pi-provider-swiss-ai-platform 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (C) 2026 Daniel Roethlisberger <daniel@roe.ch>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# Pi provider extension for Swiss AI Platform
+Copyright (C) 2026, [Daniel Roethlisberger](//daniel.roe.ch/).  
+https://github.com/droe/pi-provider-swiss-ai-platform  
+
+Experimental Pi extension that registers a model provider for [Swiss AI
+Platform][1] by Swisscom in partnership with NVIDIA, offered via Swisscom's API
+platform [Digital Marketplace][2].
+
+[1]: https://www.swisscom.ch/en/business/enterprise/offer/platforms-applications/data-driven-business/swiss-ai-platform.html
+[2]: https://digital.swisscom.com/products/swiss-ai-platform/info
+
+## Models
+
+As of August 2026, the following models offered as part of Swiss AI Platform
+work with Pi:
+
+  - `swiss-ai/Apertus-v1.5-70B`
+  - `google/gemma-4-31b-it`
+  - `qwen/qwen3.5-397b-a17b`
+  - `qwen/qwen3.6-35b-a3b`
+  - `mistralai/mistral-small-4-119b-2603` (partially)
+
+See `MODEL_METADATA` in `index.ts` for metadata on all models, including hidden
+models and why they have been hidden.  Feedback or patches to improve model
+compatibility very welcome.
+
+Models added more recently, i.e. models not included in `MODEL_METADATA` yet,
+may or may not work, and likely need manual configuration in
+`~/.pi/agent/models.json`.
+
+## Prerequisites
+
+You need a Swiss AI Platform subscription and matching Client ID and Client
+Secret.
+
+In your subscription on Digital Marketplace, select Documentation and check
+«Production Url».  The last path component is the subscription name, e.g.
+`all-models` or `apertus-1.5-70b`.  Note that for model-specific subscriptions,
+the subscription name is different from the model identifier.
+
+The credentials are more straightforward.  From your subscription, select
+«Credentials» and check the «OAuth 2.0 Credentials» section.
+
+## Installation
+
+```
+pi install npm:pi-provider-swiss-ai-platform
+```
+
+## Configuration
+
+Interactive configuration as usual: `/login` -> «Swiss AI Platform» prompts for
+the subscription name, the Client ID and the Client Secret, verifies them
+against the gateway and stores them in `~/.pi/agent/auth.json`.  Access tokens
+are minted on demand and cached in memory until they expire.
+
+Multiple configured subscriptions are not currently implemented.  Switching
+subscription is another `/login`.
+
+For headless use, the following environment variables can be set:
+
+-   `SWISS_AI_PLATFORM_SUBSCRIPTION`
+-   `SWISS_AI_PLATFORM_CLIENT_ID`
+-   `SWISS_AI_PLATFORM_CLIENT_SECRET`
+
+## Implementation Details
+
+Models are served over the OpenAI-compatible `/v1/chat/completions` API; only
+some of them also support `/v1/responses`, so completions is the default and
+`MODEL_METADATA.api` opts a model into the Responses API.  Authentication is an
+OAuth 2.0 client-credentials grant (HTTP Basic client authentication).
+
+The model catalog is pulled from `/v1/models` on model refresh and cached by Pi
+in `~/.pi/agent/models-store.json`.  The endpoint returns ids only, so model
+capabilities come from the curated `MODEL_METADATA` table in `index.ts`.
+Unknown ids fall back to `DEFAULT_METADATA`; entries flagged `hideModel: true`
+are dropped from the catalog.  Per-model overrides are still possible in
+`~/.pi/agent/models.json`.
+
+## Disclaimer
+
+This Pi extension is inofficial, neither provided by nor supported by Swisscom.

package/index.ts

@@ -0,0 +1,460 @@
+/*
+ * Pi provider extension for Swiss AI Platform by Swisscom.
+ * Copyright (C) 2026 Daniel Roethlisberger <daniel@roe.ch>
+ * https://github.com/droe/pi-provider-swiss-ai-platform
+ */
+
+import {
+  type ApiKeyAuth,
+  type ApiKeyCredential,
+  type AuthInteraction,
+  createProvider,
+  type Model,
+  type RefreshModelsContext,
+} from "@earendil-works/pi-ai";
+import { openAICompletionsApi, openAIResponsesApi } from "@earendil-works/pi-ai/compat";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+// =============================================================================
+// Configuration
+// =============================================================================
+
+const PROVIDER_ID = "swiss-ai-platform";
+const PROVIDER_NAME = "Swiss AI Platform";
+const PRODUCT_URL = "https://api.swisscom.com/products/swiss-ai-platform";
+const TOKEN_URL = "https://api.swisscom.com/products/oauth2/token";
+
+const ENV_SUBSCRIPTION = "SWISS_AI_PLATFORM_SUBSCRIPTION";
+const ENV_CLIENT_ID = "SWISS_AI_PLATFORM_CLIENT_ID";
+const ENV_CLIENT_SECRET = "SWISS_AI_PLATFORM_CLIENT_SECRET";
+const ENV_ACCESS_TOKEN = "SWISS_AI_PLATFORM_ACCESS_TOKEN";
+
+/** Safety margin subtracted from the token lifetime reported by the gateway. */
+const TOKEN_EXPIRY_SKEW_MS = 60_000;
+
+/** e.g. subscription "all-models" -> ".../swiss-ai-platform/all-models/v1" */
+const baseUrlFor = (subscription: string) => `${PRODUCT_URL}/${encodeURIComponent(subscription)}/v1`;
+
+type SwissApi = "openai-completions" | "openai-responses";
+type SwissModel = Model<SwissApi>;
+
+/** Only some models support the Responses API, so chat completions is the default. */
+const DEFAULT_API: SwissApi = "openai-completions";
+
+interface ModelMetadata {
+  name?: string;
+  /** Streaming API for this model. Default: DEFAULT_API ("openai-completions"). */
+  api?: SwissApi;
+  /**
+   * Keep the model out of pi entirely. Use it for models that cannot serve a
+   * coding agent, e.g. text-to-speech, speech-to-text, embeddings or moderation.
+   */
+  hideModel?: boolean;
+  reasoning?: boolean;
+  input?: ("text" | "image")[];
+  /** USD per million tokens. */
+  cost?: { input: number; output: number; cacheRead: number; cacheWrite: number };
+  contextWindow?: number;
+  maxTokens?: number;
+  thinkingLevelMap?: SwissModel["thinkingLevelMap"];
+  compat?: SwissModel["compat"];
+}
+
+/**
+ * Curated capabilities per model id, keyed exactly as returned by /v1/models.
+ * Model documentation by Swisscom:
+ * https://docs.cloud.swisscom.ch/guide/cloud-services/aip/use/inference-endpoints/
+ *
+ * Configuration may not be perfect, please submit issues or PRs with improvements.
+ */
+const MODEL_METADATA: Record<string, ModelMetadata> = {
+  "google/gemma-4-31b-it": {
+    name: "Gemma 4 31b",
+    api: "openai-responses",
+    reasoning: true,
+    input: ["text", "image"],
+    contextWindow: 256000,
+  },
+  "magpie-tts-multilingual": {
+    // Disabled because Pi does not do text-to-speech.
+    hideModel: true,
+    name: "Magpie TTS Multilingual",
+  },
+  "meta/llama-3.1-8b-instruct": {
+    // Disabled because the model does not seem to work with Pi.
+    hideModel: true,
+    name: "Llama 3.1 8b instruct",
+  },
+  "meta/llama-4-scout-17b-16e-instruct": {
+    // Disabled because tool calling does not seem to work.
+    hideModel: true,
+    name: "Llama 4 Scout 17b 16e instruct",
+    input: ["text", "image"],
+    contextWindow: 131072,
+  },
+  "mistralai/mistral-small-4-119b-2603": {
+    // FIXME Docs state that this model supports the responses API, but
+    // responses API results in error 400 "'input_text' is not a valid
+    // ChunkTypes".  Use completions until someone figures this one out.
+    // FIXME [THINK]...[/THINK] tags are not recognised by Pi.
+    name: "Mistral Small 4 119b 2603",
+    //api: "openai-responses",
+    reasoning: true,
+    input: ["text", "image"],
+    contextWindow: 256144,
+    thinkingLevelMap: {
+      off: "none",
+      minimal: null,
+      low: null,
+      medium: null,
+      high: "high",
+      xhigh: null,
+      max: null,
+    },
+    compat: {
+      supportsDeveloperRole: false,
+    },
+  },
+  "nvidia/llama-3.1-nemoguard-8b-content-safety": {
+    // Disabled because Pi does not do content safety.
+    hideModel: true,
+    name: "Llama 3.1 Nemoguard 8b content safety",
+  },
+  "nvidia/llama-3.2-nv-embedqa-1b-v2": {
+    // Disabled because Pi does not do text-to-embeddings.
+    hideModel: true,
+    name: "Llama 3.2 NV embedqa 1b v2",
+  },
+  "openai/gpt-oss-20b": {
+    // FIXME Works, but performs very poorly with tool calling.
+    // Should investigate root cause.
+    hideModel: true,
+    name: "GPT OSS 20b",
+    input: ["text"],
+    contextWindow: 131072,
+  },
+  "openai/gpt-oss-120b": {
+    // FIXME Works, but performs very poorly with tool calling.
+    // Should investigate root cause.
+    hideModel: true,
+    name: "GPT OSS 120b",
+    input: ["text"],
+    contextWindow: 131072,
+  },
+  "openai/whisper-large-v3-turbo": {
+    // Disabled because Pi does not do speech-to-text.
+    hideModel: true,
+    name: "Whisper Large V3 Turbo",
+  },
+  "qwen/qwen3.5-397b-a17b": {
+    name: "Qwen 3.5 397b A17B",
+    reasoning: true,
+    input: ["text"],
+    contextWindow: 262144,
+    thinkingLevelMap: {
+      off: "none",
+      minimal: null,
+      low: "low",
+      medium: "medium",
+      high: "high",
+      xhigh: null,
+      max: null,
+    },
+    compat: {
+      thinkingFormat: "qwen",
+      supportsDeveloperRole: false,
+    },
+  },
+  "qwen/qwen3.6-35b-a3b": {
+    // FIXME Docs state that this model supports the responses API, but
+    // responses API results in "Error: OpenAI API error (429): 429
+    // status code (no body)".  Use completions until someone figures
+    // this one out.
+    name: "Qwen 3.6 35b A3B",
+    //api: "openai-responses",
+    reasoning: true,
+    input: ["text"],
+    contextWindow: 262144,
+    compat: {
+      thinkingFormat: "qwen",
+    },
+  },
+  "rednote-hilab/dots.ocr": {
+    // Disabled because Pi does not do OCR.
+    hideModel: true,
+    name: "Rednote Hilab Dots OCR",
+  },
+  "swiss-ai/Apertus-v1.5-70B": {
+    name: "Apertus v1.5 70b",
+    api: "openai-responses",
+    input: ["text", "image"],
+    contextWindow: 262144,
+  },
+};
+
+/** Applied to models returned by /v1/models that have no MODEL_METADATA entry. */
+const DEFAULT_METADATA: Required<Pick<ModelMetadata, "reasoning" | "input" | "cost" | "contextWindow" | "maxTokens">> = {
+  reasoning: false,
+  input: ["text"],
+  cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+  contextWindow: 131_072,
+  maxTokens: 16_384,
+};
+
+/** Models flagged with `hideModel` are never offered by this provider. */
+const isHidden = (id: string) => MODEL_METADATA[id]?.hideModel === true;
+
+// =============================================================================
+// Gateway requests
+// =============================================================================
+
+interface AccessToken {
+  access: string;
+  /** Absolute expiry in ms, already reduced by TOKEN_EXPIRY_SKEW_MS. */
+  expires: number;
+}
+
+async function errorDetail(response: Response): Promise<string> {
+  const body = await response.text().catch(() => "");
+  try {
+    const json = JSON.parse(body) as { message?: string; error_description?: string; error?: string };
+    return json.message ?? json.error_description ?? json.error ?? body;
+  } catch {
+    return body;
+  }
+}
+
+/** OAuth 2.0 client-credentials grant with HTTP Basic client authentication. */
+async function requestAccessToken(clientId: string, clientSecret: string, signal?: AbortSignal): Promise<AccessToken> {
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: {
+      Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`, "utf8").toString("base64")}`,
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+    },
+    body: new URLSearchParams({ grant_type: "client_credentials" }).toString(),
+    signal,
+  });
+
+  if (!response.ok) {
+    throw new Error(`${PROVIDER_NAME} token request failed (${response.status}): ${await errorDetail(response)}`);
+  }
+
+  const data = (await response.json()) as { access_token?: string; expires_in?: number };
+  if (!data.access_token) throw new Error(`${PROVIDER_NAME} token response contained no access_token`);
+
+  return {
+    access: data.access_token,
+    expires: Date.now() + (data.expires_in ?? 3600) * 1000 - TOKEN_EXPIRY_SKEW_MS,
+  };
+}
+
+/** In-process token cache; promises are cached so concurrent requests share one grant. */
+const tokenCache = new Map<string, Promise<AccessToken>>();
+
+async function cachedAccessToken(clientId: string, clientSecret: string, signal?: AbortSignal): Promise<string> {
+  const key = `${clientId}:${clientSecret}`;
+  const pending = tokenCache.get(key);
+
+  if (pending) {
+    const token = await pending.catch(() => undefined);
+    if (token && token.expires > Date.now()) return token.access;
+  }
+
+  const request = requestAccessToken(clientId, clientSecret, signal);
+  tokenCache.set(key, request);
+  try {
+    return (await request).access;
+  } catch (error) {
+    tokenCache.delete(key);
+    throw error;
+  }
+}
+
+/** Model ids offered by one subscription. Doubles as the subscription check during login. */
+async function fetchModelIds(subscription: string, token: string, signal?: AbortSignal): Promise<string[]> {
+  const response = await fetch(`${baseUrlFor(subscription)}/models`, {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+    signal,
+  });
+
+  if (!response.ok) {
+    throw new Error(
+      `${PROVIDER_NAME} model listing for subscription "${subscription}" failed (${response.status}): ${await errorDetail(response)}`,
+    );
+  }
+
+  const payload = (await response.json()) as { data?: { id?: string }[] };
+  return (payload.data ?? []).map((entry) => entry?.id).filter((id): id is string => typeof id === "string" && id.length > 0);
+}
+
+// =============================================================================
+// Auth
+// =============================================================================
+
+/** Everything needed to reach one subscription: endpoint plus a way to get a token. */
+interface Settings {
+  subscription: string;
+  token?: string;
+  clientId?: string;
+  clientSecret?: string;
+  source: string;
+}
+
+type EnvLookup = (name: string) => Promise<string | undefined> | string | undefined;
+
+/**
+ * Collect settings from the stored credential first, then the environment.
+ * The subscription name is mandatory: without it there is no endpoint to call.
+ */
+async function lookupSettings(env: EnvLookup, credential?: ApiKeyCredential): Promise<Settings | undefined> {
+  const stored = credential?.env ?? {};
+  const subscription = stored[ENV_SUBSCRIPTION] ?? (await env(ENV_SUBSCRIPTION));
+
+  const token = credential?.key ?? (await env(ENV_ACCESS_TOKEN));
+  const clientId = stored[ENV_CLIENT_ID] ?? (await env(ENV_CLIENT_ID));
+  const clientSecret = stored[ENV_CLIENT_SECRET] ?? (await env(ENV_CLIENT_SECRET));
+
+  const origin = token
+    ? credential?.key
+      ? "stored access token"
+      : ENV_ACCESS_TOKEN
+    : clientId && clientSecret
+      ? stored[ENV_CLIENT_ID]
+        ? "stored client credentials"
+        : `${ENV_CLIENT_ID}/${ENV_CLIENT_SECRET}`
+      : undefined;
+  if (!origin) return undefined;
+
+  if (!subscription) {
+    throw new Error(
+      `No ${PROVIDER_NAME} subscription name — run /login ${PROVIDER_ID} or set ${ENV_SUBSCRIPTION}`,
+    );
+  }
+
+  return { subscription, token, clientId, clientSecret, source: `${origin}, subscription "${subscription}"` };
+}
+
+async function accessTokenFor(settings: Settings, signal?: AbortSignal): Promise<string> {
+  return settings.token ?? cachedAccessToken(settings.clientId!, settings.clientSecret!, signal);
+}
+
+const apiKeyAuth: ApiKeyAuth = {
+  name: `${PROVIDER_NAME} subscription and client credentials`,
+
+  /** Interactive setup started by /login: subscription name, Client ID, Client Secret. */
+  async login(interaction: AuthInteraction): Promise<ApiKeyCredential> {
+    const subscription = (
+      await interaction.prompt({
+        type: "text",
+        message: "Subscription name (part of the API base URL, no default)",
+        placeholder: "all-models",
+      })
+    ).trim();
+    if (!subscription) throw new Error("A subscription name is required");
+
+    const clientId = (
+      await interaction.prompt({ type: "text", message: "Client ID", placeholder: "OAuth 2.0 client id" })
+    ).trim();
+    const clientSecret = (await interaction.prompt({ type: "secret", message: "Client Secret" })).trim();
+    if (!clientId || !clientSecret) throw new Error("Client ID and Client Secret are required");
+
+    // Verify credentials and subscription before storing; also primes the token cache.
+    interaction.notify({ type: "progress", message: "Verifying client credentials..." });
+    const token = await cachedAccessToken(clientId, clientSecret, interaction.signal);
+
+    interaction.notify({ type: "progress", message: `Checking subscription "${subscription}"...` });
+    const modelIds = (await fetchModelIds(subscription, token, interaction.signal)).filter((id) => !isHidden(id));
+    interaction.notify({ type: "info", message: `${modelIds.length} usable model(s) in "${subscription}"` });
+
+    return {
+      type: "api_key",
+      env: {
+        [ENV_SUBSCRIPTION]: subscription,
+        [ENV_CLIENT_ID]: clientId,
+        [ENV_CLIENT_SECRET]: clientSecret,
+      },
+    };
+  },
+
+  async check({ ctx, credential }) {
+    const settings = await lookupSettings((name) => ctx.env(name), credential).catch(() => undefined);
+    return settings ? { type: "api_key", source: settings.source } : undefined;
+  },
+
+  async resolve({ ctx, credential }) {
+    const settings = await lookupSettings((name) => ctx.env(name), credential);
+    if (!settings) return undefined;
+
+    return {
+      auth: { apiKey: await accessTokenFor(settings), baseUrl: baseUrlFor(settings.subscription) },
+      env: { [ENV_SUBSCRIPTION]: settings.subscription },
+      source: settings.source,
+    };
+  },
+};
+
+// =============================================================================
+// Model catalog
+// =============================================================================
+
+function toModel(id: string, baseUrl: string): SwissModel {
+  const meta = MODEL_METADATA[id] ?? {};
+  return {
+    id,
+    name: meta.name ?? id,
+    api: meta.api ?? DEFAULT_API,
+    provider: PROVIDER_ID,
+    baseUrl,
+    reasoning: meta.reasoning ?? DEFAULT_METADATA.reasoning,
+    ...(meta.thinkingLevelMap ? { thinkingLevelMap: meta.thinkingLevelMap } : {}),
+    input: meta.input ?? DEFAULT_METADATA.input,
+    cost: meta.cost ?? DEFAULT_METADATA.cost,
+    contextWindow: meta.contextWindow ?? DEFAULT_METADATA.contextWindow,
+    maxTokens: meta.maxTokens ?? DEFAULT_METADATA.maxTokens,
+    ...(meta.compat ? { compat: meta.compat } : {}),
+  };
+}
+
+/** Throws on failure so pi keeps the previously stored catalog. */
+async function fetchModels({ credential, signal }: RefreshModelsContext): Promise<readonly SwissModel[]> {
+  const apiKeyCredential: ApiKeyCredential | undefined = credential?.type === "api_key" ? credential : undefined;
+  const settings = await lookupSettings((name) => process.env[name], apiKeyCredential);
+  if (!settings) {
+    throw new Error(`No ${PROVIDER_NAME} credentials — run /login ${PROVIDER_ID} or set ${ENV_CLIENT_ID}/${ENV_CLIENT_SECRET}`);
+  }
+
+  const token = await accessTokenFor(settings, signal);
+  const baseUrl = baseUrlFor(settings.subscription);
+
+  return (await fetchModelIds(settings.subscription, token, signal))
+    .filter((id) => !isHidden(id))
+    .map((id) => toModel(id, baseUrl))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// =============================================================================
+// Extension entry point
+// =============================================================================
+
+export default function (pi: ExtensionAPI) {
+  pi.registerProvider(
+    createProvider<SwissApi>({
+      id: PROVIDER_ID,
+      name: PROVIDER_NAME,
+      // Per-credential endpoint; the subscription-specific URL comes from auth.
+      baseUrl: PRODUCT_URL,
+      auth: { apiKey: apiKeyAuth },
+      models: [],
+      fetchModels,
+      // Second line of defence: also hides models restored from a stale catalog cache.
+      filterModels: (models) => models.filter((model) => !isHidden(model.id)),
+      // Per-model dispatch: completions for everything unless MODEL_METADATA says otherwise.
+      api: {
+        "openai-completions": openAICompletionsApi(),
+        "openai-responses": openAIResponsesApi(),
+      },
+    }),
+  );
+}

package/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "pi-provider-swiss-ai-platform",
+  "version": "0.1.0",
+  "keywords": ["pi-package"],
+  "pi": {
+    "extensions": ["./index.ts"]
+  }
+}