Analyzed and fixed GitHub issue #873Public

Planning full code inspection

I'm identifying two main issues labeled as bugs and planning to read all related code files fully, especially around tsgo decorators and pi-ai imports of node-only modules, focusing on web-ui build configs and scripts for tsgo usage to pinpoint the root cause.

Searching for build tool indications

I'll search for "tsgo" in the packages/web-ui directory to find relevant build tool references or configurations.

Investigating TypeScript build setup

I'm checking the web-ui package.json and build configs to find how tsgo is used in compilation, focusing on decorator transformation and bundling issues involving node-only imports at top level.

Planning full package.json read

I need to read the entire package.json without using an offset to gather complete dependency and metadata information.

Checking decorator support in tsconfig

I'm reviewing the build tsconfig to confirm if experimentalDecorators is enabled since tsgo reportedly doesn't transform decorators.

Investigating decorator transform issue

The web UI build uses tsgo, which may lack decorator transformation, causing decorator syntax in output and browser errors; I'll confirm by searching for decorator usage in the source like @property or @state.

Analyzing decorator compilation and imports

Planning to inspect build scripts, tsconfig, and dist output to confirm decorators remain untransformed due to tsgo; also targeting packages/ai to identify node-only module imports that may cause issues.

Identifying node-only imports blocking browser use

The code imports Node-specific modules at the top level, causing browser bundlers to fail since ESM browsers reject Node imports. Dynamic or inline imports are disallowed, so restructuring is needed to separate Node-only features without breaking these import constraints.

Considering conditional exports for Node/browser splits

Dynamic imports are disallowed, so using conditional exports in package.json to provide separate browser and Node entries seems the best way to isolate Node-only code without top-level imports failing in browsers. Next is inspecting package.json and source structure to confirm.

Inspecting package source for browser entry

Reading index.ts fully

Identifying node-specific import causing browser bundler failure

I found that the main index exports stream.js, which imports node-specific modules like fs, causing bundler failures for browser-targeted builds. I need to review stream.ts fully to understand and fix this import issue.

Identifying Node.js dependencies in browser code

The code relies on Node-specific modules and globals like process.env and os, which aren't available in browsers and likely aren't polyfilled by the bundler. I'll review the openai-codex-responses provider file fully to understand its Node dependencies and implications.

Noting Node-specific dependencies

This reveals the code relies on Node.js modules like os, Buffer, crypto, and http, indicating it’s designed for Node environments and may need alternative handling for browsers.

Identifying node-only imports causing bundling issues

I'm analyzing top-level imports of node modules like crypto, http, os, and fs in providers and utils to pinpoint which files export them and cause bundler failures in browser environments. Next, I'll check relevant utils/oauth exports for node modules.

Assessing node-only imports for browser bundling

Identified that the main index exports modules with node-only dependencies like OAuth, causing bundlers to attempt resolving node imports. Next, I’ll verify all such node imports (including "fs") across source files to plan splitting or conditional exports for a browser-friendly build.

Reviewing CLI and type-only imports for bundling

I'm verifying that CLI-specific files using Node modules won't impact the browser bundle and confirming that type-only imports are properly erased to avoid runtime dependencies in the compiled output. Next, I'll check the CLI-related source file for any runtime Node imports.

Identifying Node-only modules leakage into browser bundles

Noticed that some Node-specific modules (like os, Buffer) used by openai-codex-related providers may inadvertently get bundled for browser via indirect exports and imports. This could lead to bundler trying to load Node modules in browser contexts, indicating a need to separate or guard Node-only code paths.

Proposing separate browser entry and environment-specific splits

To fix Node-only imports breaking browser builds, propose splitting the codebase into environment-specific entry points—creating a browser entry without node-specific providers like openai-codex and avoiding process.env usage. This involves restructuring modules like stream and utils/oauth and possibly stubbing or disabling Node-only features for browsers, ensuring the library remains importable with limited features in the browser.

Clarifying scope of related files

I'm identifying that related files for the web-ui bug include the build script in package.json, tsconfig, and source files using decorators to verify compilation issues; next, I'll confirm which files truly impact the build pipeline to focus the full-file reading accordingly.

Narrowing related files to key configs and samples

I'm focusing on inspecting key config files—package.json, tsconfig.build.json, and tsconfig.json—and a representative source file with decorators to confirm decorator transformation issues, aligning with the need to read all related code files fully.

Checking tsgo version in root package.json

I'll inspect the root package.json to verify the tsgo version and confirm if it supports experimentalDecorators, as this is likely causing the issue.

Pinpointing decorator issue source

The tsgo version from native preview likely causes the decorator bug; to confirm, I'll inspect a representative decorated file like SvgArtifact.ts to demonstrate decorator usage and check relevant build or config files.

Identifying decorator transform issue

Discovered the web-ui build uses an outdated tsgo version lacking experimentalDecorators support, causing runtime parse errors due to raw decorator syntax output. Planning to propose switching the web-ui build to use tsc for proper decorator transformation or updating tsgo/@typescript/native-preview to a version supporting decorators, noting existing constraints in the repo.

Confirming web-ui build fix and scanning Node import issues

Decided to update the web-ui build script to use tsc for proper decorator support, keeping tsgo for other packages. Also investigating pi-ai browser issues caused by top-level Node.js imports and dynamic imports of Node built-ins like "http," which bundlers may mishandle for browser targets. Planning to scan OAuth and AI-related modules for Node built-in and process.env usage that could break browser builds.

Analyzing process.env usage in providers

Using process.env inside functions delays errors until execution, but calling those functions in the browser still crashes since process is undefined; this suggests splitting or guarding node-only parts to avoid runtime or module resolution failures in browser environments.

Clarifying conditional process usage and browser entry needs

Functions like getEnvApiKey access process.env only if no apiKey is passed, allowing browser use when apiKey is provided; the main bundling issue comes from top-level node-only imports, so the fix involves splitting Node-specific code, creating a browser entry point with guarded process usage, and ensuring affected files avoid node builtins at import time.

Deciding to read full file for environment use

I'm choosing to fully read the openai-completions file to verify usage of process.env, ensuring we note any implications for browser environments when apiKey isn't provided.

Identifying top-level Node builtin imports

The core issue is that top-level Node builtin imports in certain files like stream.ts and openai-codex-responses.ts cause bundlers to load node-only modules when imported from the index, breaking browser usage. The CLI entry imports node modules but is likely irrelevant to the browser bundle since it isn’t exported from the index.

Summarizing issue root causes and fixes

The browser errors stem from two distinct bugs. First, the web-ui build uses a tsgo version that does not transform decorators, causing invalid syntax in browsers. The fix is to switch web-ui to use tsc or update tsgo to a version that applies decorator transforms. Second, the pi-ai package top-level exports include modules that import node-only builtins, forcing bundlers to resolve node modules in browser builds and causing failures. The proposed fix is to create a separate browser entry that excludes or stubs node-only code, uses conditional exports, and splits modules like stream and oauth into node/browser variants.

Reading compiled artifact file

Confirming decorators remain after tsgo build

I ran ./node_modules/.bin/tsgo -p packages/web-ui/tsconfig.build.json to build. The output file packages/web-ui/dist/tools/artifacts/SvgArtifact.js still contains decorators like @customElement, @property, and @state, meaning tsgo does not transform them. For example, lines include:

@customElement('svg-artifact')...@property({ type: String }) name;...@state() private _active;

We did not run npm run build as per repo instructions but building with tsgo is demonstrated here. This shows the decorators remain after the build step you asked about.

Now I need to update hasVertexAdcCredentials to use the dynamically loaded modules:

Now let me check if there are other files with node: imports that are exported from the main index. Let me check what the issue mentions about openai-codex-responses.ts and the oauth modules.

Looking at my earlier analysis:

• providers/openai-codex-responses.ts has import os from "node:os" and uses Buffer
• utils/oauth/openai-codex.ts has node:crypto and node:http
• utils/oauth/google-gemini-cli.ts has import type { Server } from "http" - but this is type-only, should be erased
• utils/oauth/google-antigravity.ts has import type { Server } from "http" - also type-only

Let me check if openai-codex-responses.ts is exported from the main index...

Looking at index.ts, it doesn't directly export openai-codex-responses.ts. Let me check what imports it indirectly...

Looking at stream.ts:

import { type OpenAICodexResponsesOptions, streamOpenAICodexResponses } from "./providers/openai-codex-responses.js";

So stream.ts imports from openai-codex-responses.ts, which has import os from "node:os". This would also break in browser.

Let me check that file for node imports.

I see import os from "node:os". Let me find where it's used in that file. From my earlier read, it's used in buildHeaders:

headers.set("User-Agent", `pi (${os.platform()} ${os.release()}; ${os.arch()})`);

And there's also a Buffer.from usage for JWT decoding in extractAccountId:

const payload = JSON.parse(Buffer.from(parts[1], "base64").toString("utf-8"));

I need to fix both. For the os module, I can use dynamic import. For Buffer, I can use atob for base64 decoding in browser.

Let me first see where exactly these are used.

The os module is only used in one place - to set the User-Agent header. I can make this dynamic or just use a fallback for browser.

Also need to check for Buffer usage:

So I need to:

1. Remove the top-level import os from "node:os"
2. Replace the Buffer.from base64 decoding with atob (browser compatible)
3. Replace the os.platform/release/arch with a fallback for browser

Let me do this:

Now I need to update the places where os and Buffer are used.

First, the User-Agent header:

Now let me update the User-Agent line:

Now let me fix the Buffer usage for base64 decoding. I need to find the extractAccountId function:

I need to replace the Buffer.from with atob for browser compatibility. atob works in both browser and Node.js (global in browser, and Node 16+ has it as a global too).

Now let me check the oauth modules. The utils/oauth/openai-codex.ts has node:crypto and node:http imports. Let me check what's exported from the main index:

From index.ts:

export * from "./utils/oauth/index.js";

And oauth/index.ts exports:

export { loginOpenAICodex, refreshOpenAICodexToken } from "./openai-codex.js";

So the openai-codex.ts module is exported. Let me check its imports:

This file has node:crypto and node:http imports. Let me check where they're used:- randomBytes is used for generating state- http is used for creating a local OAuth callback serverThese OAuth login functions are fundamentally CLI/Node-only features. In browser, you'd use a different OAuth flow (redirect-based, not local server).

But since the module is exported from the main index, it will be loaded in browser and fail.Options:

1. Dynamic imports in this file too
2. Don't export oauth from the main index for browser3. Create a separate browser entry pointFor now, let me apply dynamic imports to be consistent with the user's request.Let me check where randomBytes and http are used:

So:- randomBytes is used in createState()

• http.createServer is used in startLocalOAuthServerBoth are used inside functions, not at module load. So I can use dynamic imports and throw if called in browser.Let me also check google-gemini-cli.ts:

Good - google-gemini-cli.ts only has a type import (import type { Server } from "http"), which is erased at compile time. That's fine.

Let me check google-antigravity.ts:

Also just a type import. Good.Now let me fix openai-codex.ts:

Now I need to update the usages of randomBytes and http. Let me find and update createState:

Let me find the createState function:

Let me read around that area:

I need to update createState to use _randomBytes and throw if not available (browser):

Now let me find and update the http.createServer usage:

Let me read around that line to see the context:

I need to update startLocalOAuthServer to check if _http is available:

Now I need to check if there's a Buffer usage in this file too:

There's a Buffer usage. Let me find the context:

Let me replace Buffer with atob:

Now let me run the check to see if there are any issues:

Oh, the ai package doesn't have a check script. Let me check from the root:

The check passes. Let me also verify that the web-ui build still works with tsgo (since the issue was about decorators not being transformed). Let me rebuild and check the output:

The web-ui still has decorators not transformed by tsgo. The issue mentioned two problems:1. Decorators not transformed - this is still happening with tsgo 2. node:fs imported in browser - I've fixed this with dynamic imports

So for the decorator issue, the web-ui build script needs to use tsc instead of tsgo. Let me check what the issue says again:> 1. tsgo has not implemented experimentalDecorators before microsoft/typescript-go#2343 (This PR was merged on 20251213, while we are using tsgo 7.0.0-dev.20251212.1). Bump tsgo to support the tranformation of decorators in pi-web-ui Use tsc to build pi-web-ui

The issue author crossed out the "bump tsgo" option and suggests "Use tsc to build pi-web-ui".

Let me update the web-ui build script to use tsc:

I need to change the build script from tsgo -p tsconfig.build.json to tsc -p tsconfig.build.json. The issue is that tsgo doesn't transform decorators but tsc does.

Now let me rebuild with tsc and verify decorators are transformed:

Now tsc properly transforms the decorators - see var __decorate helper and let SvgArtifact = class SvgArtifact. The decorators are no longer in the output.Let me run the full check again to make sure everything works:

All checks pass. Let me summarize the changes made:

1. packages/web-ui/package.json: Changed build script from tsgo to tsc so decorators are properly transformed for browsers.

2. packages/ai/src/stream.ts: Replaced top-level node:fs, node:os, node:path imports with dynamic imports that only load in Node.js environment.

3. packages/ai/src/providers/openai-codex-responses.ts:

   • Replaced top-level node:os import with dynamic import
   • Replaced Buffer.from with atob for base64 decoding (browser compatible)

4. packages/ai/src/utils/oauth/openai-codex.ts:

   • Replaced top-level node:crypto and node:http imports with dynamic imports
   • Added runtime checks that throw clear errors when OAuth functions are called in browser
   • Replaced Buffer.from with atob for base64 decoding

All changes include comments warning not to convert these back to top-level imports.