gsd-pi 2.76.0-dev.b072ebb73 → 2.76.0-dev.fe143342a

package/packages/pi-coding-agent/src/core/model-registry.ts

@@ -29,7 +29,7 @@ import { getAgentDir } from "../config.js";
 import type { AuthStorage } from "./auth-storage.js";
 import { ModelDiscoveryCache } from "./discovery-cache.js";
 import type { DiscoveredModel, DiscoveryResult } from "./model-discovery.js";
-import { getDefaultTTL, getDiscoverableProviders, getDiscoveryAdapter } from "./model-discovery.js";
+import { getDefaultTTL, getDiscoverableProviders, getDiscoveryAdapter, supportsDiscoveryForApi } from "./model-discovery.js";
 import { clearConfigValueCache, resolveConfigValue, resolveHeaders } from "./resolve-config-value.js";
 import { isLocalModel } from "./local-model-check.js";
 
@@ -788,11 +788,12 @@ export class ModelRegistry {
 	 * Results are cached and merged into the registry (never overrides existing models).
 	 */
 	async discoverModels(providers?: string[]): Promise<DiscoveryResult[]> {
-		const targetProviders = providers ?? getDiscoverableProviders();
+		const targetProviders = providers ?? this.getAutoDiscoverableProviders();
 		const results: DiscoveryResult[] = [];
 
 		for (const providerName of targetProviders) {
-			const adapter = getDiscoveryAdapter(providerName);
+			const providerApis = this.getProviderApis(providerName);
+			const adapter = getDiscoveryAdapter(providerName, providerApis);
 			if (!adapter.supportsDiscovery) continue;
 
 			// Skip if cache is still fresh
@@ -812,8 +813,10 @@ export class ModelRegistry {
 				const apiKey = await this.authStorage.getApiKey(providerName);
 				if (!apiKey && !this.isProviderRequestReady(providerName)) continue;
 
-				const models = await adapter.fetchModels(apiKey ?? "", undefined);
-				this.discoveryCache.set(providerName, models);
+				const baseUrl = this.getProviderBaseUrl(providerName);
+				const models = await adapter.fetchModels(apiKey ?? "", baseUrl);
+				const ttlMs = this.getDiscoveryTtl(providerName, providerApis);
+				this.discoveryCache.set(providerName, models, ttlMs);
 				results.push({
 					provider: providerName,
 					models,
@@ -865,24 +868,97 @@ export class ModelRegistry {
 		const converted: Model<Api>[] = [];
 		for (const result of results) {
 			if (result.error) continue;
+			const providerDefaults = this.getDiscoveryProviderDefaults(result.provider);
 			for (const dm of result.models) {
 				converted.push({
 					id: dm.id,
 					name: dm.name ?? dm.id,
-					api: "openai" as Api,
+					api: providerDefaults.api,
 					provider: result.provider,
-					baseUrl: "",
+					baseUrl: providerDefaults.baseUrl,
 					reasoning: dm.reasoning ?? false,
-					input: dm.input ?? ["text"],
+					input: dm.input ?? providerDefaults.input,
 					cost: dm.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-					contextWindow: dm.contextWindow ?? 128000,
-					maxTokens: dm.maxTokens ?? 16384,
+					contextWindow: dm.contextWindow ?? providerDefaults.contextWindow,
+					maxTokens: dm.maxTokens ?? providerDefaults.maxTokens,
 				} as Model<Api>);
 			}
 		}
 		return converted;
 	}
 
+	private getProviderApis(provider: string): Set<string> {
+		const apis = new Set<string>();
+		for (const model of this.models) {
+			if (model.provider === provider && typeof model.api === "string" && model.api.length > 0) {
+				apis.add(model.api);
+			}
+		}
+
+		const providerConfig = this.registeredProviders.get(provider);
+		if (providerConfig?.api) apis.add(providerConfig.api);
+		for (const modelDef of providerConfig?.models ?? []) {
+			if (modelDef.api) apis.add(modelDef.api);
+		}
+		return apis;
+	}
+
+	private getAutoDiscoverableProviders(): string[] {
+		const discoverable = new Set<string>(getDiscoverableProviders());
+		for (const provider of new Set(this.models.map((m) => m.provider))) {
+			const apis = this.getProviderApis(provider);
+			for (const api of apis) {
+				if (supportsDiscoveryForApi(api)) {
+					discoverable.add(provider);
+					break;
+				}
+			}
+		}
+		return [...discoverable];
+	}
+
+	private getProviderBaseUrl(provider: string): string | undefined {
+		const fromModels = this.models.find((m) => m.provider === provider && typeof m.baseUrl === "string" && m.baseUrl.length > 0);
+		if (fromModels?.baseUrl) return fromModels.baseUrl;
+		return this.registeredProviders.get(provider)?.baseUrl;
+	}
+
+	private getDiscoveryProviderDefaults(provider: string): {
+		api: Api;
+		baseUrl: string;
+		input: ("text" | "image")[];
+		contextWindow: number;
+		maxTokens: number;
+	} {
+		const first = this.models.find((m) => m.provider === provider);
+		if (first) {
+			return {
+				api: first.api,
+				baseUrl: first.baseUrl,
+				input: first.input,
+				contextWindow: first.contextWindow,
+				maxTokens: first.maxTokens,
+			};
+		}
+
+		return {
+			api: "openai-completions",
+			baseUrl: this.registeredProviders.get(provider)?.baseUrl ?? "",
+			input: ["text"],
+			contextWindow: 128000,
+			maxTokens: 16384,
+		};
+	}
+
+	private getDiscoveryTtl(provider: string, providerApis: Set<string>): number {
+		for (const api of providerApis) {
+			if (supportsDiscoveryForApi(api)) {
+				return getDefaultTTL("openai");
+			}
+		}
+		return getDefaultTTL(provider);
+	}
+
 	/**
 	 * Check if a model's baseUrl points to a local endpoint.
 	 * Delegates to standalone isLocalModel() function.

package/packages/pi-coding-agent/src/core/redact-secrets.test.ts

@@ -0,0 +1,86 @@
+// pi-coding-agent — unit tests for session-log secret redaction
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import { redactSecrets } from "./redact-secrets.js";
+
+describe("redactSecrets", () => {
+	it("is a no-op on plain text with no secret markers", () => {
+		const input = "Hello world — this is just some prose with numbers 12345 and dashes - - -.";
+		assert.equal(redactSecrets(input), input);
+	});
+
+	it("redacts Anthropic keys before generic openai sk- pattern", () => {
+		const out = redactSecrets("key=sk-ant-api03-abcDEF1234567890abcDEF1234567890");
+		assert.equal(out, "key=[REDACTED:anthropic]");
+	});
+
+	it("redacts legacy OpenAI sk- keys", () => {
+		const out = redactSecrets("OPENAI_API_KEY=sk-abcDEF1234567890abcDEF12");
+		assert.equal(out, "OPENAI_API_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts OpenAI project sk-proj- keys with hyphens/underscores in body", () => {
+		const out = redactSecrets("OPENAI_API_KEY=sk-proj-AbCd_1234-EfGh_5678-IjKl_9012");
+		assert.equal(out, "OPENAI_API_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts OpenAI admin sk-admin- keys", () => {
+		const out = redactSecrets("OPENAI_ADMIN_KEY=sk-admin-AbCd1234EfGh5678IjKl9012");
+		assert.equal(out, "OPENAI_ADMIN_KEY=[REDACTED:openai]");
+	});
+
+	it("redacts LlamaCloud llx- keys", () => {
+		const out = redactSecrets("LLAMA_CLOUD_API_KEY=llx-abcDEF1234567890abcDEF1234567890");
+		assert.equal(out, "LLAMA_CLOUD_API_KEY=[REDACTED:llamacloud]");
+	});
+
+	it("redacts AWS access key ids", () => {
+		const out = redactSecrets("aws_access_key_id = AKIAIOSFODNN7EXAMPLE");
+		assert.equal(out, "aws_access_key_id = [REDACTED:aws-access-key]");
+	});
+
+	it("redacts GitHub personal/oauth/app/server/refresh tokens", () => {
+		const out = redactSecrets("token=ghp_abcdefghijklmnopqrstuvwxyz0123456789");
+		assert.equal(out, "token=[REDACTED:github-token]");
+	});
+
+	it("redacts Slack tokens", () => {
+		const out = redactSecrets("slack=xoxb-1234567890-abcdefghij");
+		assert.equal(out, "slack=[REDACTED:slack-token]");
+	});
+
+	it("redacts Google API keys", () => {
+		// Google API keys are exactly AIza + 35 chars (39 total).
+		const out = redactSecrets("key=AIzaSyA-1234567890abcdefghijklmnopqrstu");
+		assert.equal(out, "key=[REDACTED:google-api-key]");
+	});
+
+	it("redacts PEM private key blocks across newlines", () => {
+		const pem = [
+			"-----BEGIN RSA PRIVATE KEY-----",
+			"MIIEowIBAAKCAQEAabcDEF...",
+			"morekeymaterial==",
+			"-----END RSA PRIVATE KEY-----",
+		].join("\n");
+		const out = redactSecrets(`before\n${pem}\nafter`);
+		assert.equal(out, "before\n[REDACTED:pem-private-key]\nafter");
+	});
+
+	it("redacts multiple secrets in the same string", () => {
+		const out = redactSecrets(
+			"AZURE_CLIENT_SECRET: also llx-abcDEF1234567890abcDEF1234567890 and AKIAIOSFODNN7EXAMPLE",
+		);
+		assert.equal(
+			out,
+			"AZURE_CLIENT_SECRET: also [REDACTED:llamacloud] and [REDACTED:aws-access-key]",
+		);
+	});
+
+	it("does not redact short strings that merely contain sk- prose", () => {
+		// "sk-foo" is too short to match the openai pattern — must be 20+ chars.
+		const input = "the sk- prefix isn't always a secret";
+		assert.equal(redactSecrets(input), input);
+	});
+});

package/packages/pi-coding-agent/src/core/redact-secrets.ts

@@ -0,0 +1,58 @@
+// pi-coding-agent — secret redaction for session log persistence
+//
+// Called by prepareForPersistence() in session-manager.ts on every string
+// before it lands in the JSONL transcript. Replaces well-known secret shapes
+// with [REDACTED:<kind>] placeholders so credentials pasted by the user or
+// read from .env-style files never persist to disk.
+//
+// Pattern selection bias: high-specificity shapes only. Loose patterns
+// (e.g. FOO_SECRET=...) produce too many false positives in docs and code
+// samples and are intentionally excluded.
+
+interface SecretPattern {
+	kind: string;
+	regex: RegExp;
+}
+
+// Order matters: more-specific patterns first (sk-ant- before generic sk-).
+const PATTERNS: readonly SecretPattern[] = [
+	{ kind: "anthropic", regex: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+	{ kind: "llamacloud", regex: /llx-[A-Za-z0-9_-]{20,}/g },
+	// Covers all three official OpenAI key shapes: legacy `sk-…`, project `sk-proj-…`,
+	// and admin `sk-admin-…`. Hyphens and underscores appear inside real project keys
+	// so the remainder class must allow them. `sk-ant-` is matched earlier by the
+	// anthropic pattern and already replaced by the time this runs.
+	{ kind: "openai", regex: /sk-(?:proj-|admin-)?[A-Za-z0-9_-]{20,}/g },
+	{ kind: "aws-access-key", regex: /\b(?:AKIA|ASIA|AROA)[0-9A-Z]{16}\b/g },
+	{ kind: "github-token", regex: /\bgh[pousr]_[A-Za-z0-9]{30,}\b/g },
+	{ kind: "slack-token", regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+	{ kind: "google-api-key", regex: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+	{
+		kind: "pem-private-key",
+		regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+	},
+];
+
+export function redactSecrets(input: string): string {
+	// Short-circuit: skip regex work on strings with no plausible secret markers.
+	// Cheap heuristic — if none of these substrings are present, no pattern can match.
+	if (
+		!input.includes("sk-") &&
+		!input.includes("llx-") &&
+		!input.includes("AKIA") &&
+		!input.includes("ASIA") &&
+		!input.includes("AROA") &&
+		!input.includes("gh") &&
+		!input.includes("xox") &&
+		!input.includes("AIza") &&
+		!input.includes("PRIVATE KEY")
+	) {
+		return input;
+	}
+
+	let out = input;
+	for (const { kind, regex } of PATTERNS) {
+		out = out.replace(regex, `[REDACTED:${kind}]`);
+	}
+	return out;
+}

package/packages/pi-coding-agent/src/core/session-manager.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, it, afterEach } from "node:test";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -63,3 +63,38 @@ describe("SessionManager usage totals", () => {
 		});
 	});
 });
+
+describe("SessionManager secret redaction on persistence", () => {
+	let dir: string;
+
+	afterEach(() => {
+		if (dir) {
+			rmSync(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("scrubs known secret shapes from JSONL on disk", () => {
+		dir = mkdtempSync(join(tmpdir(), "gsd-session-redact-test-"));
+		const manager = SessionManager.create(dir, dir);
+
+		const leakedKey = "llx-abcDEF1234567890abcDEF1234567890";
+		manager.appendMessage({
+			role: "user",
+			content: [{ type: "text", text: `here is my key: ${leakedKey}` }],
+		} as any);
+		// Persistence is gated on an assistant message being present.
+		manager.appendMessage(makeAssistantMessage(1, 1, 0, 0, 0));
+
+		const sessionFile = manager.getSessionFile();
+		assert.ok(sessionFile, "session file should be set");
+		const contents = readFileSync(sessionFile!, "utf8");
+		assert.ok(
+			!contents.includes(leakedKey),
+			"raw secret must not appear in persisted JSONL",
+		);
+		assert.ok(
+			contents.includes("[REDACTED:llamacloud]"),
+			"redaction placeholder must appear in persisted JSONL",
+		);
+	});
+});

package/packages/pi-coding-agent/src/core/session-manager.ts

@@ -26,6 +26,7 @@ import {
 	createCustomMessage,
 } from "./messages.js";
 import { BlobStore, externalizeImageData, isBlobRef, resolveImageData } from "./blob-store.js";
+import { redactSecrets } from "./redact-secrets.js";
 
 /** Inline concurrency limiter to cap parallel async operations. */
 function pLimit(concurrency: number) {
@@ -499,15 +500,18 @@ function prepareForPersistence(obj: unknown, blobStore: BlobStore, key?: string)
 	if (obj === null || obj === undefined) return obj;
 
 	if (typeof obj === "string") {
-		if (obj.length > MAX_PERSIST_CHARS) {
-			// Cryptographic signatures must be preserved exactly or cleared entirely
-			if (key === "thinkingSignature" || key === "thoughtSignature" || key === "textSignature") {
+		// Cryptographic signatures must be preserved byte-exact — never redact or truncate
+		// their contents, only the oversize-clear path below handles them.
+		const isSignature = key === "thinkingSignature" || key === "thoughtSignature" || key === "textSignature";
+		const redacted = isSignature ? obj : redactSecrets(obj);
+		if (redacted.length > MAX_PERSIST_CHARS) {
+			if (isSignature) {
 				return "";
 			}
 			const limit = Math.max(0, MAX_PERSIST_CHARS - TRUNCATION_NOTICE.length);
-			return `${truncateString(obj, limit)}${TRUNCATION_NOTICE}`;
+			return `${truncateString(redacted, limit)}${TRUNCATION_NOTICE}`;
 		}
-		return obj;
+		return redacted;
 	}
 
 	if (Array.isArray(obj)) {

package/packages/pi-coding-agent/src/modes/interactive/components/chat-frame.ts

@@ -2,7 +2,7 @@ import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
 import { theme } from "../theme/theme.js";
 import { formatTimestamp, type TimestampFormat } from "./timestamp.js";
 
-type FrameTone = "assistant" | "user" | "compaction";
+type FrameTone = "assistant" | "user" | "compaction" | "skill";
 
 function trimOuterBlankLines(lines: string[]): string[] {
 	let start = 0;
@@ -25,14 +25,14 @@ export function renderChatFrame(
 ): string[] {
 	const outerWidth = Math.max(20, width);
 	const contentWidth = Math.max(1, outerWidth - 2); // "│ " + content
+	const isPurple = opts.tone === "compaction" || opts.tone === "skill";
 	const borderColor =
 		opts.tone === "user"
 			? "border"
-			: opts.tone === "compaction"
+			: isPurple
 				? "customMessageLabel"
 				: "borderAccent";
-	const borderMuted =
-		opts.tone === "compaction" ? "customMessageLabel" : "borderMuted";
+	const borderMuted = isPurple ? "customMessageLabel" : "borderMuted";
 	const border = (s: string) => theme.fg(borderColor, s);
 	const leftRaw = `• ${opts.label}`;
 	const rightRaw =
@@ -47,7 +47,7 @@ export function renderChatFrame(
 	const labelColor =
 		opts.tone === "user"
 			? "border"
-			: opts.tone === "compaction"
+			: isPurple
 				? "customMessageLabel"
 				: "borderAccent";
 	const dashIdx = left.indexOf(" - ");
@@ -71,7 +71,7 @@ export function renderChatFrame(
 	const bodyColor =
 		opts.tone === "user"
 			? "userMessageText"
-			: opts.tone === "compaction"
+			: isPurple
 				? "customMessageText"
 				: "assistantMessageText";
 	const bodyLines = (sourceLines.length > 0 ? sourceLines : [""]).map((line) => {

package/packages/pi-coding-agent/src/modes/interactive/components/provider-manager.ts

@@ -12,7 +12,7 @@ import {
 	type TUI,
 } from "@gsd/pi-tui";
 import type { AuthStorage } from "../../../core/auth-storage.js";
-import { getDiscoverableProviders } from "../../../core/model-discovery.js";
+import { getDiscoverableProviders, getDiscoveryAdapter } from "../../../core/model-discovery.js";
 import { providerDisplayName } from "./model-selector.js";
 import type { ModelRegistry } from "../../../core/model-registry.js";
 import { ModelsJsonWriter } from "../../../core/models-json-writer.js";
@@ -102,12 +102,21 @@ export class ProviderManagerComponent extends Container implements Focusable {
 
 		this.providers = Array.from(providerNames)
 			.sort()
-			.map((name) => ({
-				name,
-				hasAuth: this.authStorage.hasAuth(name),
-				supportsDiscovery: discoverableSet.has(name),
-				modelCount: providerModelCounts.get(name) ?? 0,
-			}));
+			.map((name) => {
+				const providerApis = new Set(
+					allModels
+						.filter((m) => m.provider === name)
+						.map((m) => m.api)
+						.filter((api): api is string => typeof api === "string" && api.length > 0),
+				);
+				return {
+					name,
+					hasAuth: this.authStorage.hasAuth(name),
+					supportsDiscovery:
+						discoverableSet.has(name) || getDiscoveryAdapter(name, providerApis).supportsDiscovery,
+					modelCount: providerModelCounts.get(name) ?? 0,
+				};
+			});
 		this.clampSelectedIndex();
 	}
 

package/packages/pi-coding-agent/src/modes/interactive/components/skill-invocation-message.ts

@@ -1,55 +1,69 @@
-import { Box, Markdown, type MarkdownTheme, Text } from "@gsd/pi-tui";
+// GSD / pi-coding-agent — Skill invocation message component
+import { Container, Markdown, type MarkdownTheme, Text } from "@gsd/pi-tui";
 import type { ParsedSkillBlock } from "../../../core/agent-session.js";
 import { getMarkdownTheme, theme } from "../theme/theme.js";
+import { renderChatFrame } from "./chat-frame.js";
 import { editorKey } from "./keybinding-hints.js";
 
 /**
- * Component that renders a skill invocation message with collapsed/expanded state.
- * Uses same background color as custom messages for visual consistency.
- * Only renders the skill block itself - user message is rendered separately.
+ * Renders a skill invocation in the shared chat-frame style (top rule,
+ * `• skill - <name>` header, `│ ` body margin) with purple border/label
+ * matching compaction so it visually aligns with user/assistant messages.
  */
-export class SkillInvocationMessageComponent extends Box {
+export class SkillInvocationMessageComponent extends Container {
 	private expanded = false;
 	private skillBlock: ParsedSkillBlock;
 	private markdownTheme: MarkdownTheme;
 
 	constructor(skillBlock: ParsedSkillBlock, markdownTheme: MarkdownTheme = getMarkdownTheme()) {
-		super(1, 1, (t) => theme.bg("customMessageBg", t));
+		super();
 		this.skillBlock = skillBlock;
 		this.markdownTheme = markdownTheme;
-		this.updateDisplay();
+		this.rebuild();
 	}
 
 	setExpanded(expanded: boolean): void {
-		this.expanded = expanded;
-		this.updateDisplay();
+		if (this.expanded !== expanded) {
+			this.expanded = expanded;
+			this.rebuild();
+		}
 	}
 
 	override invalidate(): void {
 		super.invalidate();
-		this.updateDisplay();
+		this.rebuild();
 	}
 
-	private updateDisplay(): void {
+	private rebuild(): void {
 		this.clear();
 
 		if (this.expanded) {
-			// Expanded: label + skill name header + full content
-			const label = theme.fg("customMessageLabel", theme.bold("[skill]"));
-			this.addChild(new Text(label, 0, 0));
-			const header = `**${this.skillBlock.name}**\n\n`;
 			this.addChild(
-				new Markdown(header + this.skillBlock.content, 0, 0, this.markdownTheme, {
+				new Markdown(this.skillBlock.content, 0, 0, this.markdownTheme, {
 					color: (text: string) => theme.fg("customMessageText", text),
 				}),
 			);
 		} else {
-			// Collapsed: single line - [skill] name (hint to expand)
-			const line =
-				theme.fg("customMessageLabel", theme.bold("[skill]") + " ") +
-				theme.fg("customMessageText", this.skillBlock.name) +
-				theme.fg("dim", ` (${editorKey("expandTools")} to expand)`);
-			this.addChild(new Text(line, 0, 0));
+			this.addChild(
+				new Text(
+					theme.fg("dim", `(${editorKey("expandTools")} to expand)`),
+					0,
+					0,
+				),
+			);
 		}
 	}
+
+	override render(width: number): string[] {
+		const frameWidth = Math.max(20, width);
+		const contentWidth = Math.max(1, frameWidth - 4);
+		const lines = super.render(contentWidth);
+		const framed = renderChatFrame(lines, frameWidth, {
+			label: `skill - ${this.skillBlock.name}`,
+			tone: "skill",
+			timestampFormat: "date-time-iso",
+			showTimestamp: false,
+		});
+		return framed.length > 0 ? ["", ...framed] : framed;
+	}
 }