@psnext/slingcli 2.5.20260710-1 → 2.5.20260718-1

package/node_modules/@earendil-works/pi-ai/dist/models.js

@@ -2,13 +2,30 @@ import { lazyStream } from "./api/lazy.js";
 import { defaultProviderAuthContext as defaultAuthContext } from "./auth/context.js";
 import { InMemoryCredentialStore } from "./auth/credential-store.js";
 import { ModelsError, resolveProviderAuth } from "./auth/resolve.js";
+import { InMemoryModelsStore } from "./models-store.js";
 export { ModelsError } from "./auth/resolve.js";
+function mergeHeaders(base, override) {
+    if (!base && !override)
+        return undefined;
+    const merged = { ...base };
+    for (const [name, value] of Object.entries(override ?? {})) {
+        const lowerName = name.toLowerCase();
+        for (const existingName of Object.keys(merged)) {
+            if (existingName.toLowerCase() === lowerName)
+                delete merged[existingName];
+        }
+        merged[name] = value;
+    }
+    return merged;
+}
 class ModelsImpl {
     providers = new Map();
     credentials;
+    modelsStore;
     authContext;
     constructor(options) {
         this.credentials = options?.credentials ?? new InMemoryCredentialStore();
+        this.modelsStore = options?.modelsStore ?? new InMemoryModelsStore();
         this.authContext = options?.authContext ?? defaultAuthContext();
     }
     setProvider(provider) {
@@ -52,30 +69,168 @@ class ModelsImpl {
     getModel(provider, id) {
         return this.getModels(provider).find((model) => model.id === id);
     }
-    async refresh(provider) {
-        if (provider !== undefined) {
-            const entry = this.providers.get(provider);
-            if (!entry?.refreshModels)
+    async refresh(options = {}) {
+        const allowNetwork = options.allowNetwork ?? true;
+        const errors = new Map();
+        const refreshable = Array.from(this.providers.values()).filter((provider) => provider.refreshModels !== undefined);
+        await Promise.all(refreshable.map(async (provider) => {
+            if (options.signal?.aborted)
                 return;
+            const store = {
+                read: () => this.modelsStore.read(provider.id),
+                write: (entry) => this.modelsStore.write(provider.id, entry),
+                delete: () => this.modelsStore.delete(provider.id),
+            };
+            let stored;
             try {
-                await entry.refreshModels();
+                stored = await this.readCredential(provider.id);
+                const credential = await this.resolveRefreshCredential(provider, stored, allowNetwork, options.signal);
+                if (!credential)
+                    return;
+                await provider.refreshModels({
+                    credential,
+                    store,
+                    allowNetwork,
+                    force: options.force,
+                    signal: options.signal,
+                });
             }
             catch (error) {
-                if (error instanceof ModelsError)
-                    throw error;
-                throw new ModelsError("model_source", `Model refresh failed for ${provider}`, { cause: error });
+                if (!options.signal?.aborted) {
+                    errors.set(provider.id, error instanceof Error
+                        ? error
+                        : new ModelsError("model_source", `Model refresh failed for ${provider.id}`, { cause: error }));
+                }
+                try {
+                    await provider.refreshModels({
+                        credential: stored,
+                        store,
+                        allowNetwork: false,
+                        signal: options.signal,
+                    });
+                }
+                catch {
+                    // Preserve the original auth/network error; cache restoration is best-effort here.
+                }
             }
-            return;
+        }));
+        return { aborted: options.signal?.aborted ?? false, errors };
+    }
+    async resolveRefreshCredential(provider, stored, allowNetwork, signal) {
+        if (stored?.type === "oauth") {
+            const oauth = provider.auth.oauth;
+            if (!oauth)
+                return undefined;
+            if (!allowNetwork || Date.now() < stored.expires)
+                return stored;
+            if (signal?.aborted)
+                return undefined;
+            const post = await this.credentials.modify(provider.id, async (current) => {
+                if (current?.type !== "oauth" || Date.now() < current.expires)
+                    return undefined;
+                return oauth.refresh(current, signal);
+            });
+            return post?.type === "oauth" ? post : undefined;
         }
-        // Cannot reject: the async mapper turns even sync throws from ill-behaved
-        // providers into rejections, and allSettled captures all of them.
-        await Promise.allSettled(Array.from(this.providers.values(), async (entry) => entry.refreshModels?.()));
+        const apiKey = provider.auth.apiKey;
+        if (!apiKey)
+            return undefined;
+        const credential = stored?.type === "api_key" ? stored : undefined;
+        const result = await apiKey.resolve({ ctx: this.authContext, credential });
+        if (!result)
+            return undefined;
+        return { type: "api_key", key: result.auth.apiKey, env: result.env };
     }
-    async getAuth(model) {
-        const provider = this.providers.get(model.provider);
+    async readCredential(providerId) {
+        try {
+            return await this.credentials.read(providerId);
+        }
+        catch (error) {
+            throw new ModelsError("auth", `Credential store read failed for ${providerId}`, { cause: error });
+        }
+    }
+    async checkProviderAuth(provider, credential) {
+        if (credential?.type === "oauth") {
+            return provider.auth.oauth ? { source: "OAuth", type: "oauth" } : undefined;
+        }
+        const apiKey = provider.auth.apiKey;
+        if (!apiKey)
+            return undefined;
+        if (apiKey.check) {
+            try {
+                return await apiKey.check({
+                    ctx: this.authContext,
+                    credential: credential?.type === "api_key" ? credential : undefined,
+                });
+            }
+            catch (error) {
+                throw new ModelsError("auth", `API key auth check failed for provider ${provider.id}`, { cause: error });
+            }
+        }
+        const resolution = await resolveProviderAuth(provider, this.credentials, this.authContext);
+        return resolution ? { source: resolution.source, type: "api_key" } : undefined;
+    }
+    async checkAuth(providerId) {
+        const provider = this.providers.get(providerId);
         if (!provider)
             return undefined;
-        return resolveProviderAuth(provider, model, this.credentials, this.authContext);
+        return this.checkProviderAuth(provider, await this.readCredential(providerId));
+    }
+    async getAvailable(providerId) {
+        const providers = providerId
+            ? [this.providers.get(providerId)].filter((entry) => entry !== undefined)
+            : this.getProviders();
+        const checks = await Promise.all(providers.map(async (provider) => {
+            const credential = await this.readCredential(provider.id);
+            return { provider, credential, auth: await this.checkProviderAuth(provider, credential) };
+        }));
+        return checks.flatMap(({ provider, credential, auth }) => {
+            if (!auth)
+                return [];
+            const models = provider.getModels();
+            return provider.filterModels?.(models, credential) ?? models;
+        });
+    }
+    async getAuth(providerOrModel, overrides) {
+        const providerId = typeof providerOrModel === "string" ? providerOrModel : providerOrModel.provider;
+        const provider = this.providers.get(providerId);
+        if (!provider)
+            return undefined;
+        const result = await resolveProviderAuth(provider, this.credentials, this.authContext, overrides);
+        if (!result || typeof providerOrModel === "string" || !providerOrModel.headers)
+            return result;
+        return {
+            ...result,
+            auth: {
+                ...result.auth,
+                headers: mergeHeaders(result.auth.headers, providerOrModel.headers),
+            },
+        };
+    }
+    async login(providerId, type, interaction) {
+        const provider = this.providers.get(providerId);
+        if (!provider)
+            throw new ModelsError("provider", `Unknown provider: ${providerId}`);
+        const method = type === "oauth" ? provider.auth.oauth : provider.auth.apiKey;
+        if (!method?.login) {
+            throw new ModelsError("auth", `${provider.name} does not support ${type} login`);
+        }
+        const credential = await method.login(interaction);
+        try {
+            await this.credentials.modify(providerId, async () => credential);
+        }
+        catch (error) {
+            throw new ModelsError("auth", `Credential store modify failed for ${providerId}`, { cause: error });
+        }
+        return credential;
+    }
+    async logout(providerId) {
+        try {
+            await this.credentials.delete(providerId);
+        }
+        catch (error) {
+            throw new ModelsError("auth", `Credential store delete failed for ${providerId}`, { cause: error });
+        }
     }
     requireProvider(model) {
         const provider = this.providers.get(model.provider);
@@ -85,19 +240,24 @@ class ModelsImpl {
         return provider;
     }
     async applyAuth(model, options) {
-        const resolution = await resolveProviderAuth(this.requireProvider(model), model, this.credentials, this.authContext, {
+        this.requireProvider(model);
+        const resolution = await this.getAuth(model, {
             apiKey: options?.apiKey,
             env: options?.env,
         });
-        const auth = resolution?.auth;
-        if (!auth)
-            return { requestModel: model, requestOptions: options };
-        const requestModel = auth.baseUrl ? { ...model, baseUrl: auth.baseUrl } : model;
-        // Explicit request options win per-field; headers/env merge per key.
+        if (!resolution) {
+            throw new ModelsError("auth", `Provider is not configured: ${model.provider}`);
+        }
+        const auth = resolution.auth;
+        // Explicit request options win per-field; the Models-only transform runs last.
         const apiKey = options?.apiKey ?? auth.apiKey;
-        const headers = auth.headers || options?.headers ? { ...auth.headers, ...options?.headers } : undefined;
+        let headers = mergeHeaders(auth.headers, options?.headers);
+        if (options?.transformHeaders)
+            headers = await options.transformHeaders(headers ?? {});
         const env = resolution.env || options?.env ? { ...(resolution.env ?? {}), ...(options?.env ?? {}) } : undefined;
-        const requestOptions = { ...options, apiKey, headers, env };
+        const requestModel = auth.baseUrl ? { ...model, baseUrl: auth.baseUrl } : model;
+        const { transformHeaders: _transformHeaders, ...providerOptions } = options ?? {};
+        const requestOptions = { ...providerOptions, apiKey, headers, env };
         return { requestModel, requestOptions };
     }
     stream(model, context, options) {
@@ -131,9 +291,21 @@ export function createModels(options) {
  * produces a stream error.
  */
 export function createProvider(input) {
-    let models = input.models;
+    const baselineModels = input.models;
+    let dynamicModels = [];
     let inflightRefresh;
-    const refreshModels = input.refreshModels;
+    const fetchModels = input.fetchModels;
+    const currentModels = () => {
+        const merged = [...baselineModels];
+        for (const model of dynamicModels) {
+            const index = merged.findIndex((entry) => entry.id === model.id);
+            if (index >= 0)
+                merged[index] = model;
+            else
+                merged.push(model);
+        }
+        return merged;
+    };
     const single = typeof input.api.stream === "function" ? input.api : undefined;
     const byApi = single ? undefined : input.api;
     const apiFor = (model) => single ?? byApi?.[model.api];
@@ -152,12 +324,24 @@ export function createProvider(input) {
         baseUrl: input.baseUrl,
         headers: input.headers,
         auth: input.auth,
-        getModels: () => models,
-        refreshModels: refreshModels
-            ? () => {
+        getModels: currentModels,
+        refreshModels: fetchModels
+            ? (context) => {
                 inflightRefresh ??= (async () => {
                     try {
-                        models = await refreshModels();
+                        const stored = await context.store.read();
+                        if (stored) {
+                            dynamicModels = stored.models
+                                .filter((model) => model.provider === input.id)
+                                .map((model) => model);
+                        }
+                        if (!context.allowNetwork || context.signal?.aborted)
+                            return;
+                        const refreshed = await fetchModels(context);
+                        if (context.signal?.aborted)
+                            return;
+                        dynamicModels = refreshed;
+                        await context.store.write({ models: refreshed, checkedAt: Date.now() });
                     }
                     finally {
                         inflightRefresh = undefined;
@@ -166,6 +350,7 @@ export function createProvider(input) {
                 return inflightRefresh;
             }
             : undefined,
+        filterModels: input.filterModels,
         stream: (model, context, options) => dispatch(model, (streams) => streams.stream(model, context, options)),
         streamSimple: (model, context, options) => dispatch(model, (streams) => streams.streamSimple(model, context, options)),
     };
@@ -184,17 +369,26 @@ export function hasApi(model, api) {
     return model.api === api;
 }
 export function calculateCost(model, usage) {
+    const inputTokens = usage.input + usage.cacheRead + usage.cacheWrite;
+    let rates = model.cost;
+    let matchedThreshold = -1;
+    for (const tier of model.cost.tiers ?? []) {
+        if (inputTokens > tier.inputTokensAbove && tier.inputTokensAbove > matchedThreshold) {
+            rates = tier;
+            matchedThreshold = tier.inputTokensAbove;
+        }
+    }
     // Anthropic charges 2x base input for 1h cache writes.
     const longWrite = usage.cacheWrite1h ?? 0;
     const shortWrite = usage.cacheWrite - longWrite;
-    usage.cost.input = (model.cost.input / 1000000) * usage.input;
-    usage.cost.output = (model.cost.output / 1000000) * usage.output;
-    usage.cost.cacheRead = (model.cost.cacheRead / 1000000) * usage.cacheRead;
-    usage.cost.cacheWrite = (model.cost.cacheWrite * shortWrite + model.cost.input * 2 * longWrite) / 1000000;
+    usage.cost.input = (rates.input / 1000000) * usage.input;
+    usage.cost.output = (rates.output / 1000000) * usage.output;
+    usage.cost.cacheRead = (rates.cacheRead / 1000000) * usage.cacheRead;
+    usage.cost.cacheWrite = (rates.cacheWrite * shortWrite + rates.input * 2 * longWrite) / 1000000;
     usage.cost.total = usage.cost.input + usage.cost.output + usage.cost.cacheRead + usage.cost.cacheWrite;
     return usage.cost;
 }
-const EXTENDED_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh"];
+const EXTENDED_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 export function getSupportedThinkingLevels(model) {
     if (!model.reasoning)
         return ["off"];
@@ -202,7 +396,7 @@ export function getSupportedThinkingLevels(model) {
         const mapped = model.thinkingLevelMap?.[level];
         if (mapped === null)
             return false;
-        if (level === "xhigh")
+        if (level === "xhigh" || level === "max")
             return mapped !== undefined;
         return true;
     });

package/node_modules/@earendil-works/pi-ai/dist/oauth.js

@@ -1,2 +1,2 @@
-export * from "./utils/oauth/index.js";
+export {};
 //# sourceMappingURL=oauth.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/all.js

@@ -28,6 +28,7 @@ import { opencodeProvider } from "./opencode.js";
 import { opencodeGoProvider } from "./opencode-go.js";
 import { openrouterProvider } from "./openrouter.js";
 import { openrouterImagesProvider } from "./openrouter-images.js";
+import { radiusProvider } from "./radius.js";
 import { togetherProvider } from "./together.js";
 import { vercelAIGatewayProvider } from "./vercel-ai-gateway.js";
 import { xaiProvider } from "./xai.js";
@@ -37,6 +38,7 @@ import { xiaomiTokenPlanCnProvider } from "./xiaomi-token-plan-cn.js";
 import { xiaomiTokenPlanSgpProvider } from "./xiaomi-token-plan-sgp.js";
 import { zaiProvider } from "./zai.js";
 import { zaiCodingCnProvider } from "./zai-coding-cn.js";
+export { radiusProvider };
 /** Typed read of the generated built-in catalog. */
 export function getBuiltinModel(provider, modelId) {
     const models = MODELS[provider];
@@ -80,6 +82,7 @@ export function builtinProviders() {
         opencodeProvider(),
         opencodeGoProvider(),
         openrouterProvider(),
+        radiusProvider(),
         togetherProvider(),
         vercelAIGatewayProvider(),
         xaiProvider(),

package/node_modules/@earendil-works/pi-ai/dist/providers/amazon-bedrock.js

@@ -2,19 +2,64 @@ import { bedrockConverseStreamApi } from "../api/bedrock-converse-stream.lazy.js
 import { createProvider } from "../models.js";
 import { AMAZON_BEDROCK_MODELS } from "./amazon-bedrock.models.js";
 /**
- * Bedrock auth is ambient: the AWS SDK's default credential chain handles the
- * actual signing, so `resolve` only reports whether the provider is
- * configured. A stored credential key is surfaced as the bearer token.
+ * Bedrock accepts a bearer token or the AWS SDK's default credential chain.
+ * The login flow can store a token/profile choice; resolve also detects ambient
+ * AWS credentials without copying them into pi's credential store.
  */
 const bedrockAuth = {
-    name: "AWS credentials",
+    name: "AWS credentials or bearer token",
+    login: async (interaction) => {
+        const method = await interaction.prompt({
+            type: "select",
+            message: "Select Amazon Bedrock authentication method:",
+            options: [
+                { id: "bearer-token", label: "Bearer token" },
+                { id: "aws-profile", label: "AWS profile" },
+                { id: "credential-chain", label: "Existing AWS credential chain" },
+            ],
+        });
+        if (method === "bearer-token") {
+            return {
+                type: "api_key",
+                key: await interaction.prompt({ type: "secret", message: "Enter Amazon Bedrock bearer token" }),
+            };
+        }
+        interaction.notify({
+            type: "info",
+            message: "Amazon Bedrock supports AWS profiles, IAM credentials, and role-based credentials.",
+            links: [
+                {
+                    label: "AWS credential provider chain",
+                    url: "https://docs.aws.amazon.com/sdkref/latest/guide/standardized-credentials.html",
+                },
+            ],
+        });
+        if (method === "aws-profile") {
+            return {
+                type: "api_key",
+                env: { AWS_PROFILE: await interaction.prompt({ type: "text", message: "Enter AWS profile name" }) },
+            };
+        }
+        if (method !== "credential-chain")
+            throw new Error(`Unknown Amazon Bedrock auth method: ${method}`);
+        await interaction.prompt({
+            type: "text",
+            message: "Configure AWS credentials, then press Enter to continue",
+        });
+        return { type: "api_key" };
+    },
     resolve: async ({ ctx, credential }) => {
         if (credential?.key)
             return { auth: { apiKey: credential.key }, source: "stored credential" };
         if (await ctx.env("AWS_BEARER_TOKEN_BEDROCK"))
             return { auth: {}, source: "AWS_BEARER_TOKEN_BEDROCK" };
-        if (await ctx.env("AWS_PROFILE"))
-            return { auth: {}, source: "AWS_PROFILE" };
+        if (credential?.env?.AWS_PROFILE ?? (await ctx.env("AWS_PROFILE"))) {
+            return {
+                auth: {},
+                env: credential?.env,
+                source: credential?.env?.AWS_PROFILE ? "stored credential" : "AWS_PROFILE",
+            };
+        }
         if ((await ctx.env("AWS_ACCESS_KEY_ID")) && (await ctx.env("AWS_SECRET_ACCESS_KEY"))) {
             return { auth: {}, source: "AWS access keys" };
         }