feat(providers): add Augment (Auggie CLI) local provider (#5972)

* feat(providers): add Augment (Auggie CLI) local provider

Adds a new local, no-auth provider that spawns the user's local `auggie`
CLI (`auggie --print --quiet --model <m> --`) and pipes a flattened prompt
via stdin, wrapping stdout as an OpenAI-compatible SSE stream or a single
chat.completion JSON body depending on the request's `stream` flag.

Auth is delegated entirely to `auggie login` outside OmniRoute — the
connection is registered `noAuth: true` and `refreshCredentials()` is a
no-op, matching the existing `NOAUTH_PROVIDERS` credential-less flow
(synthetic connection, no DB row required). An optional connection row is
still admitted via `FREE_APIKEY_PROVIDER_IDS` for display/priority
tracking, consistent with `opencode`. The dashboard "Test Connection"
flow spawns `auggie --version` to confirm the CLI is installed and
runnable, since there is no API key to validate upstream.

Security hardening (spawn is an untrusted-input sink):
- Command injection: spawn no longer passes `shell: true` on Windows. The
  binary is resolved to a concrete path/name and argv is handed straight to
  the OS loader, so no cmd.exe metacharacter interpretation is possible.
- Argument injection (flag smuggling): `model` is validated against the
  registry allowlist (`auggieProvider.models`) before any spawn — a model
  that is unknown or starts with "-" is rejected with a sanitized error and
  the subprocess is never started. A trailing `--` marks end-of-options in
  the argv as belt-and-suspenders.

Co-authored-by: chamdanilukman <16629923+chamdanilukman@users.noreply.github.com>
Inspired-by: https://github.com/decolua/9router/pull/1200

* test(golden): regenerate translate-path for auggie provider

---------

Co-authored-by: chamdanilukman <16629923+chamdanilukman@users.noreply.github.com>

src/lib/providers/validation.ts

@@ -298,6 +298,23 @@ export async function validateProviderApiKey({ provider, apiKey, providerSpecifi
       }
     },
     jules: validateJulesProvider,
+    // auggie is a fully local, credential-less CLI passthrough — there is no API
+    // key to check upstream. The only meaningful validation is confirming the
+    // `auggie` binary is installed and runnable on this machine.
+    auggie: async () => {
+      const { checkAuggieCliVersion } = await import(
+        "@omniroute/open-sse/executors/auggie.ts"
+      );
+      const result = await checkAuggieCliVersion();
+      if (!result.ok) {
+        return {
+          valid: false,
+          error: result.error || "Auggie CLI not found. Install it and run `auggie login`.",
+          unsupported: false,
+        };
+      }
+      return { valid: true, error: null, unsupported: false, method: result.version };
+    },
     qoder: async ({ apiKey, providerSpecificData }: any) => {
       // Bifurcate validation: PAT tokens use Cosy auth against api1.qoder.sh;
       // regular API keys validate against dashscope (OpenAI-compatible endpoint).

src/shared/constants/providers.ts

@@ -33,6 +33,11 @@ export const FREE_APIKEY_PROVIDER_IDS = new Set([
   // API key (Authorization: Bearer). Admit it through the same managed-provider
   // gate so POST /api/providers accepts the dual-auth shape.
   "codebuddy-cn",
+  // auggie is a fully local, credential-less CLI passthrough (auth handled by
+  // `auggie login` outside OmniRoute). Admitted here purely so POST /api/providers
+  // accepts an optional connection row for display/priority/testStatus tracking —
+  // no apiKey is ever required or sent upstream.
+  "auggie",
 ]);
 
 export function supportsApiKeyOnFreeProvider(providerId: unknown): boolean {

src/shared/constants/providers/noauth.ts

@@ -100,4 +100,24 @@ export const NOAUTH_PROVIDERS = {
       text: "MiMoCode uses Xiaomi's public free AI endpoint with bootstrap-based JWT authentication. No signup needed. Rate limits apply.",
     },
   },
+  auggie: {
+    id: "auggie",
+    alias: "aug",
+    name: "Augment (Auggie CLI)",
+    icon: "terminal",
+    color: "#7C3AED",
+    textIcon: "AU",
+    website: "https://augmentcode.com",
+    noAuth: true,
+    hasFree: false,
+    serviceKinds: ["llm"],
+    isLocalCli: true,
+    freeNote:
+      "Local passthrough — runs the Augment CLI (`auggie`) on this machine. Auth is handled by `auggie login`, not OmniRoute.",
+    authHint:
+      "No API key stored by OmniRoute. Install the Auggie CLI and run `auggie login` on this machine, then OmniRoute spawns it locally for each request.",
+    notice: {
+      text: "Augment (Auggie CLI) requires the `auggie` binary installed and authenticated locally (`auggie login`). OmniRoute spawns it as a subprocess and never sees or stores your Augment credentials.",
+    },
+  },
 };