pi-webdesk 0.1.0

package/dist/packages/git/src/validation.js

@@ -0,0 +1,263 @@
+// packages/git/src/validation.ts
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { StringDecoder } from "node:string_decoder";
+var DEFAULT_VALIDATION_TIMEOUT_MS = 6e5;
+var MAX_VALIDATION_TIMEOUT_MS = 6e5;
+var DEFAULT_VALIDATION_MAX_OUTPUT_CHARS = 1e5;
+var MAX_VALIDATION_COMMAND_CHARS = 4096;
+var DEFAULT_TERM_GRACE_MS = 5e3;
+var MAX_TERM_GRACE_MS = 1e4;
+var SETTLE_FAILSAFE_SLACK_MS = 1e3;
+var VALIDATION_SUPERVISOR_SCRIPT = String.raw`
+validation_command=$1
+term_grace_seconds=$2
+process_group=$$
+exec 3<&0
+(
+  trap 'exit 0' TERM HUP INT
+  if ! IFS= read -r _ <&3; then
+    trap '' TERM HUP INT
+    kill -TERM "-$process_group" 2>/dev/null || true
+    sleep "$term_grace_seconds"
+    kill -KILL "-$process_group" 2>/dev/null || true
+  fi
+) &
+watchdog=$!
+/bin/sh -lc "$validation_command" </dev/null
+command_status=$?
+kill -KILL "$watchdog" 2>/dev/null || true
+wait "$watchdog" 2>/dev/null || true
+exit "$command_status"
+`;
+var ValidationRunnerError = class extends Error {
+  name = "ValidationRunnerError";
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+};
+function isValidationRunnerError(value, code) {
+  if (!(value instanceof ValidationRunnerError)) return false;
+  return code === void 0 || value.code === code;
+}
+function boundedNumber(value, min, max) {
+  if (!Number.isSafeInteger(value) || value < min) return min;
+  return Math.min(value, max);
+}
+function commandCharacterIsSafe(character) {
+  return character === "\n" || character === "	" || !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cs}]/u.test(character) && (!new RegExp("\\p{Zs}", "u").test(character) || character === " ") && !/[\u115F\u1160\u2800\u3164\uFFA0]/u.test(character);
+}
+function startValidationRun(options) {
+  const command = options.command;
+  if (typeof command !== "string" || command.trim().length === 0 || command.length > MAX_VALIDATION_COMMAND_CHARS || ![...command].every(commandCharacterIsSafe)) {
+    throw new ValidationRunnerError(
+      "VALIDATION_COMMAND_INVALID",
+      `Validation commands must be non-empty, at most ${MAX_VALIDATION_COMMAND_CHARS} characters, and free of unsafe invisible characters`
+    );
+  }
+  if (!path.isAbsolute(options.worktreePath)) {
+    throw new ValidationRunnerError(
+      "VALIDATION_WORKTREE_INVALID",
+      "Validation runs require an absolute, caller-verified worktree path"
+    );
+  }
+  const timeoutMs = boundedNumber(
+    options.timeoutMs ?? DEFAULT_VALIDATION_TIMEOUT_MS,
+    1,
+    MAX_VALIDATION_TIMEOUT_MS
+  );
+  const maxOutputChars = boundedNumber(
+    options.maxOutputChars ?? DEFAULT_VALIDATION_MAX_OUTPUT_CHARS,
+    1,
+    DEFAULT_VALIDATION_MAX_OUTPUT_CHARS
+  );
+  const termGraceMs = boundedNumber(
+    options.termGraceMs ?? DEFAULT_TERM_GRACE_MS,
+    1,
+    MAX_TERM_GRACE_MS
+  );
+  const now = options.now ?? Date.now;
+  const spawnImpl = options.spawnImpl ?? spawn;
+  const startedAtMs = now();
+  let child;
+  try {
+    child = spawnImpl(
+      "/bin/sh",
+      [
+        "-c",
+        VALIDATION_SUPERVISOR_SCRIPT,
+        "pita-validation-supervisor",
+        command,
+        String(termGraceMs / 1e3)
+      ],
+      {
+        cwd: options.worktreePath,
+        env: { ...process.env },
+        detached: true,
+        stdio: ["pipe", "pipe", "pipe"]
+      }
+    );
+  } catch (error) {
+    throw new ValidationRunnerError(
+      "VALIDATION_SPAWN_FAILED",
+      "The validation shell could not be started",
+      { cause: error }
+    );
+  }
+  let output = "";
+  let omittedOutputChars = 0;
+  let timedOut = false;
+  let disposed = false;
+  let settled = false;
+  let exitRecord = null;
+  const timers = [];
+  function append(text) {
+    if (text.length === 0) return;
+    const capacity = maxOutputChars - output.length;
+    if (capacity <= 0) {
+      omittedOutputChars += text.length;
+      return;
+    }
+    if (text.length <= capacity) {
+      output += text;
+      return;
+    }
+    output += text.slice(0, capacity);
+    omittedOutputChars += text.length - capacity;
+  }
+  const decoders = [];
+  for (const stream of [child.stdout, child.stderr]) {
+    if (stream === null) continue;
+    const decoder = new StringDecoder("utf8");
+    const state = { decoder, ended: false };
+    decoders.push(state);
+    stream.on("data", (chunk) => append(decoder.write(chunk)));
+    stream.on("end", () => {
+      if (state.ended) return;
+      state.ended = true;
+      append(decoder.end());
+    });
+    stream.on("error", () => void 0);
+  }
+  function flushDecoders() {
+    for (const state of decoders) {
+      if (state.ended) continue;
+      state.ended = true;
+      append(state.decoder.end());
+    }
+  }
+  function signalGroup(signal) {
+    const pid = child.pid;
+    if (pid === void 0) return;
+    try {
+      process.kill(-pid, signal);
+    } catch {
+    }
+  }
+  function groupIsAlive() {
+    const pid = child.pid;
+    if (pid === void 0) return false;
+    try {
+      process.kill(-pid, 0);
+      return true;
+    } catch (error) {
+      return !(error !== null && typeof error === "object" && "code" in error && error.code === "ESRCH");
+    }
+  }
+  function scheduleTimer(callback, delayMs) {
+    const timer = setTimeout(callback, delayMs);
+    timer.unref?.();
+    timers.push(timer);
+  }
+  function escalate() {
+    if (groupIsAlive()) signalGroup("SIGTERM");
+    scheduleTimer(() => {
+      if (groupIsAlive()) signalGroup("SIGKILL");
+    }, termGraceMs);
+  }
+  let settle = () => void 0;
+  let fail = () => void 0;
+  const result = new Promise((resolve, reject) => {
+    settle = () => {
+      if (settled) return;
+      flushDecoders();
+      settled = true;
+      for (const timer of timers) clearTimeout(timer);
+      if (disposed) {
+        reject(
+          new ValidationRunnerError(
+            "VALIDATION_DISPOSED",
+            "The validation run was disposed before completion"
+          )
+        );
+        return;
+      }
+      const exitCode = exitRecord?.code ?? null;
+      const signal = exitRecord?.signal ?? null;
+      resolve({
+        outcome: timedOut ? "timed-out" : exitCode === 0 && signal === null ? "passed" : "failed",
+        exitCode,
+        signal,
+        output,
+        outputTruncated: omittedOutputChars > 0,
+        omittedOutputChars,
+        startedAtMs,
+        finishedAtMs: Math.max(now(), startedAtMs)
+      });
+    };
+    fail = (error) => {
+      if (settled) return;
+      settled = true;
+      for (const timer of timers) clearTimeout(timer);
+      reject(error);
+    };
+  });
+  result.catch(() => void 0);
+  scheduleTimer(() => {
+    if (exitRecord !== null) return;
+    timedOut = true;
+    escalate();
+    scheduleTimer(settle, termGraceMs + SETTLE_FAILSAFE_SLACK_MS);
+  }, timeoutMs);
+  child.on("error", (error) => {
+    fail(
+      new ValidationRunnerError(
+        "VALIDATION_SPAWN_FAILED",
+        "The validation shell could not be started",
+        { cause: error }
+      )
+    );
+  });
+  child.on("exit", (code, signal) => {
+    exitRecord = { code, signal };
+    if (!timedOut && !disposed) {
+      escalate();
+    }
+    scheduleTimer(settle, termGraceMs + SETTLE_FAILSAFE_SLACK_MS);
+  });
+  child.on("close", () => {
+    if (!groupIsAlive()) settle();
+  });
+  return {
+    result,
+    async dispose() {
+      if (!settled) {
+        disposed = true;
+        escalate();
+        scheduleTimer(settle, termGraceMs + SETTLE_FAILSAFE_SLACK_MS);
+      }
+      await result.catch(() => void 0);
+    }
+  };
+}
+export {
+  DEFAULT_VALIDATION_MAX_OUTPUT_CHARS,
+  DEFAULT_VALIDATION_TIMEOUT_MS,
+  MAX_VALIDATION_COMMAND_CHARS,
+  MAX_VALIDATION_TIMEOUT_MS,
+  ValidationRunnerError,
+  isValidationRunnerError,
+  startValidationRun
+};

package/dist/packages/git/src/worktree.js

@@ -0,0 +1,233 @@
+// packages/git/src/worktree.ts
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import {
+  GitServiceError,
+  GitWorktreeIncompleteError,
+  boundedDetailText
+} from "./errors.js";
+import { canonicalPathForms, requireAbsolutePath } from "./paths.js";
+import {
+  COMMIT_SHA_PATTERN,
+  inspectRepository
+} from "./repository.js";
+import {
+  defaultGitRunner,
+  runGitExpectingSuccess
+} from "./runner.js";
+function containsControlCharacters(value) {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function validateBranchInput(branch) {
+  const reject = (reason) => {
+    throw new GitServiceError("GIT_INVALID_BRANCH_NAME", `Invalid branch name: ${reason}`, {
+      details: { branch: boundedDetailText(branch, 120) }
+    });
+  };
+  if (branch.length === 0) reject("name is empty");
+  if (branch.startsWith("-")) reject("name must not start with '-'");
+  if (containsControlCharacters(branch)) reject("name contains control characters");
+}
+function validateBaseRefInput(baseRef) {
+  const reject = (reason) => {
+    throw new GitServiceError("GIT_INVALID_BASE_REF", `Invalid base ref: ${reason}`, {
+      details: { baseRef: boundedDetailText(baseRef, 120) }
+    });
+  };
+  if (baseRef.length === 0) reject("ref is empty");
+  if (baseRef.startsWith("-")) reject("ref must not start with '-'");
+  if (containsControlCharacters(baseRef)) reject("ref contains control characters");
+}
+function validateWorktreeTargetPath(worktreePath) {
+  requireAbsolutePath(worktreePath, "worktree path");
+  if (path.resolve(worktreePath) !== worktreePath) {
+    throw new GitServiceError(
+      "GIT_PATH_NOT_NORMALIZED",
+      "Worktree path must be normalized (no '.', '..', repeated or trailing separators)",
+      { details: { path: worktreePath } }
+    );
+  }
+  return worktreePath;
+}
+function parseWorktreeListPaths(porcelainZ) {
+  return porcelainZ.split("\0").filter((token) => token.startsWith("worktree ")).map((token) => token.slice("worktree ".length));
+}
+async function isWorktreePathRegistered(runner, repositoryRoot, worktreePath) {
+  const list = await runGitExpectingSuccess(runner, ["worktree", "list", "--porcelain", "-z"], {
+    cwd: repositoryRoot
+  });
+  const targetForms = new Set(await canonicalPathForms(worktreePath));
+  for (const listed of parseWorktreeListPaths(list.stdout)) {
+    for (const form of await canonicalPathForms(listed)) {
+      if (targetForms.has(form)) return true;
+    }
+  }
+  return false;
+}
+async function branchExists(runner, repositoryRoot, branch) {
+  const result = await runner(["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+    cwd: repositoryRoot
+  });
+  if (result.exitCode === 0) return true;
+  if (result.exitCode === 1) return false;
+  throw new GitServiceError("GIT_COMMAND_FAILED", "git show-ref exited unexpectedly", {
+    details: { exitCode: result.exitCode, stderr: boundedDetailText(result.stderr) }
+  });
+}
+async function preflightTaskWorktree(options) {
+  const runner = options.runner ?? defaultGitRunner;
+  validateBranchInput(options.branch);
+  validateBaseRefInput(options.baseRef);
+  const worktreePath = validateWorktreeTargetPath(options.worktreePath);
+  const repository = await inspectRepository(options.repositoryPath, { runner });
+  const root = repository.root;
+  const format = await runner(["check-ref-format", `refs/heads/${options.branch}`], { cwd: root });
+  if (format.exitCode !== 0) {
+    throw new GitServiceError("GIT_INVALID_BRANCH_NAME", "Branch name is not a valid Git ref name", {
+      details: { branch: boundedDetailText(options.branch, 120) }
+    });
+  }
+  const resolved = await runner(
+    ["rev-parse", "--verify", "--quiet", "--end-of-options", `${options.baseRef}^{commit}`],
+    { cwd: root }
+  );
+  if (resolved.exitCode !== 0) {
+    throw new GitServiceError(
+      "GIT_BASE_REF_NOT_FOUND",
+      "Base ref does not resolve to a commit in this repository",
+      { details: { baseRef: boundedDetailText(options.baseRef, 120) } }
+    );
+  }
+  const baseCommit = resolved.stdout.endsWith("\n") ? resolved.stdout.slice(0, -1) : resolved.stdout;
+  if (!COMMIT_SHA_PATTERN.test(baseCommit)) {
+    throw new GitServiceError("GIT_COMMAND_FAILED", "git rev-parse returned an unexpected commit value", {
+      details: { value: boundedDetailText(baseCommit, 80) }
+    });
+  }
+  if (await branchExists(runner, root, options.branch)) {
+    throw new GitServiceError("GIT_BRANCH_EXISTS", "A local branch with this name already exists", {
+      details: { branch: options.branch }
+    });
+  }
+  let targetOnDisk = false;
+  try {
+    await lstat(worktreePath);
+    targetOnDisk = true;
+  } catch (error) {
+    const errno = error;
+    if (errno.code !== "ENOENT" && errno.code !== "ENOTDIR") {
+      throw new GitServiceError("GIT_FILESYSTEM_ERROR", "Worktree target path could not be checked", {
+        cause: error,
+        details: { path: worktreePath }
+      });
+    }
+  }
+  if (targetOnDisk) {
+    throw new GitServiceError(
+      "GIT_WORKTREE_TARGET_EXISTS",
+      "Worktree target path already exists on disk",
+      { details: { path: worktreePath } }
+    );
+  }
+  if (await isWorktreePathRegistered(runner, root, worktreePath)) {
+    throw new GitServiceError(
+      "GIT_WORKTREE_TARGET_REGISTERED",
+      "Worktree target path is already registered in git worktree list",
+      { details: { path: worktreePath } }
+    );
+  }
+  return { repository, branch: options.branch, baseCommit, worktreePath };
+}
+async function collectRecoveryFacts(runner, plan) {
+  let branchNowExists = null;
+  try {
+    branchNowExists = await branchExists(runner, plan.repository.root, plan.branch);
+  } catch {
+    branchNowExists = null;
+  }
+  let targetRegisteredAsWorktree = null;
+  try {
+    targetRegisteredAsWorktree = await isWorktreePathRegistered(
+      runner,
+      plan.repository.root,
+      plan.worktreePath
+    );
+  } catch {
+    targetRegisteredAsWorktree = null;
+  }
+  let targetExistsOnDisk = null;
+  try {
+    await lstat(plan.worktreePath);
+    targetExistsOnDisk = true;
+  } catch (error) {
+    const errno = error;
+    targetExistsOnDisk = errno.code === "ENOENT" || errno.code === "ENOTDIR" ? false : null;
+  }
+  return {
+    branch: plan.branch,
+    worktreePath: plan.worktreePath,
+    baseCommit: plan.baseCommit,
+    branchExists: branchNowExists,
+    targetRegisteredAsWorktree,
+    targetExistsOnDisk
+  };
+}
+async function createTaskWorktree(options) {
+  const runner = options.runner ?? defaultGitRunner;
+  const plan = await preflightTaskWorktree({ ...options, runner });
+  let addOutcome = null;
+  let addFailure = null;
+  try {
+    addOutcome = await runner(
+      ["worktree", "add", "-b", plan.branch, plan.worktreePath, plan.baseCommit],
+      { cwd: plan.repository.root }
+    );
+  } catch (error) {
+    addFailure = error;
+  }
+  if (addOutcome === null || addOutcome.exitCode !== 0) {
+    const facts = await collectRecoveryFacts(runner, plan);
+    throw new GitWorktreeIncompleteError(
+      "git worktree add failed; nothing was cleaned up automatically",
+      facts,
+      { cause: addFailure ?? void 0 }
+    );
+  }
+  try {
+    const worktree = await inspectRepository(plan.worktreePath, { runner });
+    const canonicalTarget = await realpath(plan.worktreePath);
+    if (worktree.root !== canonicalTarget) {
+      throw new Error("created worktree root does not match the requested target path");
+    }
+    if (worktree.branch !== plan.branch) {
+      throw new Error("created worktree is not on the requested branch");
+    }
+    if (worktree.headCommit !== plan.baseCommit) {
+      throw new Error("created worktree HEAD does not match the requested base commit");
+    }
+    if (worktree.commonDir !== plan.repository.commonDir) {
+      throw new Error("created worktree does not belong to the requested repository");
+    }
+    return {
+      repository: plan.repository,
+      branch: plan.branch,
+      baseCommit: plan.baseCommit,
+      worktree
+    };
+  } catch (error) {
+    const facts = await collectRecoveryFacts(runner, plan);
+    throw new GitWorktreeIncompleteError(
+      "created worktree failed post-verification; nothing was cleaned up automatically",
+      facts,
+      { cause: error }
+    );
+  }
+}
+export {
+  createTaskWorktree,
+  preflightTaskWorktree
+};

package/dist/packages/pi-bridge/extensions/pita-policy.js

@@ -0,0 +1,117 @@
+// packages/pi-bridge/extensions/pita-policy.ts
+import {
+  PITA_POLICY_PROTOCOL,
+  PITA_POLICY_STATUS_KEY,
+  PITA_POLICY_VERSION,
+  encodePolicyStatus
+} from "../src/handshake.js";
+import {
+  MAX_POLICY_APPROVAL_SUMMARY_CHARS,
+  MAX_POLICY_APPROVAL_TIMEOUT_MS,
+  PITA_POLICY_APPROVAL_TITLE,
+  encodePolicyApproval,
+  sanitizeApprovalDisplayText
+} from "../src/policy-approval.js";
+var ROUTINE_READ_ONLY_TOOL_NAMES = /* @__PURE__ */ new Set(["read", "grep", "find", "ls"]);
+var DEFAULT_CONFIRM_TIMEOUT_MS = 12e4;
+function resolveRuntimeMode(env) {
+  return env["PITA_RUNTIME_MODE"] === "trusted" ? "trusted" : "supervised";
+}
+function resolveConfirmTimeoutMs(env) {
+  const raw = env["PITA_POLICY_CONFIRM_TIMEOUT_MS"];
+  if (raw === void 0) return DEFAULT_CONFIRM_TIMEOUT_MS;
+  const parsed = Number(raw);
+  return Number.isSafeInteger(parsed) && parsed > 0 && parsed <= MAX_POLICY_APPROVAL_TIMEOUT_MS ? parsed : DEFAULT_CONFIRM_TIMEOUT_MS;
+}
+function describeToolCall(toolName, input) {
+  if (toolName === "bash" && typeof input === "object" && input !== null) {
+    const command = input["command"];
+    if (typeof command === "string") {
+      return `Run bash command:
+${sanitizeApprovalDisplayText(command)}`;
+    }
+  }
+  if ((toolName === "write" || toolName === "edit") && typeof input === "object" && input !== null) {
+    const args = input;
+    const path = args["path"];
+    if (typeof path === "string") {
+      const heading = `${toolName === "write" ? "Write" : "Edit"} file:
+${sanitizeApprovalDisplayText(path)}`;
+      const lines = (value, prefix) => sanitizeApprovalDisplayText(value).split("\n").map((line) => `${prefix}${line}`).join("\n");
+      if (toolName === "write" && typeof args.content === "string") return `${heading}
+
+Proposed file contents:
+${lines(args.content, "+ ")}`;
+      const replacements = Array.isArray(args.edits) ? args.edits : [args];
+      const previews = replacements.flatMap((edit) => {
+        if (!edit || typeof edit !== "object") return [];
+        const replacement = edit;
+        return typeof replacement.oldText === "string" && typeof replacement.newText === "string" ? [`${lines(replacement.oldText, "- ")}
+${lines(replacement.newText, "+ ")}`] : [];
+      });
+      return previews.length ? `${heading}
+
+Proposed replacements (\u2212 before, + after):
+${previews.join("\n\n")}` : heading;
+    }
+  }
+  return `Run tool "${sanitizeApprovalDisplayText(toolName)}"`;
+}
+function pitaPolicyExtension(pi) {
+  const mode = resolveRuntimeMode(process.env);
+  const confirmTimeoutMs = resolveConfirmTimeoutMs(process.env);
+  pi.on("session_start", async (_event, ctx) => {
+    ctx.ui.setStatus(
+      PITA_POLICY_STATUS_KEY,
+      encodePolicyStatus({
+        protocol: PITA_POLICY_PROTOCOL,
+        version: PITA_POLICY_VERSION,
+        mode
+      })
+    );
+  });
+  pi.on("tool_call", async (event, ctx) => {
+    if (mode === "trusted") return void 0;
+    if (ROUTINE_READ_ONLY_TOOL_NAMES.has(event.toolName)) return void 0;
+    try {
+      const summary = describeToolCall(event.toolName, event.input);
+      const displayToolName = sanitizeApprovalDisplayText(event.toolName);
+      if (summary.length > MAX_POLICY_APPROVAL_SUMMARY_CHARS || displayToolName.length > 200) {
+        const reason = `Pita blocked ${displayToolName}: the action description is too large for a safe approval. Split it into smaller tool calls.`;
+        ctx.ui.notify(reason, "warning");
+        return { block: true, reason };
+      }
+      const requestedAtMs = Date.now();
+      const confirmed = await ctx.ui.confirm(
+        PITA_POLICY_APPROVAL_TITLE,
+        encodePolicyApproval({
+          toolCallId: event.toolCallId,
+          toolName: displayToolName,
+          summary,
+          requestedAtMs,
+          timeoutMs: confirmTimeoutMs
+        }),
+        { timeout: confirmTimeoutMs }
+      );
+      if (confirmed !== true) {
+        return {
+          block: true,
+          reason: `Pita blocked ${event.toolName}: approval was denied, cancelled, or timed out`
+        };
+      }
+      return void 0;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        block: true,
+        reason: `Pita blocked ${event.toolName}: approval UI failed (${message})`
+      };
+    }
+  });
+}
+export {
+  pitaPolicyExtension as default,
+  describeToolCall,
+  resolveConfirmTimeoutMs,
+  resolveRuntimeMode
+};

package/dist/packages/pi-bridge/src/auth.js

@@ -0,0 +1,80 @@
+// packages/pi-bridge/src/auth.ts
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+function createPiAuthManager(options = {}) {
+  let runtimePromise = null;
+  function runtime() {
+    if (runtimePromise === null) {
+      const created = options.createModelRuntime?.() ?? ModelRuntime.create({ refreshOnCreate: false });
+      runtimePromise = created;
+      void created.catch(() => {
+        if (runtimePromise === created) runtimePromise = null;
+      });
+    }
+    return runtimePromise;
+  }
+  return {
+    async listProviders() {
+      const modelRuntime = await runtime();
+      const providers = await Promise.all(
+        modelRuntime.getProviders().map(async (provider) => {
+          const methods = [];
+          if (typeof provider.auth.apiKey?.login === "function") {
+            methods.push({ type: "api_key", label: provider.auth.apiKey.name });
+          }
+          if (provider.auth.oauth !== void 0) {
+            methods.push({
+              type: "oauth",
+              label: provider.auth.oauth.loginLabel ?? provider.auth.oauth.name
+            });
+          }
+          try {
+            const auth = await modelRuntime.checkAuth(provider.id);
+            if (auth === void 0 && methods.length === 0) return null;
+            const models = auth === void 0 ? [] : (await modelRuntime.getAvailable(provider.id)).map((model) => ({
+              id: model.id,
+              provider: model.provider,
+              name: model.name,
+              reasoning: model.reasoning
+            }));
+            return {
+              id: provider.id,
+              name: provider.name,
+              authenticated: auth !== void 0,
+              ...auth?.source === void 0 ? {} : { source: auth.source },
+              ...auth === void 0 ? {} : { authType: auth.type },
+              methods,
+              models
+            };
+          } catch {
+            return methods.length === 0 ? null : {
+              id: provider.id,
+              name: provider.name,
+              authenticated: false,
+              methods,
+              models: []
+            };
+          }
+        })
+      );
+      return providers.filter((provider) => provider !== null).sort((left, right) => left.name.localeCompare(right.name));
+    },
+    async hasAuth(providerId) {
+      return await (await runtime()).checkAuth(providerId) !== void 0;
+    },
+    async login(providerId, method, interaction) {
+      const modelRuntime = await runtime();
+      const provider = modelRuntime.getProviders().find((candidate) => candidate.id === providerId);
+      if (provider === void 0) {
+        throw new Error(`Pi provider ${providerId} is not installed.`);
+      }
+      const supported = method === "api_key" ? typeof provider.auth.apiKey?.login === "function" : provider.auth.oauth !== void 0;
+      if (!supported) {
+        throw new Error(`Pi provider ${providerId} does not support ${method} login.`);
+      }
+      await modelRuntime.login(providerId, method, interaction);
+    }
+  };
+}
+export {
+  createPiAuthManager
+};