pi-sap-aicore 0.3.6 → 0.3.7

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.7] - 2026-07-16
+
+### Fixed
+
+- Restored shared `/login` credentials for `sap-aicore-foundation` and
+  `/sap-models discover` on Pi 0.80.9+. Pi replaced the old synchronous
+  `AuthStorage.list()` / `get()` API; the extension now uses the public
+  `readStoredCredential()` helper and reads only the `sap-aicore` credential.
+  Previously the compatibility error was swallowed and every model request
+  incorrectly reported that no service key was configured.
+
+### Added
+
+- Added `scripts/test-auth-storage.mjs`, an isolated regression test that checks
+  shared credential lookup, literal `$` preservation, provider isolation, and
+  credential-type validation.
+
+### Changed
+
+- Raised the Pi peer and development dependency floor to 0.80.9, where the
+  supported synchronous stored-credential helper is available.
+
 ## [0.3.6] - 2026-07-04
 
 ### Fixed
@@ -221,7 +243,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `reasoning_effort` for OpenAI).
 - MIT license and npm packaging.
 
-[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.3...HEAD
+[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.7...HEAD
+[0.3.7]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.6...v0.3.7
+[0.3.6]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.5...v0.3.6
+[0.3.5]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.4...v0.3.5
+[0.3.4]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.3...v0.3.4
 [0.3.3]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.0...v0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-sap-aicore",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "SAP AI Core (orchestration + foundation) provider for the pi coding agent",
   "license": "MIT",
   "author": "Tim Pearson (https://github.com/ttiimmaahh)",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "update-models": "node scripts/update-models.mjs",
-    "test": "node scripts/test-vertex-tool-schema.mjs && node scripts/test-bedrock-tool-results.mjs && node scripts/test-empty-content-blocks.mjs",
+    "test": "node scripts/test-auth-storage.mjs && node scripts/test-vertex-tool-schema.mjs && node scripts/test-bedrock-tool-results.mjs && node scripts/test-empty-content-blocks.mjs",
     "validate:foundation": "node scripts/validate-foundation-executables.mjs",
     "prepublishOnly": "tsc --noEmit && npm test"
   },
@@ -41,13 +41,13 @@
     "@sap-ai-sdk/orchestration": "^2.12.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-ai": ">=0.80.9",
+    "@earendil-works/pi-coding-agent": ">=0.80.9"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
-    "typescript": "^6.0.3"
+    "@earendil-works/pi-ai": "^0.80.9",
+    "@earendil-works/pi-coding-agent": "^0.80.9",
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=20"

package/scripts/test-auth-storage.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// Offline regression test for sharing the orchestration provider's stored
+// subscription credential with the foundation provider. This makes no network
+// calls and uses an isolated temporary auth file.
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+const { readSharedServiceKeyFromStore } = await import(
+	pathToFileURL(join(ROOT, "src/stream.ts")).href
+);
+
+let failures = 0;
+function check(condition, message) {
+	if (condition) {
+		console.log(`  ✓ ${message}`);
+		return;
+	}
+	console.error(`  ❌ ${message}`);
+	failures++;
+}
+
+const serviceKey = JSON.stringify({
+	clientid: "client-id",
+	clientsecret: "literal$secret",
+	url: "https://auth.example.test",
+	serviceurls: { AI_API_URL: "https://api.example.test" },
+});
+const tempDir = mkdtempSync(join(tmpdir(), "pi-sap-aicore-auth-"));
+const authPath = join(tempDir, "auth.json");
+
+try {
+	console.log("Shared OAuth credential lookup");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"sap-aicore": {
+				type: "oauth",
+				serviceKey,
+				access: "",
+				refresh: "",
+				expires: Number.MAX_SAFE_INTEGER,
+			},
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === serviceKey,
+		"reads the sap-aicore OAuth credential verbatim",
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath)?.includes("literal$secret"),
+		"preserves literal dollar signs",
+	);
+
+	console.log("Provider isolation");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"another-provider": {
+				type: "oauth",
+				serviceKey,
+				access: "",
+				refresh: "",
+				expires: Number.MAX_SAFE_INTEGER,
+			},
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === undefined,
+		"does not borrow another provider's credential",
+	);
+
+	console.log("Credential type validation");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"sap-aicore": { type: "api_key", key: serviceKey },
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === undefined,
+		"ignores non-OAuth credentials",
+	);
+} finally {
+	rmSync(tempDir, { recursive: true, force: true });
+}
+
+if (failures > 0) {
+	console.error(`\n${failures} check(s) failed`);
+	process.exit(1);
+}
+console.log("\nAll checks passed");

package/src/sap-model-commands.ts

@@ -1,7 +1,4 @@
-import {
-	AuthStorage,
-	type ExtensionAPI,
-} from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { ScenarioApi } from "@sap-ai-sdk/ai-api";
 
 import { parseAndValidateServiceKey } from "./auth.ts";
@@ -14,31 +11,10 @@ import {
 } from "./model-catalog.ts";
 import { ensureServiceKey, resolveResourceGroup } from "./stream.ts";
 
-function sharedServiceKeyFromAuthStore(): string | undefined {
-	try {
-		const store = AuthStorage.create();
-		for (const provider of store.list()) {
-			const cred = store.get(provider);
-			if (cred?.type !== "oauth") continue;
-			const serviceKey = (cred as { serviceKey?: unknown }).serviceKey;
-			if (
-				typeof serviceKey === "string" &&
-				serviceKey.trimStart().startsWith("{")
-			) {
-				return serviceKey;
-			}
-		}
-	} catch {
-		// Let callers produce the actionable no-key message.
-	}
-	return undefined;
-}
-
 function resolveCommandServiceKey(): ReturnType<
 	typeof parseAndValidateServiceKey
 > {
-	const raw = process.env.AICORE_SERVICE_KEY ?? sharedServiceKeyFromAuthStore();
-	return ensureServiceKey(raw);
+	return ensureServiceKey(undefined);
 }
 
 function formatModelList(ids: string[], max = 30): string {

package/src/stream.ts

@@ -14,7 +14,7 @@ import {
 	type SimpleStreamOptions,
 	type Usage,
 } from "@earendil-works/pi-ai";
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential } from "@earendil-works/pi-coding-agent";
 import type { ChatModel, LlmModelParams } from "@sap-ai-sdk/orchestration";
 import type { TokenUsage } from "@sap-ai-sdk/orchestration/internal.js";
 
@@ -575,27 +575,22 @@ export function latchFinishReason(
 
 let lastValidatedKey: ValidatedKey | undefined;
 
-// pi stores oauth credentials keyed by PROVIDER name, not by the oauth `name`.
-// So a `/login` under `sap-aicore` is NOT automatically handed to a second
-// provider (`sap-aicore-foundation`) that shares the same oauth object — pi
-// passes that provider the registration placeholder instead, and we'd wrongly
-// report "no key configured". Recover the shared login by reading pi's own auth
-// store directly and returning the first sibling oauth credential that carries
-// a service-key JSON. This is what makes one `/login` serve both providers.
-function readSharedServiceKeyFromStore(): string | undefined {
-	try {
-		const store = AuthStorage.create();
-		for (const provider of store.list()) {
-			const cred = store.get(provider);
-			if (cred?.type !== "oauth") continue;
-			const sk = (cred as { serviceKey?: unknown }).serviceKey;
-			if (typeof sk === "string" && sk.trimStart().startsWith("{")) return sk;
-		}
-	} catch {
-		// Auth store unreadable (missing/locked/format change) — fall through to
-		// the actionable "no key configured" error below.
-	}
-	return undefined;
+// pi stores OAuth credentials by provider id, not by the OAuth display name.
+// The foundation provider therefore reads the orchestration provider's stored
+// login explicitly. `readStoredCredential` is the synchronous, public helper
+// for stream setup; AuthStorage's old synchronous list/get API was removed in
+// pi 0.80.9.
+export function readSharedServiceKeyFromStore(
+	authPath?: string,
+): string | undefined {
+	const credential = readStoredCredential("sap-aicore", authPath);
+	if (credential?.type !== "oauth") return undefined;
+
+	const serviceKey = (credential as { serviceKey?: unknown }).serviceKey;
+	return typeof serviceKey === "string" &&
+		serviceKey.trimStart().startsWith("{")
+		? serviceKey
+		: undefined;
 }
 
 export function ensureServiceKey(apiKey: string | undefined): ValidatedKey {