pi-sap-aicore 0.1.0

package/scripts/update-models.mjs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+/**
+ * Refresh src/models-snapshot.json from models.dev's SAP AI Core entry.
+ * Run: npm run update-models
+ */
+
+import { writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const OUT = join(__dirname, "..", "src", "models-snapshot.json");
+const SOURCE = "https://models.dev/api.json";
+
+// SAP orchestration uses provider-native reasoning shapes (see
+// src/stream.ts:reasoningParams). What's *common* across providers is the
+// effort tier — pi has 5 above-off levels, the provider tiers are 3
+// (low/medium/high). Fold minimal→low and xhigh→high so every pi level
+// still does something (rather than dropping minimal/xhigh silently).
+const SAP_EFFORT_BY_LEVEL = {
+	minimal: "low",
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "high",
+};
+
+function thinkingMapFor(reasoning) {
+	if (!reasoning) return undefined;
+	return { ...SAP_EFFORT_BY_LEVEL };
+}
+
+// Per-family reasoning support. SAP orchestration accepts Anthropic's
+// `thinking + output_config` and OpenAI's `reasoning_effort`. Gemini's
+// shape via SAP is undocumented — we leave reasoning OFF for gemini-* so
+// pi's Shift+Tab cycle doesn't silently no-op. If/when SAP confirms the
+// passthrough (likely `thinking_config.thinking_budget`), wire it in
+// src/stream.ts:reasoningParams and re-enable here.
+function supportsReasoning(model) {
+	if (!model.reasoning) return false;
+	if (model.id.startsWith("gemini-")) return false;
+	return true;
+}
+
+function adapt(model) {
+	const input = (model.modalities?.input ?? ["text"]).filter((m) =>
+		["text", "image", "pdf"].includes(m),
+	);
+	const reasoning = supportsReasoning(model);
+	const adapted = {
+		id: model.id,
+		name: model.name ?? model.id,
+		reasoning,
+		tool_call: !!model.tool_call,
+		temperature: model.temperature !== false,
+		modalities: {
+			input,
+			output: ["text"],
+		},
+		limit: {
+			context: model.limit?.context ?? 0,
+			output: model.limit?.output ?? 0,
+		},
+		cost: {
+			input: model.cost?.input ?? 0,
+			output: model.cost?.output ?? 0,
+			cacheRead: model.cost?.cache_read ?? 0,
+			cacheWrite: model.cost?.cache_write ?? 0,
+		},
+	};
+	const thinkingMap = thinkingMapFor(reasoning);
+	if (thinkingMap) adapted.thinkingLevelMap = thinkingMap;
+	return adapted;
+}
+
+function shouldInclude(id) {
+	return (
+		id.startsWith("anthropic--claude-4") ||
+		id.startsWith("gpt-5") ||
+		id.startsWith("gemini-2.5")
+	);
+}
+
+const res = await fetch(SOURCE);
+if (!res.ok) {
+	console.error(`Failed to fetch ${SOURCE}: ${res.status} ${res.statusText}`);
+	process.exit(1);
+}
+const all = await res.json();
+const sapModels = all["sap-ai-core"]?.models ?? {};
+const adapted = Object.values(sapModels)
+	.filter((m) => shouldInclude(m.id))
+	.map(adapt)
+	.sort((a, b) => a.id.localeCompare(b.id));
+
+const snapshot = {
+	source: SOURCE,
+	fetchedAt: new Date().toISOString(),
+	count: adapted.length,
+	models: adapted,
+};
+
+writeFileSync(OUT, `${JSON.stringify(snapshot, null, 2)}\n`);
+console.log(`Wrote ${adapted.length} models to ${OUT}`);
+for (const m of adapted) {
+	console.log(`  ${m.id}  ctx=${m.limit.context} out=${m.limit.output} reasoning=${m.reasoning}`);
+}

package/src/auth.ts

@@ -0,0 +1,104 @@
+import type { ProviderConfig } from "@earendil-works/pi-coding-agent";
+
+/** A validated SAP AI Core service key: the raw JSON plus any embedded resource group. */
+export type ValidatedKey = { raw: string; resourceGroup?: string };
+
+// Fields a usable BTP service-key JSON must contain. `serviceurls.AI_API_URL`
+// is a dot-path into a nested object.
+const REQUIRED_FIELDS = [
+	"clientid",
+	"clientsecret",
+	"url",
+	"serviceurls.AI_API_URL",
+] as const;
+
+/**
+ * Parse and validate a SAP BTP service-key JSON string. Throws an actionable
+ * error if it isn't valid JSON or is missing required fields. Returns the raw
+ * string alongside any non-standard `resourceGroup` baked into the key.
+ *
+ * Accepts an optional `resourceGroup` field on the key itself (non-standard but
+ * convenient for teams managing multiple groups); `AICORE_RESOURCE_GROUP` still
+ * wins at request time (see `resolveResourceGroup` in stream.ts).
+ */
+export function parseAndValidateServiceKey(raw: string): ValidatedKey {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		throw new Error(
+			"SAP AI Core key must be the full BTP service-key JSON, not a " +
+				"plain string. Get it from BTP cockpit → AI Core service " +
+				`instance → Service Keys → View. Got: ${raw.slice(0, 40)}...`,
+		);
+	}
+
+	const missing = REQUIRED_FIELDS.filter((path) => {
+		const value = path
+			.split(".")
+			.reduce<unknown>(
+				(acc, segment) =>
+					acc && typeof acc === "object" && segment in (acc as object)
+						? (acc as Record<string, unknown>)[segment]
+						: undefined,
+				parsed,
+			);
+		return typeof value !== "string" || value.length === 0;
+	});
+
+	if (missing.length > 0) {
+		throw new Error(
+			`SAP AI Core service-key JSON is missing required fields: ${missing.join(", ")}. ` +
+				"Make sure you pasted the entire service-key object from BTP cockpit.",
+		);
+	}
+
+	const fromKey =
+		typeof (parsed as Record<string, unknown>).resourceGroup === "string"
+			? (parsed as Record<string, string>).resourceGroup
+			: undefined;
+	return { raw, resourceGroup: fromKey };
+}
+
+// pi 0.78 runs stored `type:"api_key"` credentials through a $-interpolating
+// template engine (resolve-config-value.js), which corrupts any secret
+// containing a literal `$` — and SAP service keys carry one in `clientsecret`.
+// The `oauth` registration path is pi's escape hatch: a provider's
+// `getApiKey()` return value is used verbatim and never passed through that
+// engine (auth-storage.js). We aren't doing real OAuth here — `login` just
+// captures and validates the pasted service-key JSON and stashes it in the
+// persisted credential; `getApiKey` hands it back unchanged.
+type SapOAuth = NonNullable<ProviderConfig["oauth"]>;
+
+// Far-future expiry so pi never considers the credential stale and calls
+// `refreshToken` (its check is `Date.now() >= expires`, always false here).
+const NEVER_EXPIRES = Number.MAX_SAFE_INTEGER;
+
+export const sapAiCoreOAuth: SapOAuth = {
+	name: "SAP AI Core",
+	async login(callbacks) {
+		const raw = (
+			await callbacks.onPrompt({
+				message:
+					"Paste your SAP BTP service-key JSON (single line) for AI Core",
+				placeholder: '{ "clientid": "…", "clientsecret": "…", … }',
+			})
+		).trim();
+		// Validate up front so a malformed paste fails at /login, not on first chat.
+		parseAndValidateServiceKey(raw);
+		// `serviceKey` is a custom field (OAuthCredentials allows extra keys); the
+		// required refresh/access/expires fields are stubbed since this isn't a
+		// token flow.
+		return { serviceKey: raw, access: "", refresh: "", expires: NEVER_EXPIRES };
+	},
+	getApiKey(credentials) {
+		return typeof credentials.serviceKey === "string"
+			? credentials.serviceKey
+			: "";
+	},
+	async refreshToken(credentials) {
+		// No tokens to refresh; unreachable given NEVER_EXPIRES, but the interface
+		// requires it. Return the credential unchanged.
+		return credentials;
+	},
+};

package/src/foundation-params.ts

@@ -0,0 +1,55 @@
+import type { Api, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
+
+// The subset of the Azure OpenAI chat-completion request body we set per turn.
+// Field choices are dictated by what `@sap-ai-sdk/foundation-models`' request
+// schema actually exposes (it pins Azure API version 2024-10-21):
+//   - `max_tokens` AND `max_completion_tokens` both exist; reasoning models
+//     (gpt-5*, o-series) reject `max_tokens` and require `max_completion_tokens`.
+//   - `reasoning_effort` is NOT in this schema/version, so depth is the model's
+//     own default and pi's reasoning-level selector is a no-op on this route
+//     (see note below). Orchestration remains the path for tuned effort.
+//   - `temperature` exists but gpt-5* reject it ("Unsupported parameter").
+export type AzureOpenAiParams = {
+	max_tokens?: number;
+	max_completion_tokens?: number;
+	temperature?: number;
+};
+
+// Build the per-turn Azure OpenAI params for a foundation (direct) request.
+//
+// This is the foundation analogue of `buildLlmParams` in stream.ts, but far
+// smaller: the direct Azure-OpenAI endpoint is OpenAI-only, so all of the
+// Anthropic adaptive/budget-thinking branching collapses away.
+//
+// REASONING NOTE: gpt-5.5 still reasons here — it just reasons at its built-in
+// default effort, because `reasoning_effort` isn't expressible against API
+// version 2024-10-21. If a future SDK bump exposes it (or SAP accepts it as a
+// passthrough field), add it here off `model.thinkingLevelMap[reasoning]`.
+//
+// VERIFY ON FIRST LIVE CALL: that gpt-5.5 accepts `max_completion_tokens` (and
+// rejects `max_tokens`) on your tenant. If SAP's proxy unexpectedly wants
+// `max_tokens` for this model, flip the branch below — the error will say so.
+export function buildAzureOpenAiParams(
+	model: Model<Api>,
+	options: SimpleStreamOptions | undefined,
+): AzureOpenAiParams {
+	// Pi may pass a tighter budget than the model's hard cap (to reserve room
+	// for thinking). Respect it; otherwise use the model's documented max output.
+	const effectiveMaxTokens = options?.maxTokens ?? model.maxTokens;
+
+	const params: AzureOpenAiParams = {};
+	if (model.reasoning) {
+		params.max_completion_tokens = effectiveMaxTokens;
+	} else {
+		params.max_tokens = effectiveMaxTokens;
+	}
+
+	// Only forward temperature for models that accept it. gpt-5* reject it; the
+	// snapshot records `temperature:false`, but we gate on the id prefix here to
+	// stay self-contained (mirrors `modelSupportsTemperature` in stream.ts).
+	if (options?.temperature !== undefined && !model.id.startsWith("gpt-5")) {
+		params.temperature = options.temperature;
+	}
+
+	return params;
+}

package/src/models-config.ts

@@ -0,0 +1,93 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+type ThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
+
+export type SapModel = {
+	id: string;
+	name: string;
+	reasoning: boolean;
+	tool_call: boolean;
+	temperature: boolean;
+	modalities: {
+		input: ("text" | "image" | "pdf")[];
+		output: ("text")[];
+	};
+	limit: {
+		context: number;
+		output: number;
+	};
+	cost: {
+		input: number;
+		output: number;
+		cacheRead: number;
+		cacheWrite: number;
+	};
+	thinkingLevelMap?: Partial<Record<ThinkingLevel, string | null>>;
+};
+
+// Tenant-specific or pre-release models not yet in models.dev's SAP catalog.
+// Anything in your SAP tenant that the snapshot doesn't include — add here.
+// User-side additions (per-machine, not in source control) should go in
+// ~/.pi/agent/models.json using pi's built-in custom-models mechanism.
+// SAP orchestration unifies reasoning across providers as
+// output_config.effort: "low" | "medium" | "high". See scripts/update-models.mjs
+// and stream.ts for the full mapping rationale.
+const SAP_EFFORT: SapModel["thinkingLevelMap"] = {
+	minimal: "low",
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "high",
+};
+
+// Currently empty — models.dev's SAP catalog covers everything in our
+// tenant. Add entries here when SAP exposes a tenant-only or pre-release
+// model that hasn't landed in the public catalog yet, e.g.:
+//
+//   {
+//     id: "some-preview-model",
+//     name: "Some Preview Model",
+//     reasoning: true,
+//     tool_call: true,
+//     temperature: true,
+//     modalities: { input: ["text"], output: ["text"] },
+//     limit: { context: 200_000, output: 32_000 },
+//     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+//     thinkingLevelMap: SAP_EFFORT,
+//   },
+const TENANT_EXTRAS: SapModel[] = [];
+
+function loadSnapshot(): SapModel[] {
+	const snapshotPath = join(
+		dirname(fileURLToPath(import.meta.url)),
+		"models-snapshot.json",
+	);
+	const raw = readFileSync(snapshotPath, "utf8");
+	const parsed = JSON.parse(raw) as { models?: SapModel[] };
+	return parsed.models ?? [];
+}
+
+const SNAPSHOT_MODELS = loadSnapshot();
+
+// Merge: snapshot first, then extras (extras win on duplicate id).
+const byId = new Map<string, SapModel>();
+for (const m of SNAPSHOT_MODELS) byId.set(m.id, m);
+for (const m of TENANT_EXTRAS) byId.set(m.id, m);
+
+export const MODELS: SapModel[] = Array.from(byId.values()).sort((a, b) =>
+	a.id.localeCompare(b.id),
+);
+
+// Models exposed via the direct *foundation* (Azure OpenAI) provider, which
+// routes through a per-model SAP AI Core deployment instead of orchestration.
+// List ONLY ids you've created a foundation-models deployment for — SAP needs
+// one deployment per (model, version, resource group), and an id with no
+// deployment 404s at call time. Definitions (cost/limits/modalities) are reused
+// from the shared snapshot above, so an id only has to be present there.
+const FOUNDATION_MODEL_IDS = new Set(["gpt-5.5"]);
+
+export const FOUNDATION_MODELS: SapModel[] = MODELS.filter((m) =>
+	FOUNDATION_MODEL_IDS.has(m.id),
+);