@pikku/core 0.12.23 → 0.12.25

package/src/wirings/ai-agent/ai-agent-prepare.ts

@@ -16,7 +16,7 @@ import { AIProviderNotConfiguredError } from '../../errors/errors.js'
 import { pikkuState, getSingletonServices } from '../../pikku-state.js'
 import { createMiddlewareSessionWireProps } from '../../services/user-session-service.js'
 import type { SessionService } from '../../services/user-session-service.js'
-import { randomUUID } from 'crypto'
+import { randomUUID } from './ai-agent-utils.js'
 import { streamAIAgent } from './ai-agent-stream.js'
 import { runAIAgent } from './ai-agent-runner.js'
 import {
@@ -32,6 +32,8 @@ import { resolveModelConfig } from './ai-agent-model-config.js'
 
 export type RunAIAgentParams = {
   sessionService?: SessionService<CoreUserSession>
+  /** Credential accessor for the current request — used to read per-user overrides (e.g. AI_API_KEY). */
+  getCredential?: <T = unknown>(name: string) => T | null | Promise<T | null>
 }
 
 export type StreamAIAgentOptions = {
@@ -616,11 +618,20 @@ export async function prepareAgentRun(
   const singletonServices = getSingletonServices()
   const { agent, packageName, resolvedName } = resolveAgent(agentName)
 
-  const agentRunner = singletonServices.aiAgentRunner
+  let agentRunner = singletonServices.aiAgentRunner
   if (!agentRunner) {
     throw new AIProviderNotConfiguredError()
   }
 
+  if (params.getCredential && agentRunner.withApiKey) {
+    const aiCredential = await params.getCredential<{ apiKey: string }>(
+      'AI_API_KEY'
+    )
+    if (aiCredential?.apiKey?.trim()) {
+      agentRunner = agentRunner.withApiKey(aiCredential.apiKey)
+    }
+  }
+
   const { storage } = resolveMemoryServices(agent, singletonServices)
   const memoryConfig = agent.memory
   const threadId = input.threadId
@@ -698,7 +709,10 @@ export async function prepareAgentRun(
     agent.agentMode
   )
 
-  const instructions = await buildInstructions(resolvedName, packageName)
+  let instructions = await buildInstructions(resolvedName, packageName)
+  if (input.context) {
+    instructions = `${instructions}\n\nCurrent context (use these identifiers directly in tool calls — do not ask the user for them):\n${input.context}`
+  }
 
   const resolved = resolveModelConfig(resolvedName, agent)
 

package/src/wirings/ai-agent/ai-agent-runner.test.ts

@@ -970,3 +970,108 @@ describe('resumeAIAgentSync', () => {
     assert.equal(result.text, 'Recovered')
   })
 })
+
+describe('getCredential API key override', () => {
+  test('uses withApiKey runner when getCredential returns apiKey', async () => {
+    addTestAgent('api-key-agent')
+
+    const originalRunCalls: string[] = []
+    const overrideRunCalls: string[] = []
+
+    const overrideRunner = {
+      run: async (): Promise<AIAgentStepResult> => {
+        overrideRunCalls.push('override')
+        return makeStepResult({ text: 'from-override', finishReason: 'stop' })
+      },
+    }
+
+    const mockServices = {
+      logger: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+      aiAgentRunner: {
+        run: async (): Promise<AIAgentStepResult> => {
+          originalRunCalls.push('original')
+          return makeStepResult({ text: 'from-original', finishReason: 'stop' })
+        },
+        withApiKey: (_key: string) => overrideRunner,
+      },
+      aiRunState: {
+        createRun: async () => 'run-key-override',
+        updateRun: async () => {},
+      },
+    } as any
+
+    pikkuState(null, 'package', 'singletonServices', mockServices)
+
+    const result = await runAIAgent(
+      'api-key-agent',
+      { message: 'hi', threadId: 't-key', resourceId: 'r-key' },
+      { getCredential: async () => ({ apiKey: 'my-secret-key' }) }
+    )
+
+    assert.equal(result.text, 'from-override')
+    assert.equal(overrideRunCalls.length, 1)
+    assert.equal(originalRunCalls.length, 0)
+  })
+
+  test('uses original runner when getCredential returns null', async () => {
+    addTestAgent('no-cred-agent')
+
+    const originalRunCalls: string[] = []
+
+    const mockServices = {
+      logger: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+      aiAgentRunner: {
+        run: async (): Promise<AIAgentStepResult> => {
+          originalRunCalls.push('original')
+          return makeStepResult({ text: 'from-original', finishReason: 'stop' })
+        },
+        withApiKey: (_key: string) => ({ run: async () => makeStepResult({ text: 'should-not-be-called', finishReason: 'stop' }) }),
+      },
+      aiRunState: {
+        createRun: async () => 'run-no-cred',
+        updateRun: async () => {},
+      },
+    } as any
+
+    pikkuState(null, 'package', 'singletonServices', mockServices)
+
+    const result = await runAIAgent(
+      'no-cred-agent',
+      { message: 'hi', threadId: 't-no-cred', resourceId: 'r-no-cred' },
+      { getCredential: async () => null }
+    )
+
+    assert.equal(result.text, 'from-original')
+    assert.equal(originalRunCalls.length, 1)
+  })
+
+  test('uses original runner when runner does not implement withApiKey', async () => {
+    addTestAgent('no-withkey-agent')
+
+    const originalRunCalls: string[] = []
+
+    const mockServices = {
+      logger: { info: () => {}, warn: () => {}, error: () => {}, debug: () => {} },
+      aiAgentRunner: {
+        run: async (): Promise<AIAgentStepResult> => {
+          originalRunCalls.push('original')
+          return makeStepResult({ text: 'from-original', finishReason: 'stop' })
+        },
+      },
+      aiRunState: {
+        createRun: async () => 'run-no-withkey',
+        updateRun: async () => {},
+      },
+    } as any
+
+    pikkuState(null, 'package', 'singletonServices', mockServices)
+
+    await runAIAgent(
+      'no-withkey-agent',
+      { message: 'hi', threadId: 't-no-withkey', resourceId: 'r-no-withkey' },
+      { getCredential: async () => ({ apiKey: 'ignored-key' }) }
+    )
+
+    assert.equal(originalRunCalls.length, 1)
+  })
+})

package/src/wirings/ai-agent/ai-agent-runner.ts

@@ -33,6 +33,7 @@ import { checkForApprovals, appendStepMessages } from './ai-agent-stream.js'
 import { pikkuState, getSingletonServices } from '../../pikku-state.js'
 import { resolveModelConfig } from './ai-agent-model-config.js'
 import { AIProviderNotConfiguredError } from '../../errors/errors.js'
+import { randomUUID } from './ai-agent-utils.js'
 
 function stripNulls(obj: unknown): unknown {
   if (obj === null) return undefined
@@ -46,7 +47,6 @@ function stripNulls(obj: unknown): unknown {
   }
   return result
 }
-import { randomUUID } from 'crypto'
 
 function extractStructuredAssistantOutput(object: unknown): {
   text: string | null

package/src/wirings/ai-agent/ai-agent-stream.ts

@@ -11,11 +11,11 @@ import type {
 } from './ai-agent.types.js'
 import { pikkuState, getSingletonServices } from '../../pikku-state.js'
 import { AIProviderNotConfiguredError } from '../../errors/errors.js'
+import { randomUUID } from './ai-agent-utils.js'
 import {
   combineChannelMiddleware,
   wrapChannelWithMiddleware,
 } from '../channel/channel-middleware-runner.js'
-import { randomUUID } from 'crypto'
 import type { AIStorageService } from '../../services/ai-storage-service.js'
 import type {
   AIAgentRunnerParams,

package/src/wirings/ai-agent/ai-agent-utils.ts

@@ -0,0 +1 @@
+export const randomUUID = (): string => globalThis.crypto.randomUUID()

package/src/wirings/ai-agent/ai-agent.types.ts

@@ -81,6 +81,10 @@ export interface AIAgentInput {
   attachments?: AIAgentInputAttachment[]
   model?: string
   temperature?: number
+  /** Structured context injected into the system instructions for this request.
+   *  Use to provide upfront state (e.g. current org/project/branch/deployment)
+   *  so the agent can call tools without asking the user for identifiers. */
+  context?: string
 }
 
 export interface AIAgentOutput {

package/src/wirings/oauth2/oauth2-client.test.ts

@@ -14,9 +14,8 @@ function createMockSecretService(
 ): SecretService & { getStoredSecrets: () => Map<string, unknown> } {
   const secrets = new Map<string, unknown>(Object.entries(initialSecrets))
   return {
-    getSecret: async (key: string) => secrets.get(key) as string,
-    getSecretJSON: async <T>(key: string) => secrets.get(key) as T,
-    setSecretJSON: async (key: string, value: unknown) => {
+    getSecret: async <T = string>(key: string) => secrets.get(key) as T,
+    setSecret: async (key: string, value: unknown) => {
       secrets.set(key, value)
     },
     deleteSecret: async (_key: string) => {

package/src/wirings/oauth2/oauth2-client.ts

@@ -124,7 +124,7 @@ export class OAuth2Client {
     }
 
     // Load from secrets
-    const token = await this.secrets.getSecretJSON<OAuth2Token>(
+    const token = await this.secrets.getSecret<OAuth2Token>(
       this.oauth2Config.tokenSecretId
     )
     this.cachedToken = token
@@ -209,7 +209,7 @@ export class OAuth2Client {
       scope: data.scope,
     }
 
-    await this.secrets.setSecretJSON(this.oauth2Config.tokenSecretId, token)
+    await this.secrets.setSecret(this.oauth2Config.tokenSecretId, token)
     this.cachedToken = token
 
     return token
@@ -233,7 +233,7 @@ export class OAuth2Client {
       return this.cachedAppCredential
     }
     this.cachedAppCredential =
-      await this.secrets.getSecretJSON<OAuth2AppCredential>(
+      await this.secrets.getSecret<OAuth2AppCredential>(
         this.appCredentialSecretId
       )
     return this.cachedAppCredential

package/src/wirings/rpc/rpc-runner.ts

@@ -325,6 +325,7 @@ export class ContextAwareRPCService {
       run: async (agentName: string, input: AIAgentInput) => {
         const result = await runAIAgent(agentName, input, {
           sessionService: this.options.sessionService,
+          getCredential: this.wire.getCredential?.bind(this.wire),
         })
         return {
           runId: result.runId,
@@ -353,7 +354,10 @@ export class ContextAwareRPCService {
           agentName,
           input,
           channel,
-          { sessionService: this.options.sessionService },
+          {
+            sessionService: this.options.sessionService,
+            getCredential: this.wire.getCredential?.bind(this.wire),
+          },
           undefined,
           options
         )
@@ -368,7 +372,10 @@ export class ContextAwareRPCService {
         await resumeAIAgent(
           { runId, ...input },
           channel,
-          { sessionService: this.options.sessionService },
+          {
+            sessionService: this.options.sessionService,
+            getCredential: this.wire.getCredential?.bind(this.wire),
+          },
           options
         )
       },