pi-gproxy 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LeenHawk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,121 @@
+# pi-gproxy
+
+[English](https://github.com/LeenHawk/pi-gproxy/blob/main/README.md) | [简体中文](https://github.com/LeenHawk/pi-gproxy/blob/main/README.zh-CN.md)
+
+Sign in to [Pi](https://github.com/badlogic/pi-mono) with your
+[GPROXY](https://github.com/LeenHawk/gproxy) account, discover the models you can
+access, and use different upstream providers through one gateway.
+
+This is a standalone **GPROXY** provider. It does not modify Pi, replace Codex,
+or ask for your upstream provider credentials.
+
+## Requirements
+
+- Node.js **22.19.0 or newer**.
+- Pi **0.85.1**, the tested compatibility baseline. Package peer dependencies
+  accept `>=0.85.1 <0.86.0`; other versions are not verified.
+- A GPROXY v3 instance with unified account OAuth, such as
+  [v3 staging](https://github.com/LeenHawk/gproxy/releases/tag/staging), and a
+  GPROXY user account with access to at least one model.
+
+## Install and sign in
+
+1. In **GPROXY Console → Settings → OAuth clients**, enable the preconfigured
+   `pi-gproxy` client. Keep the redirect URL
+   `http://127.0.0.1/oauth/callback` without a port: browser login allocates a
+   local port automatically.
+2. Install the extension:
+
+   ```sh
+   pi install npm:pi-gproxy
+   ```
+
+   To pin the first release, use `pi install npm:pi-gproxy@0.1.0`.
+3. Start Pi, run `/login`, and select **GPROXY**.
+4. Enter your instance origin, for example `https://gproxy.example.com`.
+   Use HTTPS, or HTTP on loopback for local testing, such as
+   `http://127.0.0.1:8787`. Subpaths, URL credentials, queries and fragments
+   are not accepted.
+5. Choose **Browser** on your own machine, or **Device code** for SSH, containers
+   and approval from another device. Sign in to the GPROXY Portal and approve
+   the request. Only approve a login you initiated.
+6. Run `/model` and select a GPROXY model.
+
+The login authorizes your GPROXY account, not an upstream account. Your
+administrator's current model permissions still apply.
+
+## Commands
+
+| Command | Purpose |
+| --- | --- |
+| `/login` → GPROXY | Sign in through browser PKCE or device authorization. |
+| `/gproxy-refresh` | Force a refresh of models available to this account. |
+| `/fast [on\|off]` | Toggle priority service for a selected GPROXY model that advertises it. |
+| `/logout` | Remove Pi's local credentials; this does not revoke the server session. |
+
+`/fast` is scoped to the model and authorization and lasts only for the current
+Pi process. Models without the advertised `priority` tier are not modified.
+Inference uses Pi's standard Responses streaming implementation at
+`/v1/responses`; WebSocket transport is not required.
+
+## Credentials, sessions and billing
+
+- Pi stores the OAuth credentials and serializes token refresh. The instance
+  origin is bound to the credential; refresh only contacts that instance's
+  `/oauth/token`. This extension does not maintain another credential file or
+  fall back to OpenAI.
+- Model discovery uses `/v1/models`. Pi's model store caches the catalog per
+  instance and authorization, including restoration after a restart. Normal
+  refreshes use a 60-second cache window; `/gproxy-refresh` forces a new request.
+- Rejected refresh or model authentication stops use of that authorization and
+  prompts you to sign in again.
+- To revoke access on the server, open **GPROXY Portal → Authorized sessions**
+  and revoke the session. Pi's built-in `/logout` only removes local credentials.
+- Cancelling device login makes a best-effort request to cancel the pending
+  server flow. Browser cancellation closes the local callback listener. An
+  authorization that never exchanges a code for tokens is not counted as a login.
+- **Pi's zero-cost placeholder does not mean free usage and is not your GPROXY
+  bill.** Actual usage and charges are recorded by GPROXY. This extension does
+  not substitute prices from external model catalogs.
+- Context limits, output limits, image input and thinking levels come from
+  model discovery. When limits are missing, Pi's required fields use conservative
+  defaults of 8192 context tokens and 4096 output tokens. Ask the administrator
+  to complete the model metadata.
+
+## Troubleshooting
+
+- **Invalid or disabled client:** enable `pi-gproxy` in Console and check the
+  registered callback URL.
+- **No GPROXY models:** run `/gproxy-refresh` and check your account's model
+  permissions. Complete login normally rather than copying only an auth file:
+  Pi also needs the discovered model catalog.
+- **Expired or revoked authorization:** run `/login` again. Re-enabling a client
+  does not restore previously revoked sessions.
+- **Cannot use a local browser callback:** cancel and choose device-code login.
+
+## Development
+
+```sh
+git clone https://github.com/LeenHawk/pi-gproxy.git
+cd pi-gproxy
+npm ci
+npm run check
+npm pack --dry-run
+```
+
+Load the checkout with `pi -e /absolute/path/to/pi-gproxy/src/index.ts`, or install
+the local directory with `pi install /absolute/path/to/pi-gproxy`.
+
+- `src/auth/`: browser PKCE, device authorization, refresh and cancellation.
+- `src/models.ts`: explicit GPROXY model-to-Pi capability mapping.
+- `src/provider.ts`: native Pi provider, OAuth, catalog cache and Responses streaming.
+- `src/index.ts`: registration and the model-refresh/priority commands.
+
+Tests use local simulated endpoints for state checks, PKCE, cancellation,
+serialized refresh and cache isolation. Local gateway integration also exercised
+OpenAI/Claude streaming, tool round trips and settlement with simulated upstreams.
+These checks do not establish production-provider compatibility.
+
+## License
+
+[MIT](LICENSE).

package/README.zh-CN.md

@@ -0,0 +1,97 @@
+# pi-gproxy
+
+[English](https://github.com/LeenHawk/pi-gproxy/blob/main/README.md) | [简体中文](https://github.com/LeenHawk/pi-gproxy/blob/main/README.zh-CN.md)
+
+用 GPROXY 用户账户登录 [Pi](https://github.com/badlogic/pi-mono)，发现账户允许使用的模型，
+并通过 [GPROXY](https://github.com/LeenHawk/gproxy) 调用不同上游渠道。
+
+这是独立的 **GPROXY** Provider，不修改 Pi，不替换或冒充 Codex，也不要求你提供上游凭证。
+
+## 使用要求
+
+- Node.js **22.19.0 或更高**。
+- Pi **0.85.1**，这是已验证的兼容基线。包依赖范围为 `>=0.85.1 <0.86.0`，其他版本尚未验证。
+- 支持统一账户 OAuth 的 GPROXY v3 实例，例如
+  [v3 staging](https://github.com/LeenHawk/gproxy/releases/tag/staging)，以及至少有一个可用模型的 GPROXY 用户账户。
+
+## 安装和登录
+
+1. 在 **GPROXY Console → 设置 → OAuth 客户端** 中启用预置的 `pi-gproxy`。
+   保留回调地址 `http://127.0.0.1/oauth/callback`，不要填写端口：浏览器登录时会自动分配本机端口。
+2. 安装扩展：
+
+   ```sh
+   pi install npm:pi-gproxy
+   ```
+
+   要固定使用首个版本，运行 `pi install npm:pi-gproxy@0.1.0`。
+3. 启动 Pi，输入 `/login`，选择 **GPROXY**。
+4. 输入实例根地址，例如 `https://gproxy.example.com`。应使用 HTTPS；
+   本机测试可用 `http://127.0.0.1:8787`。不接受子路径、URL 内的账号密码、查询参数或片段。
+5. 本机登录选 **Browser**；SSH、容器或跨设备确认选 **Device code**。
+   在 GPROXY Portal 登录并允许授权，只批准由你自己发起的登录请求。
+6. 输入 `/model`，选择 GPROXY 模型。
+
+授权的是你的 GPROXY 账户，不是上游账户；管理员设置的当前模型权限仍然生效。
+
+## 命令
+
+| 命令 | 用途 |
+| --- | --- |
+| `/login` → GPROXY | 使用浏览器 PKCE 或设备码登录。 |
+| `/gproxy-refresh` | 强制刷新当前账户可访问的模型。 |
+| `/fast [on\|off]` | 为当前明确支持优先档位的 GPROXY 模型切换优先服务。 |
+| `/logout` | 删除 Pi 本地凭证，不会撤销服务器会话。 |
+
+`/fast` 按模型和授权隔离，只在当前 Pi 进程中保留；不会给没有公布 `priority` 档位的模型强塞参数。
+推理复用 Pi 的标准 Responses 流式实现访问 `/v1/responses`，不强制使用 WebSocket。
+
+## 凭证、会话和账单
+
+- OAuth 凭证只交给 Pi 存储，刷新由 Pi 串行化。实例地址与凭证绑定，只请求原实例的
+  `/oauth/token`；扩展不另建一份凭证文件，也不会回退到 OpenAI。
+- 模型通过 `/v1/models` 发现，并使用 Pi 的模型存储，按实例和授权隔离缓存。
+  重启后可恢复同一授权的目录；普通刷新有 60 秒缓存窗口，`/gproxy-refresh` 强制重拉。
+- 刷新或模型认证被拒绝后，停止使用该授权并提示重新登录。
+- 要在服务器上彻底撤销访问，请到 **GPROXY Portal → 授权会话** 撤销对应记录。
+  Pi 内置的 `/logout` 只删除本地凭证。
+- 取消设备码登录时，会尽力通知服务器取消待完成流程；取消浏览器登录时会关闭本地回调监听。
+  没有成功换取 token 的授权，不计入登录次数。
+- **Pi 显示的零成本占位不代表免费，也不是 GPROXY 实际账单。**
+  用量和费用以 GPROXY 的记录为准，本扩展不借用外部模型目录的价格冒充实际收费。
+- 上下文、输出上限、图片输入和思考档位来自模型发现。缺少限额信息时，Pi 必填字段暂取保守的
+  8192 上下文 token / 4096 输出 token；请让管理员补全模型元数据。
+
+## 常见问题
+
+- **客户端无效或未启用：** 在 Console 启用 `pi-gproxy`，并检查回调地址。
+- **没有 GPROXY 模型：** 运行 `/gproxy-refresh`，检查账户模型权限。
+  请正常完成登录，不要只复制认证文件：Pi 还需要登录后发现的模型目录。
+- **授权过期或已撤销：** 重新运行 `/login`。重新启用客户端不会恢复之前已撤销的会话。
+- **无法使用本机浏览器回调：** 取消当前流程，改用设备码登录。
+
+## 开发者
+
+```sh
+git clone https://github.com/LeenHawk/pi-gproxy.git
+cd pi-gproxy
+npm ci
+npm run check
+npm pack --dry-run
+```
+
+用 `pi -e /absolute/path/to/pi-gproxy/src/index.ts` 临时加载工作区，
+或用 `pi install /absolute/path/to/pi-gproxy` 安装本地目录。
+
+- `src/auth/`：浏览器 PKCE、设备码、刷新和取消流程。
+- `src/models.ts`：GPROXY 模型到 Pi 模型能力的显式映射。
+- `src/provider.ts`：Pi 原生 Provider、OAuth、目录缓存和 Responses 流式调用。
+- `src/index.ts`：注册扩展、刷新模型和切换优先服务的命令。
+
+测试通过本机模拟端点验证 state、PKCE、取消、串行刷新和缓存隔离。
+本地网关联调还使用模拟 OpenAI / Claude 上游验证了流式响应、工具多轮调用和结算。
+这些检查不代表真实生产供应商兼容性验证。
+
+## 许可证
+
+[MIT](LICENSE)。

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "pi-gproxy",
+  "version": "0.1.0",
+  "description": "GPROXY account OAuth and model discovery for Pi",
+  "license": "MIT",
+  "repository": { "type": "git", "url": "git+https://github.com/LeenHawk/pi-gproxy.git" },
+  "homepage": "https://github.com/LeenHawk/pi-gproxy#readme",
+  "bugs": { "url": "https://github.com/LeenHawk/pi-gproxy/issues" },
+  "keywords": ["pi-package", "pi", "gproxy", "oauth", "llm"],
+  "files": ["src/", "README.md", "README.zh-CN.md", "LICENSE"],
+  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" },
+  "type": "module",
+  "engines": { "node": ">=22.19.0" },
+  "pi": { "extensions": ["./src/index.ts"] },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "node --experimental-strip-types --test test/*.test.ts",
+    "check": "npm run typecheck && npm run lint && npm run test",
+    "prepublishOnly": "npm run check"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": ">=0.85.1 <0.86.0",
+    "@earendil-works/pi-coding-agent": ">=0.85.1 <0.86.0"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "0.85.1",
+    "@earendil-works/pi-coding-agent": "0.85.1",
+    "@eslint/js": "9.39.1",
+    "@types/node": "24.10.0",
+    "eslint": "9.39.1",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.48.0"
+  }
+}

package/src/auth/browser.ts

@@ -0,0 +1,60 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import type { ProviderAuthInteraction } from "@earendil-works/pi-ai";
+import { CLIENT_ID, SCOPE, post, tokens } from "./wire.ts";
+
+export async function browserLogin(instance: string, interaction: ProviderAuthInteraction) {
+  const verifier = randomBytes(48).toString("base64url");
+  const state = randomBytes(32).toString("base64url");
+  const signal = AbortSignal.any([interaction.signal, AbortSignal.timeout(300_000)]);
+  let redirect = "";
+  let complete: (code: string) => void;
+  let fail: (error: Error) => void;
+  const callback = new Promise<string>((resolve, reject) => { complete = resolve; fail = reject; });
+  void callback.catch(() => {});
+  const server = createServer((request, response) => {
+    response.setHeader("cache-control", "no-store");
+    response.setHeader("referrer-policy", "no-referrer");
+    response.setHeader("content-type", "text/plain; charset=utf-8");
+    const url = new URL(request.url ?? "/", redirect);
+    if (request.method !== "GET" || request.headers.host !== new URL(redirect).host || url.pathname !== "/oauth/callback") {
+      response.writeHead(404).end("Not found"); return;
+    }
+    if (url.searchParams.getAll("state").length !== 1 || url.searchParams.get("state") !== state) {
+      response.writeHead(400).end("Invalid authorization state. Return to the login you started."); return;
+    }
+    if (url.searchParams.has("error")) {
+      response.writeHead(400).end("Authorization was denied. Return to Pi.");
+      fail(new Error("GPROXY authorization denied.")); return;
+    }
+    const code = url.searchParams.get("code");
+    if (!code || url.searchParams.getAll("code").length !== 1) {
+      response.writeHead(400).end("Missing authorization code"); return;
+    }
+    response.end("GPROXY authorization received. Return to Pi to finish signing in.");
+    complete(code);
+  });
+  const abort = () => fail(signal.reason instanceof Error ? signal.reason : new Error("Login cancelled"));
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    signal.throwIfAborted();
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => { server.removeListener("error", reject); resolve(); });
+    });
+    redirect = `http://127.0.0.1:${(server.address() as AddressInfo).port}/oauth/callback`;
+    const authorization = new URL(`${instance}/oauth/authorize`);
+    authorization.search = new URLSearchParams({
+      response_type: "code", client_id: CLIENT_ID, redirect_uri: redirect, scope: SCOPE,
+      code_challenge: createHash("sha256").update(verifier).digest("base64url"), code_challenge_method: "S256", state,
+    }).toString();
+    interaction.notify({ type: "auth_url", url: authorization.href, instructions: "Authorize your GPROXY account in a browser on this machine. For SSH or another device, cancel and choose device code login." });
+    const code = await callback;
+    return tokens(instance, await post(instance, "/oauth/token", { grant_type: "authorization_code", code, redirect_uri: redirect, code_verifier: verifier }, signal));
+  } finally {
+    signal.removeEventListener("abort", abort);
+    server.closeAllConnections();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+}

package/src/auth/device.ts

@@ -0,0 +1,33 @@
+import { setTimeout } from "node:timers/promises";
+import type { ProviderAuthInteraction } from "@earendil-works/pi-ai";
+import { OAuthRequestError, SCOPE, post, tokens } from "./wire.ts";
+
+export async function deviceLogin(instance: string, interaction: ProviderAuthInteraction) {
+  const started = await post(instance, "/oauth/device/code", { scope: SCOPE }, interaction.signal);
+  if (typeof started.device_code !== "string" || typeof started.user_code !== "string" || typeof started.verification_uri !== "string" || typeof started.expires_in !== "number" || !Number.isFinite(started.expires_in) || started.expires_in <= 0) {
+    throw new Error("Invalid GPROXY device authorization response.");
+  }
+  const verification = new URL(typeof started.verification_uri_complete === "string" ? started.verification_uri_complete : started.verification_uri);
+  if (verification.origin !== instance) throw new Error("Device authorization redirected to another instance.");
+  let interval = typeof started.interval === "number" && Number.isFinite(started.interval) ? Math.max(1, started.interval) : 5;
+  const signal = AbortSignal.any([interaction.signal, AbortSignal.timeout(Math.min(started.expires_in, 900) * 1_000)]);
+  interaction.notify({ type: "device_code", userCode: started.user_code, verificationUri: verification.href, intervalSeconds: interval, expiresInSeconds: started.expires_in });
+  let finished = false;
+  try {
+    for (;;) {
+      await setTimeout(interval * 1_000, undefined, { signal });
+      try {
+        const response = await post(instance, "/oauth/token", { grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: started.device_code }, signal);
+        const result = tokens(instance, response);
+        finished = true;
+        return result;
+      } catch (error) {
+        if (!(error instanceof OAuthRequestError)) throw error;
+        if (error.code === "slow_down") { interval += 5; continue; }
+        if (error.code !== "authorization_pending") throw error;
+      }
+    }
+  } finally {
+    if (!finished) await post(instance, "/oauth/device/cancel", { device_code: started.device_code }, AbortSignal.timeout(5_000)).catch(() => {});
+  }
+}

package/src/auth/index.ts

@@ -0,0 +1,34 @@
+import type { OAuthAuth } from "@earendil-works/pi-ai";
+import { browserLogin } from "./browser.ts";
+import { deviceLogin } from "./device.ts";
+import { credential, instanceUrl, OAuthRequestError, post, tokens, type GproxyCredential } from "./wire.ts";
+
+export function oauth(invalidate: (value: GproxyCredential) => void, check: (value: GproxyCredential) => void): OAuthAuth {
+  return {
+    name: "GPROXY", isSubscription: false,
+    async login(interaction) {
+      const instance = instanceUrl(await interaction.prompt({ type: "text", message: "GPROXY instance URL", placeholder: "https://gproxy.example.com" }));
+      const flow = await interaction.prompt({ type: "select", message: "Sign in to GPROXY", options: [
+        { id: "browser", label: "Browser (this machine)", description: "Authorization code with PKCE and a local callback." },
+        { id: "device", label: "Device code (SSH or another device)", description: "Approve a short code in your GPROXY portal." },
+      ] });
+      if (flow === "browser") return browserLogin(instance, interaction);
+      if (flow === "device") return deviceLogin(instance, interaction);
+      throw new Error("GPROXY login cancelled.");
+    },
+    async refresh(value, signal) {
+      const previous = credential(value);
+      try {
+        return tokens(previous.instance, await post(previous.instance, "/oauth/token", { grant_type: "refresh_token", refresh_token: previous.refresh }, signal), previous);
+      } catch (error) {
+        if (error instanceof OAuthRequestError && ["invalid_grant", "invalid_client"].includes(error.code)) invalidate(previous);
+        throw error;
+      }
+    },
+    async toAuth(value) {
+      const current = credential(value);
+      check(current);
+      return { apiKey: current.access, baseUrl: `${current.instance}/v1` };
+    },
+  };
+}

package/src/auth/wire.ts

@@ -0,0 +1,61 @@
+import { randomUUID } from "node:crypto";
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+
+export const CLIENT_ID = "pi-gproxy";
+export const SCOPE = "gproxy";
+
+export type GproxyCredential = OAuthCredential & { instance: string; authorization: string };
+
+export class OAuthRequestError extends Error {
+  readonly code: string;
+  readonly status: number;
+
+  constructor(code: string, status: number) {
+    super(`GPROXY OAuth: ${code} (HTTP ${status}).${["invalid_grant", "invalid_client"].includes(code) ? " Run /login GPROXY again; check that the client is enabled." : ""}`);
+    this.code = code;
+    this.status = status;
+  }
+}
+
+export function instanceUrl(input: string): string {
+  const url = new URL(input.trim());
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("Use an HTTPS instance origin, or HTTP on localhost. Paths, credentials, query strings and fragments are not allowed.");
+  }
+  return url.origin;
+}
+
+export function credential(value: OAuthCredential): GproxyCredential {
+  if (typeof value.instance !== "string" || typeof value.authorization !== "string" || !value.authorization || !value.access || !value.refresh || !Number.isFinite(value.expires)) {
+    throw new Error("Invalid GPROXY credential. Run /login GPROXY again.");
+  }
+  return { ...value, instance: instanceUrl(value.instance), authorization: value.authorization };
+}
+
+export async function post(instance: string, path: string, values: Record<string, string>, signal: AbortSignal): Promise<Record<string, unknown>> {
+  const response = await fetch(`${instance}${path}`, {
+    method: "POST", redirect: "error", cache: "no-store", signal: AbortSignal.any([signal, AbortSignal.timeout(30_000)]),
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams({ client_id: CLIENT_ID, ...values }),
+  });
+  const payload: unknown = await response.json();
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new Error("Invalid GPROXY OAuth response.");
+  const record = payload as Record<string, unknown>;
+  if (!response.ok) {
+    const code = typeof record.error === "string" && /^[a-z_]+$/.test(record.error) ? record.error : "request_failed";
+    throw new OAuthRequestError(code, response.status);
+  }
+  return record;
+}
+
+export function tokens(instance: string, response: Record<string, unknown>, previous?: GproxyCredential): GproxyCredential {
+  if (typeof response.access_token !== "string" || !response.access_token || typeof response.refresh_token !== "string" || !response.refresh_token || typeof response.expires_in !== "number" || !Number.isFinite(response.expires_in) || response.expires_in <= 0 || response.token_type !== "Bearer") {
+    throw new Error("GPROXY did not return a complete OAuth token set.");
+  }
+  return {
+    type: "oauth", instance, authorization: previous?.authorization ?? randomUUID(),
+    access: response.access_token, refresh: response.refresh_token,
+    expires: Date.now() + Math.max(1, response.expires_in - 30) * 1_000,
+  };
+}

package/src/index.ts

@@ -0,0 +1,24 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createGproxyProvider } from "./provider.ts";
+
+export default function gproxy(pi: ExtensionAPI) {
+  const { provider, setFast } = createGproxyProvider();
+  pi.registerProvider(provider);
+  pi.registerCommand("gproxy-refresh", {
+    description: "Refresh models allowed by your GPROXY account",
+    handler: async (_args, context) => {
+      const result = await context.modelRegistry.refresh({ providers: ["gproxy"], allowNetwork: true, force: true });
+      const error = result.errors.get("gproxy");
+      context.ui.notify(error?.message ?? `GPROXY: ${provider.getModels().length} models. Billing is shown in the GPROXY portal, not Pi's estimates.`, error ? "error" : "info");
+    },
+  });
+  pi.registerCommand("fast", {
+    description: "Toggle GPROXY priority service for a model that advertises it",
+    handler: async (args, context) => {
+      const value = args.trim();
+      if (!["", "on", "off"].includes(value)) { context.ui.notify("Usage: /fast [on|off]", "warning"); return; }
+      const enabled = context.model ? setFast(context.model, value === "" ? undefined : value === "on") : undefined;
+      context.ui.notify(enabled === undefined ? "Select a GPROXY model that advertises the priority service tier." : `GPROXY priority service ${enabled ? "on" : "off"}. Actual charges are recorded by GPROXY.`, enabled === undefined ? "warning" : "info");
+    },
+  });
+}

package/src/models.ts

@@ -0,0 +1,62 @@
+import { createHash } from "node:crypto";
+import type { Api, Model, ModelThinkingLevel, ThinkingLevelMap } from "@earendil-works/pi-ai";
+import type { GproxyCredential } from "./auth/wire.ts";
+
+export type GproxyModel = Model<"openai-responses"> & {
+  gproxy: { authorization: string; priority: boolean };
+};
+
+export function authorizationKey(value: GproxyCredential): string {
+  return createHash("sha256").update(`${value.instance}\0${value.authorization}`).digest("hex");
+}
+
+function record(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid GPROXY model catalog.");
+  return value as Record<string, unknown>;
+}
+
+function identifiers(value: unknown, field: string): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry) => {
+    if (typeof entry === "string") return [entry];
+    if (!entry || typeof entry !== "object") return [];
+    const name: unknown = entry[field];
+    return typeof name === "string" ? [name] : [];
+  });
+}
+
+function positive(...values: unknown[]): number | undefined {
+  return values.find((value): value is number => typeof value === "number" && Number.isSafeInteger(value) && value > 0);
+}
+
+export function mapModels(payload: unknown, current: GproxyCredential): GproxyModel[] {
+  const catalog = record(payload);
+  if (!Array.isArray(catalog.data)) throw new Error("GPROXY /v1/models did not return a model list.");
+  return catalog.data.map((entry) => {
+    const model = record(entry);
+    if (typeof model.id !== "string" || !model.id) throw new Error("GPROXY returned a model without an ID.");
+    const efforts = identifiers(model.supported_reasoning_levels, "effort");
+    const parameters = identifiers(model.supported_parameters, "id");
+    const levels: ModelThinkingLevel[] = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+    const thinkingLevelMap: ThinkingLevelMap | undefined = efforts.length ? Object.fromEntries(levels.map((level) => {
+      const effort = level === "off" ? "none" : level;
+      return [level, efforts.includes(effort) ? effort : null];
+    })) : undefined;
+    const contextWindow = positive(model.context_window, model.context_length, model.max_context_window) ?? 8_192;
+    return {
+      id: model.id, name: typeof model.display_name === "string" ? model.display_name : model.id,
+      api: "openai-responses", provider: "gproxy", baseUrl: `${current.instance}/v1`,
+      reasoning: efforts.some((effort) => effort !== "none") || parameters.includes("reasoning"),
+      thinkingLevelMap, input: identifiers(model.input_modalities, "type").includes("image") ? ["text", "image"] : ["text"],
+      contextWindow, maxTokens: Math.min(contextWindow, positive(model.max_completion_tokens, model.max_output_tokens) ?? 4_096),
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      compat: { supportsLongCacheRetention: false, supportsStrictMode: false },
+      gproxy: { authorization: authorizationKey(current), priority: identifiers(model.service_tiers, "id").includes("priority") },
+    };
+  });
+}
+
+export function matchesAuthorization(model: Model<Api>, current: GproxyCredential): model is GproxyModel {
+  const data = (model as Partial<GproxyModel>).gproxy;
+  return model.provider === "gproxy" && model.api === "openai-responses" && model.baseUrl === `${current.instance}/v1` && data?.authorization === authorizationKey(current);
+}

package/src/provider.ts

@@ -0,0 +1,77 @@
+import type { Api, Model, Provider, RefreshModelsContext, StreamOptions } from "@earendil-works/pi-ai";
+import { openAIResponsesApi } from "@earendil-works/pi-ai/compat";
+import { oauth } from "./auth/index.ts";
+import { credential, type GproxyCredential } from "./auth/wire.ts";
+import { authorizationKey, mapModels, matchesAuthorization, type GproxyModel } from "./models.ts";
+
+const { stream, streamSimple } = openAIResponsesApi();
+
+export function createGproxyProvider() {
+  let models: GproxyModel[] = [];
+  const invalid = new Set<string>();
+  const fast = new Set<string>();
+  const key = (model: GproxyModel) => `${model.gproxy.authorization}:${model.id}`;
+  const check = (current: GproxyCredential) => {
+    if (invalid.has(authorizationKey(current))) throw new Error("GPROXY authorization is no longer valid. Run /login GPROXY again.");
+  };
+  const invalidate = (current: GproxyCredential) => {
+    invalid.add(authorizationKey(current));
+    models = models.filter((model) => !matchesAuthorization(model, current));
+  };
+  const options = <Options extends StreamOptions>(model: Model<"openai-responses">, original?: Options): Options => ({
+    ...original,
+    onPayload: async (payload, selected) => {
+      const modified = await original?.onPayload?.(payload, selected);
+      const body = modified ?? payload;
+      const entry = models.find((entry) => entry.id === model.id && entry.baseUrl === model.baseUrl);
+      if (entry?.gproxy.priority && fast.has(key(entry)) && body && typeof body === "object") return { ...body, service_tier: "priority" };
+      return body;
+    },
+  } as Options);
+
+  const provider: Provider<"openai-responses"> = {
+    id: "gproxy", name: "GPROXY",
+    auth: { oauth: oauth(invalidate, check) },
+    getModels: () => models,
+    filterModels: (available, value) => {
+      if (value?.type !== "oauth") return [];
+      const current = credential(value);
+      return invalid.has(authorizationKey(current)) ? [] : available.filter((model) => matchesAuthorization(model, current));
+    },
+    async refreshModels(context: RefreshModelsContext) {
+      if (context.credential?.type !== "oauth") {
+        await context.publish({ persist: null, update: () => { models = []; } });
+        return;
+      }
+      const current = credential(context.credential);
+      check(current);
+      const restored = (context.stored?.models ?? []).filter((model) => matchesAuthorization(model, current));
+      await context.publish({ update: () => { models = restored; } });
+      if (!context.allowNetwork || (!context.force && restored.length && Date.now() - (context.stored?.checkedAt ?? 0) < 60_000)) return;
+      const response = await fetch(`${current.instance}/v1/models`, {
+        headers: { authorization: `Bearer ${current.access}`, accept: "application/json" },
+        signal: AbortSignal.any([context.signal, AbortSignal.timeout(30_000)]), redirect: "error", cache: "no-store",
+      });
+      if (response.status === 401) {
+        invalidate(current);
+        await context.publish({ persist: null, update: () => { models = []; } });
+        throw new Error("GPROXY authorization was revoked or expired. Run /login GPROXY again.");
+      }
+      if (!response.ok) throw new Error(`GPROXY model discovery failed (HTTP ${response.status}).`);
+      const discovered = mapModels(await response.json(), current);
+      await context.publish({ persist: { models: discovered, checkedAt: Date.now() }, update: () => { models = discovered; } });
+    },
+    stream: (model, context, original) => stream(model, context, options(model, original)),
+    streamSimple: (model, context, original) => streamSimple(model, context, options(model, original)),
+  };
+  return {
+    provider,
+    setFast(model: Model<Api>, enabled?: boolean): boolean | undefined {
+      const current = models.find((entry) => entry.id === model.id && entry.baseUrl === model.baseUrl && model.provider === "gproxy");
+      if (!current?.gproxy.priority) return undefined;
+      const active = enabled ?? !fast.has(key(current));
+      if (active) fast.add(key(current)); else fast.delete(key(current));
+      return active;
+    },
+  };
+}