@oh-my-pi/pi-ai 17.1.5 → 17.1.6

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [17.1.6] - 2026-07-27
+
+### Added
+
+- Added `getProxyForUrl()` for transports that need provider-specific and standard proxy environment resolution with `NO_PROXY` support ([#6770](https://github.com/can1357/oh-my-pi/issues/6770)).
+- Added SiliconFlow and SiliconFlow (China) to the built-in API-key login provider catalog so `omp login siliconflow` / `omp login siliconflow-cn` stores a reusable credential validated against each region's `/v1/models` endpoint.
+
 ## [17.1.5] - 2026-07-27
 
 ### Fixed

package/dist/types/registry/registry.d.ts

@@ -239,6 +239,14 @@ declare const ALL: ({
     readonly id: "sakana";
     readonly name: "Sakana AI";
     readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "siliconflow";
+    readonly name: "SiliconFlow";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
+} | {
+    readonly id: "siliconflow-cn";
+    readonly name: "SiliconFlow (China)";
+    readonly login: (cb: import("./oauth/index.js").OAuthLoginCallbacks) => Promise<string>;
 } | {
     readonly id: "synthetic";
     readonly name: "Synthetic";

package/dist/types/registry/siliconflow-cn.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginSiliconFlowCn: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const siliconflowCnProvider: {
+    readonly id: "siliconflow-cn";
+    readonly name: "SiliconFlow (China)";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/registry/siliconflow.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthLoginCallbacks } from "./oauth/types.js";
+export declare const loginSiliconFlow: (options: import("./oauth/index.js").OAuthController) => Promise<string>;
+export declare const siliconflowProvider: {
+    readonly id: "siliconflow";
+    readonly name: "SiliconFlow";
+    readonly login: (cb: OAuthLoginCallbacks) => Promise<string>;
+};

package/dist/types/utils/proxy.d.ts

@@ -18,6 +18,8 @@ export declare function __resetProxyCache(): void;
  * for the lifetime of the process and this function is called for every outgoing request.
  */
 export declare function getProxyForProvider(provider: string): string | undefined;
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+export declare function getProxyForUrl(provider: string, url: URL): string | undefined;
 /**
  * Wraps a fetch implementation to inject proxy options for non-local hosts.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "17.1.5",
+	"version": "17.1.6",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -38,9 +38,9 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.1",
-		"@oh-my-pi/pi-catalog": "17.1.5",
-		"@oh-my-pi/pi-utils": "17.1.5",
-		"@oh-my-pi/pi-wire": "17.1.5",
+		"@oh-my-pi/pi-catalog": "17.1.6",
+		"@oh-my-pi/pi-utils": "17.1.6",
+		"@oh-my-pi/pi-wire": "17.1.6",
 		"arktype": "2.2.3",
 		"zod": "^4"
 	},

package/src/providers/openai-codex-responses.ts

@@ -61,7 +61,7 @@ import {
 	getOpenAIStreamIdleTimeoutMs,
 	iterateWithIdleTimeout,
 } from "../utils/idle-iterator";
-import { getProxyForProvider, shouldBypassProxy } from "../utils/proxy";
+import { getProxyForUrl } from "../utils/proxy";
 import { createRequestDebugSession, isRequestDebugEnabled, type RequestDebugResponseLog } from "../utils/request-debug";
 import { adaptSchemaForStrict, NO_STRICT, sanitizeSchemaForOpenAIResponses, toolWireSchema } from "../utils/schema";
 import { notifyRawSseEvent } from "../utils/sse-debug";
@@ -3855,15 +3855,7 @@ async function getOrCreateCodexWebSocketConnection(
 	provider: string,
 	signal?: AbortSignal,
 ): Promise<CodexWebSocketConnection> {
-	const targetUrl = new URL(url);
-	const proxy = shouldBypassProxy(targetUrl)
-		? undefined
-		: (getProxyForProvider(provider) ??
-			(targetUrl.protocol === "wss:"
-				? Bun.env.HTTPS_PROXY || Bun.env.https_proxy
-				: Bun.env.HTTP_PROXY || Bun.env.http_proxy) ??
-			Bun.env.ALL_PROXY ??
-			Bun.env.all_proxy);
+	const proxy = getProxyForUrl(provider, new URL(url));
 	const headerRecord = headersToRecord(headers);
 	// Join an in-flight handshake instead of tearing it down: closing a
 	// CONNECTING socket rejects the concurrent caller (prewarm racing the first

package/src/registry/registry.ts

@@ -51,6 +51,8 @@ import { perplexityProvider } from "./perplexity";
 import { qianfanProvider } from "./qianfan";
 import { qwenPortalProvider } from "./qwen-portal";
 import { sakanaProvider } from "./sakana";
+import { siliconflowProvider } from "./siliconflow";
+import { siliconflowCnProvider } from "./siliconflow-cn";
 import { syntheticProvider } from "./synthetic";
 import { tavilyProvider } from "./tavily";
 import { togetherProvider } from "./together";
@@ -121,6 +123,8 @@ const ALL = [
 	perplexityProvider,
 	qianfanProvider,
 	veniceProvider,
+	siliconflowProvider,
+	siliconflowCnProvider,
 	syntheticProvider,
 	nanogptProvider,
 	waferServerlessProvider,

package/src/registry/siliconflow-cn.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginSiliconFlowCn = createApiKeyLogin({
+	providerLabel: "SiliconFlow (China)",
+	authUrl: "https://cloud.siliconflow.cn/account/ak",
+	instructions: "Create or copy your API key from the SiliconFlow console",
+	promptMessage: "Paste your SiliconFlow API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "siliconflow-cn",
+		modelsUrl: "https://api.siliconflow.cn/v1/models",
+	},
+});
+
+export const siliconflowCnProvider = {
+	id: "siliconflow-cn",
+	name: "SiliconFlow (China)",
+	login: (cb: OAuthLoginCallbacks) => loginSiliconFlowCn(cb),
+} as const satisfies ProviderDefinition;

package/src/registry/siliconflow.ts

@@ -0,0 +1,22 @@
+import { createApiKeyLogin } from "./api-key-login";
+import type { OAuthLoginCallbacks } from "./oauth/types";
+import type { ProviderDefinition } from "./types";
+
+export const loginSiliconFlow = createApiKeyLogin({
+	providerLabel: "SiliconFlow",
+	authUrl: "https://cloud.siliconflow.com/account/ak",
+	instructions: "Create or copy your API key from the SiliconFlow console",
+	promptMessage: "Paste your SiliconFlow API key",
+	placeholder: "sk-...",
+	validation: {
+		kind: "models-endpoint",
+		provider: "siliconflow",
+		modelsUrl: "https://api.siliconflow.com/v1/models",
+	},
+});
+
+export const siliconflowProvider = {
+	id: "siliconflow",
+	name: "SiliconFlow",
+	login: (cb: OAuthLoginCallbacks) => loginSiliconFlow(cb),
+} as const satisfies ProviderDefinition;

package/src/utils/proxy.ts

@@ -129,6 +129,16 @@ export function getProxyForProvider(provider: string): string | undefined {
 	return value;
 }
 
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+export function getProxyForUrl(provider: string, url: URL): string | undefined {
+	if (shouldBypassProxy(url)) return undefined;
+	const protocolProxy =
+		url.protocol === "https:" || url.protocol === "wss:"
+			? Bun.env.HTTPS_PROXY || Bun.env.https_proxy
+			: Bun.env.HTTP_PROXY || Bun.env.http_proxy;
+	return getProxyForProvider(provider) || protocolProxy || Bun.env.ALL_PROXY || Bun.env.all_proxy || undefined;
+}
+
 /**
  * Wraps a fetch implementation to inject proxy options for non-local hosts.
  */

package/dist/types/providers/__tests__/google-auth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/keyless-auth-header.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/kimi-code-thinking.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/providers/__tests__/openai-codex-error.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/types/registry/oauth/__tests__/xai-oauth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/src/providers/__tests__/google-auth.test.ts

@@ -1,144 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { Buffer } from "node:buffer";
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import type { FetchImpl } from "../../types";
-import { __resetVertexTokenCache, getVertexAccessToken } from "../google-auth";
-
-const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
-const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-
-/** Generate a real RS256 private key so signJwtRs256 / pemToPkcs8 run for real. */
-async function generateServiceAccountPem(): Promise<string> {
-	const keyPair = (await globalThis.crypto.subtle.generateKey(
-		{ name: "RSASSA-PKCS1-v1_5", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
-		true,
-		["sign", "verify"],
-	)) as CryptoKeyPair;
-	const pkcs8 = new Uint8Array(await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey));
-	const body = (
-		Buffer.from(pkcs8)
-			.toString("base64")
-			.match(/.{1,64}/g) ?? []
-	).join("\n");
-	return `-----BEGIN PRIVATE KEY-----\n${body}\n-----END PRIVATE KEY-----\n`;
-}
-
-function urlOf(input: string | URL | Request): string {
-	if (typeof input === "string") return input;
-	if (input instanceof URL) return input.toString();
-	return input.url;
-}
-
-describe("getVertexAccessToken impersonated_service_account ADC", () => {
-	let tmpDir: string;
-	let originalGac: string | undefined;
-
-	beforeEach(async () => {
-		__resetVertexTokenCache();
-		originalGac = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
-		tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "omp-vertex-adc-"));
-	});
-
-	afterEach(async () => {
-		__resetVertexTokenCache();
-		if (originalGac === undefined) delete Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
-		else Bun.env.GOOGLE_APPLICATION_CREDENTIALS = originalGac;
-		await fs.rm(tmpDir, { recursive: true, force: true });
-	});
-
-	it("rejects a malformed service_account_impersonation_url before any network call", async () => {
-		const adcPath = path.join(tmpDir, "impersonated-bad-url.json");
-		await Bun.write(
-			adcPath,
-			JSON.stringify({
-				type: "impersonated_service_account",
-				// Missing the trailing ":generateAccessToken" the principal parser requires.
-				service_account_impersonation_url:
-					"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/target@project.iam.gserviceaccount.com",
-				source_credentials: {
-					type: "authorized_user",
-					client_id: "client-id",
-					client_secret: "client-secret",
-					refresh_token: "refresh-token",
-				},
-			}),
-		);
-		Bun.env.GOOGLE_APPLICATION_CREDENTIALS = adcPath;
-
-		const calls: string[] = [];
-		const fetchImpl: FetchImpl = async input => {
-			calls.push(urlOf(input));
-			return new Response("{}");
-		};
-
-		// The principal is parsed before the source exchange, so a bad URL must fail
-		// up front rather than after burning a source-token round trip.
-		await expect(getVertexAccessToken({ fetch: fetchImpl })).rejects.toBeInstanceOf(RangeError);
-		expect(calls).toEqual([]);
-	});
-
-	it("signs an RS256 JWT for a service_account source and reconstructs the IAM URL", async () => {
-		const pem = await generateServiceAccountPem();
-		const adcPath = path.join(tmpDir, "impersonated-sa.json");
-		await Bun.write(
-			adcPath,
-			JSON.stringify({
-				type: "impersonated_service_account",
-				// Non-canonical project segment proves the request URL is rebuilt, not echoed.
-				service_account_impersonation_url:
-					"https://iamcredentials.googleapis.com/v1/projects/explicit-proj/serviceAccounts/target@project.iam.gserviceaccount.com:generateAccessToken",
-				source_credentials: {
-					type: "service_account",
-					client_email: "source@project.iam.gserviceaccount.com",
-					private_key: pem,
-					private_key_id: "key-1",
-				},
-				// delegates intentionally omitted — the IAM body must default to [].
-			}),
-		);
-		Bun.env.GOOGLE_APPLICATION_CREDENTIALS = adcPath;
-
-		const calls: { url: string; init?: RequestInit }[] = [];
-		const fetchImpl: FetchImpl = async (input, init) => {
-			const url = urlOf(input);
-			calls.push({ url, init });
-			if (url === "https://oauth2.googleapis.com/token") {
-				return new Response(JSON.stringify({ access_token: "sa-source-token", expires_in: 3600 }));
-			}
-			if (url.startsWith("https://iamcredentials.googleapis.com/")) {
-				return new Response(
-					JSON.stringify({
-						accessToken: "impersonated-token",
-						expireTime: new Date(Date.now() + 3_600_000).toISOString(),
-					}),
-				);
-			}
-			return new Response("unexpected", { status: 404 });
-		};
-
-		const token = await getVertexAccessToken({ fetch: fetchImpl });
-		expect(token).toBe("impersonated-token");
-
-		// Source JWT exchange happens first, then the impersonation exchange.
-		expect(calls.map(c => c.url)).toEqual([
-			"https://oauth2.googleapis.com/token",
-			"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/target@project.iam.gserviceaccount.com:generateAccessToken",
-		]);
-
-		// Source credential is exchanged via a signed JWT bearer assertion, not a refresh grant.
-		const sourceBody = new URLSearchParams(String(calls[0].init?.body));
-		expect(sourceBody.get("grant_type")).toBe(JWT_BEARER_GRANT);
-		expect((sourceBody.get("assertion") ?? "").split(".")).toHaveLength(3);
-
-		// The IAM call carries the source-derived bearer token and defaults delegates to [].
-		const iamHeaders = calls[1].init?.headers as Record<string, string>;
-		expect(iamHeaders.Authorization).toBe("Bearer sa-source-token");
-		expect(JSON.parse(String(calls[1].init?.body))).toEqual({
-			delegates: [],
-			scope: [CLOUD_PLATFORM_SCOPE],
-			lifetime: "3600s",
-		});
-	});
-});

package/src/providers/__tests__/keyless-auth-header.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { NO_AUTH_SENTINEL, resolveOpenAIRequestSetup } from "../openai-shared";
-
-describe("resolveOpenAIRequestSetup keyless auth", () => {
-	test("omits Authorization for the keyless (auth: none) sentinel, keeping custom headers", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{
-				provider: "qwen",
-				id: "Qwen3.6-35B-A3B",
-				baseUrl: "http://localhost:8788",
-				headers: { "x-api-key": "real-key" },
-			},
-			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
-		);
-		expect(setup.headers.Authorization).toBeUndefined();
-		expect(setup.headers["x-api-key"]).toBe("real-key");
-	});
-
-	test("still injects Bearer for a real key", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{ provider: "custom", id: "m", baseUrl: "http://localhost:8788" },
-			{ apiKey: "sk-real", messages: [] },
-		);
-		expect(setup.headers.Authorization).toBe("Bearer sk-real");
-	});
-
-	test("caller-supplied Authorization in model.headers is preserved even when keyless", () => {
-		const setup = resolveOpenAIRequestSetup(
-			{
-				provider: "qwen",
-				id: "m",
-				baseUrl: "http://localhost:8788",
-				headers: { Authorization: "Bearer custom-token" },
-			},
-			{ apiKey: NO_AUTH_SENTINEL, messages: [] },
-		);
-		expect(setup.headers.Authorization).toBe("Bearer custom-token");
-	});
-});