pi-sap-aicore 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -7,6 +7,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-07-01
+
+### Fixed
+
+- Direct GCP Vertex AI (Gemini) foundation route now sends pi tool schemas via
+  Gemini's `parametersJsonSchema` (full JSON Schema) instead of the legacy
+  `parameters` field (a restricted OpenAPI 3.0 subset). The legacy field rejected
+  common JSON Schema constructs with HTTP 400 — `const` ("Unknown name const")
+  and non-string `enum` values ("enum[0] (TYPE_STRING)") — which broke Gemini
+  foundation models (e.g. `gemini-3.5-flash`) on tool-heavy coding-agent turns.
+- SAP AI Core orchestration route no longer sends `reasoning_effort` alongside
+  function tools for `gpt-*` models. SAP's `/v1/chat/completions` (the only
+  endpoint reachable through the orchestration SDK) rejects that combination for
+  gpt-5.x with a 400 pointing to `/v1/responses`, which is a foundation-models
+  deployment endpoint the orchestration SDK cannot target. `reasoning_effort` is
+  still sent on text-only turns; SAP continues to spend reasoning tokens
+  internally on tool turns (governed by `max_completion_tokens`).
+
+### Added
+
+- Added `npm test` (`scripts/test-vertex-tool-schema.mjs`), a fast,
+  credential-free regression test asserting the Vertex/Gemini adapter emits
+  `parametersJsonSchema` and preserves `const`/boolean-`enum` constructs. Wired
+  into `prepublishOnly`. The live `validate:foundation` matrix also gained a
+  complex-tool-schema scenario that exercises the real HTTP tool path.
+
+## [0.3.3] - 2026-07-01
+
+### Added
+
+- Added `npm run validate:foundation`, a live SAP AI Core validation matrix for
+  direct foundation executables. It verifies text generation, real tool execution
+  side effects, and image input across Azure OpenAI, AWS Bedrock, and GCP Vertex
+  AI foundation routes.
+
+### Changed
+
+- Raised SAP AI SDK dependency floors to `^2.12.0` so fresh installs prefer the
+  patched transitive `axios` / `form-data` tree that resolves the npm audit
+  advisory for `form-data <4.0.6`.
+
 ## [0.3.2] - 2026-07-01
 
 ### Fixed
@@ -146,7 +187,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `reasoning_effort` for OpenAI).
 - MIT license and npm packaging.
 
-[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.2...HEAD
+[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.3...HEAD
+[0.3.3]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.2.2...v0.3.0

package/README.md

@@ -160,6 +160,26 @@ there. An id with no matching deployment 404s at call time. Run
 `/sap-models discover` in pi (or `node scripts/list-sap-models.mjs` from this
 repo) to see what your tenant actually deploys.
 
+### Live foundation validation
+
+To validate normal coding-agent behavior across the three direct foundation
+executables, run the live smoke-test matrix from this repo:
+
+```bash
+npm run validate:foundation
+```
+
+The script uses `pi --no-extensions -e ./index.ts` so it tests the local checkout,
+not a globally installed package. It makes real SAP model calls and validates:
+
+- text generation
+- real tool execution via side-effect files
+- image input smoke tests
+
+Default models are `gpt-5.5`, `anthropic--claude-4.8-opus`, and
+`gemini-3.5-flash`. Override them with `GPT_MODEL`, `BEDROCK_MODEL`, and
+`VERTEX_MODEL`; set `SKIP_IMAGE=1` to skip vision tests.
+
 ## Models
 
 The model list is composed of three sources, merged at startup:
@@ -450,9 +470,10 @@ npmjs.com:
 │   └── publish.yml           # tag-driven npm publish via OIDC trusted publishing
 ├── index.ts                  # ExtensionAPI factory + registerProvider calls (both providers)
 ├── scripts/
-│   ├── update-models.mjs     # maintainer script: fetches models.dev, writes models-snapshot.json
-│   ├── list-sap-models.mjs   # lists models your tenant actually deploys (diff vs snapshot)
-│   └── diagnose-streaming.mjs # probes orchestration streaming support per model
+│   ├── update-models.mjs                    # maintainer script: fetches models.dev, writes models-snapshot.json
+│   ├── list-sap-models.mjs                  # lists models your tenant actually deploys (diff vs snapshot)
+│   ├── diagnose-streaming.mjs               # probes orchestration streaming support per model
+│   └── validate-foundation-executables.mjs  # live text/tool/image smoke tests for direct foundation executables
 └── src/
     ├── auth.ts                  # service-key validation + pi oauth registration
     ├── model-catalog.ts         # loads snapshot/cache/overlay and adapts models.dev metadata

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-sap-aicore",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "SAP AI Core (orchestration + foundation) provider for the pi coding agent",
   "license": "MIT",
   "author": "Tim Pearson (https://github.com/ttiimmaahh)",
@@ -31,12 +31,14 @@
   },
   "scripts": {
     "update-models": "node scripts/update-models.mjs",
-    "prepublishOnly": "tsc --noEmit"
+    "test": "node scripts/test-vertex-tool-schema.mjs",
+    "validate:foundation": "node scripts/validate-foundation-executables.mjs",
+    "prepublishOnly": "tsc --noEmit && npm test"
   },
   "dependencies": {
-    "@sap-ai-sdk/ai-api": "^2.10.0",
-    "@sap-ai-sdk/foundation-models": "^2.10.0",
-    "@sap-ai-sdk/orchestration": "^2.10.0"
+    "@sap-ai-sdk/ai-api": "^2.12.0",
+    "@sap-ai-sdk/foundation-models": "^2.12.0",
+    "@sap-ai-sdk/orchestration": "^2.12.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/scripts/fixtures/complex-tool-extension.mjs

@@ -0,0 +1,59 @@
+// Test-only pi extension: registers a `record_choice` tool whose parameter
+// schema contains the exact JSON Schema constructs that Gemini's legacy
+// OpenAPI `parameters` field rejects (`const`, boolean `enum`, nested anyOf).
+//
+// Loaded by scripts/validate-foundation-executables.mjs to exercise the real
+// HTTP tool-schema path end-to-end. If an adapter serializes tool schemas
+// incorrectly, the provider returns HTTP 400 and the live scenario fails.
+//
+// The tool simply writes its stringified args to OUTPUT_FILE so the validator
+// can assert a real side effect (proving the model both received the schema
+// and successfully issued a tool call against it).
+
+import { writeFileSync } from "node:fs";
+
+/** @param {import("@earendil-works/pi-coding-agent").ExtensionAPI} pi */
+export default function (pi) {
+	pi.registerTool({
+		name: "record_choice",
+		label: "Record Choice",
+		description:
+			"Record a processing choice. Call this once with mode set to 'fast'.",
+		promptSnippet: "record_choice: record a processing choice",
+		// Raw JSON Schema (cast through unknown) with the constructs that broke
+		// Gemini's legacy `parameters` field. TypeBox typing is bypassed on
+		// purpose — we are validating wire serialization, not TS ergonomics.
+		parameters: /** @type {any} */ ({
+			type: "object",
+			properties: {
+				mode: {
+					anyOf: [{ const: "fast" }, { const: "slow" }],
+					description: "Processing mode",
+				},
+				verbose: {
+					anyOf: [{ type: "boolean" }, { enum: [false] }],
+					description: "Verbose flag",
+				},
+				steps: {
+					type: "array",
+					items: {
+						type: "object",
+						properties: {
+							kind: { anyOf: [{ const: "read" }, { const: "write" }] },
+						},
+					},
+				},
+			},
+			required: ["mode"],
+		}),
+		async execute(_toolCallId, params) {
+			const outputFile = process.env.COMPLEX_TOOL_OUTPUT_FILE;
+			if (outputFile) {
+				writeFileSync(outputFile, JSON.stringify(params ?? {}));
+			}
+			return {
+				content: [{ type: "text", text: "COMPLEX_TOOL_OK" }],
+			};
+		},
+	});
+}

package/scripts/test-vertex-tool-schema.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// Offline regression test for the Vertex/Gemini tool-schema translation.
+//
+// The live validator (validate-foundation-executables.mjs) only ever sent the
+// trivial `bash` tool, whose schema is a flat object with one string property.
+// That never exercised the JSON Schema constructs Gemini's legacy `parameters`
+// (OpenAPI 3.0 subset) rejects — `const` and non-string `enum` values — so a
+// real 400 in production slipped past a "green" validation run.
+//
+// This test asserts the translator emits `parametersJsonSchema` (full JSON
+// Schema) rather than the legacy `parameters` field, and that the failing
+// constructs survive the translation intact. It makes NO network calls.
+//
+// Usage from repo root:
+//   node scripts/test-vertex-tool-schema.mjs
+
+import { pathToFileURL } from "node:url";
+import { join } from "node:path";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+
+const { piContextToVertexGenerateContent } = await import(
+	pathToFileURL(join(ROOT, "src/translate-foundation-vertexai.ts")).href
+);
+
+let failures = 0;
+function check(condition, message) {
+	if (condition) {
+		console.log(`  ✓ ${message}`);
+		return;
+	}
+	console.error(`  ❌ ${message}`);
+	failures++;
+}
+
+// A schema that reproduces every class from the reported production 400:
+//   - `const` keyword                        → "Unknown name const"
+//   - boolean `enum` value (`false`)         → "enum[0] (TYPE_STRING), false"
+//   - nested anyOf/items                     → deep property paths in the error
+const context = {
+	systemPrompt: "system",
+	messages: [{ role: "user", content: "hi" }],
+	tools: [
+		{
+			name: "complex_tool",
+			description: "reproduces the reported Gemini 400 schema classes",
+			parameters: {
+				type: "object",
+				properties: {
+					mode: { anyOf: [{ const: "fast" }, { const: "slow" }] },
+					flag: { anyOf: [{ type: "boolean" }, { enum: [false] }] },
+					items: {
+						type: "array",
+						items: {
+							type: "object",
+							properties: {
+								kind: { anyOf: [{ const: "a" }, { const: "b" }] },
+							},
+						},
+					},
+				},
+				required: ["mode"],
+			},
+		},
+	],
+};
+
+const out = piContextToVertexGenerateContent(context);
+const fd = out.tools?.[0]?.functionDeclarations?.[0];
+
+check(!!fd, "tool is translated to a functionDeclaration");
+check(
+	fd && Object.hasOwn(fd, "parametersJsonSchema"),
+	"emits `parametersJsonSchema` (full JSON Schema field Gemini accepts)",
+);
+check(
+	fd && !Object.hasOwn(fd, "parameters"),
+	"does NOT emit legacy `parameters` (OpenAPI subset that 400s on const/enum)",
+);
+
+const serialized = JSON.stringify(fd?.parametersJsonSchema ?? {});
+check(
+	serialized.includes('"const"'),
+	"`const` keyword survives translation (not stripped/rewritten)",
+);
+check(
+	serialized.includes("false"),
+	"boolean `enum` value survives translation",
+);
+
+if (failures > 0) {
+	console.error(`\n❌ vertex tool-schema test: ${failures} check(s) failed`);
+	process.exit(1);
+}
+console.log("\n✅ vertex tool-schema translation test passed");

package/scripts/validate-foundation-executables.mjs

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+// Live validation for SAP AI Core direct foundation executables.
+//
+// This script makes real, billed model calls through pi using the local extension.
+// It validates the three high-value foundation executable families:
+//   - azure-openai  → GPT/OpenAI models
+//   - aws-bedrock   → Anthropic/Claude models
+//   - gcp-vertexai  → Gemini models
+//
+// Each family now also runs a complex-tool-schema scenario (const/enum/anyOf)
+// that reproduces the real HTTP tool path — the trivial bash tool alone never
+// exercised the JSON Schema constructs that broke Gemini's `parameters` field.
+//
+// For a fast, credential-free regression check of the Vertex tool-schema
+// serialization specifically, run:
+//   node scripts/test-vertex-tool-schema.mjs
+//
+// Usage from repo root:
+//   node scripts/validate-foundation-executables.mjs
+//
+// Optional model overrides:
+//   GPT_MODEL=gpt-5.5 \
+//   BEDROCK_MODEL=anthropic--claude-4.8-opus \
+//   VERTEX_MODEL=gemini-3.5-flash \
+//   node scripts/validate-foundation-executables.mjs
+//
+// Optional: SKIP_IMAGE=1 to skip vision tests.
+
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+const PI = process.env.PI_BIN ?? "pi";
+const SKIP_IMAGE = process.env.SKIP_IMAGE === "1";
+
+const SCENARIOS = [
+	{
+		name: "azure-openai/gpt",
+		model: process.env.GPT_MODEL ?? "gpt-5.5",
+		marker: "GPT_TOOL_OK",
+	},
+	{
+		name: "aws-bedrock/anthropic",
+		model: process.env.BEDROCK_MODEL ?? "anthropic--claude-4.8-opus",
+		marker: "BEDROCK_TOOL_OK",
+	},
+	{
+		name: "gcp-vertexai/gemini",
+		model: process.env.VERTEX_MODEL ?? "gemini-3.5-flash",
+		marker: "VERTEX_TOOL_OK",
+	},
+];
+
+const tinyPng = Buffer.from(
+	"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=",
+	"base64",
+);
+
+function runPi(args, options = {}) {
+	const result = spawnSync(PI, args, {
+		cwd: ROOT,
+		encoding: "utf8",
+		maxBuffer: 10 * 1024 * 1024,
+		...options,
+	});
+	return {
+		status: result.status ?? 1,
+		stdout: result.stdout ?? "",
+		stderr: result.stderr ?? "",
+		combined: `${result.stdout ?? ""}${result.stderr ?? ""}`,
+	};
+}
+
+function baseArgs(model, extraExtensions = []) {
+	const extensions = ["-e", "./index.ts"];
+	for (const ext of extraExtensions) extensions.push("-e", ext);
+	return [
+		"--no-extensions",
+		...extensions,
+		"--model",
+		`sap-aicore-foundation/${model}`,
+		"--no-context-files",
+		"--no-skills",
+		"-p",
+	];
+}
+
+function assert(condition, message, detail) {
+	if (condition) return;
+	console.error(`\n❌ ${message}`);
+	if (detail) console.error(detail);
+	process.exitCode = 1;
+	throw new Error(message);
+}
+
+function truncate(s, max = 2000) {
+	return s.length > max ? `${s.slice(0, max)}…[+${s.length - max} chars]` : s;
+}
+
+function validateText(scenario) {
+	const prompt = "Reply with exactly the single token: TEXT_OK";
+	const result = runPi([...baseArgs(scenario.model), prompt]);
+	assert(
+		result.status === 0,
+		`${scenario.name} text scenario exited ${result.status}`,
+		truncate(result.combined),
+	);
+	assert(
+		/TEXT_OK/.test(result.combined),
+		`${scenario.name} text scenario did not contain TEXT_OK`,
+		truncate(result.combined),
+	);
+	console.log(`  ✓ text generation`);
+}
+
+function validateToolUse(scenario, workDir) {
+	const file = join(workDir, `${scenario.name.replaceAll("/", "-")}.txt`);
+	const prompt =
+		`Use the bash tool to run exactly: printf ${scenario.marker} > ${file}. ` +
+		"Then say done.";
+	const result = runPi([...baseArgs(scenario.model), prompt]);
+	assert(
+		result.status === 0,
+		`${scenario.name} tool scenario exited ${result.status}`,
+		truncate(result.combined),
+	);
+	let actual = "";
+	try {
+		actual = readFileSync(file, "utf8");
+	} catch {
+		// handled below
+	}
+	assert(
+		actual === scenario.marker,
+		`${scenario.name} tool scenario did not create expected side-effect`,
+		`expected file ${file} to contain ${scenario.marker}\nmodel output:\n${truncate(result.combined)}`,
+	);
+	console.log(`  ✓ tool execution side effect`);
+}
+
+// Exercises the real HTTP tool-schema path with a schema containing the
+// constructs that broke Gemini in production (`const`, boolean `enum`, nested
+// anyOf). The trivial `bash` tool never covered these, which is why the
+// production 400 slipped past an otherwise-green validation run.
+function validateComplexToolSchema(scenario, workDir) {
+	const extension = join(ROOT, "scripts/fixtures/complex-tool-extension.mjs");
+	const outputFile = join(
+		workDir,
+		`${scenario.name.replaceAll("/", "-")}-complex-tool.json`,
+	);
+	const prompt =
+		"Call the record_choice tool exactly once with mode set to 'fast'. " +
+		"Then say done.";
+	const result = runPi([...baseArgs(scenario.model, [extension]), prompt], {
+		env: { ...process.env, COMPLEX_TOOL_OUTPUT_FILE: outputFile },
+	});
+	assert(
+		!/status code 400|Invalid (JSON payload|value at)|Unknown name/.test(
+			result.combined,
+		),
+		`${scenario.name} complex-tool scenario hit a schema rejection (HTTP 400)`,
+		truncate(result.combined),
+	);
+	assert(
+		result.status === 0,
+		`${scenario.name} complex-tool scenario exited ${result.status}`,
+		truncate(result.combined),
+	);
+	let actual = "";
+	try {
+		actual = readFileSync(outputFile, "utf8");
+	} catch {
+		// handled below
+	}
+	assert(
+		/"mode"\s*:\s*"fast"/.test(actual),
+		`${scenario.name} complex-tool scenario did not produce a valid tool call`,
+		`expected ${outputFile} to contain mode=fast\nmodel output:\n${truncate(result.combined)}`,
+	);
+	console.log(`  \u2713 complex tool schema (const/enum/anyOf)`);
+}
+
+function validateImage(scenario, workDir) {
+	const imagePath = join(workDir, "tiny.png");
+	writeFileSync(imagePath, tinyPng);
+	const prompt =
+		"Look at @" +
+		imagePath +
+		" and reply with exactly IMAGE_OK if you can inspect the attached image.";
+	const result = runPi([...baseArgs(scenario.model), prompt]);
+	assert(
+		result.status === 0,
+		`${scenario.name} image scenario exited ${result.status}`,
+		truncate(result.combined),
+	);
+	assert(
+		/IMAGE_OK/.test(result.combined),
+		`${scenario.name} image scenario did not contain IMAGE_OK`,
+		truncate(result.combined),
+	);
+	console.log(`  ✓ image input smoke test`);
+}
+
+const workDir = mkdtempSync(join(tmpdir(), "pi-sap-aicore-foundation-"));
+console.log(`Live SAP AI Core foundation validation`);
+console.log(`repo: ${ROOT}`);
+console.log(`workDir: ${workDir}`);
+console.log(`skip image: ${SKIP_IMAGE ? "yes" : "no"}\n`);
+
+try {
+	for (const scenario of SCENARIOS) {
+		console.log(`${scenario.name}  model=${scenario.model}`);
+		validateText(scenario);
+		validateToolUse(scenario, workDir);
+		validateComplexToolSchema(scenario, workDir);
+		if (!SKIP_IMAGE) validateImage(scenario, workDir);
+		console.log("");
+	}
+	console.log("✅ all foundation executable scenarios passed");
+} catch {
+	// assert() already printed details and set exitCode.
+} finally {
+	if (process.env.KEEP_VALIDATION_ARTIFACTS !== "1") {
+		rmSync(workDir, { recursive: true, force: true });
+	} else {
+		console.log(`kept artifacts: ${workDir}`);
+	}
+}

package/src/stream.ts

@@ -363,6 +363,7 @@ function reasoningParams(
 	model: Model<Api>,
 	reasoning: string | undefined,
 	effectiveMaxTokens: number,
+	hasTools: boolean,
 ): Partial<LlmModelParams> {
 	if (!reasoning || reasoning === "off") return {};
 
@@ -402,6 +403,21 @@ function reasoningParams(
 		};
 	}
 	if (model.id.startsWith("gpt-")) {
+		// SAP orchestration's chat/completions endpoint does NOT accept
+		// `reasoning_effort` alongside function tools for gpt-5.x. Confirmed
+		// against SAP's Supported Parameters list (which omits reasoning_effort
+		// entirely) and the runtime 400 from gpt-5.5:
+		//   "Function tools with reasoning_effort are not supported for
+		//    gpt-5.5-...-dz-std in /v1/chat/completions. Please use /v1/responses
+		//    instead."
+		// The Responses API (/v1/responses) is a foundation-models deployment
+		// endpoint, unreachable through the orchestration SDK, so we can't switch
+		// endpoints here. Drop reasoning_effort on tool turns so the request
+		// succeeds; SAP still spends reasoning tokens internally (governed by
+		// max_completion_tokens / max_tokens). Text-only turns keep explicit
+		// reasoning depth. Applies to all gpt-* since SAP may tighten the older
+		// gpt-5/5.4 ids the same way.
+		if (hasTools) return {};
 		const effort =
 			model.thinkingLevelMap?.[
 				reasoning as keyof NonNullable<typeof model.thinkingLevelMap>
@@ -422,6 +438,7 @@ function modelSupportsTemperature(modelId: string): boolean {
 function buildLlmParams(
 	model: Model<Api>,
 	options: SimpleStreamOptions | undefined,
+	hasTools: boolean,
 ): LlmModelParams {
 	// Pi may pass a maxTokens budget smaller than the model's hard cap (e.g.
 	// to reserve room for thinking). Respect it; otherwise fall back to the
@@ -431,6 +448,7 @@ function buildLlmParams(
 		model,
 		options?.reasoning,
 		effectiveMaxTokens,
+		hasTools,
 	);
 	const params: LlmModelParams = {
 		max_tokens: effectiveMaxTokens,
@@ -655,7 +673,7 @@ export function streamSapAiCore(
 			const { messages, tools } = piContextToOrchestration(context);
 
 			const { OrchestrationClient } = await importOrchestration();
-			const llmParams = buildLlmParams(model, options);
+			const llmParams = buildLlmParams(model, options, tools.length > 0);
 
 			debugLog({
 				requestId,

package/src/translate-foundation-vertexai.ts

@@ -23,7 +23,11 @@ export type VertexTool = {
 	functionDeclarations: Array<{
 		name: string;
 		description: string;
-		parameters: Record<string, unknown>;
+		// Gemini's `parameters` field is a restricted OpenAPI 3.0 Schema subset
+		// that rejects `const` and non-string `enum` values. `parametersJsonSchema`
+		// accepts full JSON Schema (anyOf/oneOf/const/boolean enums), which is what
+		// pi tool definitions actually use. See pi-ai google-shared convertTools.
+		parametersJsonSchema: Record<string, unknown>;
 	}>;
 };
 
@@ -139,7 +143,11 @@ function piToolToVertexFunctionDeclaration(
 	return {
 		name: tool.name,
 		description: tool.description,
-		parameters: tool.parameters as unknown as Record<string, unknown>,
+		// Use `parametersJsonSchema` (full JSON Schema) instead of the legacy
+		// `parameters` OpenAPI subset. The latter rejects `const` and non-string
+		// `enum` values that pi tool schemas commonly contain, causing HTTP 400
+		// "Unknown name const" / "enum[0] (TYPE_STRING)" errors from Gemini.
+		parametersJsonSchema: tool.parameters as unknown as Record<string, unknown>,
 	};
 }