feat(ai-providers): add Antigravity and Cursor OAuth providers

[JS-banana]

Problem

OpenPI currently has no Pi-native way to use an existing Google Antigravity or Cursor subscription as a provider. Users otherwise need a fork or a parallel agent/provider stack, which would bypass Pi ownership of credentials, model selection, tools, permissions, and session lifecycle.

Related: #234. Project-wide Pi baseline follow-up: #328 and #330.

Value

This adds opt-in OAuth providers at Pi's existing provider seam:

• Google Antigravity supports normal Pi tools through Cloud Code Assist.
• Cursor supports subscription-backed model discovery and chat/image conversations while remaining explicitly chat-only.
• Credentials, model selection, streaming events, cancellation, and errors stay in Pi native contracts.

Approach

• Register both providers from extensions/ai-providers/ without adding package defaults or an extension-specific setup command.
• Antigravity: OAuth + project provisioning, model discovery/routing, local licensed Google message conversion, CCA schema sanitization, daily→sandbox failover, bounded headers/error-body/SSE lifecycles, and cancellation-safe callback/manual-code login. The losing OAuth input path is actively aborted.
• Cursor: PKCE polling OAuth, Connect/protobuf over HTTP/2, model discovery, image input, proxy support, and conservative context metadata. Cursor native exec/tool and interaction-query channels fail closed instead of bypassing Pi permissions.
• Cursor transport boundaries contain peer/config decoding failures inside the provider lifecycle: malformed grpc-message trailers settle as stream errors, malformed proxy userinfo rejects before a socket callback is registered, and the caller timeout applies while CONNECT is opening while retaining the 30-second hard tunnel cap.
• Cursor's output-only tokenDelta is deliberately not published as complete usage. Pi 0.84.3+ estimates the all-Cursor history at the real AgentSession._checkCompaction entry and can trigger threshold compaction. Pi 0.84.1 retains correct unknown usage but cannot threshold-compact a session with no usage-backed response; chore(deps): define and enforce the supported Pi baseline #328 tracks the project-wide baseline decision separately.
• Cursor capability normalization preserves image input for the verified Kimi K3, Cursor Grok 4, and Composer 2.5 families. Bare composer-2.5 is explicitly pinned to the Standard lane rather than the server's Fast default.
• Pi 0.84.3's narrower SimpleStreamOptions.toolChoice type is handled locally without changing the provider implementation's compatibility surface.
• Add an exact runtime dependency on @earendil-works/pi-server@0.85.0 as a temporary downstream packaging shim for earendil-works/pi#9140. This does not change the frozen Pi development baseline or host peer ownership. chore(deps): remove the temporary pi-server compatibility dependency #395 defines the evidence required to remove the shim.
• Adapted protocol code and licenses are recorded in THIRD_PARTY_NOTICES.md.

Validation

Exact local and PR head: d3a844eec5e16c8df35853575141a29ba9c918f3, based on main at 72fbba52832841cfc78c2f7e7947eeb89efc73bc.

Pi 0.84.1 remains the frozen development host baseline. On the exact head:

• Package-contract regression: 6/6 passed, including the temporary exact pi-server dependency.
• bun run check — passed (config contract, discipline ledger, Web syntax, format, lint, TypeScript).
• bun run test — Node 1304 passed / 1 skipped across 4 suites.
• Fresh packed npm installation — installed the tarball and its runtime graph without legacy peer flags.
• Packed standalone Web CLI smoke — started successfully, served /marked.js, and shut down cleanly.

The prior exact-head Linux CI failure was isolated to a newly published upstream packaging regression: @earendil-works/pi-coding-agent@0.85.0 imports @earendil-works/pi-server during standalone Web startup but does not declare it. The temporary direct dependency fixes that fresh-install path. Exact-head GitHub CI now passes Node 22, Node 24, and Windows, including the packed standalone Web CLI smoke on both Linux jobs.

Earlier provider validation also covered:

• Pi 0.84.1 and isolated Pi 0.84.4 provider regression suites, checks, full tests, source-install discovery, offline RPC, and packed extension smoke.
• Real-account OAuth login, /model, text/multi-turn chat, and non-text input.

The current exact head has not been rerun against real Cursor/Antigravity accounts or a real proxy; those remain explicit acceptance work.

Impact

• User-visible behavior: adds opt-in google-antigravity and experimental cursor login/model choices.
• Model-visible context/tools: Antigravity uses ordinary Pi tools; Cursor injects a chat-only rule and never exposes Cursor native tools as Pi tool calls.
• Runtime/lifecycle: adds OAuth/network streaming, endpoint failover, HTTP/2 proxy handling, bounded timeouts, cancellation cleanup, defensive peer/config decoding, and explicit fail-closed terminal errors.
• Persisted config/data: Pi persists OAuth credentials and discovered model cache through native provider storage; no existing preferences are rewritten and no provider is selected by default.
• Compatibility/risk: wildcard host peers and the Pi 0.84.1 development baseline remain unchanged. The exact pi-server@0.85.0 runtime dependency is a temporary, tracked compatibility shim (chore(deps): remove the temporary pi-server compatibility dependency #395), not a baseline upgrade. Cursor server protocol is experimental and may drift. Real-account refresh/generation, region-specific Antigravity access, and real proxy E2E remain unverified on this exact head.

[tt-a1i]

Reviewed exact head 128a1d4b9ba93339e022cd864ee504c56aa47cc3.

The Pi-native provider direction is valuable, and the focused provider tests cover substantial protocol behavior. However, the standard installed-runtime acceptance currently fails on both required Linux jobs. This is a PR-introduced release blocker, not the unrelated UI fixture failure described in the PR body.

Both Node 22.19.0 and Node 24 complete the test suites, then fail after pi install "$PWD" when pi --offline --no-session --mode rpc auto-loads the new extension:

Cannot find module .../@earendil-works/pi-ai/dist/compat.js/api/google-shared

Please use a runtime-resolvable public Pi API or vendor the required licensed conversion logic locally, and add a clean-install/runtime-load regression test that proves the published package can load the provider extension. The branch is also behind current main, so required checks must be rerun after the fix and update.

[JS-banana]

已按 review 修复，当前 head 为 6a45d6b：移除了 @earendil-works/pi-ai/api/google-shared 深层运行时依赖，将所需 MIT 许可转换逻辑本地化并补充 attribution；同时把 ai-providers 加入 packed-install extension smoke。已通过 bun run check、隔离配置下完整测试（Node 1064 passed / 1 skipped，Vitest 30/30）、source install auto-load smoke 和 packed-package explicit-load smoke。烦请复审。

[tt-a1i]

已复审精确 head ea120dd4f1f7790ce8ec631226e356325fa7f03a。

之前反馈的 google-shared 深层导入导致安装后加载失败，当前版本已修复：本地隔离 Pi 配置下，pi list 唯一 OpenPI 来源为该 head 的 checkout，源码安装后的离线 RPC 自动加载通过；当前 Node 22/24 CI 的源码与打包加载 smoke 也均通过。这项旧阻塞不再重复计入。

本轮按仓库规范和功能契约分别复核，并补充本地回环 HTTP/HTTP2 对抗检查，确认 4 项需修改的问题，详见行内评论：

1. P1：Cursor 不完整的 token usage 被 Pi 当作完整上下文用量，破坏上下文估计和自动压缩阈值。
2. P2：拒绝 Cursor 原生 exec 后，仍可能向 Pi 返回成功终态。
3. P2：Antigravity 非 2xx 响应体读取绕过请求超时。
4. P2：Antigravity 在版本发现期间取消登录后，仍启动回调监听并继续等待。

验证：本地 Node v26.3.0；provider 专项 54/54；bun run check 通过；完整测试 Node 1068 passed / 1 skipped，Vitest 30/30。上述对抗检查使用假凭据和本地模拟响应，没有登录真实账号或调用实际模型。现有测试绿色不能覆盖这四条遗漏路径。

没有发现 Cursor 原生工具实际执行或权限绕过；第 2 项是失败没有正确传播到 Pi 的终态问题。原生 provider 注册、凭据归 Pi 管理的方向可以保留。

请修复并补回归测试后再复审。真实账号的登录/刷新、Antigravity 普通 Pi 工具调用、Cursor 纯聊天及取消仍需单独验收；分支落后于 main，更新后也需要新的精确 head CI。

[JS-banana]

已完成本轮 review 并更新到精确 head 9644edb07e6183b6922439487697596106acd0f8：

1. Cursor output-only token usage 不再覆盖 Pi 全历史上下文估算，并增加 provider→estimateContextTokens→压缩阈值集成回归。
2. unsupported Cursor exec 仍回协议拒绝，同时向 Pi 传播明确 error 终态，后续 turnEnded 不会变成成功。
3. Antigravity 非 2xx body 受 attempt deadline 和 64 KiB 上限约束，超时/截断会 cancel+release，并按 status failover。
4. Antigravity OAuth 在版本发现和 server bind 后检查取消，callback/manual 两侧均有有界取消与 waiter 清理。

验证：provider 58/58；bun run check；隔离配置完整测试 Node 1134 passed / 1 skipped、Vitest 30/30；source-install auto-load；packed-package explicit-load。该 head 的 GitHub Node 22.19、Node 24、Windows 检查也已全部通过，分支已与最新 main 对齐。PR 描述已按 Problem / Value / Approach / Validation / Impact 模板重写并明确真实账号 E2E 缺口。烦请复审。

[tt-a1i]

复审 exact head 9644edb07e6183b6922439487697596106acd0f8。Pi-native provider 方向可保留。此前4项问题中，Cursor拒绝exec后明确失败、Antigravity错误响应body有界读取、版本发现阶段取消OAuth三项已有实质修复，本次不重复计入。

Standards

注册、权限和配置入口没有新增确认违规。独立审查另发现条件性提示：自定义fetch提供的ReadableStream若cancel()永不结束，错误body读取finally仍会等待；仅mock transport复现，未证明原生fetch受影响，本次不将其算作新增阻塞。

Spec

仍有1项P2：Cursor usage全部置零后，Pi能估算上下文展示，但纯Cursor新会话没有lastUsageIndex，当前Pi 0.84.1真实阈值压缩入口会提前返回false。因此PR正文声称的context/compaction fallback仍不完整；详见行内。

验证：check通过，provider专项58/58；使用当前checkout依赖直接调用真实AgentSession.prototype._checkCompaction，800000字符输入+当前全零usage格式响应，estimate.tokens=200001、lastUsageIndex=null、compactCalls=0。没有修改Pi方法或替换其判断。全套并行尝试发生setup集成子进程超时，不能记为全套通过。日常pi list仍唯一指向openpi-main-runtime，本轮结论来自精确源码和依赖测试，不冒充该PR已安装验收；未登录真实账号、调用真实模型或验收代理E2E。

请补真实Pi压缩入口的回归，并按Pi支持的usage/压缩契约解决或明确修订支持边界；不要伪造计费usage，也不要另造一套压缩生命周期。

[tt-a1i]

当前 head 9644edb 已复审：旧4项中3项修复；剩下 Cursor 全零usage导致纯Cursor会话不进入Pi阈值压缩。真实Pi入口复现已确认，详见 #269 (review) 。check和58项provider专项通过；真实账号E2E仍未验收。本轮未改代码或合并。

[JS-banana]

The project-wide Pi baseline follow-up is now #330, which will close #328 when merged. PR #269 remains dependency-clean: its provider code covers the supported behavior boundaries, while #330 owns the repository-wide package.json / bun.lock, documentation, and Pi baseline policy.

[tt-a1i]

Reviewed exact head 98257aa. This PR adds useful opt-in Antigravity and Cursor OAuth providers and the prior review items are addressed, but three confirmed Cursor transport boundaries still need fixes before merge: malformed server trailers can escape as an uncaught exception, the caller timeout does not cover proxy tunnel setup, and malformed proxy credentials can also escape the tunnel promise. I reproduced all three locally. Targeted provider tests, bun run check, the full Node suite, and Vitest are green; the missing regression coverage is called out inline. The PR branch is also behind main, and the validation head recorded in the PR body is stale, so please update the branch and rerun validation on the resulting exact head after these fixes.

[tt-a1i]

Exact-head CI diagnosis for b6dfde017b99da5f00ec02e53b4754d4706770b7: both Linux jobs pass check, the full test suite, source-install discovery, and the packed provider smoke, then fail only when the packed standalone Web CLI resolves today’s new @earendil-works/pi-coding-agent@0.85.0. That package imports @earendil-works/pi-server from dist/experimental/server.js but does not declare it as a dependency. I reproduced the fresh-install failure locally; installing @earendil-works/pi-server@0.85.0 separately makes the identical Web smoke pass. This is independently reported at earendil-works/pi#9140. I have not hidden the failure or weakened the smoke; the PR body now records the boundary.

[tt-a1i]

Pushed d3a844e to unblock the packed standalone Web CLI without waiting for the upstream release.

The change adds an exact runtime dependency on @earendil-works/pi-server@0.85.0, plus a package-contract regression assertion. This is deliberately a temporary downstream compatibility shim for earendil-works/pi#9140, not a Pi baseline upgrade or a change to host peer ownership.

Removal is tracked in #395 with explicit gates: verify the published upstream package metadata, rerun a fresh packed npm install without the shim, and require Node 22/24 exact-head CI to pass before deleting it.

Exact-head local evidence:

• bun run check passed;
• bun run test: 1304 passed, 1 platform skip;
• fresh packed npm install passed;
• packed standalone Web CLI started and served /marked.js successfully.

GitHub CI is now running on the pushed head.

[tt-a1i]

Reviewed exact head d3a844eec5e16c8df35853575141a29ba9c918f3 after the downstream packaging fix.

The temporary pi-server@0.85.0 dependency is narrowly scoped, regression-tested, and has an explicit removal tracker in #395. Local check/full tests and the packed standalone Web smoke pass. Exact-head Node 22, Node 24, and Windows CI are green. The previously requested provider and transport changes are resolved.