gsd-pi 2.80.0-dev.4ea7d80e7 → 2.80.0-dev.7582bf37a

package/packages/pi-ai/src/providers/minimax-tool-name.test.ts

@@ -12,40 +12,53 @@
  */
 import test, { describe } from "node:test";
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { buildAnthropicClientOptions } from "./anthropic.js";
 import { convertMessages } from "./anthropic-shared.js";
+import type { Model } from "../types.js";
 import type { AssistantMessage } from "../types.js";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-function resolveSourcePath(fileName: string): string {
-	const localPath = join(__dirname, fileName);
-	if (existsSync(localPath)) return localPath;
-	return join(__dirname, "..", "..", "src", "providers", fileName);
+function anthropicModel(overrides: Partial<Model<"anthropic-messages">> = {}): Model<"anthropic-messages"> {
+	return {
+		id: "claude-sonnet-4",
+		name: "Claude Sonnet 4",
+		api: "anthropic-messages",
+		provider: "anthropic",
+		baseUrl: "https://api.anthropic.com",
+		reasoning: true,
+		input: ["text"],
+		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+		contextWindow: 200000,
+		maxTokens: 8192,
+		...overrides,
+	};
 }
 
-const source = readFileSync(resolveSourcePath("anthropic.ts"), "utf-8");
-
 describe("MiniMax fine-grained-tool-streaming exclusion (#4538)", () => {
 	test("minimax is excluded from fine-grained-tool-streaming-2025-05-14 beta", () => {
-		// The skipBetaHeaders flag must include minimax so it never receives the
-		// fine-grained-tool-streaming beta that causes empty tool names.
-		assert.match(
-			source,
-			/skipBetaHeaders.*minimax/s,
-			"minimax must be included in skipBetaHeaders to suppress fine-grained-tool-streaming",
+		const options = buildAnthropicClientOptions(anthropicModel({ provider: "minimax" }), "api-key", false);
+
+		assert.equal(
+			options.defaultHeaders["anthropic-beta"],
+			undefined,
+			"minimax must suppress fine-grained-tool-streaming",
 		);
 	});
 
 	test("minimax-cn is excluded from fine-grained-tool-streaming-2025-05-14 beta", () => {
-		assert.match(
-			source,
-			/skipBetaHeaders.*minimax-cn/s,
-			"minimax-cn must be included in skipBetaHeaders to suppress fine-grained-tool-streaming",
+		const options = buildAnthropicClientOptions(anthropicModel({ provider: "minimax-cn" }), "api-key", false);
+
+		assert.equal(
+			options.defaultHeaders["anthropic-beta"],
+			undefined,
+			"minimax-cn must suppress fine-grained-tool-streaming",
 		);
 	});
+
+	test("standard Anthropic-compatible providers keep fine-grained-tool-streaming enabled", () => {
+		const options = buildAnthropicClientOptions(anthropicModel(), "api-key", false);
+
+		assert.equal(options.defaultHeaders["anthropic-beta"], "fine-grained-tool-streaming-2025-05-14");
+	});
 });
 
 describe("empty tool name guard in convertMessages (#4538)", () => {

package/packages/pi-ai/src/types.ts

@@ -1,3 +1,4 @@
+// GSD2 - Shared AI provider type definitions
 import type { AssistantMessageEventStream } from "./utils/event-stream.js";
 
 export type { AssistantMessageEventStream } from "./utils/event-stream.js";
@@ -116,6 +117,8 @@ export type ProviderStreamOptions = StreamOptions & Record<string, unknown>;
 
 // Unified options with reasoning passed to streamSimple() and completeSimple()
 export interface SimpleStreamOptions extends StreamOptions {
+	/** Workspace root for providers that spawn local processes. */
+	cwd?: string;
 	reasoning?: ThinkingLevel;
 	/** Custom token budgets for thinking levels (token-based providers only) */
 	thinkingBudgets?: ThinkingBudgets;

package/packages/pi-ai/src/utils/oauth/github-copilot.test.ts

@@ -1,26 +1,14 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import type { Api, Model } from "../../types.js";
 import type { OAuthCredentials } from "./types.js";
 import {
 	getGitHubCopilotBaseUrl,
 	githubCopilotOAuthProvider,
+	loginGitHubCopilot,
 	normalizeDomain,
 } from "./github-copilot.js";
 
-const __dirname = fileURLToPath(new URL(".", import.meta.url));
-const packageRoot = join(__dirname, "..", "..", "..");
-const sourceDir = existsSync(join(__dirname, "github-copilot.ts"))
-	? __dirname
-	: join(packageRoot, "src", "utils", "oauth");
-
-function readSourceFile(name: string): string {
-	return readFileSync(join(sourceDir, name), "utf-8");
-}
-
 function createModel(overrides: Partial<Model<Api>> = {}): Model<Api> {
 	return {
 		id: "test-model",
@@ -191,16 +179,62 @@ describe("GitHub Copilot OAuth — credential regression", () => {
 		assert.ok(githubCopilotOAuthProvider);
 	});
 
-	test("CLIENT_ID is plaintext (not base64)", () => {
-		const content = readSourceFile("github-copilot.ts");
-		assert.ok(content.includes('CLIENT_ID = "Iv1.b507a08c87ecfe98"'));
-		assert.ok(!content.includes("atob("));
-	});
+	test("device login sends the public OAuth client id without a client secret", async (t) => {
+		const calls: Array<{ url: string; init: RequestInit }> = [];
+		const originalFetch = globalThis.fetch;
+		t.after(() => {
+			globalThis.fetch = originalFetch;
+		});
+
+		globalThis.fetch = async (input: string | URL | Request, init?: RequestInit) => {
+			const url = String(input);
+			calls.push({ url, init: init ?? {} });
+
+			if (url.endsWith("/login/device/code")) {
+				return Response.json({
+					device_code: "device-code",
+					user_code: "ABCD-EFGH",
+					verification_uri: "https://github.com/login/device",
+					interval: 1,
+					expires_in: 600,
+				});
+			}
+
+			if (url.endsWith("/login/oauth/access_token")) {
+				return Response.json({ access_token: "github-access-token" });
+			}
+
+			if (url.endsWith("/copilot_internal/v2/token")) {
+				return Response.json({
+					token: "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;",
+					expires_at: Math.floor(Date.now() / 1000) + 3600,
+				});
+			}
+
+			if (url.endsWith("/models")) {
+				return Response.json({ data: [] });
+			}
+
+			if (url.includes("/models/") && url.endsWith("/policy")) {
+				return Response.json({ ok: true });
+			}
+
+			throw new Error(`Unexpected fetch: ${url}`);
+		};
+
+		const credentials = await loginGitHubCopilot({
+			onPrompt: async () => "",
+			onAuth: () => {},
+		});
 
-	test("security explanation comments are present", () => {
-		const content = readSourceFile("github-copilot.ts");
-		assert.ok(content.includes("NOTE: This credential is public"));
-		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+		assert.equal(credentials.access, "tid=123;exp=1234567890;proxy-ep=proxy.individual.githubcopilot.com;");
+		const deviceCodeCall = calls.find((call) => call.url.endsWith("/login/device/code"));
+		assert.ok(deviceCodeCall, "device-code request should be sent");
+		const requestBody = deviceCodeCall.init.body;
+		assert.equal(typeof requestBody, "string");
+		const body = JSON.parse(requestBody as string) as Record<string, unknown>;
+		assert.equal(body.client_id, "Iv1.b507a08c87ecfe98");
+		assert.equal("client_secret" in body, false, "GitHub device flow must not send a client secret");
 	});
 });
 

package/packages/pi-ai/src/utils/oauth/google-antigravity.test.ts

@@ -1,21 +1,8 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import type { OAuthCredentials } from "./types.js";
 import { antigravityOAuthProvider } from "./google-antigravity.js";
 
-const __dirname = fileURLToPath(new URL(".", import.meta.url));
-const packageRoot = join(__dirname, "..", "..", "..");
-const sourceDir = existsSync(join(__dirname, "google-antigravity.ts"))
-	? __dirname
-	: join(packageRoot, "src", "utils", "oauth");
-
-function readSourceFile(name: string): string {
-	return readFileSync(join(sourceDir, name), "utf-8");
-}
-
 describe("Antigravity OAuth — provider structure", () => {
 	test("has correct id and name", () => {
 		assert.equal(antigravityOAuthProvider.id, "google-antigravity");
@@ -65,20 +52,29 @@ describe("Antigravity OAuth — credential regression", () => {
 		assert.ok(antigravityOAuthProvider);
 	});
 
-	test("CLIENT_ID and CLIENT_SECRET are plaintext", () => {
-		const content = readSourceFile("google-antigravity.ts");
-		assert.ok(
-			content.includes(
-				'CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"',
-			),
-		);
-		assert.ok(content.includes('CLIENT_SECRET = "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"'));
-		assert.ok(!content.includes("atob("));
-	});
+	test("refreshToken sends the desktop OAuth client credentials to Google", async (t) => {
+		const calls: RequestInit[] = [];
+		const originalFetch = globalThis.fetch;
+		t.after(() => {
+			globalThis.fetch = originalFetch;
+		});
+		globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
+			calls.push(init ?? {});
+			return Response.json({ access_token: "new-access-token", expires_in: 3600 });
+		};
 
-	test("security explanation comments are present", () => {
-		const content = readSourceFile("google-antigravity.ts");
-		assert.ok(content.includes("NOTE: These credentials are public"));
-		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+		const credentials = await antigravityOAuthProvider.refreshToken({
+			access: "old-access-token",
+			refresh: "refresh-token",
+			expires: Date.now() + 3600000,
+			projectId: "test-project-123",
+		});
+
+		assert.equal(credentials.access, "new-access-token");
+		assert.equal(credentials.projectId, "test-project-123");
+		assert.ok(calls[0]?.body instanceof URLSearchParams);
+		const body = calls[0].body;
+		assert.equal(body.get("client_id"), "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com");
+		assert.equal(body.get("client_secret"), "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");
 	});
-});
+});

package/packages/pi-ai/src/utils/oauth/google-gemini-cli.test.ts

@@ -1,21 +1,8 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import type { OAuthCredentials } from "./types.js";
 import { geminiCliOAuthProvider } from "./google-gemini-cli.js";
 
-const __dirname = fileURLToPath(new URL(".", import.meta.url));
-const packageRoot = join(__dirname, "..", "..", "..");
-const sourceDir = existsSync(join(__dirname, "google-gemini-cli.ts"))
-	? __dirname
-	: join(packageRoot, "src", "utils", "oauth");
-
-function readSourceFile(name: string): string {
-	return readFileSync(join(sourceDir, name), "utf-8");
-}
-
 describe("Gemini CLI OAuth — provider structure", () => {
 	test("has correct id and name", () => {
 		assert.equal(geminiCliOAuthProvider.id, "google-gemini-cli");
@@ -65,20 +52,29 @@ describe("Gemini CLI OAuth — credential regression", () => {
 		assert.ok(geminiCliOAuthProvider);
 	});
 
-	test("CLIENT_ID and CLIENT_SECRET are plaintext", () => {
-		const content = readSourceFile("google-gemini-cli.ts");
-		assert.ok(
-			content.includes(
-				'CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"',
-			),
-		);
-		assert.ok(content.includes('CLIENT_SECRET = "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"'));
-		assert.ok(!content.includes("atob("));
-	});
+	test("refreshToken sends the desktop OAuth client credentials to Google", async (t) => {
+		const calls: RequestInit[] = [];
+		const originalFetch = globalThis.fetch;
+		t.after(() => {
+			globalThis.fetch = originalFetch;
+		});
+		globalThis.fetch = async (_input: string | URL | Request, init?: RequestInit) => {
+			calls.push(init ?? {});
+			return Response.json({ access_token: "new-access-token", expires_in: 3600 });
+		};
 
-	test("security explanation comments are present", () => {
-		const content = readSourceFile("google-gemini-cli.ts");
-		assert.ok(content.includes("NOTE: These credentials are public"));
-		assert.ok(content.includes("obfuscated") || content.includes("security scanners"));
+		const credentials = await geminiCliOAuthProvider.refreshToken({
+			access: "old-access-token",
+			refresh: "refresh-token",
+			expires: Date.now() + 3600000,
+			projectId: "test-project-456",
+		});
+
+		assert.equal(credentials.access, "new-access-token");
+		assert.equal(credentials.projectId, "test-project-456");
+		assert.ok(calls[0]?.body instanceof URLSearchParams);
+		const body = calls[0].body;
+		assert.equal(body.get("client_id"), "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com");
+		assert.equal(body.get("client_secret"), "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");
 	});
-});
+});