pi-hypercharm-provider 1.3.8 → 1.3.9

package/.pi/fabric/mesh/state.json

@@ -1,6 +1,112 @@
 {
   "format": 1,
-  "entries": {},
+  "entries": {
+    "topology/peer-seq": {
+      "key": "topology/peer-seq",
+      "value": {
+        "format": 1,
+        "next": 1
+      },
+      "version": 1,
+      "updatedAt": 1788269765843,
+      "updatedBy": {
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "main",
+        "kind": "main",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e"
+      }
+    },
+    "topology/hosts/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a": {
+      "key": "topology/hosts/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a",
+      "value": {
+        "format": 1,
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "rootId": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "identity": {
+          "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+          "name": "main",
+          "kind": "main",
+          "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e"
+        },
+        "startedAt": 1788269765777,
+        "updatedAt": 1788270826370,
+        "expiresAt": 1788270841370
+      },
+      "version": 324,
+      "updatedAt": 1788270826371,
+      "updatedBy": {
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "main",
+        "kind": "main",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e"
+      }
+    },
+    "sessions/01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e": {
+      "key": "sessions/01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+      "value": {
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "PHP-1",
+        "label": "PHP-1",
+        "kind": "peer",
+        "status": "running",
+        "runner": "pi",
+        "transport": "host",
+        "cwd": "/Users/monotykamary/VCS/working-remote/open-source/pi-hypercharm-provider",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "model": "hypercharm/glm-5.3-flash",
+        "thinking": "high",
+        "startedAt": 1788269765777,
+        "updatedAt": 1788270826370,
+        "pendingMessages": false,
+        "local": false
+      },
+      "version": 324,
+      "updatedAt": 1788270826372,
+      "updatedBy": {
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "main",
+        "kind": "main",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e"
+      }
+    },
+    "topology/participants/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a": {
+      "key": "topology/participants/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a",
+      "value": {
+        "format": 1,
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "kind": "root",
+        "rootId": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "ownerHostId": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "ownerIdentityId": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "main",
+        "status": "running",
+        "runner": "pi",
+        "transport": "host",
+        "capabilities": [
+          "steer",
+          "followUp",
+          "fabric"
+        ],
+        "cwd": "/Users/monotykamary/VCS/working-remote/open-source/pi-hypercharm-provider",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "model": "hypercharm/glm-5.3-flash",
+        "thinking": "high",
+        "startedAt": 1788269765777,
+        "updatedAt": 1788270826370,
+        "pendingMessages": false,
+        "controlProtocol": "v1",
+        "label": "PHP-1"
+      },
+      "version": 324,
+      "updatedAt": 1788270826373,
+      "updatedBy": {
+        "id": "session:01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e",
+        "name": "main",
+        "kind": "main",
+        "sessionId": "01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e"
+      }
+    }
+  },
   "versions": {
     "topology/hosts/e9758aa8c95305a8d60a8aa2c20fd53195591d479b2460e1273457793d3f1fec": 18,
     "sessions/019fe2c8-1dd2-7435-9fa1-fa664831df18": 17,
@@ -13,7 +119,11 @@
     "topology/participants/3195ffccdcff6cb767344b2d1af6c5f3e1e3e4a9906a81129ffaf24352769d2a": 217,
     "topology/hosts/b98efd3cf26df4c69c6deae014475c4c0c080b1d0e5ef1cb0ebcc8dca7501c85": 388,
     "sessions/01a00efe-4e23-7b2b-8583-2e8493780899": 387,
-    "topology/participants/b98efd3cf26df4c69c6deae014475c4c0c080b1d0e5ef1cb0ebcc8dca7501c85": 388
+    "topology/participants/b98efd3cf26df4c69c6deae014475c4c0c080b1d0e5ef1cb0ebcc8dca7501c85": 388,
+    "topology/peer-seq": 1,
+    "topology/hosts/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a": 324,
+    "sessions/01a05d2e-8a1c-7bba-96fe-6e9eb4d7c42e": 324,
+    "topology/participants/276282166ed2e87cc2e85abfc95904809b77ae8c5dd6d44b4ab841d33b333b8a": 324
   },
   "tombstoneOrder": [
     "sessions/019fe2c8-1dd2-7435-9fa1-fa664831df18",

package/README.md

@@ -18,6 +18,7 @@ _Hyperoptimized coding models — DeepSeek, GLM, Kimi, Qwen, MiniMax, Gemma, GPT
 - **31+ AI Models** including DeepSeek V4 Flash/Pro, GLM 5/5.1, Kimi K2.5/K2.6, Qwen3.6/3.7, MiniMax M2.7, Gemma 4, GPT-OSS, and Llama
 - **DeepSeek Native Thinking** — Uses the `deepseek` thinking format for Charm Hyper requests, with native `reasoning_effort` on models that publish levels
 - **OpenAI-compatible API** via Charm Hyper's `/v1/chat/completions` endpoint
+- **OAuth Device Flow** — sign in with `/login` under the `hypercharm` provider (independent of the official provider's `hyper` registration)
 - **Official Catalog Sync** from Charm's typed `/v1/provider` endpoint, matching `@charmland/pi-hyper-provider`
 - **Reasoning Models** with provider-published on/off states and exact effort levels
 - **Attachment Support** for models the official catalog marks as attachment-capable
@@ -181,13 +182,14 @@ Non-interactive toggles:
 
 The HyperCharm API key can be configured in multiple ways (resolved in this order):
 
-1. **`auth.json`** (recommended) — Add to `~/.pi/agent/auth.json`:
+1. **OAuth** — Run `pi`, send `/login`, and pick **HyperCharm**. This uses Hyper's device flow (open the verification URL, enter the code) and stores a refreshable OAuth credential under the `hypercharm` provider — fully independent of the official `@charmland/pi-hyper-provider` (`hyper`) registration, so both extensions can be installed side by side.
+2. **`auth.json`** (recommended for API keys) — Add to `~/.pi/agent/auth.json`:
    ```json
    { "hypercharm": { "type": "api_key", "key": "your-api-key" } }
    ```
    The `key` field supports literal values, env var names, and shell commands (prefix with `!`). See [pi's auth file docs](https://github.com/badlogic/pi-mono) for details.
-2. **Runtime override** — Use the `--api-key` CLI flag
-3. **Environment variable** — Set `HYPERCHARM_API_KEY`
+3. **Runtime override** — Use the `--api-key` CLI flag
+4. **Environment variable** — Set `HYPERCHARM_API_KEY`
 
 Get your API key from [hyper.charm.land](https://hyper.charm.land).
 
@@ -217,7 +219,8 @@ Model metadata matches Charm's official [`@charmland/pi-hyper-provider`](https:/
 - `thinkingFormat: "deepseek"`, which maps Pi thinking levels onto Hyper's `thinking` envelope
 - `reasoning_effort` only when the catalog publishes concrete level names
 - `maxTokensField: "max_tokens"` and `supportsStore: false`
-- zero `cacheWrite`, because Hyper reports discounted cached-output pricing, not cache-write cost
+- `cacheRead` from `cost_per_1m_out_cached` (discounted cached-output price) and `cacheWrite` from `cost_per_1m_in_cached`, exactly as the official provider maps them
+- `/v1/credits` balance accepted in either hypercredits (`balance`) or USD (`balance_usd`, converted at the observed 20 hc = $1 rate)
 
 `patch.json` is reserved only for a verified provider regression and is currently empty.
 

package/index.ts

@@ -73,11 +73,15 @@
  *     /hypercharm-status reset
  *
  * Usage:
- *   # Option 1: Store in auth.json (recommended)
+ *   # Option 1: OAuth — run pi, send /login, and pick "HyperCharm"
+ *   # (device flow; provider id "hypercharm", distinct from the official
+ *   # @charmland/pi-hyper-provider registration "hyper")
+ *
+ *   # Option 2: Store in auth.json
  *   # Add to ~/.pi/agent/auth.json:
  *   #   "hypercharm": { "type": "api_key", "key": "your-api-key" }
  *
- *   # Option 2: Set as environment variable
+ *   # Option 3: Set as environment variable
  *   export HYPERCHARM_API_KEY=your-api-key
  *
  *   # Run pi with the extension
@@ -90,6 +94,7 @@
 
 import { clampThinkingLevel, streamOpenAICompletions } from "@earendil-works/pi-ai/compat";
 import type { AssistantMessageEventStream, SimpleStreamOptions } from "@earendil-works/pi-ai/compat";
+import { USER_AGENT, loginHypercharm, refreshHypercharmToken } from "./oauth";
 import { getAgentDir, type ExtensionAPI, type ExtensionContext, type ModelRegistry } from "@earendil-works/pi-coding-agent";
 import modelsData from "./models.json" with { type: "json" };
 import customModelsData from "./custom-models.json" with { type: "json" };
@@ -302,7 +307,7 @@ function transformApiModel(apiModel: any): JsonModel | null {
 async function fetchLiveModels(apiKey: string, signal?: AbortSignal): Promise<JsonModel[] | null> {
 	try {
 		const response = await fetch(MODELS_URL, {
-			headers: { Authorization: `Bearer ${apiKey}` },
+			headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": USER_AGENT },
 			signal: signal ? AbortSignal.any([AbortSignal.timeout(LIVE_FETCH_TIMEOUT_MS), signal]) : AbortSignal.timeout(LIVE_FETCH_TIMEOUT_MS),
 		});
 		if (!response.ok) return null;
@@ -634,7 +639,7 @@ let metaFetched = false;
 async function fetchJsonGet(url: string, apiKey: string, signal?: AbortSignal): Promise<any | null> {
 	try {
 		const response = await fetch(url, {
-			headers: { Authorization: `Bearer ${apiKey}` },
+			headers: { Authorization: `Bearer ${apiKey}`, "User-Agent": USER_AGENT },
 			signal: signal
 				? AbortSignal.any([AbortSignal.timeout(ACCOUNT_FETCH_TIMEOUT_MS), signal])
 				: AbortSignal.timeout(ACCOUNT_FETCH_TIMEOUT_MS),
@@ -656,9 +661,12 @@ function refreshCredits(apiKey: string | undefined, signal: AbortSignal | undefi
 		try {
 			const data = await fetchJsonGet(`${BASE_URL}/credits`, apiKey, signal);
 			if (data === null) return;
-			const balance = data?.balance;
-			if (typeof balance === "number" && Number.isFinite(balance)) {
-				account.balance = balance;
+			// /credits can report hypercredits ("balance") or USD ("balance_usd",
+			// USD-billed accounts). Handle both at the observed 20 hc = $1 rate so a
+			// server-side unit switch can never silently freeze the balance readout.
+			const rawBalance = typeof data?.balance === "number" ? data.balance : typeof data?.balance_usd === "number" ? data.balance_usd * 20 : undefined;
+			if (typeof rawBalance === "number" && Number.isFinite(rawBalance)) {
+				account.balance = rawBalance;
 			}
 		} finally {
 			creditsInFlight = null;
@@ -1007,6 +1015,12 @@ function makeProviderConfig(models: JsonModel[] = currentModels) {
 		api: "hypercharm",
 		models,
 		streamSimple: streamHypercharm,
+		oauth: {
+			name: "HyperCharm",
+			login: (callbacks) => loginHypercharm(callbacks),
+			refreshToken: (credentials, signal) => refreshHypercharmToken(credentials, signal),
+			getApiKey: (credentials) => String(credentials.access ?? ""),
+		},
 	};
 }
 

package/oauth.ts

@@ -0,0 +1,192 @@
+/**
+ * HyperCharm OAuth device flow (provider id "hypercharm").
+ *
+ * Mirrors the device flow from @charmland/pi-hyper-provider against
+ * hyper.charm.land, but registers under our own provider id ("hypercharm",
+ * oauth display name "HyperCharm") so it never collides with the official
+ * provider's "hyper" registration when both extensions are installed.
+ *
+ * Note: both providers register the device under the same name
+ * (`Pi (<hostname>)`), so /v1/devices entries are indistinguishable per host
+ * when the official provider is also signed in — the status widget's OAuth
+ * days-left readout may match either session.
+ */
+
+import { hostname } from "os";
+import type { OAuthCredentials, OAuthDeviceCodeInfo, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
+import pkg from "./package.json" with { type: "json" };
+
+const BASE_URL = "https://hyper.charm.land";
+const OAUTH_FETCH_TIMEOUT_MS = 30_000;
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const MIN_POLL_INTERVAL_MS = 1_000;
+const SLOW_DOWN_INCREMENT_MS = 5_000;
+const TOKEN_EXPIRY_BUFFER_MS = 30_000;
+const CANCEL_MESSAGE = "Login cancelled";
+const TIMEOUT_MESSAGE = "HyperCharm device flow timed out";
+
+export const USER_AGENT = `pi-hypercharm-provider/${(pkg as { version?: string }).version ?? "0.0.0"}`;
+
+function deviceName(): string {
+	const host = hostname();
+	return host ? `Pi (${host})` : "Pi";
+}
+
+function hyperHeaders(extra: Record<string, string> = {}): Record<string, string> {
+	return { "Content-Type": "application/json", "User-Agent": USER_AGENT, ...extra };
+}
+
+async function oauthFetch(url: string, init: RequestInit, signal?: AbortSignal): Promise<Response> {
+	const timeout = AbortSignal.timeout(OAUTH_FETCH_TIMEOUT_MS);
+	return fetch(url, { ...init, signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
+}
+
+async function abortableSleep(ms: number, signal?: AbortSignal): Promise<void> {
+	if (signal?.aborted) throw new Error(CANCEL_MESSAGE);
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(resolve, ms);
+		signal?.addEventListener(
+			"abort",
+			() => {
+				clearTimeout(timer);
+				reject(new Error(CANCEL_MESSAGE));
+			},
+			{ once: true },
+		);
+	});
+}
+
+interface DeviceAuthResponse {
+	device_code: string;
+	expires_in: number;
+	user_code: string;
+	verification_url: string;
+	interval?: number;
+}
+
+type DevicePollResponse =
+	| { refresh_token: string; team_id?: string; team_name?: string; user_id?: string }
+	| { error: string; error_description?: string };
+
+interface TokenExchangeResponse {
+	access_token: string;
+	refresh_token: string;
+	expires_in?: number;
+	expires_at?: number;
+}
+
+async function initiateDeviceAuth(signal?: AbortSignal): Promise<DeviceAuthResponse> {
+	const res = await oauthFetch(`${BASE_URL}/device/auth`, {
+		method: "POST",
+		headers: hyperHeaders(),
+		body: JSON.stringify({ device_name: deviceName() }),
+		signal,
+	});
+	if (!res.ok) throw new Error(`Hyper device auth failed: HTTP ${res.status}`);
+	const payload = await res.json();
+	if (
+		typeof payload?.device_code !== "string" ||
+		typeof payload?.user_code !== "string" ||
+		typeof payload?.verification_url !== "string" ||
+		typeof payload?.expires_in !== "number"
+	) {
+		throw new Error("Hyper device auth response is invalid");
+	}
+	return payload;
+}
+
+async function pollDeviceAuth(
+	auth: DeviceAuthResponse,
+	signal?: AbortSignal,
+): Promise<{ refresh_token: string; team_name?: string }> {
+	const deadline = Date.now() + auth.expires_in * 1000;
+	let intervalMs = Math.max(MIN_POLL_INTERVAL_MS, (auth.interval ?? DEFAULT_POLL_INTERVAL_SECONDS) * 1000);
+
+	// Server-specified cadence starts after the first wait (device codes are
+	// never ready immediately; polling sooner only earns slow_down responses).
+	await abortableSleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())), signal);
+
+	while (Date.now() < deadline) {
+		if (signal?.aborted) throw new Error(CANCEL_MESSAGE);
+		const res = await fetch(`${BASE_URL}/device/auth/${encodeURIComponent(auth.device_code)}`, {
+			headers: hyperHeaders(),
+			signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(OAUTH_FETCH_TIMEOUT_MS)]) : AbortSignal.timeout(OAUTH_FETCH_TIMEOUT_MS),
+		});
+		if (!res.ok) throw new Error(`Hyper device poll failed: HTTP ${res.status}`);
+		const payload = await res.json();
+
+		if (typeof payload?.refresh_token === "string") {
+			return { refresh_token: payload.refresh_token, team_name: payload.team_name };
+		}
+		if (payload?.error === "authorization_pending") {
+			// fall through to the interval sleep
+		} else if (payload?.error === "slow_down") {
+			intervalMs = Math.max(MIN_POLL_INTERVAL_MS, intervalMs + SLOW_DOWN_INCREMENT_MS);
+		} else {
+			throw new Error(`Hyper device authorization failed: ${payload?.error_description ?? payload?.error ?? "unknown error"}`);
+		}
+
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) break;
+		await abortableSleep(Math.min(intervalMs, remainingMs), signal);
+	}
+	throw new Error(TIMEOUT_MESSAGE);
+}
+
+async function exchangeRefreshToken(refreshToken: string, signal?: AbortSignal): Promise<TokenExchangeResponse> {
+	const res = await fetch(`${BASE_URL}/token/exchange`, {
+		method: "POST",
+		headers: hyperHeaders(),
+		body: JSON.stringify({ refresh_token: refreshToken }),
+		signal,
+	});
+	if (!res.ok) {
+		const err = new Error(`Hyper token exchange failed: HTTP ${res.status}`);
+		if (res.status === 401) {
+			throw new Error("Your Hyper session is no longer valid. Run /login and re-authenticate with HyperCharm.", { cause: err });
+		}
+		throw err;
+	}
+	const payload = (await res.json()) as TokenExchangeResponse;
+	if (typeof payload?.access_token !== "string") throw new Error("Hyper token exchange response is invalid");
+	return payload;
+}
+
+function tokenExpiresAtMs(token: TokenExchangeResponse): number {
+	const now = Date.now();
+	const expiresAt = typeof token.expires_in === "number" ? now + token.expires_in * 1000 : Number(token.expires_at) * 1000;
+	if (!Number.isFinite(expiresAt) || expiresAt <= now) {
+		throw new Error("Hyper token exchange response contains an expired token expiry");
+	}
+	return expiresAt - Math.min(TOKEN_EXPIRY_BUFFER_MS, Math.floor((expiresAt - now) / 2));
+}
+
+function toCredentials(token: TokenExchangeResponse, fallbackRefresh: string, teamName?: string): OAuthCredentials {
+	return {
+		type: "oauth",
+		refresh: token.refresh_token || fallbackRefresh,
+		access: token.access_token,
+		expires: tokenExpiresAtMs(token),
+		...(teamName ? { teamName } : {}),
+	};
+}
+
+/** Device-flow login for the "hypercharm" provider (/login flow). */
+export async function loginHypercharm(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+	const deviceAuth = await initiateDeviceAuth(callbacks.signal);
+	callbacks.onDeviceCode({
+		userCode: deviceAuth.user_code,
+		verificationUri: deviceAuth.verification_url,
+		intervalSeconds: deviceAuth.interval,
+		expiresInSeconds: deviceAuth.expires_in,
+	});
+	const devicePoll = await pollDeviceAuth(deviceAuth, callbacks.signal);
+	const token = await exchangeRefreshToken(devicePoll.refresh_token, callbacks.signal);
+	return toCredentials(token, devicePoll.refresh_token, devicePoll.team_name);
+}
+
+/** Refresh an expired HyperCharm OAuth credential via the token exchange endpoint. */
+export async function refreshHypercharmToken(credential: OAuthCredentials, signal?: AbortSignal): Promise<OAuthCredentials> {
+	const teamName = typeof credential.teamName === "string" && credential.teamName.trim() ? credential.teamName : undefined;
+	return toCredentials(await exchangeRefreshToken(credential.refresh, signal), credential.refresh, teamName);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-hypercharm-provider",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "description": "HyperCharm provider extension for pi - Access DeepSeek, GLM, Kimi, Qwen, MiniMax, Gemma, and GPT-OSS models through the Charm Hyper API",
   "type": "module",
   "main": "index.ts",