feat(ai-providers): add Antigravity and Cursor OAuth providers

[JS-banana]

Problem

OpenPI currently has no Pi-native way to use an existing Google Antigravity or Cursor subscription as a provider. Users otherwise need a fork or a parallel agent/provider stack, which would bypass Pi ownership of credentials, model selection, tools, permissions, and session lifecycle.

Related: #234. Project-wide Pi baseline follow-up: #328 and #330.

Value

This adds opt-in OAuth providers at Pi's existing provider seam:

• Google Antigravity supports normal Pi tools through Cloud Code Assist.
• Cursor supports subscription-backed model discovery and chat/image conversations while remaining explicitly chat-only.
• Credentials, model selection, streaming events, cancellation, and errors stay in Pi native contracts.

Approach

• Register both providers from extensions/ai-providers/ without adding package defaults or an extension-specific setup command.
• Antigravity: OAuth + project provisioning, model discovery/routing, local licensed Google message conversion, CCA schema sanitization, daily→sandbox failover, bounded headers/error-body/SSE lifecycles, and cancellation-safe callback/manual-code login. The losing OAuth input path is actively aborted.
• Cursor: PKCE polling OAuth, Connect/protobuf over HTTP/2, model discovery, image input, proxy support, and conservative context metadata. Cursor native exec/tool and interaction-query channels fail closed instead of bypassing Pi permissions.
• Cursor's output-only tokenDelta is deliberately not published as complete usage. Pi 0.84.3+ estimates the all-Cursor history at the real AgentSession._checkCompaction entry and can trigger threshold compaction. Pi 0.84.1 retains correct unknown usage but cannot threshold-compact a session with no usage-backed response; chore(deps): define and enforce the supported Pi baseline #328 tracks the project-wide baseline decision separately.
• Cursor capability normalization now preserves image input for the verified Kimi K3, Cursor Grok 4, and Composer 2.5 families. Bare composer-2.5 is explicitly pinned to the Standard lane rather than the server's Fast default.
• Pi 0.84.3's narrower SimpleStreamOptions.toolChoice type is handled locally without changing this PR's package manifest or lockfile.
• Adapted protocol code and licenses are recorded in THIRD_PARTY_NOTICES.md.

Validation

Exact local head: 12d9c43d145819dae7010aeb52e7d8827cd2e83e.

Pi 0.84.1 (the current frozen lock):

• bun install --frozen-lockfile — installed Pi 0.84.1.
• Provider regression suite — 59/59 passed, including the real compaction entry, unsupported Cursor exec terminal error, Cursor image-family metadata and Standard lane, stalled/oversized Antigravity error bodies, OAuth cancellation during discovery, and callback/manual-prompt loser cleanup.
• bun run check — passed (config contract, discipline ledger, format, lint, TypeScript).
• Isolated PI_CODING_AGENT_DIR + bun run test — Node 1173 passed / 1 skipped; Vitest 30/30.
• Source-install discovery/offline RPC and packed-install-without-optional-peers smoke — passed.

Pi 0.84.4 (isolated latest-compatible install; no tracked dependency changes):

• Provider regression suite — 59/59 passed.
• bun run check — passed.
• Isolated PI_CODING_AGENT_DIR + bun run test — Node 1173 passed / 1 skipped; Vitest 30/30.
• Source-install discovery/offline RPC and packed-install-without-optional-peers smoke — passed.

git diff upstream/main -- package.json bun.lock is empty: dependency/baseline changes are intentionally excluded from this feature PR.

Earlier real-account evidence covered OAuth login, /model, text/multi-turn chat, and non-text input. The current exact head changes lifecycle/error/model-metadata boundaries and has not been rerun against real Cursor/Antigravity accounts; that remains explicit acceptance work.

Impact

• User-visible behavior: adds opt-in google-antigravity and experimental cursor login/model choices.
• Model-visible context/tools: Antigravity uses ordinary Pi tools; Cursor injects a chat-only rule and never exposes Cursor native tools as Pi tool calls.
• Runtime/lifecycle: adds OAuth/network streaming, endpoint failover, HTTP/2 proxy handling, bounded timeouts, cancellation cleanup, and explicit fail-closed terminal errors.
• Persisted config/data: Pi persists OAuth credentials and discovered model cache through native provider storage; no existing preferences are rewritten and no provider is selected by default.
• Compatibility/risk: this PR leaves wildcard host peers and the Pi 0.84.1 frozen lock unchanged; the 0.84.1 compaction limitation is explicit, while chore(deps): update and align supported Pi baseline to 0.84.4 (#328) #330 separately raises the project support floor and the feature remains verified on 0.84.1 and 0.84.4. Cursor server protocol is experimental and may drift. Real-account refresh/generation, region-specific Antigravity access, and real proxy E2E remain unverified on this exact head.

[tt-a1i]

Reviewed exact head 128a1d4b9ba93339e022cd864ee504c56aa47cc3.

The Pi-native provider direction is valuable, and the focused provider tests cover substantial protocol behavior. However, the standard installed-runtime acceptance currently fails on both required Linux jobs. This is a PR-introduced release blocker, not the unrelated UI fixture failure described in the PR body.

Both Node 22.19.0 and Node 24 complete the test suites, then fail after pi install "$PWD" when pi --offline --no-session --mode rpc auto-loads the new extension:

Cannot find module .../@earendil-works/pi-ai/dist/compat.js/api/google-shared

Please use a runtime-resolvable public Pi API or vendor the required licensed conversion logic locally, and add a clean-install/runtime-load regression test that proves the published package can load the provider extension. The branch is also behind current main, so required checks must be rerun after the fix and update.

[JS-banana]

已按 review 修复，当前 head 为 6a45d6b：移除了 @earendil-works/pi-ai/api/google-shared 深层运行时依赖，将所需 MIT 许可转换逻辑本地化并补充 attribution；同时把 ai-providers 加入 packed-install extension smoke。已通过 bun run check、隔离配置下完整测试（Node 1064 passed / 1 skipped，Vitest 30/30）、source install auto-load smoke 和 packed-package explicit-load smoke。烦请复审。

[tt-a1i]

已复审精确 head ea120dd4f1f7790ce8ec631226e356325fa7f03a。

之前反馈的 google-shared 深层导入导致安装后加载失败，当前版本已修复：本地隔离 Pi 配置下，pi list 唯一 OpenPI 来源为该 head 的 checkout，源码安装后的离线 RPC 自动加载通过；当前 Node 22/24 CI 的源码与打包加载 smoke 也均通过。这项旧阻塞不再重复计入。

本轮按仓库规范和功能契约分别复核，并补充本地回环 HTTP/HTTP2 对抗检查，确认 4 项需修改的问题，详见行内评论：

1. P1：Cursor 不完整的 token usage 被 Pi 当作完整上下文用量，破坏上下文估计和自动压缩阈值。
2. P2：拒绝 Cursor 原生 exec 后，仍可能向 Pi 返回成功终态。
3. P2：Antigravity 非 2xx 响应体读取绕过请求超时。
4. P2：Antigravity 在版本发现期间取消登录后，仍启动回调监听并继续等待。

验证：本地 Node v26.3.0；provider 专项 54/54；bun run check 通过；完整测试 Node 1068 passed / 1 skipped，Vitest 30/30。上述对抗检查使用假凭据和本地模拟响应，没有登录真实账号或调用实际模型。现有测试绿色不能覆盖这四条遗漏路径。

没有发现 Cursor 原生工具实际执行或权限绕过；第 2 项是失败没有正确传播到 Pi 的终态问题。原生 provider 注册、凭据归 Pi 管理的方向可以保留。

请修复并补回归测试后再复审。真实账号的登录/刷新、Antigravity 普通 Pi 工具调用、Cursor 纯聊天及取消仍需单独验收；分支落后于 main，更新后也需要新的精确 head CI。

[JS-banana]

已完成本轮 review 并更新到精确 head 9644edb07e6183b6922439487697596106acd0f8：

1. Cursor output-only token usage 不再覆盖 Pi 全历史上下文估算，并增加 provider→estimateContextTokens→压缩阈值集成回归。
2. unsupported Cursor exec 仍回协议拒绝，同时向 Pi 传播明确 error 终态，后续 turnEnded 不会变成成功。
3. Antigravity 非 2xx body 受 attempt deadline 和 64 KiB 上限约束，超时/截断会 cancel+release，并按 status failover。
4. Antigravity OAuth 在版本发现和 server bind 后检查取消，callback/manual 两侧均有有界取消与 waiter 清理。

验证：provider 58/58；bun run check；隔离配置完整测试 Node 1134 passed / 1 skipped、Vitest 30/30；source-install auto-load；packed-package explicit-load。该 head 的 GitHub Node 22.19、Node 24、Windows 检查也已全部通过，分支已与最新 main 对齐。PR 描述已按 Problem / Value / Approach / Validation / Impact 模板重写并明确真实账号 E2E 缺口。烦请复审。

[tt-a1i]

复审 exact head 9644edb07e6183b6922439487697596106acd0f8。Pi-native provider 方向可保留。此前4项问题中，Cursor拒绝exec后明确失败、Antigravity错误响应body有界读取、版本发现阶段取消OAuth三项已有实质修复，本次不重复计入。

Standards

注册、权限和配置入口没有新增确认违规。独立审查另发现条件性提示：自定义fetch提供的ReadableStream若cancel()永不结束，错误body读取finally仍会等待；仅mock transport复现，未证明原生fetch受影响，本次不将其算作新增阻塞。

Spec

仍有1项P2：Cursor usage全部置零后，Pi能估算上下文展示，但纯Cursor新会话没有lastUsageIndex，当前Pi 0.84.1真实阈值压缩入口会提前返回false。因此PR正文声称的context/compaction fallback仍不完整；详见行内。

验证：check通过，provider专项58/58；使用当前checkout依赖直接调用真实AgentSession.prototype._checkCompaction，800000字符输入+当前全零usage格式响应，estimate.tokens=200001、lastUsageIndex=null、compactCalls=0。没有修改Pi方法或替换其判断。全套并行尝试发生setup集成子进程超时，不能记为全套通过。日常pi list仍唯一指向openpi-main-runtime，本轮结论来自精确源码和依赖测试，不冒充该PR已安装验收；未登录真实账号、调用真实模型或验收代理E2E。

请补真实Pi压缩入口的回归，并按Pi支持的usage/压缩契约解决或明确修订支持边界；不要伪造计费usage，也不要另造一套压缩生命周期。

[tt-a1i]

当前 head 9644edb 已复审：旧4项中3项修复；剩下 Cursor 全零usage导致纯Cursor会话不进入Pi阈值压缩。真实Pi入口复现已确认，详见 #269 (review) 。check和58项provider专项通过；真实账号E2E仍未验收。本轮未改代码或合并。

[JS-banana]

The project-wide Pi baseline follow-up is now #330, which will close #328 when merged. PR #269 remains dependency-clean: its provider code covers the supported behavior boundaries, while #330 owns the repository-wide package.json / bun.lock, documentation, and Pi baseline policy.