurfRegion): string {
+    const params = new URLSearchParams({
+        response_type: 'token',
+        client_id: region.oauthClientId,
+        redirect_uri: 'show-auth-token',
+        state: crypto.randomUUID(),
+        prompt: 'login',
+    });
+    return `${region.website}/windsurf/signin?${params.toString()}`;
+}
+
+/**
+ * Run the full Windsurf OAuth login through pi's `OAuthLoginCallbacks`.
+ *
+ * The returned `OAuthCredentials.access` is the Windsurf API key (not the
+ * short-lived Firebase token — that is consumed by `registerUser` and
+ * discarded). `refresh` is empty because Windsurf API keys do not expire;
+ * `expires` is set one year out as a soft sentinel, not a hard expiry.
+ *
+ * `WindsurfRegistrationError` thrown by `registerUser` is allowed to
+ * propagate — pi surfaces it to the user.
+ */
+export async function loginDevin(
+    callbacks: OAuthLoginCallbacks,
+    region: WindsurfRegion = DEFAULT_REGION,
+): Promise<OAuthCredentials> {
+    const url = buildSignInUrl(region);
+
+    // Open the browser to the Auth0 sign-in page.
+    callbacks.onAuth({ url });
+
+    // Block until the user pastes the token rendered on the sign-in page.
+    // This is the Firebase ID token (OAuth `access_token` from the fragment).
+    const firebaseIdToken = await callbacks.onPrompt({
+        message: 'Paste the token from the sign-in page:',
+    });
+
+    if (!firebaseIdToken) {
+        throw new Error('No token pasted; cannot complete sign-in.');
+    }
+
+    // Exchange the Firebase token for a long-lived Windsurf API key.
+    const result = await registerUser(firebaseIdToken.trim(), region);
+
+    return {
+        refresh: '',
+        access: result.apiKey,
+        expires: Date.now() + ONE_YEAR_MS,
+    };
+}

package/plugins/devin-auth/src/oauth/register-user.ts

@@ -0,0 +1,174 @@
+/**
+ * Exchange a Firebase ID token for a long-lived Windsurf API key.
+ *
+ * This calls the same Connect-RPC endpoint the Windsurf desktop extension uses
+ * after the browser sign-in completes:
+ *
+ *   POST https://register.windsurf.com/exa.seat_management_pb.SeatManagementService/RegisterUser
+ *   Content-Type: application/json
+ *   Body: { "firebase_id_token": "<jwt>" }
+ *
+ * Connect-RPC happily accepts plain JSON over HTTPS (no gRPC framing required),
+ * so we skip @connectrpc/connect entirely and use `fetch`. The response shape
+ * matches `exa.seat_management_pb.RegisterUserResponse`:
+ *
+ *   { api_key, name, api_server_url, redirect_url, team_options[] }
+ *
+ * Endpoint verified live (returns `{code:"unauthenticated",message:"invalid token ..."}`
+ * for a fake token, 200 with the response body for a valid one).
+ */
+
+import type { OAuthLoginResult, WindsurfRegion } from './types.js';
+
+/**
+ * Polyfill for `AbortSignal.any` — composes multiple signals so the result
+ * aborts when ANY input aborts. Built-in in Node ≥20.3 / Bun ≥1.0; we
+ * implement the fallback ourselves so the timeout/caller-signal merge
+ * works on every runtime our `engines` field permits (Node 18+).
+ */
+function anySignal(signals: AbortSignal[]): AbortSignal {
+  const builtin = (AbortSignal as unknown as { any?: (s: AbortSignal[]) => AbortSignal }).any;
+  if (typeof builtin === 'function') return builtin(signals);
+  const controller = new AbortController();
+  const onAbort = (reason: unknown): void => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
+  for (const s of signals) {
+    if (s.aborted) {
+      onAbort(s.reason);
+      break;
+    }
+    s.addEventListener('abort', () => onAbort(s.reason), { once: true });
+  }
+  return controller.signal;
+}
+
+interface RegisterUserResponseJson {
+  api_key?: string;
+  name?: string;
+  api_server_url?: string;
+  redirect_url?: string;
+  team_options?: unknown[];
+}
+
+interface ConnectErrorJson {
+  code?: string;
+  message?: string;
+}
+
+export class WindsurfRegistrationError extends Error {
+  readonly status: number;
+  readonly connectCode?: string;
+  readonly traceId?: string;
+
+  constructor(message: string, status: number, connectCode?: string, traceId?: string) {
+    super(message);
+    this.name = 'WindsurfRegistrationError';
+    this.status = status;
+    this.connectCode = connectCode;
+    this.traceId = traceId;
+  }
+}
+
+const TRACE_ID_RE = /\(trace ID: ([0-9a-f]+)\)/i;
+
+/**
+ * Exchange the Firebase ID token for a Windsurf API key.
+ *
+ * `firebaseIdToken` is the `access_token` (or `firebase_id_token`) value the
+ * Windsurf sign-in page returns in the OAuth callback URL — we treat it as
+ * opaque.
+ */
+export async function registerUser(
+  firebaseIdToken: string,
+  region: WindsurfRegion,
+  abortSignal?: AbortSignal,
+): Promise<OAuthLoginResult> {
+  if (!firebaseIdToken) {
+    throw new WindsurfRegistrationError('Empty firebase_id_token', 0, 'invalid_argument');
+  }
+
+  const url = `${region.registerApiServerUrl.replace(/\/$/, '')}/exa.seat_management_pb.SeatManagementService/RegisterUser`;
+
+  // 30s internal timeout — RegisterUser responds in ~200ms in steady state.
+  // CLI users on flaky networks need bounded waits or the sign-in command
+  // hangs forever. Compose with the caller's signal via a small polyfill
+  // (`anySignal`) because Node 18 / older Bun lack AbortSignal.any; the
+  // previous fallback `combinedSignal = abortSignal` would drop the
+  // timeout entirely on those runtimes.
+  const timeoutSignal = AbortSignal.timeout(30_000);
+  const combinedSignal: AbortSignal = abortSignal
+    ? anySignal([abortSignal, timeoutSignal])
+    : timeoutSignal;
+
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      // Connect protocol version header — not strictly required for JSON, but
+      // matches what the official Connect clients send and avoids accidental
+      // routing into a non-Connect HTTP handler.
+      'Connect-Protocol-Version': '1',
+    },
+    body: JSON.stringify({ firebase_id_token: firebaseIdToken }),
+    signal: combinedSignal,
+  });
+
+  const text = await response.text();
+
+  if (!response.ok) {
+    let connectCode: string | undefined;
+    let message = text || `RegisterUser failed with HTTP ${response.status}`;
+    try {
+      const errJson = JSON.parse(text) as ConnectErrorJson;
+      connectCode = errJson.code;
+      if (errJson.message) message = errJson.message;
+    } catch {
+      // non-JSON error body — keep raw text in `message`
+    }
+    const traceMatch = message.match(TRACE_ID_RE);
+    throw new WindsurfRegistrationError(message, response.status, connectCode, traceMatch?.[1]);
+  }
+
+  let parsed: RegisterUserResponseJson;
+  try {
+    parsed = JSON.parse(text) as RegisterUserResponseJson;
+  } catch {
+    throw new WindsurfRegistrationError(
+      `RegisterUser returned 200 but body is not JSON: ${text.slice(0, 200)}`,
+      response.status,
+      'internal',
+    );
+  }
+
+  const apiKey = parsed.api_key;
+  const name = parsed.name;
+  // Empty `api_server_url` is normal for single-tenant accounts — the desktop
+  // extension's `getApiServerUrl` helper falls back to the configured default
+  // when this is empty/missing. We mirror that behavior here.
+  const apiServerUrl = parsed.api_server_url && parsed.api_server_url.length > 0
+    ? parsed.api_server_url
+    : 'https://server.codeium.com';
+
+  if (!apiKey) {
+    throw new WindsurfRegistrationError(
+      'RegisterUser returned 200 but api_key was empty',
+      response.status,
+      'malformed_response',
+    );
+  }
+  if (!name) {
+    throw new WindsurfRegistrationError(
+      'RegisterUser returned 200 but name was empty',
+      response.status,
+      'malformed_response',
+    );
+  }
+
+  return {
+    apiKey,
+    name,
+    apiServerUrl,
+    redirectUrl: parsed.redirect_url,
+  };
+}

package/plugins/devin-auth/src/oauth/types.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared types for the OAuth login flow + persisted credentials.
+ *
+ * Two distinct token shapes appear in this codebase:
+ *
+ *  - `firebaseIdToken` — the short-lived JWT minted by Auth0 / Firebase Auth
+ *    during browser sign-in. Lives in the OAuth callback URL fragment/query.
+ *    Treated as opaque and discarded once exchanged.
+ *
+ *  - `apiKey` — the long-lived credential returned by
+ *    `SeatManagementService.RegisterUser`. Used inside every Cascade RPC's
+ *    `Metadata.api_key` field. Format is provider-defined:
+ *      * Cognition era:  `devin-session-token$<JWT>`
+ *      * Codeium classic: bare UUID v4
+ *      * Older Windsurf:  `sk-ws-01-<...>` / `cog_<...>`
+ *    The plugin treats it as an opaque string — only the cloud cares about format.
+ */
+
+export interface OAuthLoginResult {
+  /** The opaque API key used as `Metadata.api_key` in every Cascade RPC. */
+  apiKey: string;
+  /** Human-readable account name (`Satvik Kapoor`). */
+  name: string;
+  /**
+   * Cloud API server (`https://server.codeium.com`, `https://eu.windsurf.com/_route/api_server`,
+   * `https://windsurf.fedstart.com/_route/api_server`). Driven by the user's
+   * tenant — language_server needs this as `--api_server_url`.
+   */
+  apiServerUrl: string;
+  /** Optional cleanup redirect URL returned by RegisterUser. Informational. */
+  redirectUrl?: string;
+}
+
+export interface PersistedCredentials extends OAuthLoginResult {
+  /** ISO timestamp the credentials were minted at — purely informational. */
+  issuedAt: string;
+  /** Optional tag tracking the OAuth client id used (so a future client rotation can invalidate). */
+  oauthClientId: string;
+  /**
+   * True when these credentials were written as part of the
+   * `opencode auth login` → authorize() flow (so opencode's auth.json is the
+   * authoritative copy and `opencode auth logout windsurf` should mirror-clear
+   * this file). False / absent for credentials written by our standalone
+   * `opencode-windsurf-auth login` CLI; those survive opencode auth state
+   * changes.
+   */
+  syncedViaOpencodeAuth?: boolean;
+}
+
+export interface WindsurfRegion {
+  /** Where to send users for browser sign-in. */
+  website: string;
+  /** Where to POST RegisterUser. */
+  registerApiServerUrl: string;
+  /** Auth0 client id passed in the OAuth URL. */
+  oauthClientId: string;
+}
+
+/**
+ * The single tenant (free / personal) configuration. EU, FedStart, and arbitrary
+ * portal URLs override `website` + `registerApiServerUrl` at runtime when the
+ * user passes `--portal-url` to the login command.
+ */
+export const DEFAULT_REGION: WindsurfRegion = {
+  website: 'https://windsurf.com',
+  registerApiServerUrl: 'https://register.windsurf.com',
+  // From /Applications/Windsurf.app/.../extension.js — the public Windsurf
+  // Auth0 client. If Windsurf rotates this, sign-in will start failing until
+  // we re-extract it.
+  oauthClientId: '3GUryQ7ldAeKEuD2obYnppsnmj58eP5u',
+};