pi-sap-aicore 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-06-16
+
+### Fixed
+
+- `/login → Use a subscription` no longer shows a duplicate `SAP AI Core`
+  entry. The foundation provider now shares the orchestration provider's stored
+  service key through the existing auth-store fallback instead of registering a
+  second OAuth provider.
+
+## [0.2.1] - 2026-06-10
+
+### Fixed
+
+- Foundation-provider tool-call history now preserves Azure/OpenAI's required
+  ordering by emitting all matching `role: "tool"` replies immediately after an
+  assistant `tool_calls` message, then hoisting screenshot/image outputs into
+  synthetic user messages afterward.
+- Streaming turns that contain tool calls are now finalized as `toolUse` even
+  when SAP reports a trailing `stop`, preventing skipped tool execution and
+  follow-up `invalid_request_error` failures about missing tool-call responses.
+
 ## [0.2.0] - 2026-06-06
 
 ### Added
@@ -75,7 +96,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `reasoning_effort` for OpenAI).
 - MIT license and npm packaging.
 
-[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.1.2...v0.2.0
 [0.1.2]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.1.0...v0.1.1

package/README.md

@@ -406,7 +406,9 @@ build step — pi loads the `.ts` sources directly via jiti — so a release is
    git push --follow-tags
    ```
 3. The [`Publish`](.github/workflows/publish.yml) workflow fires on the `v*` tag,
-   asserts the tag matches `package.json`, typechecks, and publishes.
+   asserts the tag matches `package.json`, typechecks, publishes to npm, and
+   creates/updates the matching GitHub Release from that version's
+   `CHANGELOG.md` notes.
 
 Every push to `main` and every PR also runs the [`CI`](.github/workflows/ci.yml)
 typecheck gate.

package/index.ts

@@ -58,18 +58,19 @@ export default function (pi: ExtensionAPI) {
 			streamSimple: streamSapAiCore,
 		});
 
-		// Foundation provider — shares the exact same credential. Both providers
-		// reference the same `sapAiCoreOAuth` (oauth name "SAP AI Core"), so a single
-		// `/login` serves both and the service key is never entered twice. Models
-		// appear under `sap-aicore-foundation/…`; streaming runs natively here (no
-		// orchestration streaming-unsupported fallback). The foundation SDK is
+		// Foundation provider — shares the exact same credential via
+		// `ensureServiceKey`'s auth-store fallback instead of registering its own
+		// OAuth provider. Registering `oauth: sapAiCoreOAuth` here would make `/login`
+		// show a second, confusing "SAP AI Core" subscription entry because pi keys
+		// OAuth providers by provider id (`sap-aicore-foundation`), not by OAuth name.
+		// Models appear under `sap-aicore-foundation/…`; streaming runs natively here
+		// (no orchestration streaming-unsupported fallback). The foundation SDK is
 		// dynamically imported inside `streamSapFoundation`, same deferral as above.
 		pi.registerProvider(FOUNDATION_PROVIDER_NAME, {
 			name: "SAP AI Core (Foundation)",
 			baseUrl: "https://sap-aicore-handled-by-sdk.invalid",
 			apiKey: PLACEHOLDER_API_KEY,
 			api: FOUNDATION_PROVIDER_API,
-			oauth: sapAiCoreOAuth,
 			models: foundationModels.map((m) =>
 				toPiModel(m, FOUNDATION_PROVIDER_API),
 			),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-sap-aicore",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "SAP AI Core (orchestration + foundation) provider for the pi coding agent",
   "license": "MIT",
   "author": "Tim Pearson (https://github.com/ttiimmaahh)",
@@ -43,8 +43,8 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.78.0",
-    "@earendil-works/pi-coding-agent": "^0.78.0",
+    "@earendil-works/pi-ai": "^0.79.2",
+    "@earendil-works/pi-coding-agent": "^0.79.2",
     "typescript": "^6.0.3"
   },
   "engines": {

package/src/stream-foundation.ts

@@ -329,7 +329,9 @@ export function streamSapFoundation(
 			}
 
 			output.stopReason = mapFinishReason(
-				finishReason ?? response.getFinishReason() ?? undefined,
+				toolSlots.size > 0
+					? "tool_calls"
+					: (finishReason ?? response.getFinishReason() ?? undefined),
 			);
 			stream.push({
 				type: "done",

package/src/stream.ts

@@ -15,10 +15,7 @@ import {
 	type Usage,
 } from "@earendil-works/pi-ai";
 import { AuthStorage } from "@earendil-works/pi-coding-agent";
-import type {
-	ChatModel,
-	LlmModelParams,
-} from "@sap-ai-sdk/orchestration";
+import type { ChatModel, LlmModelParams } from "@sap-ai-sdk/orchestration";
 import type { TokenUsage } from "@sap-ai-sdk/orchestration/internal.js";
 
 import { parseAndValidateServiceKey, type ValidatedKey } from "./auth.ts";
@@ -430,7 +427,11 @@ function buildLlmParams(
 	// to reserve room for thinking). Respect it; otherwise fall back to the
 	// model's documented max output.
 	const effectiveMaxTokens = options?.maxTokens ?? model.maxTokens;
-	const reasoning = reasoningParams(model, options?.reasoning, effectiveMaxTokens);
+	const reasoning = reasoningParams(
+		model,
+		options?.reasoning,
+		effectiveMaxTokens,
+	);
 	const params: LlmModelParams = {
 		max_tokens: effectiveMaxTokens,
 	};
@@ -591,9 +592,7 @@ export function ensureServiceKey(apiKey: string | undefined): ValidatedKey {
 	//      (foundation) that shares the oauth but has no credential of its own.
 	const fromPi = apiKey?.trimStart().startsWith("{") ? apiKey : undefined;
 	const raw =
-		fromPi ??
-		process.env.AICORE_SERVICE_KEY ??
-		readSharedServiceKeyFromStore();
+		fromPi ?? process.env.AICORE_SERVICE_KEY ?? readSharedServiceKeyFromStore();
 	if (!raw) {
 		throw new Error(
 			"No SAP AI Core service key configured. Run `/login` in pi, " +
@@ -691,6 +690,10 @@ export function streamSapAiCore(
 			// Shared finalizer for both paths: map+cost usage once, promote a
 			// refusal to a visible error, otherwise emit the `done` event.
 			const finishTurn = (result: TurnResult) => {
+				const hasToolCalls = output.content.some(
+					(block) => block.type === "toolCall",
+				);
+
 				if (result.usage) {
 					output.usage = mapUsage(result.usage);
 					calculateCost(model, output.usage);
@@ -707,7 +710,9 @@ export function streamSapAiCore(
 					return;
 				}
 
-				output.stopReason = mapFinishReason(result.finishReason);
+				output.stopReason = mapFinishReason(
+					hasToolCalls ? "tool_calls" : result.finishReason,
+				);
 				stream.push({
 					type: "done",
 					reason: output.stopReason as "stop" | "length" | "toolUse",
@@ -740,7 +745,11 @@ export function streamSapAiCore(
 				if (content) {
 					output.content.push({ type: "text", text: content });
 					const idx = output.content.length - 1;
-					stream.push({ type: "text_start", contentIndex: idx, partial: output });
+					stream.push({
+						type: "text_start",
+						contentIndex: idx,
+						partial: output,
+					});
 					stream.push({
 						type: "text_delta",
 						contentIndex: idx,
@@ -808,8 +817,7 @@ export function streamSapAiCore(
 			// Stream by default; on SAP's "Streaming is not supported" 400 —
 			// and only before any chunk has been emitted — remember the model
 			// and fall back to the blocking path so the turn still completes.
-			let response: Awaited<ReturnType<typeof client.stream>> | undefined =
-				undefined;
+			let response: Awaited<ReturnType<typeof client.stream>> | undefined;
 			if (!STREAMING_UNSUPPORTED.has(model.id)) {
 				try {
 					response = await client.stream({ messages }, options?.signal, {

package/src/translate-foundation.ts

@@ -1,7 +1,6 @@
 import type {
 	AssistantMessage,
 	Context,
-	Message,
 	TextContent,
 	Tool,
 	ToolResultMessage,
@@ -33,27 +32,81 @@ export function piContextToAzureOpenAi(context: Context): {
 		messages.push({ role: "system", content: context.systemPrompt });
 	}
 
-	for (const msg of context.messages) {
-		messages.push(...piMessageToAzureOpenAi(msg));
+	const pi = context.messages;
+	for (let i = 0; i < pi.length; i++) {
+		const msg = pi[i];
+
+		if (msg.role === "assistant") {
+			const assistant = piAssistantToAzureOpenAi(msg);
+			const toolCalls = assistant.tool_calls ?? [];
+			if (toolCalls.length === 0) {
+				messages.push(assistant);
+				continue;
+			}
+
+			messages.push(assistant);
+
+			// OpenAI/Azure require every assistant tool_call to be followed
+			// immediately by role:"tool" messages for *all* tool_call_ids.
+			// Pi stores each tool result as a separate top-level message, and this
+			// translator may need to hoist image results into synthetic user messages.
+			// If we translate tool results one-by-one, multiple screenshot-producing
+			// tool results become: tool, user(image), tool — and Azure rejects the
+			// second tool call as unanswered. Batch all contiguous tool results here:
+			// assistant(tool_calls), all tool messages, then any hoisted images.
+			const expectedIds: string[] = [];
+			for (const toolCall of toolCalls) expectedIds.push(toolCall.id);
+			const expected = new Set(expectedIds);
+			const byId = new Map<string, AzureToolResultParts>();
+			const orphaned: AzureOpenAiChatCompletionRequestUserMessage[] = [];
+
+			let j = i + 1;
+			while (j < pi.length) {
+				const toolResult = pi[j];
+				if (toolResult.role !== "toolResult") break;
+				if (
+					expected.has(toolResult.toolCallId) &&
+					!byId.has(toolResult.toolCallId)
+				) {
+					byId.set(
+						toolResult.toolCallId,
+						piToolResultToAzureOpenAiParts(toolResult),
+					);
+				} else {
+					orphaned.push(...piToolResultToSyntheticUserMessages(toolResult));
+				}
+				j++;
+			}
+
+			const imageMessages: AzureOpenAiChatCompletionRequestUserMessage[] = [];
+			for (const id of expectedIds) {
+				const translated = byId.get(id);
+				if (translated) {
+					messages.push(translated.toolMessage);
+					imageMessages.push(...translated.imageMessages);
+				} else {
+					messages.push(missingToolResultMessage(id));
+				}
+			}
+			messages.push(...imageMessages, ...orphaned);
+			i = j - 1;
+			continue;
+		}
+
+		if (msg.role === "toolResult") {
+			// A standalone tool message is invalid for OpenAI. Keep the information
+			// available to the model, but present it as user-visible transcript text.
+			messages.push(...piToolResultToSyntheticUserMessages(msg));
+			continue;
+		}
+
+		messages.push(piUserToAzureOpenAi(msg));
 	}
 
 	const tools = (context.tools ?? []).map(piToolToAzureOpenAi);
 	return { messages, tools };
 }
 
-function piMessageToAzureOpenAi(
-	msg: Message,
-): AzureOpenAiChatCompletionRequestMessage[] {
-	switch (msg.role) {
-		case "user":
-			return [piUserToAzureOpenAi(msg)];
-		case "assistant":
-			return [piAssistantToAzureOpenAi(msg)];
-		case "toolResult":
-			return piToolResultToAzureOpenAi(msg);
-	}
-}
-
 function piUserToAzureOpenAi(
 	msg: UserMessage,
 ): AzureOpenAiChatCompletionRequestUserMessage {
@@ -108,38 +161,81 @@ function piAssistantToAzureOpenAi(
 	return result;
 }
 
-function piToolResultToAzureOpenAi(
+type AzureToolResultParts = {
+	toolMessage: AzureOpenAiChatCompletionRequestToolMessage;
+	imageMessages: AzureOpenAiChatCompletionRequestUserMessage[];
+};
+
+function piToolResultToAzureOpenAiParts(
 	msg: ToolResultMessage,
-): AzureOpenAiChatCompletionRequestMessage[] {
-	const text = msg.content
-		.filter((part): part is TextContent => part.type === "text")
-		.map((part) => part.text)
-		.join("\n");
+): AzureToolResultParts {
+	const text = toolResultText(msg);
+	const imageMessages = toolResultImages(msg).map((img) => ({
+		role: "user" as const,
+		content: [
+			{
+				type: "image_url" as const,
+				image_url: { url: `data:${img.mimeType};base64,${img.data}` },
+			},
+		],
+	}));
 
-	const toolMessage: AzureOpenAiChatCompletionRequestToolMessage = {
+	return {
+		toolMessage: {
+			role: "tool",
+			tool_call_id: msg.toolCallId,
+			content:
+				text ||
+				(imageMessages.length > 0
+					? "Tool returned image content; image(s) follow in the next user message."
+					: " "),
+		},
+		imageMessages,
+	};
+}
+
+function missingToolResultMessage(
+	toolCallId: string,
+): AzureOpenAiChatCompletionRequestToolMessage {
+	return {
 		role: "tool",
-		tool_call_id: msg.toolCallId,
-		content: text,
+		tool_call_id: toolCallId,
+		content: "[Tool result missing from local transcript.]",
 	};
+}
+
+function piToolResultToSyntheticUserMessages(
+	msg: ToolResultMessage,
+): AzureOpenAiChatCompletionRequestUserMessage[] {
+	const content = [
+		{
+			type: "text" as const,
+			text: `Tool result for ${msg.toolName} (${msg.toolCallId}):\n${
+				toolResultText(msg) || "[no textual output]"
+			}`,
+		},
+		...toolResultImages(msg).map((img) => ({
+			type: "image_url" as const,
+			image_url: { url: `data:${img.mimeType};base64,${img.data}` },
+		})),
+	];
+	return [{ role: "user", content }];
+}
 
-	// The tool message schema is text-only, so image blocks produced by pi
-	// tools (e.g. `read` on an image) are hoisted into a synthetic user message
-	// right after the tool result so vision-capable models still see the bytes.
-	const images = msg.content.filter(
+function toolResultText(msg: ToolResultMessage): string {
+	return msg.content
+		.filter((part): part is TextContent => part.type === "text")
+		.map((part) => part.text)
+		.join("\n");
+}
+
+function toolResultImages(
+	msg: ToolResultMessage,
+): { type: "image"; data: string; mimeType: string }[] {
+	return msg.content.filter(
 		(part): part is { type: "image"; data: string; mimeType: string } =>
 			part.type === "image",
 	);
-	if (images.length === 0) return [toolMessage];
-
-	const imageItems = images.map((img) => ({
-		type: "image_url" as const,
-		image_url: { url: `data:${img.mimeType};base64,${img.data}` },
-	}));
-	const imageMessage: AzureOpenAiChatCompletionRequestUserMessage = {
-		role: "user",
-		content: imageItems,
-	};
-	return [toolMessage, imageMessage];
 }
 
 function piToolToAzureOpenAi(tool: Tool): AzureOpenAiChatCompletionTool {