pi-sap-aicore 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.8] - 2026-07-18
+
+### Fixed
+
+- SAP AI Core no longer appears configured in `/login` on a fresh install.
+  The orchestration provider now declares its `AICORE_SERVICE_KEY` environment
+  fallback explicitly instead of using an always-configured placeholder; stored
+  subscription credentials continue to use the existing OAuth-backed login.
+
+## [0.3.7] - 2026-07-16
+
+### Fixed
+
+- Restored shared `/login` credentials for `sap-aicore-foundation` and
+  `/sap-models discover` on Pi 0.80.9+. Pi replaced the old synchronous
+  `AuthStorage.list()` / `get()` API; the extension now uses the public
+  `readStoredCredential()` helper and reads only the `sap-aicore` credential.
+  Previously the compatibility error was swallowed and every model request
+  incorrectly reported that no service key was configured.
+
+### Added
+
+- Added `scripts/test-auth-storage.mjs`, an isolated regression test that checks
+  shared credential lookup, literal `$` preservation, provider isolation, and
+  credential-type validation.
+
+### Changed
+
+- Raised the Pi peer and development dependency floor to 0.80.9, where the
+  supported synchronous stored-credential helper is available.
+
 ## [0.3.6] - 2026-07-04
 
 ### Fixed
@@ -221,7 +252,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `reasoning_effort` for OpenAI).
 - MIT license and npm packaging.
 
-[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.3...HEAD
+[Unreleased]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.8...HEAD
+[0.3.8]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.7...v0.3.8
+[0.3.7]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.6...v0.3.7
+[0.3.6]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.5...v0.3.6
+[0.3.5]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.4...v0.3.5
+[0.3.4]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.3...v0.3.4
 [0.3.3]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.2...v0.3.3
 [0.3.2]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.1...v0.3.2
 [0.3.1]: https://github.com/ttiimmaahh/pi-sap-aicore/compare/v0.3.0...v0.3.1

package/index.ts

@@ -17,13 +17,11 @@ const PROVIDER_API = "sap-aicore-orchestration" as Api;
 const FOUNDATION_PROVIDER_NAME = "sap-aicore-foundation";
 const FOUNDATION_PROVIDER_API = "sap-aicore-foundation" as Api;
 
-// pi requires a non-empty `apiKey` for any custom provider that defines models
-// (model-registry `validateConfig`), even when credentials come from `oauth`.
-// This value is never used: the real key is supplied by `sapAiCoreOAuth`
-// (after `/login`) or by AICORE_SERVICE_KEY (both handled in stream.ts). It is a
-// plain lowercase literal so pi's config-value resolver returns it as-is — no
-// `$` interpolation, no shell exec, and not mistaken for a legacy env-var name.
-const PLACEHOLDER_API_KEY = "managed-by-extension-oauth";
+// The foundation provider has no OAuth entry of its own: it shares the
+// orchestration provider's stored login in stream.ts. Pi still requires every
+// provider to expose an authentication method, so this keeps foundation models
+// selectable without adding a duplicate SAP AI Core entry to `/login`.
+const FOUNDATION_PLACEHOLDER_API_KEY = "managed-by-extension-oauth";
 
 export default function (pi: ExtensionAPI) {
 	const registerProviders = () => {
@@ -36,7 +34,10 @@ export default function (pi: ExtensionAPI) {
 		pi.registerProvider(PROVIDER_NAME, {
 			name: "SAP AI Core",
 			baseUrl: "https://sap-aicore-handled-by-sdk.invalid",
-			apiKey: PLACEHOLDER_API_KEY,
+			// Unlike a literal placeholder, this only makes Pi report the provider as
+			// configured when the environment variable is actually present. Stored
+			// subscription credentials continue to flow through `oauth` below.
+			apiKey: "$AICORE_SERVICE_KEY",
 			api: PROVIDER_API,
 			// Credentials flow through pi's `oauth` path — its escape hatch from the
 			// $-interpolating config-value resolver that corrupts service keys
@@ -69,7 +70,7 @@ export default function (pi: ExtensionAPI) {
 		pi.registerProvider(FOUNDATION_PROVIDER_NAME, {
 			name: "SAP AI Core (Foundation)",
 			baseUrl: "https://sap-aicore-handled-by-sdk.invalid",
-			apiKey: PLACEHOLDER_API_KEY,
+			apiKey: FOUNDATION_PLACEHOLDER_API_KEY,
 			api: FOUNDATION_PROVIDER_API,
 			models: foundationModels.map((m) =>
 				toPiModel(m, FOUNDATION_PROVIDER_API),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-sap-aicore",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "SAP AI Core (orchestration + foundation) provider for the pi coding agent",
   "license": "MIT",
   "author": "Tim Pearson (https://github.com/ttiimmaahh)",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "update-models": "node scripts/update-models.mjs",
-    "test": "node scripts/test-vertex-tool-schema.mjs && node scripts/test-bedrock-tool-results.mjs && node scripts/test-empty-content-blocks.mjs",
+    "test": "node scripts/test-auth-storage.mjs && node scripts/test-vertex-tool-schema.mjs && node scripts/test-bedrock-tool-results.mjs && node scripts/test-empty-content-blocks.mjs",
     "validate:foundation": "node scripts/validate-foundation-executables.mjs",
     "prepublishOnly": "tsc --noEmit && npm test"
   },
@@ -41,13 +41,13 @@
     "@sap-ai-sdk/orchestration": "^2.12.0"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*"
+    "@earendil-works/pi-ai": ">=0.80.9",
+    "@earendil-works/pi-coding-agent": ">=0.80.9"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
-    "typescript": "^6.0.3"
+    "@earendil-works/pi-ai": "^0.80.9",
+    "@earendil-works/pi-coding-agent": "^0.80.9",
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=20"

package/scripts/test-auth-storage.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// Offline regression test for sharing the orchestration provider's stored
+// subscription credential with the foundation provider. This makes no network
+// calls and uses an isolated temporary auth file.
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+const { readSharedServiceKeyFromStore } = await import(
+	pathToFileURL(join(ROOT, "src/stream.ts")).href
+);
+
+let failures = 0;
+function check(condition, message) {
+	if (condition) {
+		console.log(`  ✓ ${message}`);
+		return;
+	}
+	console.error(`  ❌ ${message}`);
+	failures++;
+}
+
+const serviceKey = JSON.stringify({
+	clientid: "client-id",
+	clientsecret: "literal$secret",
+	url: "https://auth.example.test",
+	serviceurls: { AI_API_URL: "https://api.example.test" },
+});
+const tempDir = mkdtempSync(join(tmpdir(), "pi-sap-aicore-auth-"));
+const authPath = join(tempDir, "auth.json");
+
+try {
+	console.log("Shared OAuth credential lookup");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"sap-aicore": {
+				type: "oauth",
+				serviceKey,
+				access: "",
+				refresh: "",
+				expires: Number.MAX_SAFE_INTEGER,
+			},
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === serviceKey,
+		"reads the sap-aicore OAuth credential verbatim",
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath)?.includes("literal$secret"),
+		"preserves literal dollar signs",
+	);
+
+	console.log("Provider isolation");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"another-provider": {
+				type: "oauth",
+				serviceKey,
+				access: "",
+				refresh: "",
+				expires: Number.MAX_SAFE_INTEGER,
+			},
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === undefined,
+		"does not borrow another provider's credential",
+	);
+
+	console.log("Credential type validation");
+	writeFileSync(
+		authPath,
+		JSON.stringify({
+			"sap-aicore": { type: "api_key", key: serviceKey },
+		}),
+	);
+	check(
+		readSharedServiceKeyFromStore(authPath) === undefined,
+		"ignores non-OAuth credentials",
+	);
+} finally {
+	rmSync(tempDir, { recursive: true, force: true });
+}
+
+if (failures > 0) {
+	console.error(`\n${failures} check(s) failed`);
+	process.exit(1);
+}
+console.log("\nAll checks passed");

package/src/sap-model-commands.ts

@@ -1,7 +1,4 @@
-import {
-	AuthStorage,
-	type ExtensionAPI,
-} from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { ScenarioApi } from "@sap-ai-sdk/ai-api";
 
 import { parseAndValidateServiceKey } from "./auth.ts";
@@ -14,31 +11,10 @@ import {
 } from "./model-catalog.ts";
 import { ensureServiceKey, resolveResourceGroup } from "./stream.ts";
 
-function sharedServiceKeyFromAuthStore(): string | undefined {
-	try {
-		const store = AuthStorage.create();
-		for (const provider of store.list()) {
-			const cred = store.get(provider);
-			if (cred?.type !== "oauth") continue;
-			const serviceKey = (cred as { serviceKey?: unknown }).serviceKey;
-			if (
-				typeof serviceKey === "string" &&
-				serviceKey.trimStart().startsWith("{")
-			) {
-				return serviceKey;
-			}
-		}
-	} catch {
-		// Let callers produce the actionable no-key message.
-	}
-	return undefined;
-}
-
 function resolveCommandServiceKey(): ReturnType<
 	typeof parseAndValidateServiceKey
 > {
-	const raw = process.env.AICORE_SERVICE_KEY ?? sharedServiceKeyFromAuthStore();
-	return ensureServiceKey(raw);
+	return ensureServiceKey(undefined);
 }
 
 function formatModelList(ids: string[], max = 30): string {

package/src/stream.ts

@@ -14,7 +14,7 @@ import {
 	type SimpleStreamOptions,
 	type Usage,
 } from "@earendil-works/pi-ai";
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential } from "@earendil-works/pi-coding-agent";
 import type { ChatModel, LlmModelParams } from "@sap-ai-sdk/orchestration";
 import type { TokenUsage } from "@sap-ai-sdk/orchestration/internal.js";
 
@@ -575,27 +575,22 @@ export function latchFinishReason(
 
 let lastValidatedKey: ValidatedKey | undefined;
 
-// pi stores oauth credentials keyed by PROVIDER name, not by the oauth `name`.
-// So a `/login` under `sap-aicore` is NOT automatically handed to a second
-// provider (`sap-aicore-foundation`) that shares the same oauth object — pi
-// passes that provider the registration placeholder instead, and we'd wrongly
-// report "no key configured". Recover the shared login by reading pi's own auth
-// store directly and returning the first sibling oauth credential that carries
-// a service-key JSON. This is what makes one `/login` serve both providers.
-function readSharedServiceKeyFromStore(): string | undefined {
-	try {
-		const store = AuthStorage.create();
-		for (const provider of store.list()) {
-			const cred = store.get(provider);
-			if (cred?.type !== "oauth") continue;
-			const sk = (cred as { serviceKey?: unknown }).serviceKey;
-			if (typeof sk === "string" && sk.trimStart().startsWith("{")) return sk;
-		}
-	} catch {
-		// Auth store unreadable (missing/locked/format change) — fall through to
-		// the actionable "no key configured" error below.
-	}
-	return undefined;
+// pi stores OAuth credentials by provider id, not by the OAuth display name.
+// The foundation provider therefore reads the orchestration provider's stored
+// login explicitly. `readStoredCredential` is the synchronous, public helper
+// for stream setup; AuthStorage's old synchronous list/get API was removed in
+// pi 0.80.9.
+export function readSharedServiceKeyFromStore(
+	authPath?: string,
+): string | undefined {
+	const credential = readStoredCredential("sap-aicore", authPath);
+	if (credential?.type !== "oauth") return undefined;
+
+	const serviceKey = (credential as { serviceKey?: unknown }).serviceKey;
+	return typeof serviceKey === "string" &&
+		serviceKey.trimStart().startsWith("{")
+		? serviceKey
+		: undefined;
 }
 
 export function ensureServiceKey(apiKey: string | undefined): ValidatedKey {