@nmzpy/pi-ember-stack 0.2.1 → 0.2.2

package/plugins/devin-auth/src/oauth/register-user.ts

@@ -1,174 +1,174 @@
-/**
- * Exchange a Firebase ID token for a long-lived Windsurf API key.
- *
- * This calls the same Connect-RPC endpoint the Windsurf desktop extension uses
- * after the browser sign-in completes:
- *
- *   POST https://register.windsurf.com/exa.seat_management_pb.SeatManagementService/RegisterUser
- *   Content-Type: application/json
- *   Body: { "firebase_id_token": "<jwt>" }
- *
- * Connect-RPC happily accepts plain JSON over HTTPS (no gRPC framing required),
- * so we skip @connectrpc/connect entirely and use `fetch`. The response shape
- * matches `exa.seat_management_pb.RegisterUserResponse`:
- *
- *   { api_key, name, api_server_url, redirect_url, team_options[] }
- *
- * Endpoint verified live (returns `{code:"unauthenticated",message:"invalid token ..."}`
- * for a fake token, 200 with the response body for a valid one).
- */
-
-import type { OAuthLoginResult, WindsurfRegion } from './types.js';
-
-/**
- * Polyfill for `AbortSignal.any` — composes multiple signals so the result
- * aborts when ANY input aborts. Built-in in Node ≥20.3 / Bun ≥1.0; we
- * implement the fallback ourselves so the timeout/caller-signal merge
- * works on every runtime our `engines` field permits (Node 18+).
- */
-function anySignal(signals: AbortSignal[]): AbortSignal {
-  const builtin = (AbortSignal as unknown as { any?: (s: AbortSignal[]) => AbortSignal }).any;
-  if (typeof builtin === 'function') return builtin(signals);
-  const controller = new AbortController();
-  const onAbort = (reason: unknown): void => {
-    if (!controller.signal.aborted) controller.abort(reason);
-  };
-  for (const s of signals) {
-    if (s.aborted) {
-      onAbort(s.reason);
-      break;
-    }
-    s.addEventListener('abort', () => onAbort(s.reason), { once: true });
-  }
-  return controller.signal;
-}
-
-interface RegisterUserResponseJson {
-  api_key?: string;
-  name?: string;
-  api_server_url?: string;
-  redirect_url?: string;
-  team_options?: unknown[];
-}
-
-interface ConnectErrorJson {
-  code?: string;
-  message?: string;
-}
-
-export class WindsurfRegistrationError extends Error {
-  readonly status: number;
-  readonly connectCode?: string;
-  readonly traceId?: string;
-
-  constructor(message: string, status: number, connectCode?: string, traceId?: string) {
-    super(message);
-    this.name = 'WindsurfRegistrationError';
-    this.status = status;
-    this.connectCode = connectCode;
-    this.traceId = traceId;
-  }
-}
-
-const TRACE_ID_RE = /\(trace ID: ([0-9a-f]+)\)/i;
-
-/**
- * Exchange the Firebase ID token for a Windsurf API key.
- *
- * `firebaseIdToken` is the `access_token` (or `firebase_id_token`) value the
- * Windsurf sign-in page returns in the OAuth callback URL — we treat it as
- * opaque.
- */
-export async function registerUser(
-  firebaseIdToken: string,
-  region: WindsurfRegion,
-  abortSignal?: AbortSignal,
-): Promise<OAuthLoginResult> {
-  if (!firebaseIdToken) {
-    throw new WindsurfRegistrationError('Empty firebase_id_token', 0, 'invalid_argument');
-  }
-
-  const url = `${region.registerApiServerUrl.replace(/\/$/, '')}/exa.seat_management_pb.SeatManagementService/RegisterUser`;
-
-  // 30s internal timeout — RegisterUser responds in ~200ms in steady state.
-  // CLI users on flaky networks need bounded waits or the sign-in command
-  // hangs forever. Compose with the caller's signal via a small polyfill
-  // (`anySignal`) because Node 18 / older Bun lack AbortSignal.any; the
-  // previous fallback `combinedSignal = abortSignal` would drop the
-  // timeout entirely on those runtimes.
-  const timeoutSignal = AbortSignal.timeout(30_000);
-  const combinedSignal: AbortSignal = abortSignal
-    ? anySignal([abortSignal, timeoutSignal])
-    : timeoutSignal;
-
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      // Connect protocol version header — not strictly required for JSON, but
-      // matches what the official Connect clients send and avoids accidental
-      // routing into a non-Connect HTTP handler.
-      'Connect-Protocol-Version': '1',
-    },
-    body: JSON.stringify({ firebase_id_token: firebaseIdToken }),
-    signal: combinedSignal,
-  });
-
-  const text = await response.text();
-
-  if (!response.ok) {
-    let connectCode: string | undefined;
-    let message = text || `RegisterUser failed with HTTP ${response.status}`;
-    try {
-      const errJson = JSON.parse(text) as ConnectErrorJson;
-      connectCode = errJson.code;
-      if (errJson.message) message = errJson.message;
-    } catch {
-      // non-JSON error body — keep raw text in `message`
-    }
-    const traceMatch = message.match(TRACE_ID_RE);
-    throw new WindsurfRegistrationError(message, response.status, connectCode, traceMatch?.[1]);
-  }
-
-  let parsed: RegisterUserResponseJson;
-  try {
-    parsed = JSON.parse(text) as RegisterUserResponseJson;
-  } catch {
-    throw new WindsurfRegistrationError(
-      `RegisterUser returned 200 but body is not JSON: ${text.slice(0, 200)}`,
-      response.status,
-      'internal',
-    );
-  }
-
-  const apiKey = parsed.api_key;
-  const name = parsed.name;
-  // Empty `api_server_url` is normal for single-tenant accounts — the desktop
-  // extension's `getApiServerUrl` helper falls back to the configured default
-  // when this is empty/missing. We mirror that behavior here.
-  const apiServerUrl = parsed.api_server_url && parsed.api_server_url.length > 0
-    ? parsed.api_server_url
-    : 'https://server.codeium.com';
-
-  if (!apiKey) {
-    throw new WindsurfRegistrationError(
-      'RegisterUser returned 200 but api_key was empty',
-      response.status,
-      'malformed_response',
-    );
-  }
-  if (!name) {
-    throw new WindsurfRegistrationError(
-      'RegisterUser returned 200 but name was empty',
-      response.status,
-      'malformed_response',
-    );
-  }
-
-  return {
-    apiKey,
-    name,
-    apiServerUrl,
-    redirectUrl: parsed.redirect_url,
-  };
-}
+/**
+ * Exchange a Firebase ID token for a long-lived Windsurf API key.
+ *
+ * This calls the same Connect-RPC endpoint the Windsurf desktop extension uses
+ * after the browser sign-in completes:
+ *
+ *   POST https://register.windsurf.com/exa.seat_management_pb.SeatManagementService/RegisterUser
+ *   Content-Type: application/json
+ *   Body: { "firebase_id_token": "<jwt>" }
+ *
+ * Connect-RPC happily accepts plain JSON over HTTPS (no gRPC framing required),
+ * so we skip @connectrpc/connect entirely and use `fetch`. The response shape
+ * matches `exa.seat_management_pb.RegisterUserResponse`:
+ *
+ *   { api_key, name, api_server_url, redirect_url, team_options[] }
+ *
+ * Endpoint verified live (returns `{code:"unauthenticated",message:"invalid token ..."}`
+ * for a fake token, 200 with the response body for a valid one).
+ */
+
+import type { OAuthLoginResult, WindsurfRegion } from './types.js';
+
+/**
+ * Polyfill for `AbortSignal.any` — composes multiple signals so the result
+ * aborts when ANY input aborts. Built-in in Node ≥20.3 / Bun ≥1.0; we
+ * implement the fallback ourselves so the timeout/caller-signal merge
+ * works on every runtime our `engines` field permits (Node 18+).
+ */
+function anySignal(signals: AbortSignal[]): AbortSignal {
+  const builtin = (AbortSignal as unknown as { any?: (s: AbortSignal[]) => AbortSignal }).any;
+  if (typeof builtin === 'function') return builtin(signals);
+  const controller = new AbortController();
+  const onAbort = (reason: unknown): void => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
+  for (const s of signals) {
+    if (s.aborted) {
+      onAbort(s.reason);
+      break;
+    }
+    s.addEventListener('abort', () => onAbort(s.reason), { once: true });
+  }
+  return controller.signal;
+}
+
+interface RegisterUserResponseJson {
+  api_key?: string;
+  name?: string;
+  api_server_url?: string;
+  redirect_url?: string;
+  team_options?: unknown[];
+}
+
+interface ConnectErrorJson {
+  code?: string;
+  message?: string;
+}
+
+export class WindsurfRegistrationError extends Error {
+  readonly status: number;
+  readonly connectCode?: string;
+  readonly traceId?: string;
+
+  constructor(message: string, status: number, connectCode?: string, traceId?: string) {
+    super(message);
+    this.name = 'WindsurfRegistrationError';
+    this.status = status;
+    this.connectCode = connectCode;
+    this.traceId = traceId;
+  }
+}
+
+const TRACE_ID_RE = /\(trace ID: ([0-9a-f]+)\)/i;
+
+/**
+ * Exchange the Firebase ID token for a Windsurf API key.
+ *
+ * `firebaseIdToken` is the `access_token` (or `firebase_id_token`) value the
+ * Windsurf sign-in page returns in the OAuth callback URL — we treat it as
+ * opaque.
+ */
+export async function registerUser(
+  firebaseIdToken: string,
+  region: WindsurfRegion,
+  abortSignal?: AbortSignal,
+): Promise<OAuthLoginResult> {
+  if (!firebaseIdToken) {
+    throw new WindsurfRegistrationError('Empty firebase_id_token', 0, 'invalid_argument');
+  }
+
+  const url = `${region.registerApiServerUrl.replace(/\/$/, '')}/exa.seat_management_pb.SeatManagementService/RegisterUser`;
+
+  // 30s internal timeout — RegisterUser responds in ~200ms in steady state.
+  // CLI users on flaky networks need bounded waits or the sign-in command
+  // hangs forever. Compose with the caller's signal via a small polyfill
+  // (`anySignal`) because Node 18 / older Bun lack AbortSignal.any; the
+  // previous fallback `combinedSignal = abortSignal` would drop the
+  // timeout entirely on those runtimes.
+  const timeoutSignal = AbortSignal.timeout(30_000);
+  const combinedSignal: AbortSignal = abortSignal
+    ? anySignal([abortSignal, timeoutSignal])
+    : timeoutSignal;
+
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      // Connect protocol version header — not strictly required for JSON, but
+      // matches what the official Connect clients send and avoids accidental
+      // routing into a non-Connect HTTP handler.
+      'Connect-Protocol-Version': '1',
+    },
+    body: JSON.stringify({ firebase_id_token: firebaseIdToken }),
+    signal: combinedSignal,
+  });
+
+  const text = await response.text();
+
+  if (!response.ok) {
+    let connectCode: string | undefined;
+    let message = text || `RegisterUser failed with HTTP ${response.status}`;
+    try {
+      const errJson = JSON.parse(text) as ConnectErrorJson;
+      connectCode = errJson.code;
+      if (errJson.message) message = errJson.message;
+    } catch {
+      // non-JSON error body — keep raw text in `message`
+    }
+    const traceMatch = message.match(TRACE_ID_RE);
+    throw new WindsurfRegistrationError(message, response.status, connectCode, traceMatch?.[1]);
+  }
+
+  let parsed: RegisterUserResponseJson;
+  try {
+    parsed = JSON.parse(text) as RegisterUserResponseJson;
+  } catch {
+    throw new WindsurfRegistrationError(
+      `RegisterUser returned 200 but body is not JSON: ${text.slice(0, 200)}`,
+      response.status,
+      'internal',
+    );
+  }
+
+  const apiKey = parsed.api_key;
+  const name = parsed.name;
+  // Empty `api_server_url` is normal for single-tenant accounts — the desktop
+  // extension's `getApiServerUrl` helper falls back to the configured default
+  // when this is empty/missing. We mirror that behavior here.
+  const apiServerUrl = parsed.api_server_url && parsed.api_server_url.length > 0
+    ? parsed.api_server_url
+    : 'https://server.codeium.com';
+
+  if (!apiKey) {
+    throw new WindsurfRegistrationError(
+      'RegisterUser returned 200 but api_key was empty',
+      response.status,
+      'malformed_response',
+    );
+  }
+  if (!name) {
+    throw new WindsurfRegistrationError(
+      'RegisterUser returned 200 but name was empty',
+      response.status,
+      'malformed_response',
+    );
+  }
+
+  return {
+    apiKey,
+    name,
+    apiServerUrl,
+    redirectUrl: parsed.redirect_url,
+  };
+}

package/plugins/devin-auth/src/oauth/types.ts

@@ -1,71 +1,71 @@
-/**
- * Shared types for the OAuth login flow + persisted credentials.
- *
- * Two distinct token shapes appear in this codebase:
- *
- *  - `firebaseIdToken` — the short-lived JWT minted by Auth0 / Firebase Auth
- *    during browser sign-in. Lives in the OAuth callback URL fragment/query.
- *    Treated as opaque and discarded once exchanged.
- *
- *  - `apiKey` — the long-lived credential returned by
- *    `SeatManagementService.RegisterUser`. Used inside every Cascade RPC's
- *    `Metadata.api_key` field. Format is provider-defined:
- *      * Cognition era:  `devin-session-token$<JWT>`
- *      * Codeium classic: bare UUID v4
- *      * Older Windsurf:  `sk-ws-01-<...>` / `cog_<...>`
- *    The plugin treats it as an opaque string — only the cloud cares about format.
- */
-
-export interface OAuthLoginResult {
-  /** The opaque API key used as `Metadata.api_key` in every Cascade RPC. */
-  apiKey: string;
-  /** Human-readable account name (`Satvik Kapoor`). */
-  name: string;
-  /**
-   * Cloud API server (`https://server.codeium.com`, `https://eu.windsurf.com/_route/api_server`,
-   * `https://windsurf.fedstart.com/_route/api_server`). Driven by the user's
-   * tenant — language_server needs this as `--api_server_url`.
-   */
-  apiServerUrl: string;
-  /** Optional cleanup redirect URL returned by RegisterUser. Informational. */
-  redirectUrl?: string;
-}
-
-export interface PersistedCredentials extends OAuthLoginResult {
-  /** ISO timestamp the credentials were minted at — purely informational. */
-  issuedAt: string;
-  /** Optional tag tracking the OAuth client id used (so a future client rotation can invalidate). */
-  oauthClientId: string;
-  /**
-   * True when these credentials were written as part of the
-   * `opencode auth login` → authorize() flow (so opencode's auth.json is the
-   * authoritative copy and `opencode auth logout windsurf` should mirror-clear
-   * this file). False / absent for credentials written by our standalone
-   * `opencode-windsurf-auth login` CLI; those survive opencode auth state
-   * changes.
-   */
-  syncedViaOpencodeAuth?: boolean;
-}
-
-export interface WindsurfRegion {
-  /** Where to send users for browser sign-in. */
-  website: string;
-  /** Where to POST RegisterUser. */
-  registerApiServerUrl: string;
-  /** Auth0 client id passed in the OAuth URL. */
-  oauthClientId: string;
-}
-
-/**
- * The single tenant (free / personal) configuration. EU, FedStart, and arbitrary
- * portal URLs override `website` + `registerApiServerUrl` at runtime when the
- * user passes `--portal-url` to the login command.
- */
-export const DEFAULT_REGION: WindsurfRegion = {
-  website: 'https://windsurf.com',
-  registerApiServerUrl: 'https://register.windsurf.com',
-  // From /Applications/Windsurf.app/.../extension.js — the public Windsurf
-  // Auth0 client. If Windsurf rotates this, sign-in will start failing until
-  // we re-extract it.
-  oauthClientId: '3GUryQ7ldAeKEuD2obYnppsnmj58eP5u',
-};
+/**
+ * Shared types for the OAuth login flow + persisted credentials.
+ *
+ * Two distinct token shapes appear in this codebase:
+ *
+ *  - `firebaseIdToken` — the short-lived JWT minted by Auth0 / Firebase Auth
+ *    during browser sign-in. Lives in the OAuth callback URL fragment/query.
+ *    Treated as opaque and discarded once exchanged.
+ *
+ *  - `apiKey` — the long-lived credential returned by
+ *    `SeatManagementService.RegisterUser`. Used inside every Cascade RPC's
+ *    `Metadata.api_key` field. Format is provider-defined:
+ *      * Cognition era:  `devin-session-token$<JWT>`
+ *      * Codeium classic: bare UUID v4
+ *      * Older Windsurf:  `sk-ws-01-<...>` / `cog_<...>`
+ *    The plugin treats it as an opaque string — only the cloud cares about format.
+ */
+
+export interface OAuthLoginResult {
+  /** The opaque API key used as `Metadata.api_key` in every Cascade RPC. */
+  apiKey: string;
+  /** Human-readable account name (`Satvik Kapoor`). */
+  name: string;
+  /**
+   * Cloud API server (`https://server.codeium.com`, `https://eu.windsurf.com/_route/api_server`,
+   * `https://windsurf.fedstart.com/_route/api_server`). Driven by the user's
+   * tenant — language_server needs this as `--api_server_url`.
+   */
+  apiServerUrl: string;
+  /** Optional cleanup redirect URL returned by RegisterUser. Informational. */
+  redirectUrl?: string;
+}
+
+export interface PersistedCredentials extends OAuthLoginResult {
+  /** ISO timestamp the credentials were minted at — purely informational. */
+  issuedAt: string;
+  /** Optional tag tracking the OAuth client id used (so a future client rotation can invalidate). */
+  oauthClientId: string;
+  /**
+   * True when these credentials were written as part of the
+   * `opencode auth login` → authorize() flow (so opencode's auth.json is the
+   * authoritative copy and `opencode auth logout windsurf` should mirror-clear
+   * this file). False / absent for credentials written by our standalone
+   * `opencode-windsurf-auth login` CLI; those survive opencode auth state
+   * changes.
+   */
+  syncedViaOpencodeAuth?: boolean;
+}
+
+export interface WindsurfRegion {
+  /** Where to send users for browser sign-in. */
+  website: string;
+  /** Where to POST RegisterUser. */
+  registerApiServerUrl: string;
+  /** Auth0 client id passed in the OAuth URL. */
+  oauthClientId: string;
+}
+
+/**
+ * The single tenant (free / personal) configuration. EU, FedStart, and arbitrary
+ * portal URLs override `website` + `registerApiServerUrl` at runtime when the
+ * user passes `--portal-url` to the login command.
+ */
+export const DEFAULT_REGION: WindsurfRegion = {
+  website: 'https://windsurf.com',
+  registerApiServerUrl: 'https://register.windsurf.com',
+  // From /Applications/Windsurf.app/.../extension.js — the public Windsurf
+  // Auth0 client. If Windsurf rotates this, sign-in will start failing until
+  // we re-extract it.
+  oauthClientId: '3GUryQ7ldAeKEuD2obYnppsnmj58eP5u',
+};

package/plugins/devin-auth/src/stream.ts

@@ -265,7 +265,7 @@ export function streamDevin(
                     output.usage.cacheRead = ev.cachedInputTokens ?? 0;
                     output.usage.cacheWrite = ev.cacheCreationInputTokens ?? 0;
                     output.usage.totalTokens =
-                        ev.totalTokens ?? output.usage.input + output.usage.output;
+                        output.usage.input + output.usage.output + output.usage.cacheRead + output.usage.cacheWrite;
                     // calculateCost mutates output.usage.cost in place.
                     calculateCost(model, output.usage);
                     break;

package/plugins/pi-compact-tools/index.ts

@@ -14,6 +14,7 @@ import { type Component } from "@earendil-works/pi-tui";
 import {
 	CompactRenderer,
 	GROUPABLE_TOOLS,
+	bashGrepInfo,
 	type ToolRenderContext,
 	type ToolRenderResultOptions,
 } from "./renderer.ts";
@@ -73,6 +74,8 @@ function registerCompactTool(
 
 let sharedRenderer: CompactRenderer | null = null;
 
+export { bashGrepInfo };
+
 export function getSharedRenderer(): CompactRenderer {
 	if (!sharedRenderer) sharedRenderer = new CompactRenderer();
 	return sharedRenderer;
@@ -81,11 +84,26 @@ export function getSharedRenderer(): CompactRenderer {
 export default function piCompactToolsPlugin(pi: ExtensionAPI): void {
 	const renderer = getSharedRenderer();
 	pi.on("turn_start", () => renderer.beginTurn());
+	pi.on("message_update", (event: any) => {
+		// When the model streams visible text (not just thinking tokens),
+		// mark the turn as having visible output so the next discovery
+		// call starts a fresh group instead of appending to the previous
+		// turn's group. Thinking-only turns keep grouping coherent.
+		const ev = event?.assistantMessageEvent;
+		if (ev && (ev.type === "text_start" || ev.type === "text_delta")) {
+			renderer.noteVisibleText();
+		}
+	});
 	pi.on("tool_call", (event: any) => {
 		if (GROUPABLE_TOOLS.has(event.toolName) || TOOL_FACTORIES[event.toolName]) {
-			renderer.observeCall(event.toolName, event.toolCallId, event.input);
+			renderer.registerCall(event.toolName, event.toolCallId, event.input);
 		}
 	});
+	// Reset the shared renderer on session replacement so stale call rows
+	// from the previous session do not leak into the new one. The renderer
+	// is module-level (shared across sessions because jiti caches the
+	// module), so it must be explicitly cleared.
+	pi.on("session_start", () => renderer.resetForSession());
 	for (const [name, factory] of Object.entries(TOOL_FACTORIES)) {
 		registerCompactTool(pi, name, factory, renderer);
 	}