pi-ui-extend 0.1.13 → 0.1.17

package/external/pi-tools-suite/src/antigravity-auth/oauth.ts

@@ -1,9 +1,10 @@
 import { createHash, randomBytes } from "node:crypto";
 import type { OAuthCredentials } from "@earendil-works/pi-ai";
-import { CLIENT_ID, CLIENT_SECRET, DEFAULT_PROJECT_ID, LOAD_ENDPOINTS, REDIRECT_URI, SCOPES, TOKEN_EXPIRY_SKEW_MS, PROVIDER_ID } from "./constants";
-import { accountFromCredential, clampAccountIndex, decodeApiKey, encodeApiKey, findMatchingAccountIndex, getAccountProjectId, getPiAuthPath, getStoredAccounts, joinRefresh, readJsonFile, splitRefresh, writeJsonFileSecure } from "./auth-store";
+import { DEFAULT_PROJECT_ID, LOAD_ENDPOINTS, REDIRECT_URI, SCOPES, TOKEN_EXPIRY_SKEW_MS, PROVIDER_ID } from "./constants";
+import { accountFromCredential, clampAccountIndex, encodeApiKey, findMatchingAccountIndex, getAccountProjectId, getAccountRefreshToken, getGoogleOAuthClientCredentials, getPiAuthPath, getStoredAccounts, joinRefresh, readJsonFile, splitRefresh, writeJsonFileSecure } from "./auth-store";
 import { getAntigravityHeaders } from "./headers";
-import type { AntigravityAddAccountResult, AntigravityFailoverCredential, AntigravityLoginCallbacks, OpencodeAntigravityAccount, PiAuthCredential, PiAuthData, RefreshedAntigravityAccount } from "./types";
+import { notifyAntigravityLoginFailure } from "./status";
+import type { AntigravityAddAccountResult, AntigravityFailoverCredential, AntigravityLoginCallbacks, GoogleOAuthClientCredentials, OpencodeAntigravityAccount, PiAuthCredential, PiAuthData, RefreshedAntigravityAccount } from "./types";
 
 function base64Url(input: Buffer): string {
 	return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -25,6 +26,12 @@ function decodeState(state: string): { verifier: string; projectId?: string } {
 	return { verifier: parsed.verifier, projectId: typeof parsed.projectId === "string" ? parsed.projectId : undefined };
 }
 
+function assertGoogleOAuthCredentialsConfigured(credentials?: GoogleOAuthClientCredentials): asserts credentials is GoogleOAuthClientCredentials & { clientId: string } {
+	if (!credentials?.clientId) {
+		throw new Error(`Antigravity Google OAuth client credentials are missing in Pi auth: ${getPiAuthPath()}.`);
+	}
+}
+
 async function fetchProjectId(accessToken: string): Promise<string | undefined> {
 	const headers = {
 		Authorization: `Bearer ${accessToken}`,
@@ -90,60 +97,65 @@ function extractOAuthParams(input: string): { code: string; state: string } {
 	throw new Error("Paste the full localhost callback URL, or code#state.");
 }
 
-export async function loginAntigravity(callbacks: AntigravityLoginCallbacks): Promise<OAuthCredentials> {
-	if (!CLIENT_ID || !CLIENT_SECRET) {
-		throw new Error("Antigravity Google OAuth credentials are not configured; set PIX_ANTIGRAVITY_GOOGLE_CLIENT_ID and PIX_ANTIGRAVITY_GOOGLE_CLIENT_SECRET.");
-	}
+export async function loginAntigravity(callbacks: AntigravityLoginCallbacks, options: { authPath?: string } = {}): Promise<OAuthCredentials> {
+	try {
+		const auth = await readJsonFile<PiAuthData>(options.authPath ?? getPiAuthPath(), {});
+		const oauthClient = getGoogleOAuthClientCredentials(auth[PROVIDER_ID]);
+		assertGoogleOAuthCredentialsConfigured(oauthClient);
 
-	const { verifier, challenge } = generatePkce();
-	const state = encodeState({ verifier });
-	const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
-	url.searchParams.set("client_id", CLIENT_ID);
-	url.searchParams.set("response_type", "code");
-	url.searchParams.set("redirect_uri", REDIRECT_URI);
-	url.searchParams.set("scope", SCOPES.join(" "));
-	url.searchParams.set("code_challenge", challenge);
-	url.searchParams.set("code_challenge_method", "S256");
-	url.searchParams.set("state", state);
-	url.searchParams.set("access_type", "offline");
-	url.searchParams.set("prompt", "consent");
+		const { verifier, challenge } = generatePkce();
+		const state = encodeState({ verifier });
+		const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+		url.searchParams.set("client_id", oauthClient.clientId);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("redirect_uri", REDIRECT_URI);
+		url.searchParams.set("scope", SCOPES.join(" "));
+		url.searchParams.set("code_challenge", challenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		url.searchParams.set("state", state);
+		url.searchParams.set("access_type", "offline");
+		url.searchParams.set("prompt", "consent");
 
-	callbacks.onAuth({ url: url.toString() });
-	const pasted = await callbacks.onPrompt({
-		message: "Paste the full http://localhost:51121/oauth-callback URL after Google login (or code#state):",
-	});
-	const params = extractOAuthParams(pasted);
-	const decodedState = decodeState(params.state);
-	if (decodedState.verifier !== verifier) throw new Error("OAuth state verifier mismatch");
+		callbacks.onAuth({ url: url.toString() });
+		const pasted = await callbacks.onPrompt({
+			message: "Paste the full http://localhost:51121/oauth-callback URL after Google login (or code#state):",
+		});
+		const params = extractOAuthParams(pasted);
+		const decodedState = decodeState(params.state);
+		if (decodedState.verifier !== verifier) throw new Error("OAuth state verifier mismatch");
 
-	const start = Date.now();
-	const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
-			Accept: "*/*",
-			"User-Agent": getAntigravityHeaders("gemini-cli")["User-Agent"],
-		},
-		body: new URLSearchParams({
-			client_id: CLIENT_ID,
-			client_secret: CLIENT_SECRET,
-			code: params.code,
-			grant_type: "authorization_code",
-			redirect_uri: REDIRECT_URI,
-			code_verifier: verifier,
-		}),
-	});
-	if (!tokenResponse.ok) throw new Error(`Token exchange failed: ${await tokenResponse.text()}`);
-	const tokenPayload = (await tokenResponse.json()) as { access_token: string; refresh_token?: string; expires_in: number };
-	if (!tokenPayload.refresh_token) throw new Error("Missing refresh token in Google response");
+		const start = Date.now();
+		const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
+				Accept: "*/*",
+				"User-Agent": getAntigravityHeaders("gemini-cli")["User-Agent"],
+			},
+			body: new URLSearchParams({
+				client_id: oauthClient.clientId,
+				...(oauthClient.clientSecret ? { client_secret: oauthClient.clientSecret } : {}),
+				code: params.code,
+				grant_type: "authorization_code",
+				redirect_uri: REDIRECT_URI,
+				code_verifier: verifier,
+			}),
+		});
+		if (!tokenResponse.ok) throw new Error(`Token exchange failed: ${await tokenResponse.text()}`);
+		const tokenPayload = (await tokenResponse.json()) as { access_token: string; refresh_token?: string; expires_in: number };
+		if (!tokenPayload.refresh_token) throw new Error("Missing refresh token in Google response");
 
-	const [projectId, email] = await Promise.all([fetchProjectId(tokenPayload.access_token), fetchGoogleUserEmail(tokenPayload.access_token)]);
-	return {
-		refresh: joinRefresh(tokenPayload.refresh_token, projectId ?? DEFAULT_PROJECT_ID),
-		access: encodeApiKey(tokenPayload.access_token, projectId ?? DEFAULT_PROJECT_ID),
-		expires: start + tokenPayload.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
-		...(email ? { email } : {}),
-	};
+		const [projectId, email] = await Promise.all([fetchProjectId(tokenPayload.access_token), fetchGoogleUserEmail(tokenPayload.access_token)]);
+		return {
+			refresh: joinRefresh(tokenPayload.refresh_token, projectId ?? DEFAULT_PROJECT_ID),
+			access: encodeApiKey(tokenPayload.access_token, projectId ?? DEFAULT_PROJECT_ID),
+			expires: start + tokenPayload.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
+			...(email ? { email } : {}),
+		};
+	} catch (error) {
+		notifyAntigravityLoginFailure(error);
+		throw error;
+	}
 }
 
 export async function addAntigravityAccount(
@@ -151,7 +163,7 @@ export async function addAntigravityAccount(
 	options: { authPath?: string; activate?: boolean; email?: string } = {},
 ): Promise<AntigravityAddAccountResult> {
 	const authPath = options.authPath ?? getPiAuthPath();
-	const credentials = (await loginAntigravity(callbacks)) as OAuthCredentials & PiAuthCredential;
+	const credentials = (await loginAntigravity(callbacks, { authPath })) as OAuthCredentials & PiAuthCredential;
 	const refreshDetails = splitRefresh(credentials.refresh);
 	const projectId = refreshDetails.projectId || refreshDetails.managedProjectId || DEFAULT_PROJECT_ID;
 	const account: OpencodeAntigravityAccount = {
@@ -159,6 +171,7 @@ export async function addAntigravityAccount(
 		refreshToken: refreshDetails.refreshToken,
 		projectId,
 		managedProjectId: refreshDetails.managedProjectId,
+		...getGoogleOAuthClientCredentials(credentials),
 		enabled: true,
 	};
 
@@ -207,8 +220,11 @@ export async function addAntigravityAccount(
 	};
 }
 
-async function refreshAccountToken(account: OpencodeAntigravityAccount): Promise<RefreshedAntigravityAccount> {
-	if (!account.refreshToken) throw new Error(`Missing refresh token for Antigravity account ${account.email ?? "<unknown>"}`);
+async function refreshAccountToken(account: OpencodeAntigravityAccount, oauthClient?: GoogleOAuthClientCredentials): Promise<RefreshedAntigravityAccount> {
+	const refreshToken = getAccountRefreshToken(account);
+	if (!refreshToken) throw new Error(`Missing refresh token for Antigravity account ${account.email ?? "<unknown>"}`);
+	const clientCredentials = getGoogleOAuthClientCredentials(account) ?? oauthClient;
+	assertGoogleOAuthCredentialsConfigured(clientCredentials);
 	const projectId = getAccountProjectId(account);
 	const start = Date.now();
 	const response = await fetch("https://oauth2.googleapis.com/token", {
@@ -219,10 +235,10 @@ async function refreshAccountToken(account: OpencodeAntigravityAccount): Promise
 			"User-Agent": getAntigravityHeaders("gemini-cli")["User-Agent"],
 		},
 		body: new URLSearchParams({
-			client_id: CLIENT_ID,
-			client_secret: CLIENT_SECRET,
+			client_id: clientCredentials.clientId,
+			...(clientCredentials.clientSecret ? { client_secret: clientCredentials.clientSecret } : {}),
 			grant_type: "refresh_token",
-			refresh_token: account.refreshToken,
+			refresh_token: refreshToken,
 		}),
 	});
 	if (!response.ok) throw new Error(`Token refresh failed for ${account.email ?? "Antigravity account"}: ${await response.text()}`);
@@ -231,7 +247,7 @@ async function refreshAccountToken(account: OpencodeAntigravityAccount): Promise
 		account,
 		projectId,
 		credentials: {
-			refresh: joinRefresh(payload.refresh_token ?? account.refreshToken, projectId, account.managedProjectId),
+			refresh: joinRefresh(payload.refresh_token ?? refreshToken, projectId, account.managedProjectId),
 			access: encodeApiKey(payload.access_token, projectId),
 			expires: start + payload.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
 			email: account.email,
@@ -241,6 +257,7 @@ async function refreshAccountToken(account: OpencodeAntigravityAccount): Promise
 
 export async function refreshAntigravityToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {
 	const credentialDetails = credentials as OAuthCredentials & PiAuthCredential;
+	const oauthClient = getGoogleOAuthClientCredentials(credentialDetails);
 	const storedAccounts = getStoredAccounts(credentialDetails);
 	const baseIndex = clampAccountIndex(credentialDetails.activeIndex, storedAccounts.length);
 	const rotationAccount = storedAccounts.length > 0 ? storedAccounts[(baseIndex + 1) % storedAccounts.length] : undefined;
@@ -253,6 +270,7 @@ export async function refreshAntigravityToken(credentials: OAuthCredentials): Pr
 			managedProjectId: fallback.managedProjectId,
 			email: credentialDetails.email,
 		},
+		oauthClient,
 	);
 	return {
 		...refreshed.credentials,
@@ -260,6 +278,55 @@ export async function refreshAntigravityToken(credentials: OAuthCredentials): Pr
 	};
 }
 
+export async function refreshStoredAntigravityCredential(authPath = getPiAuthPath()): Promise<AntigravityFailoverCredential | undefined> {
+	const auth = await readJsonFile<PiAuthData>(authPath, {});
+	const current = auth[PROVIDER_ID];
+	if (current?.type !== "oauth") return undefined;
+
+	const accounts = getStoredAccounts(current);
+	const oauthClient = getGoogleOAuthClientCredentials(current);
+	const activeIndex = accounts.length > 0 ? clampAccountIndex(current.activeIndex, accounts.length) : 0;
+	const fallback = splitRefresh(current.refresh ?? "");
+	const account = accounts[activeIndex] ?? {
+		refreshToken: fallback.refreshToken,
+		projectId: fallback.projectId || fallback.managedProjectId,
+		managedProjectId: fallback.managedProjectId,
+		email: current.email,
+	};
+	if (!account.refreshToken) return undefined;
+
+	const refreshed = await refreshAccountToken({ ...account, refreshToken: getAccountRefreshToken(account) }, oauthClient);
+	const refreshedParts = splitRefresh(refreshed.credentials.refresh);
+	const nextAccounts = accounts.length > 0
+		? accounts.map((stored, index) => index === activeIndex
+			? {
+				...stored,
+				refreshToken: refreshedParts.refreshToken || stored.refreshToken,
+				projectId: refreshed.projectId,
+				managedProjectId: account.managedProjectId,
+				email: account.email ?? stored.email,
+				enabled: stored.enabled !== false,
+			}
+			: stored)
+		: [];
+	const nextCredential: PiAuthCredential = {
+		...current,
+		type: "oauth",
+		...refreshed.credentials,
+		...(nextAccounts.length > 0 ? { accounts: nextAccounts, activeIndex, email: account.email ?? current.email } : {}),
+	};
+	auth[PROVIDER_ID] = nextCredential;
+	await writeJsonFileSecure(authPath, auth);
+
+	return {
+		apiKey: nextCredential.access ?? "",
+		projectId: refreshed.projectId,
+		email: account.email,
+		accountIndex: activeIndex,
+		accountCount: accounts.length || 1,
+	};
+}
+
 export async function refreshNextFailoverCredential(attemptedAccountIndices: Set<number>): Promise<AntigravityFailoverCredential | undefined> {
 	const authPath = getPiAuthPath();
 	const auth = await readJsonFile<PiAuthData>(authPath, {});
@@ -267,6 +334,7 @@ export async function refreshNextFailoverCredential(attemptedAccountIndices: Set
 	if (current?.type !== "oauth") return undefined;
 
 	const accounts = getStoredAccounts(current);
+	const oauthClient = getGoogleOAuthClientCredentials(current);
 	if (accounts.length <= attemptedAccountIndices.size) return undefined;
 	const baseIndex = clampAccountIndex(current.activeIndex, accounts.length);
 	let lastRefreshError: unknown;
@@ -277,7 +345,7 @@ export async function refreshNextFailoverCredential(attemptedAccountIndices: Set
 		attemptedAccountIndices.add(accountIndex);
 		const account = accounts[accountIndex];
 		try {
-			const refreshed = await refreshAccountToken(account);
+			const refreshed = await refreshAccountToken(account, oauthClient);
 			const nextCredential: PiAuthCredential = {
 				...current,
 				type: "oauth",

package/external/pi-tools-suite/src/antigravity-auth/status.ts

@@ -7,6 +7,9 @@ import type { AntigravityStatusDetails, OpencodeAntigravityAccount, PiAuthData,
 
 let extensionUi: ExtensionUIContext | undefined;
 let extensionApi: ExtensionAPI | undefined;
+const notifiedLoginFailures = new WeakSet<object>();
+const PROVIDER_FAILURE_DEDUPE_MS = 60_000;
+const notifiedProviderFailures = new Map<string, number>();
 
 export function rememberAntigravityApi(api: ExtensionAPI): void {
 	extensionApi = api;
@@ -16,6 +19,80 @@ export function rememberAntigravityUi(ui: ExtensionUIContext | undefined): void
 	if (ui) extensionUi = ui;
 }
 
+function errorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+export function formatAntigravityLoginFailure(error: unknown): string {
+	return `Antigravity login failed: ${errorMessage(error)}. Auth file: ${getPiAuthPath()}`;
+}
+
+export function formatAntigravityProviderFailure(error: unknown): string {
+	return `Antigravity request failed: ${errorMessage(error)}. Auth file: ${getPiAuthPath()}`;
+}
+
+function notifyAntigravityFailure(message: string, details: Record<string, unknown>, options: { ui?: ExtensionUIContext; sendSessionMessage?: boolean } = {}): void {
+	const { ui, sendSessionMessage = true } = options;
+	const targetUi = ui ?? extensionUi;
+	if (typeof targetUi?.notify === "function") {
+		targetUi.notify(message, "error");
+	} else if (typeof (targetUi as any)?.toast?.error === "function") {
+		(targetUi as any).toast.error(message);
+	}
+	if (!sendSessionMessage) return;
+	(extensionApi as any)?.sendMessage?.({
+		customType: "antigravity-auth-status",
+		content: message,
+		display: true,
+		details,
+	}, { triggerTurn: false });
+}
+
+function shouldNotifyProviderFailure(message: string, model?: string): boolean {
+	const now = Date.now();
+	const key = `${model ?? ""}\0${message}`;
+	for (const [existingKey, timestamp] of notifiedProviderFailures) {
+		if (now - timestamp > PROVIDER_FAILURE_DEDUPE_MS) notifiedProviderFailures.delete(existingKey);
+	}
+	const previous = notifiedProviderFailures.get(key);
+	if (previous !== undefined && now - previous <= PROVIDER_FAILURE_DEDUPE_MS) return false;
+	notifiedProviderFailures.set(key, now);
+	return true;
+}
+
+export function notifyAntigravityLoginFailure(error: unknown): boolean {
+	if (typeof error === "object" && error !== null) {
+		if (notifiedLoginFailures.has(error)) return false;
+		notifiedLoginFailures.add(error);
+	}
+
+	const message = formatAntigravityLoginFailure(error);
+	notifyAntigravityFailure(message, {
+		kind: "login-failure",
+		authPath: getPiAuthPath(),
+		error: errorMessage(error),
+	});
+	return true;
+}
+
+export function notifyAntigravityProviderFailure(error: unknown, options: { ui?: ExtensionUIContext; model?: string } = {}): boolean {
+	const message = formatAntigravityProviderFailure(error);
+	if (!shouldNotifyProviderFailure(message, options.model)) return false;
+	notifyAntigravityFailure(message, {
+		kind: "provider-failure",
+		authPath: getPiAuthPath(),
+		error: errorMessage(error),
+		model: options.model,
+	}, {
+		ui: options.ui,
+		// Provider failures are raised while the agent is still streaming. pi.sendMessage()
+		// would be delivered as a steering message in that state, which can trigger
+		// another Antigravity request and create an endless toast/request loop.
+		sendSessionMessage: false,
+	});
+	return true;
+}
+
 export async function getCurrentAntigravityStatus(): Promise<AntigravityStatusDetails> {
 	const auth = await readJsonFile<PiAuthData>(getPiAuthPath(), {});
 	const credential = auth[PROVIDER_ID];
@@ -51,7 +128,7 @@ async function startupAntigravityAccountList(): Promise<string> {
 	try {
 		const auth = await readJsonFile<PiAuthData>(getPiAuthPath(), {});
 		const accounts = getStartupAccounts(auth[PROVIDER_ID]);
-		if (accounts.length === 0) return "no accounts (run /antigravity-import or /antigravity-add-account)";
+		if (accounts.length === 0) return "no accounts in auth.json (run /antigravity-add-account)";
 		return accounts.map(formatStartupAccountName).join(", ");
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -68,8 +145,10 @@ export async function publishAntigravityAuthStartupSection(): Promise<void> {
 }
 
 export function emitAntigravityStatus(details: AntigravityStatusDetails): void {
-	extensionUi?.setStatus(LEGACY_STATUS_KEY, undefined);
-	extensionUi?.setStatus(STATUS_KEY, formatAntigravityStatus(details));
+	if (typeof extensionUi?.setStatus === "function") {
+		extensionUi.setStatus(LEGACY_STATUS_KEY, undefined);
+		extensionUi.setStatus(STATUS_KEY, formatAntigravityStatus(details));
+	}
 	(extensionApi as any)?.sendMessage?.({
 		role: "system",
 		content: formatAntigravityStatus(details),

package/external/pi-tools-suite/src/antigravity-auth/stream.ts

@@ -3,7 +3,7 @@ import { calculateCost, createAssistantMessageEventStream, type AssistantMessage
 import { ALL_ACCOUNTS_EXHAUSTED_MARKER, API_ID, ENDPOINT_PROD, PROVIDER_ID, STREAM_ENDPOINTS } from "./constants";
 import { clampAccountIndex, decodeApiKey, getPiAuthPath, getStoredAccounts, readJsonFile } from "./auth-store";
 import { getAntigravityHeaders, getModelHeaderStyle } from "./headers";
-import { refreshNextFailoverCredential } from "./oauth";
+import { refreshNextFailoverCredential, refreshStoredAntigravityCredential } from "./oauth";
 import { buildPayload, extraHeadersForPayload, partThoughtSignature } from "./payload";
 import { emitAntigravityStatus } from "./status";
 import type { AntigravityChunk, AntigravityModel, PiAuthData } from "./types";
@@ -104,6 +104,24 @@ function updateUsage(output: AssistantMessage, model: AntigravityModel, metadata
 	calculateCost(model, output.usage);
 }
 
+async function resolveAntigravityApiKey(optionsApiKey?: string): Promise<{ auth: PiAuthData; apiKey: string }> {
+	const auth = await readJsonFile<PiAuthData>(getPiAuthPath(), {});
+	const storedCredential = auth[PROVIDER_ID];
+
+	const storedApiKey = storedCredential?.type === "oauth" && storedCredential.access && (storedCredential.expires ?? 0) > Date.now()
+		? storedCredential.access
+		: undefined;
+	const apiKey = storedApiKey ?? optionsApiKey;
+	if (apiKey) return { auth, apiKey };
+
+	if (storedCredential?.type === "oauth") {
+		const refreshed = await refreshStoredAntigravityCredential();
+		if (refreshed?.apiKey) return { auth: await readJsonFile<PiAuthData>(getPiAuthPath(), {}), apiKey: refreshed.apiKey };
+	}
+
+	throw new Error(`No Antigravity OAuth account found in Pi auth: ${getPiAuthPath()}.`);
+}
+
 export function streamAntigravity(model: AntigravityModel, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream {
 	const stream = createAssistantMessageEventStream();
 	(async () => {
@@ -135,12 +153,7 @@ export function streamAntigravity(model: AntigravityModel, context: Context, opt
 
 		try {
 			const attemptedAccountIndices = new Set<number>();
-			const auth = await readJsonFile<PiAuthData>(getPiAuthPath(), {});
-			const storedCredential = auth[PROVIDER_ID];
-			const apiKey = storedCredential?.type === "oauth" && storedCredential.access && (storedCredential.expires ?? 0) > Date.now()
-				? storedCredential.access
-				: options?.apiKey;
-			if (!apiKey) throw new Error("Not authenticated with Antigravity. Run /login antigravity first.");
+			const { auth, apiKey } = await resolveAntigravityApiKey(options?.apiKey);
 			const decodedApiKey = decodeApiKey(apiKey);
 			const authAccounts = getStoredAccounts(auth[PROVIDER_ID]);
 			if (authAccounts.length > 0) attemptedAccountIndices.add(clampAccountIndex(auth[PROVIDER_ID]?.activeIndex, authAccounts.length));

package/external/pi-tools-suite/src/antigravity-auth/types.ts

@@ -39,10 +39,26 @@ export type AntigravityChunk = {
 
 export type OpencodeAntigravityAccount = {
 	email?: string;
+	access?: string;
+	refresh?: string;
+	expires?: number;
 	refreshToken?: string;
 	projectId?: string;
 	managedProjectId?: string;
 	enabled?: boolean;
+	clientId?: string;
+	clientSecret?: string;
+	googleClientId?: string;
+	googleClientSecret?: string;
+	oauthClient?: GoogleOAuthClientCredentials;
+	fingerprint?: { apiClient?: string; [key: string]: unknown };
+	fingerprintHistory?: Array<{ fingerprint?: { apiClient?: string; [key: string]: unknown }; [key: string]: unknown }>;
+	[key: string]: unknown;
+};
+
+export type GoogleOAuthClientCredentials = {
+	clientId?: string;
+	clientSecret?: string;
 };
 
 export type OpencodeAntigravityStorage = {
@@ -59,6 +75,11 @@ export type PiAuthCredential = {
 	email?: string;
 	accounts?: OpencodeAntigravityAccount[];
 	activeIndex?: number;
+	clientId?: string;
+	clientSecret?: string;
+	googleClientId?: string;
+	googleClientSecret?: string;
+	oauthClient?: GoogleOAuthClientCredentials;
 	[key: string]: unknown;
 };
 

package/external/pi-tools-suite/src/config.ts

@@ -8,11 +8,13 @@ import { DEFAULT_PI_TOOLS_SUITE_CONFIG_JSONC } from "./default-pi-tools-suite-co
 export interface PiToolsSuiteConfig {
 	enabled: boolean;
 	disabledModules: string[];
+	todoThinking: boolean;
 }
 
 type MutableConfig = {
 	enabled: boolean;
 	disabledModules: Set<string>;
+	todoThinking: boolean;
 };
 
 type Env = Record<string, string | undefined>;
@@ -107,6 +109,7 @@ function removeDisabled(config: MutableConfig, value: unknown, knownModules: Rea
 
 function mergeConfigLayer(config: MutableConfig, raw: Record<string, unknown>, knownModules: ReadonlySet<string>): MutableConfig {
 	if (typeof raw.enabled === "boolean") config.enabled = raw.enabled;
+	if (typeof raw.todoThinking === "boolean") config.todoThinking = raw.todoThinking;
 
 	for (const key of DISABLED_LIST_KEYS) addDisabled(config, raw[key], knownModules);
 	for (const key of ENABLED_LIST_KEYS) removeDisabled(config, raw[key], knownModules);
@@ -150,6 +153,9 @@ function applyEnv(config: MutableConfig, env: Env, knownModules: ReadonlySet<str
 	addDisabled(config, env.PI_TOOLS_SUITE_DISABLED_MODULES, knownModules);
 	addDisabled(config, env.PI_TOOLS_SUITE_DISABLED_EXTENSIONS, knownModules);
 
+	const todoThinking = boolFromEnv(env.PI_TOOLS_SUITE_TODO_THINKING);
+	if (todoThinking !== undefined) config.todoThinking = todoThinking;
+
 	return config;
 }
 
@@ -159,6 +165,7 @@ export function loadPiToolsSuiteConfig(moduleNames: readonly string[], options:
 	const config: MutableConfig = {
 		enabled: true,
 		disabledModules: new Set([...DEFAULT_DISABLED_MODULES].filter((name) => knownModules.has(name))),
+		todoThinking: false,
 	};
 	const userConfigPath = getPiToolsSuiteUserConfigPath(options.homeDir);
 
@@ -176,5 +183,6 @@ export function loadPiToolsSuiteConfig(moduleNames: readonly string[], options:
 	return {
 		enabled: config.enabled,
 		disabledModules: [...config.disabledModules].sort(),
+		todoThinking: config.todoThinking,
 	};
 }

package/external/pi-tools-suite/src/dcp/index.ts

@@ -105,7 +105,7 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 	// ── 2. Create state ───────────────────────────────────────────────────────
 	const state = createState()
 	const appendNudgeTelemetry = (
-		event: "emitted" | "upgraded",
+		event: "emitted" | "upgraded" | "reapplied",
 		type: DcpNudgeType,
 		anchor: { id: number; anchorTimestamp: number; anchorStableId?: string; anchorRole: string },
 		usage: ReturnType<typeof normalizeDcpContextUsage>,
@@ -329,6 +329,21 @@ export default async function dcpModule(pi: ExtensionAPI): Promise<void> {
 							toolCallsSinceLastUser,
 						)
 						saveState(pi, state)
+					} else {
+						// Anchor already exists at >= priority; the reminder text is
+						// re-applied below via applyAnchoredNudges on every context
+						// event. Emit 'reapplied' so telemetry reflects every active
+						// reminder delivery, not just creates/upgrades. Without this
+						// branch the user/developer sees a single "emitted" entry even
+						// when the LLM was reminded many times across a long autonomous
+						// loop, which made auto-nudge look silent when it actually ran.
+						appendNudgeTelemetry(
+							"reapplied",
+							anchorResult.anchor.type,
+							anchorResult.anchor,
+							usage,
+							toolCallsSinceLastUser,
+						)
 					}
 				} else {
 					// No safe existing message could be anchored (rare); keep the older

package/external/pi-tools-suite/src/dcp/state.ts

@@ -283,6 +283,20 @@ export interface SerializedDcpState {
   nudgeAnchors?: DcpNudgeAnchor[]
   nextNudgeAnchorId?: number
   lastNudge?: DcpLastNudge
+  /**
+   * Persisted since v??. `context` events re-seed currentTurn from raw
+   * messages, but keeping it across session restarts gives diagnostics and
+   * telemetry a contiguous turn counter instead of resetting to 0.
+   */
+  currentTurn?: number
+  /**
+   * Persisted since v?.?. Without persistence a pi process restart silently
+   * reset the nudge cadence counter to 0, which could suppress the next
+   * reminder on a session that was already near a context threshold.
+   */
+  nudgeCounter?: number
+  /** Persisted since v?.?. Diagnostic turn of the last emitted nudge. */
+  lastNudgeTurn?: number
 }
 
 function isToolRecord(value: unknown): value is ToolRecord {
@@ -337,6 +351,9 @@ export function serializeState(state: DcpState): SerializedDcpState {
     nudgeAnchors: state.nudgeAnchors,
     nextNudgeAnchorId: state.nextNudgeAnchorId,
     lastNudge: state.lastNudge,
+    currentTurn: state.currentTurn,
+    nudgeCounter: state.nudgeCounter,
+    lastNudgeTurn: state.lastNudgeTurn,
   }
 }
 
@@ -444,6 +461,24 @@ export function restoreState(state: DcpState, data: unknown): void {
   if (isLastNudge(saved.lastNudge)) {
     state.lastNudge = saved.lastNudge
   }
+
+  // nudgeCounter: clamp to a non-negative integer so a corrupted payload
+  // cannot stall reminders by going negative. Default 0 keeps older sessions
+  // behaving like a fresh cadence on first post-restart context event.
+  if (typeof saved.nudgeCounter === "number" && Number.isFinite(saved.nudgeCounter) && saved.nudgeCounter >= 0) {
+    state.nudgeCounter = Math.floor(saved.nudgeCounter)
+  }
+
+  // lastNudgeTurn and currentTurn default to createState() values when absent
+  // (lastNudgeTurn = -1, currentTurn = 0). currentTurn is re-derived from
+  // raw messages on every `context` event, so persistence here is best-effort
+  // for telemetry continuity rather than authoritative.
+  if (typeof saved.lastNudgeTurn === "number" && Number.isFinite(saved.lastNudgeTurn)) {
+    state.lastNudgeTurn = Math.floor(saved.lastNudgeTurn)
+  }
+  if (typeof saved.currentTurn === "number" && Number.isFinite(saved.currentTurn) && saved.currentTurn >= 0) {
+    state.currentTurn = Math.floor(saved.currentTurn)
+  }
 }
 
 // ---------------------------------------------------------------------------

package/external/pi-tools-suite/src/default-pi-tools-suite-config.ts

@@ -5,6 +5,9 @@ export const DEFAULT_PI_TOOLS_SUITE_CONFIG_JSONC = String.raw`{
     // "ast-grep",
     // "dcp"
   ],
+  // When true, todo items may carry a per-task thinking level and the todo
+  // module will switch/restore Pi's thinking level as in-progress tasks change.
+  "todoThinking": false,
   "terminalBell": { "sound": true },
   "dcp": {
     "enabled": true,