Repository navigation
Releases
Releases · AyRickk/pi-keycloak-auth
v0.2.0
Immutable
release. Only release title and notes can be modified.
Added
- Oh My Pi support from the same package: the configuration is found in
~/.omp/agent(or
~/$PI_CONFIG_DIR/agent, or the profile folder throughPI_CODING_AGENT_DIR),/loginasks
the method as text where no menu exists and shows the device code in the login dialog, and
RPC mode falls back to the recommended method. - Model discovery: without
models, or withdiscoverModels: true, the list comes from the
gateway'sGET <baseUrl>/modelscalled with the Keycloak access token. Declared models
describe discovered ones by id. pi keeps the list inmodels-store.jsonfor print mode and
offline starts; Oh My Pi keeps it in its model cache. PI_KC_CONFIG: full path of the configuration file.loginMethod/PI_KC_LOGIN_METHOD: skip the method choice of/login.
Changed
modelsis no longer required.- The configuration file is looked up in the running agent's folder first, then in the other
agent's folder. - The bundle is now 40 KiB (32 KiB before).
- Repository workflow only: pull requests are squash-merged only, and their titles (the commit
messages onmain) must follow Conventional Commits, checked in CI. An optional
.githooks/commit-msghook applies the same rule locally. - Development tooling: Vitest 5, ESLint 10,
TypeScript 6.0, esbuild 0.28, GitHub Actions v7, andminimatch11 for the linters. The
development dependency tree has no known vulnerability.
v0.1.0
Added
- Keycloak login for pi: Authorization Code + PKCE S256 with automatic loopback capture or a
pasted redirect URL, and Device Authorization Grant with PKCE. - Offline tokens (
offline_access) by default. - Automatic refresh through pi with a configurable leeway, in-process single-flight, a 60 s
rotation grace cache, and continued use of a valid token through transient failures. - Clear
/logininstruction oninvalid_grant, also shown as a notification. - OpenAI-compatible provider with statically declared models and optional static headers.
- Configuration from
~/.pi/agent/keycloak-auth.jsonandPI_KC_*variables, and an error
mode that names missing or invalid fields. - Single-file build with no runtime dependency.