pi-roundtable-sandbox 0.7.19 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+## 0.8.0
+
+- `apiKey` and `oauthToken` receive `{ channel, speaker }` (`SandboxCredentialScope`, a new export) before every model call, so a host can pick a key or a subscription per channel or speaker, such as `apiKey: ({ channel }) => keys.get(channel)`. A zero-argument function keeps working. A turn keeps the scope it started with while its requests are in flight, and a getter that returns `undefined` or an empty string fails the call: no other credential is used. The worker still sees only the placeholder key.
+
 ## 0.7.18
 
 - Preserve a reset requested during broker startup or an active turn for the following turn; a successful turn consumes only the reset generation it started with.

package/README.md

@@ -10,7 +10,7 @@ Channel memory and recent conversation text persist in the channel's dedicated w
 
 ## Requirements
 
-- Bun 1.4.2 or later and pi-roundtable `>=0.7.0 <0.8.0`.
+- Bun 1.4.2 or later and pi-roundtable `>=0.8.0 <0.9.0`.
 - A native Linux host with a local Docker daemon and a non-root service account permitted to run Docker.
 - The worker UID/GID match that account; root workers are refused.
 - A trusted OpenAI-compatible, non-streaming Chat Completions endpoint supporting function tools and `max_tokens`.
@@ -59,6 +59,8 @@ export const guestPlugins = [sandbox({
 Choose a model available to your endpoint and sign the host into its provider.
 By default, `context.apiKey(provider)` is read on every request, allowing login refresh without copying credentials into the worker.
 Alternatively supply `apiKey: () => process.env.MODEL_API_KEY` when the endpoint uses a separate key.
+`apiKey` receives `{ channel, speaker }` (`SandboxCredentialScope`) before every model call, so a host can pick a different key per channel or speaker, for example `apiKey: ({ channel }) => keys.get(channel)`; a zero-argument function keeps working.
+When the hook has no key it should return `undefined` (the call fails closed) rather than fall back to the host's own login.
 Keep secrets in the service's protected environment, not configuration source or the worker image.
 All directories must be dedicated to this package and owned by the service account.
 Existing roots and the state directory must have no group/other permissions; insecure permissions are refused at startup.
@@ -216,7 +218,7 @@ Other model transports are not implicitly proxied by this broker.
 | --- | --- |
 | `partyDir`, `image` | Dedicated private, host-owned directory and operator-built Pi image. |
 | `profiles` | Host allow-list mapping profile names to fixed Anthropic `model` and optional MCP server names. |
-| `oauthToken()` | Host-only credential getter called for each model request; supports refresh without container credentials. |
+| `oauthToken({ channel, speaker })` | Host-only credential getter called before each model request with the bound turn's channel and speaker, so a host can use a different subscription per channel or speaker; supports refresh without container credentials. A zero-argument getter still works. Returning `undefined` or an empty string fails the call; no other credential is used. |
 | `memory.promptBlock(channel, id, name)` | Current admitted speaker's context, at most 100,000 characters; database implementations remain host adapters. |
 | `effort.judge(text, { level })` | Host-selected `low`, `medium`, `high`, or `xhigh`; the previous channel choice is retained for the next judgment. |
 | `tools.names`, `tools.call` | Explicit host tool allow-list and callback receiving fixed channel/profile/speaker plus cancellation signal. |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-sandbox",
-	"version": "0.7.19",
+	"version": "0.8.0",
 	"description": "Sealed guest channels and an allow-listed credential broker for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -36,7 +36,7 @@
 	},
 	"peerDependencies": {
 		"@earendil-works/pi-coding-agent": ">=1.0.0 <2",
-		"pi-roundtable": ">=0.7.0 <0.8.0",
+		"pi-roundtable": ">=0.8.0 <0.9.0",
 		"typebox": ">=1.3.34 <2"
 	},
 	"peerDependenciesMeta": {
@@ -52,7 +52,7 @@
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
 		"discord.js": "14.27.0",
-		"pi-roundtable": "0.7.19",
+		"pi-roundtable": "0.8.0",
 		"typebox": "1.3.34",
 		"typescript": "7.0.2"
 	}

package/src/broker.ts

@@ -21,6 +21,11 @@ export interface HostToolContext {
 	speaker: { id: string; name: string };
 	signal: AbortSignal;
 }
+/** Who a model call is made for; a credential hook can pick a token per channel or speaker. */
+export interface SandboxCredentialScope {
+	channel: ChannelKey;
+	speaker: { id: string; name: string };
+}
 export interface HostTool extends ToolSpec {
 	run(
 		input: Record<string, unknown>,
@@ -39,7 +44,10 @@ export interface BrokerOptions {
 	model: string;
 	/** Fixed complete URL, not a guest-selected base URL. */
 	modelUrl: string;
-	apiKey: () => Promise<string | undefined> | string | undefined;
+	/** Host-only, read before each model call; a zero-argument function still works. */
+	apiKey: (
+		scope: SandboxCredentialScope,
+	) => Promise<string | undefined> | string | undefined;
 	tools?: readonly HostTool[];
 	mcp?: readonly McpServer[];
 	/** Allow cleartext endpoints only for local testing. */
@@ -219,7 +227,11 @@ export class SandboxBroker {
 				return new Response("text/function model payload required", {
 					status: 400,
 				});
-			const key = await this.#options.apiKey();
+			const { channel, speaker } = this.#options.context;
+			const key = await this.#options.apiKey({
+				channel,
+				speaker: { id: speaker.id, name: speaker.name },
+			});
 			if (!key) throw new Error("model credential unavailable");
 			return await this.#forward(
 				this.#options.modelUrl,

package/src/index.ts

@@ -19,6 +19,7 @@ export {
 	type HostToolContext,
 	type McpServer,
 	SandboxBroker,
+	type SandboxCredentialScope,
 } from "./broker.ts";
 export { SandboxChannelStore } from "./channel-store.ts";
 export {

package/src/pi-broker.ts

@@ -1,6 +1,10 @@
 import type { ChannelKey, Logger } from "pi-roundtable";
 import { HARD_COMPACT_TOKENS, scrubDiagnostic } from "pi-roundtable/kit";
-import { type BrokerListener, listenBroker } from "./broker.ts";
+import {
+	type BrokerListener,
+	listenBroker,
+	type SandboxCredentialScope,
+} from "./broker.ts";
 import { piModelInput } from "./pi-model-input.ts";
 import {
 	PI_MEDIA_LIMITS,
@@ -62,8 +66,10 @@ export interface PiCompactor {
 }
 export interface PiBrokerOptions {
 	model: string;
-	/** Host-only, read at each call. Never sent to the worker. */
-	oauthToken: () => string | Promise<string>;
+	/** Host-only, read before each model call for its channel and speaker; a zero-argument function still works. Return `undefined` or an empty string when the scope has no token: the call fails rather than using another credential. Never sent to the worker. */
+	oauthToken: (
+		scope: SandboxCredentialScope,
+	) => string | undefined | Promise<string | undefined>;
 	tools?: {
 		names: readonly string[];
 		call(
@@ -640,7 +646,12 @@ export class PiSandboxBroker {
 					);
 				}
 				target = `${this.#options.upstream ?? "https://api.anthropic.com"}${url.pathname.slice("/anthropic".length)}${url.search}`;
-				secret = await this.#options.oauthToken();
+				const { channel, speaker } = turn.context;
+				secret =
+					(await this.#options.oauthToken({
+						channel,
+						speaker: { id: speaker.id, name: speaker.name },
+					})) ?? "";
 				for (const name of HEADERS) {
 					const value = request.headers.get(name);
 					if (value && value.length <= 4096) headers.set(name, value);

package/src/plugin.ts

@@ -15,6 +15,7 @@ export interface SandboxOptions
 	initialChannels?: readonly ChannelKey[];
 	/** Host login provider used for each model call, unless apiKey is supplied. */
 	provider?: string;
+	/** Read before each model call with its channel and speaker; never falls back to the host login. */
 	apiKey?: SandboxRuntimeOptions["apiKey"];
 }
 export interface SandboxService {