pi-advisor-flow 0.11.2 → 0.12.0

package/src/jev/key-store.ts

@@ -258,7 +258,7 @@ export const consumePlaintextKeyWarning = (): string | undefined => {
     return undefined;
   }
   warnedPlaintextKey = true;
-  return `Advisor is using a plaintext ${TYPESAFE_KEY_CONFIG_FIELD} from advisor.json; this is not recommended. Open /advisor-settings → Jev consultation filter to migrate it into a secure store, or use the ${TYPESAFE_KEY_ENV_VAR} environment variable.`;
+  return `Advisor is using a plaintext ${TYPESAFE_KEY_CONFIG_FIELD} from advisor.json; this is not recommended. Open /advisor-settings → Jev/Decisions consultation filter to migrate it into a secure store, or use the ${TYPESAFE_KEY_ENV_VAR} environment variable.`;
 };
 
 /** Test-only: re-arms the one-time plaintext warning. */

package/src/jev/ledger.ts

@@ -4,6 +4,8 @@ export interface AdvisorJevUsageTotals {
   cost: number;
   inputTokens: number;
   outputTokens: number;
+  unavailableCostCalls: number;
+  knownCostCalls: number;
 }
 
 export interface AdvisorJevFilterLedger {
@@ -29,7 +31,7 @@ export interface AdvisorJevLedger {
 }
 
 export interface AdvisorJevUsage {
-  cost: number;
+  cost?: number;
   inputTokens: number;
   outputTokens: number;
 }
@@ -49,7 +51,9 @@ export interface JevInvocationView {
 const freshJevUsage = (): AdvisorJevUsageTotals => ({
   cost: 0,
   inputTokens: 0,
+  knownCostCalls: 0,
   outputTokens: 0,
+  unavailableCostCalls: 0,
 });
 
 const freshJevLedger = (): AdvisorJevLedger => ({
@@ -66,7 +70,12 @@ const freshJevLedger = (): AdvisorJevLedger => ({
 });
 
 const addJevUsage = (totals: AdvisorJevUsageTotals, usage: AdvisorJevUsage) => {
-  totals.cost += usage.cost;
+  if (usage.cost === undefined) {
+    totals.unavailableCostCalls += 1;
+  } else {
+    totals.cost += usage.cost;
+    totals.knownCostCalls += 1;
+  }
   totals.inputTokens += usage.inputTokens;
   totals.outputTokens += usage.outputTokens;
 };
@@ -82,6 +91,15 @@ const savingsLine = (costs: number[], skipped: number) => {
 const formatJevTokens = (usage: AdvisorJevUsageTotals) =>
   `↑${formatTokenCount(usage.inputTokens + usage.outputTokens)}`;
 
+const jevCostText = (usage: AdvisorJevUsageTotals) => {
+  if (usage.unavailableCostCalls > 0) {
+    return usage.knownCostCalls > 0
+      ? `cost unavailable (known-provider estimates $${usage.cost.toFixed(4)}; Decisions billing unconfirmed)`
+      : "cost unavailable (Decisions billing unconfirmed)";
+  }
+  return `$${usage.cost.toFixed(4)}`;
+};
+
 const markdownCosts = (invocations: readonly JevInvocationView[]): number[] =>
   invocations
     .filter(
@@ -101,7 +119,7 @@ const filterLine = (filter: AdvisorJevFilterLedger) => {
   if (filter.failures > 0) {
     parts.push(`${filter.failures} failure${filter.failures === 1 ? "" : "s"}`);
   }
-  return `Jev filter: ${parts.join(", ")}`;
+  return `Jev/Decisions filter: ${parts.join(", ")}`;
 };
 
 const gateLine = (
@@ -115,7 +133,7 @@ const gateLine = (
     )
     .map((item) => item.cost);
   const gateSpend = consultationCosts.reduce((sum, cost) => sum + cost, 0);
-  return `Turn gate: ${gate.checks} check${gate.checks === 1 ? "" : "s"} (Jev ${formatJevTokens(gate.usage)} · $${gate.usage.cost.toFixed(4)}), ${gate.consultations} consultation${gate.consultations === 1 ? "" : "s"} ($${gateSpend.toFixed(4)})`;
+  return `Turn gate: ${gate.checks} check${gate.checks === 1 ? "" : "s"} (Jev/Decisions ${formatJevTokens(gate.usage)} · ${jevCostText(gate.usage)}), ${gate.consultations} consultation${gate.consultations === 1 ? "" : "s"} ($${gateSpend.toFixed(4)})`;
 };
 
 /** One session's Jev screening and turn-gate accounting plus summary lines. */
@@ -206,9 +224,13 @@ export class AdvisorJevLedgerState {
     } else if (this.#filterActive()) {
       lines.push(filterLine(filter));
       const jevTokens = usage.inputTokens + usage.outputTokens;
-      if (jevTokens > 0) {
+      if (jevTokens > 0 || usage.unavailableCostCalls > 0) {
+        const cost =
+          usage.unavailableCostCalls > 0
+            ? jevCostText(usage)
+            : `$${usage.cost.toFixed(4)} (input only; output free)`;
         lines.push(
-          `Jev cost: ${formatJevTokens(usage)} tokens · $${usage.cost.toFixed(4)} (input only; output free)`
+          `Jev/Decisions cost: ${formatJevTokens(usage)} tokens · ${cost}`
         );
       }
       if (filter.skipped > 0) {

package/src/jev/openai-key-store.ts

@@ -0,0 +1,159 @@
+import {
+  chmodSync,
+  existsSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+
+import { redactSecrets } from "../redaction.ts";
+import type { JevKeyStoreResult, JevSecretsLike } from "./key-store.ts";
+
+export const OPENAI_DECISIONS_KEY_SERVICE = "pi-advisor";
+export const OPENAI_DECISIONS_KEY_NAME = "openai-decisions-api-key";
+const KEY_FILE_MODE = 0o600;
+
+export type OpenAIDecisionsKeySource = "openai-bun-secrets" | "openai-file";
+
+export interface OpenAIDecisionsKeyResolution {
+  key?: string;
+  source?: OpenAIDecisionsKeySource;
+}
+
+export interface OpenAIDecisionsKeyStoreDeps {
+  deleteFileStore?: () => void;
+  readFileStore?: () => string | undefined;
+  secrets?: JevSecretsLike | null;
+  writeFileStore?: (key: string) => void;
+}
+
+interface BunGlobal {
+  Bun?: { secrets?: JevSecretsLike };
+}
+
+const runtimeSecrets = (): JevSecretsLike | undefined => {
+  // SAFETY: only Bun runtimes expose Bun.secrets; other hosts leave the property absent.
+  const bun = globalThis as BunGlobal;
+  return bun.Bun?.secrets;
+};
+
+const keyFilePath = () => join(getAgentDir(), "openai_api_key");
+const normalizeKey = (value: string | null | undefined) =>
+  value?.trim() || undefined;
+
+const readDefaultFileStore = (): string | undefined => {
+  try {
+    return normalizeKey(readFileSync(keyFilePath(), "utf-8"));
+  } catch {
+    return undefined;
+  }
+};
+
+const writeDefaultFileStore = (key: string) => {
+  const path = keyFilePath();
+  writeFileSync(path, `${key}\n`, { mode: KEY_FILE_MODE });
+  chmodSync(path, KEY_FILE_MODE);
+};
+
+const deleteDefaultFileStore = () => rmSync(keyFilePath(), { force: true });
+
+const messageOf = <Error>(error: Error) =>
+  redactSecrets(error instanceof Error ? error.message : String(error));
+
+export const resolveOpenAIDecisionsKey = async (
+  deps: OpenAIDecisionsKeyStoreDeps = {}
+): Promise<OpenAIDecisionsKeyResolution> => {
+  const secrets = deps.secrets === undefined ? runtimeSecrets() : deps.secrets;
+  if (secrets) {
+    let secretKey: string | undefined;
+    try {
+      secretKey = normalizeKey(
+        await secrets.get({
+          name: OPENAI_DECISIONS_KEY_NAME,
+          service: OPENAI_DECISIONS_KEY_SERVICE,
+        })
+      );
+    } catch {
+      secretKey = undefined;
+    }
+    if (secretKey) {
+      return { key: secretKey, source: "openai-bun-secrets" };
+    }
+  }
+  const key = normalizeKey((deps.readFileStore ?? readDefaultFileStore)());
+  return key ? { key, source: "openai-file" } : {};
+};
+
+export const writeOpenAIDecisionsKey = async (
+  key: string,
+  deps: OpenAIDecisionsKeyStoreDeps = {}
+): Promise<JevKeyStoreResult> => {
+  const normalized = normalizeKey(key);
+  if (!normalized) {
+    return { message: "The OpenAI API key is empty.", ok: false };
+  }
+  const secrets = deps.secrets === undefined ? runtimeSecrets() : deps.secrets;
+  if (secrets) {
+    try {
+      await secrets.set({
+        name: OPENAI_DECISIONS_KEY_NAME,
+        service: OPENAI_DECISIONS_KEY_SERVICE,
+        value: normalized,
+      });
+      return { message: "OpenAI API key stored in Bun.secrets.", ok: true };
+    } catch (error) {
+      return {
+        message: `Storing the OpenAI API key in Bun.secrets failed: ${messageOf(error)}. Configure OPENAI_API_KEY in Pi or retry secure storage.`,
+        ok: false,
+      };
+    }
+  }
+  try {
+    (deps.writeFileStore ?? writeDefaultFileStore)(normalized);
+    return {
+      message: "OpenAI API key stored in the Pi agent directory (mode 0600).",
+      ok: true,
+    };
+  } catch (error) {
+    return {
+      message: `Storing the OpenAI API key failed: ${messageOf(error)}. Configure OPENAI_API_KEY in Pi or retry secure storage.`,
+      ok: false,
+    };
+  }
+};
+
+export const clearOpenAIDecisionsKey = async (
+  deps: OpenAIDecisionsKeyStoreDeps = {}
+): Promise<JevKeyStoreResult> => {
+  let firstError: string | undefined;
+  const secrets = deps.secrets === undefined ? runtimeSecrets() : deps.secrets;
+  if (secrets) {
+    try {
+      await secrets.delete({
+        name: OPENAI_DECISIONS_KEY_NAME,
+        service: OPENAI_DECISIONS_KEY_SERVICE,
+      });
+    } catch (error) {
+      firstError = messageOf(error);
+    }
+  }
+  try {
+    if (deps.deleteFileStore) {
+      deps.deleteFileStore();
+    } else if (existsSync(keyFilePath())) {
+      deleteDefaultFileStore();
+    }
+  } catch (error) {
+    firstError ??= messageOf(error);
+  }
+  if (firstError) {
+    return {
+      message: `Clearing the OpenAI API key failed: ${firstError}.`,
+      ok: false,
+    };
+  }
+  return { message: "Stored OpenAI API key cleared.", ok: true };
+};

package/src/jev/transport.ts

@@ -3,24 +3,87 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { advisorJevTransportRef } from "../config/state.ts";
 import { resolveTypeSafeKey } from "./key-store.ts";
 import type { JevKeySource } from "./key-store.ts";
+import { resolveOpenAIDecisionsKey } from "./openai-key-store.ts";
+import type { OpenAIDecisionsKeyResolution } from "./openai-key-store.ts";
 
-export type JevTransportKind = "typesafe" | "openrouter";
+export type JevTransportKind = "typesafe" | "openrouter" | "openai-decisions";
+
+export type JevCredentialSource =
+  | JevKeySource
+  | "openai-env"
+  | "openai-provider-credential"
+  | "openai-bun-secrets"
+  | "openai-file";
 
 export interface JevCredentials {
   apiKey: string;
-  /** Where the TypeSafe key came from; present on the typesafe transport. */
-  source?: JevKeySource;
+  source?: JevCredentialSource;
   transport: JevTransportKind;
 }
 
+export interface JevProviderAuthResult {
+  auth: { apiKey?: string };
+  source?: string;
+}
+
 export interface JevTransportDeps {
   /** Reads a pi-stored provider login; injectable for tests. */
   getProviderKey?: (provider: string) => Promise<string | undefined>;
+  /** Resolves Pi provider auth with its source label; injectable for tests. */
+  getProviderAuth?: (
+    provider: string
+  ) => Promise<JevProviderAuthResult | undefined>;
+  /** Resolves the extension-owned OpenAI Decisions key; injectable for tests. */
+  resolveOpenAIKey?: () => Promise<OpenAIDecisionsKeyResolution>;
   /** Resolves the TypeSafe key chain; injectable for tests. */
   resolveTypesafe?: () => ReturnType<typeof resolveTypeSafeKey>;
 }
 
 const OPENROUTER_PROVIDER = "openrouter";
+const OPENAI_PROVIDER = "openai";
+const OPENAI_API_KEY_SOURCES = new Map<string, JevCredentialSource>([
+  ["OPENAI_API_KEY", "openai-env"],
+  ["stored credential", "openai-provider-credential"],
+]);
+
+const openAiPlatformCredentials = async (
+  ctx: ExtensionContext | undefined,
+  deps: JevTransportDeps
+): Promise<JevCredentials | undefined> => {
+  let result: JevProviderAuthResult | undefined;
+  try {
+    result = deps.getProviderAuth
+      ? await deps.getProviderAuth(OPENAI_PROVIDER)
+      : await ctx?.modelRegistry?.getProviderAuth(OPENAI_PROVIDER);
+  } catch {
+    result = undefined;
+  }
+  const source = result?.source;
+  const credentialSource = source
+    ? OPENAI_API_KEY_SOURCES.get(source)
+    : undefined;
+  const apiKey = result?.auth.apiKey?.trim();
+  if (credentialSource && apiKey) {
+    return {
+      apiKey,
+      source: credentialSource,
+      transport: "openai-decisions",
+    };
+  }
+  try {
+    const stored = await (deps.resolveOpenAIKey ?? resolveOpenAIDecisionsKey)();
+    const storedKey = stored.key?.trim();
+    return storedKey && stored.source
+      ? {
+          apiKey: storedKey,
+          source: stored.source,
+          transport: "openai-decisions",
+        }
+      : undefined;
+  } catch {
+    return undefined;
+  }
+};
 
 const openRouterKey = async (
   ctx: ExtensionContext | undefined,
@@ -32,32 +95,47 @@ const openRouterKey = async (
   return key?.trim() || undefined;
 };
 
-/** Resolves how Jev calls authenticate: a dedicated TypeSafe key first, then
- * the existing pi OpenRouter login (reuse per advisorJevTransport). */
+const typeSafeCredentials = async (
+  deps: JevTransportDeps
+): Promise<JevCredentials | undefined> => {
+  const resolution = await (deps.resolveTypesafe ?? resolveTypeSafeKey)();
+  if (!resolution.key) {
+    return undefined;
+  }
+  const credentials: JevCredentials = {
+    apiKey: resolution.key,
+    transport: "typesafe",
+  };
+  if (resolution.source) {
+    credentials.source = resolution.source;
+  }
+  return credentials;
+};
+
+export const resolveJevTransportFor = async (
+  transport: JevTransportKind,
+  ctx?: ExtensionContext,
+  deps: JevTransportDeps = {}
+): Promise<JevCredentials | undefined> => {
+  if (transport === "typesafe") {
+    return typeSafeCredentials(deps);
+  }
+  if (transport === "openrouter") {
+    const key = await openRouterKey(ctx, deps);
+    return key ? { apiKey: key, transport } : undefined;
+  }
+  return openAiPlatformCredentials(ctx, deps);
+};
+
+/** Resolves `auto` as TypeSafe then OpenRouter; explicit choices never fall back. */
 export const resolveJevTransport = async (
   ctx?: ExtensionContext,
   deps: JevTransportDeps = {}
 ): Promise<JevCredentials | undefined> => {
   const preference = advisorJevTransportRef;
-  if (preference !== "openrouter") {
-    const resolveTypesafe = deps.resolveTypesafe ?? resolveTypeSafeKey;
-    const resolution = await resolveTypesafe();
-    if (resolution.key) {
-      const credentials: JevCredentials = {
-        apiKey: resolution.key,
-        transport: "typesafe",
-      };
-      if (resolution.source) {
-        credentials.source = resolution.source;
-      }
-      return credentials;
-    }
-  }
-  if (preference === "typesafe") {
-    return undefined;
+  if (preference !== "auto") {
+    return resolveJevTransportFor(preference, ctx, deps);
   }
-  const openrouter = await openRouterKey(ctx, deps);
-  return openrouter
-    ? { apiKey: openrouter, transport: "openrouter" }
-    : undefined;
+  const typesafe = await typeSafeCredentials(deps);
+  return typesafe ?? resolveJevTransportFor("openrouter", ctx, deps);
 };

package/src/tools/jev-filter.ts

@@ -57,7 +57,7 @@ const repeatSkipText = (advice: string) =>
 
 const outageNotifier = createOutageNotifier(
   (category, message) =>
-    `Advisor Jev filter failed (${category}); allowing consultations. ${message}`
+    `Advisor Jev/Decisions filter failed (${category}); allowing consultations. ${message}`
 );
 
 const notifyOutageOnce = outageNotifier.notify;
@@ -107,7 +107,7 @@ const screenWithJev = async (
     notifyOutageOnce(
       ctx,
       "missing-key",
-      "No Jev credentials resolved (no TypeSafe key and no OpenRouter login)."
+      "No credentials resolved for the selected Jev/Decisions provider."
     );
     return allow();
   }

package/src/tools/jev-turn-gate.ts

@@ -69,7 +69,7 @@ export interface JevTurnGateRegistration {
 
 const outageNotifier = createOutageNotifier(
   (category, message) =>
-    `Advisor Jev turn gate failed (${category}); continuing without a proactive consultation. ${message}`
+    `Advisor Jev/Decisions turn gate failed (${category}); continuing without a proactive consultation. ${message}`
 );
 
 const notifyFailureOnce = outageNotifier.notify;
@@ -133,7 +133,7 @@ export const handleJevTurnEnd = async (
       notifyFailureOnce(
         ctx,
         "missing-key",
-        "No Jev credentials resolved (no TypeSafe key and no OpenRouter login)."
+        "No credentials resolved for the selected Jev/Decisions provider."
       );
       return;
     }

package/src/ui/jev-setup-submenu-view.ts

@@ -0,0 +1,96 @@
+import { truncateToWidth } from "@earendil-works/pi-tui";
+
+import {
+  canClearCredential,
+  providerName,
+  transportLabel,
+} from "./jev-setup-support.ts";
+import type {
+  JevSetupSubmenuOptions,
+  JevSetupViewState,
+  SetupAction,
+} from "./jev-setup-support.ts";
+import type { MaskedInput } from "./masked-input.ts";
+
+export const setupActions = (state: JevSetupViewState): SetupAction[] => {
+  const actions: SetupAction[] = ["typesafe", "openrouter", "openai-decisions"];
+  if (state.canEnterKey) {
+    actions.push("enter-key");
+  }
+  if (state.filterEnabled) {
+    actions.push("disable");
+  }
+  if (state.credentials && canClearCredential(state.credentials)) {
+    actions.push("clear-stored-key");
+  }
+  actions.push("done");
+  return actions;
+};
+
+const setupLabels = (state: JevSetupViewState): string[] =>
+  setupActions(state).map((action) => {
+    if (action === "clear-stored-key") {
+      return state.filterEnabled
+        ? "Disable and clear stored key"
+        : "Clear stored key";
+    }
+    if (action === "disable") {
+      return "Disable";
+    }
+    if (action === "done") {
+      return "Done";
+    }
+    if (action === "enter-key") {
+      return state.selectedTransport === "openai-decisions"
+        ? "Enter an OpenAI Platform API key"
+        : "Enter a TypeSafe API key";
+    }
+    return providerName(action);
+  });
+
+export const renderJevSetup = (
+  options: JevSetupSubmenuOptions,
+  state: JevSetupViewState,
+  maskedInput: MaskedInput,
+  width: number
+): string[] => {
+  const { theme } = options;
+  const lines = [
+    theme.fg("accent", theme.bold("  Jev/Decisions consultation filter")),
+    "",
+    `  Filter: ${state.filterEnabled ? "On" : "Off"}`,
+  ];
+  if (state.credentials) {
+    lines.push(`  Credential: ${transportLabel(state.credentials)}`);
+  } else if (state.selectedTransport) {
+    lines.push(`  Selected provider: ${providerName(state.selectedTransport)}`);
+  } else {
+    lines.push(`  Saved transport: ${options.currentTransport}`);
+  }
+  if (state.notice) {
+    lines.push("", theme.fg("warning", `  ${state.notice}`));
+  }
+  lines.push("");
+  if (state.mode === "resolving") {
+    lines.push("  Checking the selected provider credentials…");
+  } else if (state.mode === "verifying") {
+    lines.push("  Verifying with a live Jev call…");
+  } else if (state.mode === "clearing") {
+    lines.push("  Clearing the selected provider's stored key…");
+  } else if (state.mode === "key-entry") {
+    lines.push(
+      `  ${providerName(state.selectedTransport ?? "typesafe")}`,
+      state.selectedTransport === "openai-decisions"
+        ? "  No OpenAI Platform API key found. ChatGPT subscription OAuth is not accepted."
+        : "  No TypeSafe API key found.",
+      `  ${maskedInput.render(Math.max(10, width - 4))[0] ?? ""}`,
+      theme.fg("dim", "  Enter: verify and securely store · Esc: return")
+    );
+  } else {
+    for (const [index, label] of setupLabels(state).entries()) {
+      const prefix = index === state.selectedIndex ? "→ " : "  ";
+      lines.push(`${prefix}${label}`);
+    }
+  }
+  return lines.map((line) => truncateToWidth(line, width));
+};