codiedev 0.10.0-beta.1 → 0.10.0-beta.11

package/dist/managedPi.js

@@ -0,0 +1,256 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedPiArgError = exports.GUARD_SOURCE = exports.BLOCKED_BASE_URL = exports.CAPTURE_FILE = exports.GUARD_FILE = exports.PI_PROVIDER_ENV = exports.PI_PROVIDER_ID = void 0;
+exports.managedPiAgentDir = managedPiAgentDir;
+exports.piProviderConfig = piProviderConfig;
+exports.prepareManagedPiDir = prepareManagedPiDir;
+exports.managedPiEnv = managedPiEnv;
+exports.managedPiArgs = managedPiArgs;
+exports.runManagedPi = runManagedPi;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const codieLauncher_1 = require("./codieLauncher");
+const piRuntime_1 = require("./piRuntime");
+const utils_1 = require("./utils");
+exports.PI_PROVIDER_ID = "codiedev";
+exports.PI_PROVIDER_ENV = [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "AZURE_OPENAI_API_KEY",
+    "AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_RESOURCE_NAME", "DEEPSEEK_API_KEY", "GEMINI_API_KEY",
+    "GROQ_API_KEY", "CEREBRAS_API_KEY", "XAI_API_KEY", "FIREWORKS_API_KEY", "OPENROUTER_API_KEY",
+    "AI_GATEWAY_API_KEY", "ZAI_API_KEY", "MISTRAL_API_KEY", "MINIMAX_API_KEY", "MOONSHOT_API_KEY",
+    "OPENCODE_API_KEY", "KIMI_API_KEY", "CLOUDFLARE_API_KEY", "XIAOMI_API_KEY",
+    "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+    "AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+    "AWS_BEARER_TOKEN_BEDROCK", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_API_KEY",
+    "COPILOT_GITHUB_TOKEN",
+];
+const BLOCKED_SUBCOMMANDS = new Set(["install", "remove", "uninstall", "config"]);
+exports.GUARD_FILE = "codie-guard.ts";
+exports.CAPTURE_FILE = "codiedev-capture.ts";
+exports.BLOCKED_BASE_URL = "http://127.0.0.1:9/blocked-by-codiedev";
+exports.GUARD_SOURCE = `// Written by Codiedev on every \`codie --pi\` launch. Edits are overwritten.
+import { execFile, execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { getProviders } from "@mariozechner/pi-ai";
+
+const PROVIDER = ${JSON.stringify(exports.PI_PROVIDER_ID)};
+const BLOCKED = ${JSON.stringify(exports.BLOCKED_BASE_URL)};
+const ours = (m) => Boolean(m && m.provider === PROVIDER);
+const label = (m) => (m ? m.provider + "/" + m.id : "that model");
+// pi runs a header value starting with "!" as a shell command, so no value
+// may start with one; branch and skill names are user-controlled.
+const clean = (v, max) => String(v ?? "").replace(/[\\r\\n]/g, "").trim().replace(/^!+/, "").slice(0, max);
+const git = (cwd, args) => { try { return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1500 }).trim(); } catch { return ""; } };
+
+export default function (pi) {
+  for (const p of getProviders()) if (p !== PROVIDER) pi.registerProvider(p, { baseUrl: BLOCKED });
+
+  let last;
+  const skills = new Set();
+  const fallback = (ctx) => last ?? ctx.modelRegistry.getAll().find(ours);
+  const pin = async (model, ctx) => {
+    const back = fallback(ctx);
+    if (back) await pi.setModel(back);
+    if (ctx.hasUI) ctx.ui.notify("codie: " + label(model) + " isn't a Codiedev-approved model" + (back ? "; using " + back.id : "") + ".", "warning");
+  };
+  const tag = (ctx) => {
+    const headers = {};
+    const session = clean(ctx.sessionManager?.getSessionId?.(), 200);
+    if (session) headers["X-Codiedev-Session-Id"] = session;
+    const repo = clean(git(ctx.cwd, ["remote", "get-url", "origin"]).replace(/\\/\\/[^/@]*@/, "//"), 2048);
+    if (repo) headers["X-Codiedev-Repo-Url"] = repo;
+    const branch = clean(git(ctx.cwd, ["branch", "--show-current"]), 200);
+    if (branch) headers["X-Codiedev-Branch"] = branch;
+    const sha = clean(git(ctx.cwd, ["rev-parse", "HEAD"]), 40);
+    if (/^[0-9a-f]{7,40}$/i.test(sha)) headers["X-Codiedev-Head-Sha"] = sha;
+    const list = clean([...skills].join(","), 4096);
+    if (list) headers["X-Codiedev-Skills-Used"] = list;
+    // pi replaces the provider's whole request config here, so the key name
+    // goes with the headers every time.
+    pi.registerProvider(PROVIDER, { apiKey: "CODIEDEV_GATEWAY_KEY", headers });
+  };
+
+  pi.on("session_start", async (_event, ctx) => {
+    skills.clear();
+    for (const m of ctx.modelRegistry.getAll()) if (!ours(m)) pi.registerProvider(m.provider, { baseUrl: BLOCKED });
+    if (ours(ctx.model)) last = ctx.model;
+    else await pin(ctx.model, ctx);
+    tag(ctx);
+  });
+  pi.on("model_select", async (event, ctx) => {
+    if (ours(event.model)) last = event.model;
+    else await pin(event.model, ctx);
+  });
+  pi.on("input", async (event) => {
+    const m = String(event?.text ?? "").match(/^\\/skill:([a-z0-9][a-z0-9_.:-]{0,119})(?:\\s|$)/i);
+    if (m && skills.size < 50) skills.add(m[1]);
+  });
+  pi.on("tool_result", async (event) => {
+    const p = String(event?.input?.path ?? "").replace(/\\\\/g, "/").match(/\\/([a-z0-9][a-z0-9_.:-]{0,119})\\/SKILL\\.md$/i);
+    if (event?.toolName === "read" && !event.isError && p && skills.size < 50) skills.add(p[1]);
+  });
+  // Browser sign-in: pi reads CODIEDEV_GATEWAY_KEY at request time, so put
+  // the current token there, refreshing it as it nears expiry (same logic as
+  // assets/session-key.mjs). Pasted API tokens: no variables, nothing changes.
+  const freshKey = async () => {
+    const env = process.env;
+    if (!env.CODIEDEV_SESSION_CONFIG || !env.CODIEDEV_CLI_JS || !env.CODIEDEV_NODE) return;
+    const read = () => { try { const c = JSON.parse(readFileSync(env.CODIEDEV_SESSION_CONFIG, "utf8")); return c && c.auth && c.token ? c : null; } catch { return null; } };
+    let s = read();
+    if (!s) return;
+    if (!(Number(s.auth.accessTokenExpiresAt) - Date.now() > 30 * 60000)) {
+      await new Promise((r) => execFile(env.CODIEDEV_NODE, [env.CODIEDEV_CLI_JS, "session-refresh"], { timeout: 30000 }, () => r()));
+      s = read() ?? s;
+    }
+    env.CODIEDEV_GATEWAY_KEY = s.token;
+  };
+  // Before every model call in the turn: the agent may have switched branch.
+  pi.on("turn_start", async (_event, ctx) => { await freshKey(); tag(ctx); });
+  pi.on("before_provider_request", (_event, ctx) => {
+    // Belt and braces: the request is already headed for BLOCKED.
+    if (!ours(ctx.model)) ctx.abort();
+  });
+}
+`;
+function managedPiAgentDir(stateDir) {
+    return path.join(stateDir, "managed", "pi", "agent");
+}
+function piProviderConfig(gatewayUrl, catalog) {
+    return {
+        baseUrl: gatewayUrl.replace(/\/+$/, ""),
+        api: "openai-completions",
+        apiKey: "CODIEDEV_GATEWAY_KEY",
+        compat: { supportsDeveloperRole: false, supportsReasoningEffort: false },
+        models: catalog.map((model) => ({
+            id: (0, codieLauncher_1.bareModel)(model.id),
+            name: model.name || (0, codieLauncher_1.bareModel)(model.id),
+            ...(model.limit ? { contextWindow: model.limit.context, maxTokens: model.limit.output } : {}),
+            ...(model.cost ? { cost: { input: model.cost.input, output: model.cost.output, cacheRead: 0, cacheWrite: 0 } } : {}),
+        })),
+    };
+}
+function writeJsonAtomic(file, value) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+function prepareManagedPiDir(opts) {
+    const { agentDir, gatewayUrl, catalog } = opts;
+    if (!catalog.length)
+        throw new Error("No company-approved models were returned by Codiedev");
+    const ids = catalog.map((model) => (0, codieLauncher_1.bareModel)(model.id));
+    const requested = (0, codieLauncher_1.bareModel)(opts.model ?? "");
+    if (requested && !ids.includes(requested)) {
+        throw new Error(`Primary agent model is not approved for this Codiedev account: ${requested}`);
+    }
+    fs.mkdirSync(agentDir, { recursive: true, mode: 0o700 });
+    writeJsonAtomic(path.join(agentDir, "models.json"), { providers: { [exports.PI_PROVIDER_ID]: piProviderConfig(gatewayUrl, catalog) } });
+    writeJsonAtomic(path.join(agentDir, "settings.json"), {
+        defaultProvider: exports.PI_PROVIDER_ID,
+        defaultModel: requested || ids[0],
+        enabledModels: ids.map((id) => `${exports.PI_PROVIDER_ID}/${id}`),
+        packages: [],
+        extensions: [],
+        skills: opts.skillPaths ?? [],
+        enableInstallTelemetry: false,
+    });
+    fs.rmSync(path.join(agentDir, "auth.json"), { force: true });
+    fs.rmSync(path.join(agentDir, "extensions"), { recursive: true, force: true });
+    const guard = path.join(agentDir, exports.GUARD_FILE);
+    fs.writeFileSync(guard, exports.GUARD_SOURCE, { mode: 0o600 });
+    const capture = path.join(agentDir, exports.CAPTURE_FILE);
+    fs.writeFileSync(capture, (0, utils_1.piExtensionSource)(), { mode: 0o600 });
+    return [guard, capture];
+}
+function managedPiEnv(env, agentDir, key, platform = process.platform) {
+    const blocked = new Set([...exports.PI_PROVIDER_ENV, "PI_CODING_AGENT_DIR"]);
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        if (blocked.has(platform === "win32" ? k.toUpperCase() : k))
+            continue;
+        out[k] = v;
+    }
+    out.PI_CODING_AGENT_DIR = agentDir;
+    out.PI_TELEMETRY = "0";
+    out.CODIEDEV_GATEWAY_KEY = key;
+    return out;
+}
+class ManagedPiArgError extends Error {
+}
+exports.ManagedPiArgError = ManagedPiArgError;
+function managedPiArgs(args, extensions) {
+    if (args.length && BLOCKED_SUBCOMMANDS.has(args[0])) {
+        throw new ManagedPiArgError(`\`pi ${args[0]}\` changes extension sources, which codie --pi manages. Ask your Codiedev admin to approve a package instead.`);
+    }
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--")
+            break;
+        const [flag, inline] = a.startsWith("--") && a.includes("=") ? [a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1)] : [a, undefined];
+        if (flag === "--api-key")
+            throw new ManagedPiArgError("--api-key isn't allowed in codie --pi: models come from Codiedev.");
+        if (flag === "-e" || flag === "--extension")
+            throw new ManagedPiArgError(`${flag} isn't allowed in codie --pi: extensions are managed by Codiedev.`);
+        if (flag === "--provider") {
+            const value = inline ?? args[i + 1];
+            if (value !== exports.PI_PROVIDER_ID)
+                throw new ManagedPiArgError(`--provider ${value ?? "(none)"} isn't allowed in codie --pi: only Codiedev-approved models are available.`);
+        }
+    }
+    return ["--no-extensions", ...extensions.flatMap((file) => ["-e", file]), ...args];
+}
+function runManagedPi(opts) {
+    const env = opts.env ?? process.env;
+    const agentDir = managedPiAgentDir(opts.stateDir);
+    const extensions = prepareManagedPiDir({
+        agentDir, gatewayUrl: opts.gatewayUrl, catalog: opts.catalog, model: env.CODIEDEV_MODEL,
+        skillPaths: opts.skillPaths,
+    });
+    const args = managedPiArgs(opts.args, extensions);
+    const bin = env.CODIEDEV_PI_BIN?.trim();
+    const [command, commandArgs] = bin
+        ? [bin, args]
+        : [process.execPath, [(opts.resolvePi ?? (() => (0, piRuntime_1.ensurePiRuntime)({ stateDir: opts.stateDir })))(), ...args]];
+    const result = (0, child_process_1.spawnSync)(command, commandArgs, {
+        stdio: "inherit",
+        env: managedPiEnv(env, agentDir, opts.key),
+        shell: Boolean(bin) && process.platform === "win32",
+    });
+    if (result.error)
+        throw result.error;
+    return result.status === null ? 1 : result.status;
+}