@agents-ensemble/core 0.20.0 → 0.22.0

package/dist/conductor/pi-conductor-agent.d.ts

@@ -4,8 +4,6 @@ import type { ConductorAgent, ConductorAgentCreateOptions, ConductorAgentFactory
 import { type PiHeadlessSettingsManagerOverrides } from './pi-headless-settings.js';
 import { type PiResourceLoaderOptions, type PiResources } from './pi-resource-loader.js';
 import type { McpServerConfigMap } from '../mcp/load-mcp-config.js';
-/** Project-local Pi transcript storage used by the conductor backend. */
-export declare const PI_SESSION_ROOT = ".ensemble/pi/sessions";
 export declare const PI_CONDUCTOR_MESSAGE_HISTORY_ENTRY_TYPE = "agents-ensemble/conductor-message-history/v1";
 interface PiMcpStartupState {
     error?: string;
@@ -13,6 +11,9 @@ interface PiMcpStartupState {
 interface PiMcpLifecycleState {
     enabled: boolean;
 }
+interface PiCommandAuthRequestGate {
+    active: boolean;
+}
 export interface PiResolvedModel {
     provider: string;
     modelId: string;
@@ -36,7 +37,9 @@ export declare class PiConductorAgent implements ConductorAgent {
     private readonly modelId;
     private readonly mcpStartupState;
     private readonly mcpLifecycleState;
+    private readonly commandAuthRequestGate;
     private readonly piSkills;
+    private readonly piPromptResources;
     private readonly onStreamText?;
     private readonly onContextCompaction?;
     private readonly unsubscribe;
@@ -45,7 +48,7 @@ export declare class PiConductorAgent implements ConductorAgent {
     private closePromise?;
     constructor(session: AgentSession, resources: PiResources, settingsManager: SettingsManager, headlessSettingsOverrides: PiHeadlessSettingsManagerOverrides, systemPromptRef: {
         value: string;
-    }, agentId: string, modelId: string, mcpStartupState: PiMcpStartupState, mcpLifecycleState: PiMcpLifecycleState, piSkills: boolean, onStreamText?: ((text: string) => void) | undefined, onContextCompaction?: (() => void) | undefined);
+    }, agentId: string, modelId: string, mcpStartupState: PiMcpStartupState, mcpLifecycleState: PiMcpLifecycleState, commandAuthRequestGate: PiCommandAuthRequestGate, piSkills: boolean, piPromptResources: boolean, onStreamText?: ((text: string) => void) | undefined, onContextCompaction?: (() => void) | undefined);
     static create(options: ConductorAgentCreateOptions): Promise<PiConductorAgent>;
     static resume(agentId: string, options: ConductorAgentCreateOptions): Promise<PiConductorAgent>;
     send(prompt: string, callbacks?: ConductorSendCallbacks): Promise<ConductorSendResult>;

package/dist/conductor/pi-conductor-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi-conductor-agent.d.ts","sourceRoot":"","sources":["../../src/conductor/pi-conductor-agent.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,KAAK,EACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAOL,eAAe,EACf,KAAK,YAAY,EAIjB,KAAK,eAAe,EAIrB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,KAAK,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EAEpB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAQL,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,yEAAyE;AACzE,eAAO,MAAM,eAAe,0BAA0B,CAAC;AACvD,eAAO,MAAM,uCAAuC,iDACJ,CAAC;AAUjD,UAAU,iBAAiB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAaD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,uBAAuB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,eAAe,CAAC,CAI1B;AAyDD,oEAAoE;AACpE,qBAAa,gBAAiB,YAAW,cAAc;IAOnD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe;aAChB,OAAO,EAAE,MAAM;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAjBvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAC,CAAgB;gBAGlB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,WAAW,EACtB,eAAe,EAAE,eAAe,EAChC,yBAAyB,EAAE,kCAAkC,EAC7D,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACnC,OAAO,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,iBAAiB,EAClC,iBAAiB,EAAE,mBAAmB,EACtC,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,aAAA,EACrC,mBAAmB,CAAC,GAAE,MAAM,IAAI,aAAA;WAKtC,MAAM,CACjB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC;WAIf,MAAM,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC;IAItB,IAAI,CACR,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC;IA2FzB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAyCvB,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAOxC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,6EAA6E;IACvE,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CtB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BrC,OAAO,CAAC,WAAW;CAwCpB;AAkED,+CAA+C;AAC/C,wBAAgB,6BAA6B,IAAI,qBAAqB,CAKrE;AAkXD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,GAAE,4BAAiC,GACzC,eAAe,CAejB;AAED,MAAM,WAAW,4BAA4B;IAC3C,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB"}
+{"version":3,"file":"pi-conductor-agent.d.ts","sourceRoot":"","sources":["../../src/conductor/pi-conductor-agent.ts"],"names":[],"mappings":"AAaA,OAAO,EAML,KAAK,KAAK,EAEX,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EASL,eAAe,EACf,KAAK,YAAY,EAIjB,KAAK,eAAe,EAIrB,MAAM,iCAAiC,CAAC;AAQzC,OAAO,KAAK,EACV,cAAc,EACd,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EAEpB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAIL,KAAK,kCAAkC,EACxC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAQL,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,eAAO,MAAM,uCAAuC,iDACJ,CAAC;AAUjD,UAAU,iBAAiB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,UAAU,wBAAwB;IAChC,MAAM,EAAE,OAAO,CAAC;CACjB;AAeD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,uBAAuB,GAAG;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,OAAO,CAAC,eAAe,CAAC,CAI1B;AA6ED,oEAAoE;AACpE,qBAAa,gBAAiB,YAAW,cAAc;IAOnD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe;aAChB,OAAO,EAAE,MAAM;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAnBvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAC,CAAgB;gBAGlB,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,WAAW,EACtB,eAAe,EAAE,eAAe,EAChC,yBAAyB,EAAE,kCAAkC,EAC7D,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACnC,OAAO,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,iBAAiB,EAClC,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,wBAAwB,EAChD,QAAQ,EAAE,OAAO,EACjB,iBAAiB,EAAE,OAAO,EAC1B,YAAY,CAAC,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,aAAA,EACrC,mBAAmB,CAAC,GAAE,MAAM,IAAI,aAAA;WAKtC,MAAM,CACjB,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC;WAIf,MAAM,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,gBAAgB,CAAC;IAItB,IAAI,CACR,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,sBAAsB,GACjC,OAAO,CAAC,mBAAmB,CAAC;IAiGzB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAyCvB,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAOxC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B,6EAA6E;IACvE,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CtB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BrC,OAAO,CAAC,WAAW;CA0DpB;AA0OD,+CAA+C;AAC/C,wBAAgB,6BAA6B,IAAI,qBAAqB,CAKrE;AA0YD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvC,OAAO,GAAE,4BAAiC,GACzC,eAAe,CAejB;AAED,MAAM,WAAW,4BAA4B;IAC3C,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB"}

package/dist/conductor/pi-conductor-agent.js

@@ -1,20 +1,19 @@
 import { randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
-import { chmod, copyFile, mkdir } from 'node:fs/promises';
-import { basename, join } from 'node:path';
+import { chmod, mkdir } from 'node:fs/promises';
+import { basename } from 'node:path';
 import { getModel, getModels, getProviders, } from '@earendil-works/pi-ai/compat';
-import { getSupportedThinkingLevels, } from '@earendil-works/pi-ai';
+import { createAssistantMessageEventStream, getSupportedThinkingLevels, } from '@earendil-works/pi-ai';
+import { ModelsError } from '@earendil-works/pi-ai/models';
 import { createAgentSession, createCodemodeExtension, createMcpExtension, createToolSearchExtension, DefaultResourceLoader, SessionManager, SettingsManager, } from '@earendil-works/pi-coding-agent';
 import { resolveEnsemblePaths } from '../ensemble-paths.js';
-import { createPiConductorAuthContext, resolvePiConductorApiKey, } from './conductor-pi-auth.js';
+import { createPiConductorAuthContext, hasPiConductorCommandCredential, preparePiConductorCommandAuthForRequest, resolvePiConductorApiKey, } from './conductor-pi-auth.js';
 import { markConductorAgentFactoryCleanupIncomplete } from './conductor-agent-factory-cleanup.js';
 import { toPiCodingAgentTools } from './conductor-tool-pi-adapter.js';
 import { getPiHeadlessSettingsManagerOverrides, getPiHeadlessSetting, getPiSkillsDiscoverySettingsOverrides, } from './pi-headless-settings.js';
 import { expandPiResourcePrompt, loadPiResources, } from './pi-resource-loader.js';
-/** Project-local Pi transcript storage used by the conductor backend. */
-export const PI_SESSION_ROOT = '.ensemble/pi/sessions';
 export const PI_CONDUCTOR_MESSAGE_HISTORY_ENTRY_TYPE = 'agents-ensemble/conductor-message-history/v1';
 const PI_MCP_STARTUP_OBSERVATION_MS = 2_000;
+const PI_COMMAND_RESOLUTION_ERROR_MESSAGE = 'API key auth failed for provider: failed to resolve API key for Pi provider from the configured command.';
 const PI_THINKING_LEVELS = [
     'off',
     'minimal',
@@ -30,7 +29,7 @@ export async function resolvePiModelConfig(options) {
     const authContext = await createPiConductorAuthContext(options, resources);
     return resolvePiModelConfigFromResources(options, resources, authContext);
 }
-async function resolvePiModelConfigFromResources(options, resources, authContext) {
+async function resolvePiModelConfigFromResources(options, resources, authContext, commandAuthRequestGate) {
     const env = options.env ?? process.env;
     const settings = resources.settings;
     const selection = resolvePiModelSelection(options.modelId, settings, resources.models);
@@ -40,19 +39,36 @@ async function resolvePiModelConfigFromResources(options, resources, authContext
     const registryModel = projectDefinesModel
         ? undefined
         : authContext.modelRegistry.find(selection.provider, selection.modelId);
-    const apiKey = await resolvePiConductorApiKey({
-        modelRuntime: authContext.modelRuntime,
-        resources,
-        provider: selection.provider,
-        explicitApiKey: options.apiKey,
-        env,
-    });
+    const commandAuthConfigured = options.apiKey === undefined &&
+        hasPiConductorCommandCredential(resources, selection.provider, env);
+    const apiKey = commandAuthConfigured
+        ? undefined
+        : await resolvePiConductorApiKey({
+            modelRuntime: authContext.modelRuntime,
+            resources,
+            provider: selection.provider,
+            explicitApiKey: options.apiKey,
+            env,
+        });
     const builtInModel = getModel(selection.provider, selection.modelId);
     const model = resolvePiModel(selection.provider, selection.modelId, providerConfig, registryModel ?? builtInModel, registryModel);
     if (!model) {
         throw new Error(`Pi conductor model "${selection.provider}/${selection.modelId}" was not found in pi-ai or models.json. ` +
             'Set defaultProvider/defaultModel in Pi settings.json or pass a built-in provider/model id.');
     }
+    if (commandAuthConfigured) {
+        // Pi calls hasConfiguredAuth() during prompt setup and getAuth() just
+        // before sending a provider request. Keep the command out of setup and
+        // defer registration/resolution until the latter, while preserving Pi's
+        // own auth resolver and precedence.
+        installPiCommandAuthRequestGate({
+            modelRuntime: authContext.modelRuntime,
+            resources,
+            provider: selection.provider,
+            env,
+            gate: commandAuthRequestGate ?? { active: false },
+        });
+    }
     return {
         provider: selection.provider,
         modelId: selection.modelId,
@@ -72,14 +88,16 @@ export class PiConductorAgent {
     modelId;
     mcpStartupState;
     mcpLifecycleState;
+    commandAuthRequestGate;
     piSkills;
+    piPromptResources;
     onStreamText;
     onContextCompaction;
     unsubscribe;
     activeSend;
     closed = false;
     closePromise;
-    constructor(session, resources, settingsManager, headlessSettingsOverrides, systemPromptRef, agentId, modelId, mcpStartupState, mcpLifecycleState, piSkills, onStreamText, onContextCompaction) {
+    constructor(session, resources, settingsManager, headlessSettingsOverrides, systemPromptRef, agentId, modelId, mcpStartupState, mcpLifecycleState, commandAuthRequestGate, piSkills, piPromptResources, onStreamText, onContextCompaction) {
         this.session = session;
         this.resources = resources;
         this.settingsManager = settingsManager;
@@ -89,7 +107,9 @@ export class PiConductorAgent {
         this.modelId = modelId;
         this.mcpStartupState = mcpStartupState;
         this.mcpLifecycleState = mcpLifecycleState;
+        this.commandAuthRequestGate = commandAuthRequestGate;
         this.piSkills = piSkills;
+        this.piPromptResources = piPromptResources;
         this.onStreamText = onStreamText;
         this.onContextCompaction = onContextCompaction;
         this.unsubscribe = this.session.subscribe((event) => this.handleEvent(event));
@@ -134,9 +154,11 @@ export class PiConductorAgent {
         };
         this.activeSend = state;
         try {
-            await this.session.prompt(expandPiResourcePrompt(prompt, this.resources, {
-                expandSkills: !this.piSkills,
-            }), {
+            await this.session.prompt(this.piPromptResources
+                ? expandPiResourcePrompt(prompt, this.resources, {
+                    expandSkills: !this.piSkills,
+                })
+                : prompt, {
                 expandPromptTemplates: false,
                 source: 'rpc',
             });
@@ -145,7 +167,10 @@ export class PiConductorAgent {
             return {
                 runId,
                 status: 'error',
-                error: { message: errorMessage(error) },
+                error: {
+                    message: piConductorErrorMessage(error),
+                    ...(error instanceof ModelsError ? { code: error.code } : {}),
+                },
                 modelId: this.modelId,
             };
         }
@@ -160,6 +185,7 @@ export class PiConductorAgent {
                 modelId: this.modelId,
             };
         }
+        sanitizePiAssistantMessageInPlace(finalMessage);
         const status = statusFromStopReason(finalMessage.stopReason);
         const result = assistantText(finalMessage) || undefined;
         if (status === 'finished' &&
@@ -319,6 +345,15 @@ export class PiConductorAgent {
     }
     handleEvent(event) {
         const activeSend = this.activeSend;
+        if ((event.type === 'message_start' ||
+            event.type === 'message_update' ||
+            event.type === 'message_end') &&
+            event.message.role === 'assistant') {
+            // AgentSession emits public listeners before appending message_end to the
+            // Pi transcript. Mutating this message keeps the event and persisted entry
+            // safe if a failure came from a nonstandard Pi stream path.
+            sanitizePiAssistantMessageInPlace(event.message);
+        }
         if (event.type === 'compaction_end' &&
             event.result != null &&
             !event.aborted &&
@@ -340,6 +375,12 @@ export class PiConductorAgent {
             }
             return;
         }
+        if (event.type === 'agent_end') {
+            for (const message of event.messages) {
+                if (message.role === 'assistant')
+                    sanitizePiAssistantMessageInPlace(message);
+            }
+        }
         if (event.type === 'agent_end' && activeSend) {
             activeSend.finalMessage = lastAssistantMessage(event.messages);
             for (const message of event.messages) {
@@ -350,6 +391,135 @@ export class PiConductorAgent {
         }
     }
 }
+function installPiCommandAuthRequestGate(input) {
+    const originalHasConfiguredAuth = input.modelRuntime.hasConfiguredAuth.bind(input.modelRuntime);
+    input.modelRuntime.hasConfiguredAuth = (provider) => provider === input.provider || originalHasConfiguredAuth(provider);
+    const originalGetAuth = input.modelRuntime.getAuth.bind(input.modelRuntime);
+    input.modelRuntime.getAuth = (async (providerOrModel, overrides) => {
+        const provider = typeof providerOrModel === 'string'
+            ? providerOrModel
+            : providerOrModel.provider;
+        if (provider !== input.provider ||
+            !input.gate.active ||
+            overrides?.apiKey !== undefined) {
+            return originalGetAuth(providerOrModel, overrides);
+        }
+        await preparePiConductorCommandAuthForRequest({
+            modelRuntime: input.modelRuntime,
+            resources: input.resources,
+            provider: input.provider,
+            env: input.env,
+        });
+        try {
+            return await originalGetAuth(providerOrModel, overrides);
+        }
+        catch (error) {
+            if (isPiCommandResolutionError(error)) {
+                throw new Error(PI_COMMAND_RESOLUTION_ERROR_MESSAGE);
+            }
+            throw error;
+        }
+    });
+    const originalStreamSimple = input.modelRuntime.streamSimple.bind(input.modelRuntime);
+    input.modelRuntime.streamSimple = ((model, context, options) => {
+        if (model.provider !== input.provider) {
+            return originalStreamSimple(model, context, options);
+        }
+        // Pi 1.2.0's lazy stream starts its setup synchronously. That setup calls
+        // prepareRequest(), which starts getAuth() before streamSimple() returns.
+        // Keep the command gate active only for that setup call: prompt hooks and
+        // the provider response stream itself must not trigger command resolution
+        // through an unrelated getAuth() lookup.
+        const output = createAssistantMessageEventStream();
+        void (async () => {
+            try {
+                const wasActive = input.gate.active;
+                let response;
+                input.gate.active = true;
+                try {
+                    response = originalStreamSimple(model, context, options);
+                }
+                finally {
+                    input.gate.active = wasActive;
+                }
+                let terminalEventSeen = false;
+                for await (const event of response) {
+                    if (event.type === 'done' || event.type === 'error') {
+                        terminalEventSeen = true;
+                    }
+                    output.push(sanitizePiAssistantEvent(event));
+                }
+                if (!terminalEventSeen) {
+                    output.end(sanitizePiAssistantMessage(await response.result()));
+                }
+            }
+            catch (error) {
+                output.push({
+                    type: 'error',
+                    reason: 'error',
+                    error: createPiRequestFailureMessage(model, piConductorErrorMessage(error)),
+                });
+            }
+        })();
+        return output;
+    });
+}
+function sanitizePiAssistantEvent(event) {
+    if (event.type === 'done') {
+        return { ...event, message: sanitizePiAssistantMessage(event.message) };
+    }
+    if (event.type === 'error') {
+        return { ...event, error: sanitizePiAssistantMessage(event.error) };
+    }
+    if ('partial' in event) {
+        return { ...event, partial: sanitizePiAssistantMessage(event.partial) };
+    }
+    return event;
+}
+function sanitizePiAssistantMessage(message) {
+    if (!message.errorMessage)
+        return message;
+    const safeErrorMessage = sanitizePiCommandResolutionMessage(message.errorMessage);
+    return safeErrorMessage === message.errorMessage
+        ? message
+        : { ...message, errorMessage: safeErrorMessage };
+}
+function sanitizePiAssistantMessageInPlace(message) {
+    if (!message.errorMessage)
+        return;
+    message.errorMessage = sanitizePiCommandResolutionMessage(message.errorMessage);
+}
+function sanitizePiCommandResolutionMessage(message) {
+    return isPiCommandResolutionError(message)
+        ? PI_COMMAND_RESOLUTION_ERROR_MESSAGE
+        : message;
+}
+function createPiRequestFailureMessage(model, errorMessage) {
+    return {
+        role: 'assistant',
+        content: [],
+        api: model.api,
+        provider: model.provider,
+        model: model.id,
+        usage: {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            totalTokens: 0,
+            cost: {
+                input: 0,
+                output: 0,
+                cacheRead: 0,
+                cacheWrite: 0,
+                total: 0,
+            },
+        },
+        stopReason: 'error',
+        errorMessage: sanitizePiCommandResolutionMessage(errorMessage),
+        timestamp: Date.now(),
+    };
+}
 function appendPiConductorMessageHistory(sessionManager, input) {
     const branch = sessionManager.getBranch();
     let assistantIndex = -1;
@@ -426,55 +596,62 @@ function resolvePiConductorThinkingLevel(model, provider, modelId, value) {
     }
     return reasoning;
 }
+function resolvePiConductorSessionDir(options) {
+    if (options.sessionDir !== undefined)
+        return options.sessionDir;
+    if (!options.issueUrl) {
+        throw new Error('Pi conductor transcript storage requires issueUrl or an explicit sessionDir.');
+    }
+    return resolveEnsemblePaths({ repoRoot: options.cwd })
+        .canonicalPiSessionsDir(options.issueUrl);
+}
 async function createPiConductorSession(agentId, options, reason) {
+    const sessionDir = resolvePiConductorSessionDir(options);
+    const piInternalExtensions = options.piInternalExtensions !== false;
     const piMcpResolution = { cwd: options.cwd };
     const mcpLifecycleState = {
-        enabled: Object.keys(options.mcpServers ?? {}).length > 0,
+        enabled: piInternalExtensions && Object.keys(options.mcpServers ?? {}).length > 0,
     };
     // Validate the harness-resolved map before creating the SDK session so an
     // unsupported transport fails with an actionable Pi-specific error.
-    if (options.mcpServers)
+    if (piInternalExtensions && options.mcpServers) {
         loadPiMcpConfig(options.mcpServers, piMcpResolution);
+    }
     const piSkills = options.piSkills !== false;
+    const piPromptResources = options.piPromptResources !== false;
     const resources = await loadPiResources({
         ...options,
         loadExtensions: options.piExtensions !== false,
+        loadPromptResources: piPromptResources,
         loadSkillContents: !piSkills,
     });
     const headlessSettingsOverrides = getPiHeadlessSettingsManagerOverrides(resources.settings);
     const authContext = await createPiConductorAuthContext(options, resources);
-    const resolved = await resolvePiModelConfigFromResources(options, resources, authContext);
+    const commandAuthRequestGate = { active: false };
+    const resolved = await resolvePiModelConfigFromResources(options, resources, authContext, commandAuthRequestGate);
     const thinkingLevel = options.reasoning !== undefined
         ? resolvePiConductorThinkingLevel(resolved.model, resolved.provider, resolved.modelId, options.reasoning)
         : undefined;
     if (options.apiKey !== undefined) {
         await authContext.modelRuntime.setRuntimeApiKey(resolved.provider, options.apiKey);
     }
-    const sessionDir = options.sessionDir ??
-        resolveEnsemblePaths({ repoRoot: options.cwd }).piSessionsDir;
-    const legacySessionDir = options.legacySessionDir ?? join(options.cwd, PI_SESSION_ROOT);
     await mkdir(sessionDir, { recursive: true, mode: 0o700 });
     await chmod(sessionDir, 0o700);
     let sessionManager;
     let previousSessionFile;
     if (reason === 'resume') {
-        previousSessionFile = SessionManager.findById(options.cwd, agentId, sessionDir);
-        if (!previousSessionFile && legacySessionDir !== sessionDir) {
-            const legacyFile = SessionManager.findById(options.cwd, agentId, legacySessionDir);
-            if (legacyFile) {
-                await mkdir(sessionDir, { recursive: true, mode: 0o700 });
-                const migratedFile = join(sessionDir, basename(legacyFile));
-                try {
-                    await copyFile(legacyFile, migratedFile, constants.COPYFILE_EXCL);
-                }
-                catch (error) {
-                    if (!isAlreadyExists(error))
-                        throw error;
-                }
-                await chmod(migratedFile, 0o600);
-                previousSessionFile = migratedFile;
+        const resumeCwds = [
+            ...new Set([options.cwd, ...(options.resumeCwds ?? [])]),
+        ];
+        const findSessionFile = (directory) => {
+            for (const cwd of resumeCwds) {
+                const sessionFile = SessionManager.findById(cwd, agentId, directory);
+                if (sessionFile)
+                    return sessionFile;
             }
-        }
+            return undefined;
+        };
+        previousSessionFile = findSessionFile(sessionDir);
         if (!previousSessionFile) {
             throw new Error(`Pi session not found for resume (sessionId=${agentId}, cwd=${options.cwd}, ` +
                 `sessionsRoot=${sessionDir})`);
@@ -492,7 +669,7 @@ async function createPiConductorSession(agentId, options, reason) {
     // (.ensemble/pi), so use an in-memory manager and populate it only through
     // the code-level headless settings allowlist below.
     const settingsManager = SettingsManager.inMemory();
-    if (piSkills) {
+    if (piSkills && piPromptResources) {
         applyPiHeadlessSettings(settingsManager, getPiSkillsDiscoverySettingsOverrides(resources.settings));
         settingsManager.setProjectTrusted(true);
     }
@@ -501,18 +678,22 @@ async function createPiConductorSession(agentId, options, reason) {
         agentDir: authContext.agentDir,
         settingsManager,
         noExtensions: true,
-        noSkills: !piSkills,
-        additionalSkillPaths: piSkills ? resources.skillPaths : [],
+        noSkills: !piSkills || !piPromptResources,
+        additionalSkillPaths: piSkills && piPromptResources ? resources.skillPaths : [],
         noPromptTemplates: true,
         noThemes: true,
         noContextFiles: true,
         systemPrompt: systemPromptRef.value,
         extensionFactories: [
-            createMcpExtension({
-                loadConfig: () => loadPiMcpConfig(mcpLifecycleState.enabled ? options.mcpServers : undefined, piMcpResolution),
-            }),
-            createCodemodeExtension({ mode: 'on' }),
-            createToolSearchExtension(),
+            ...(piInternalExtensions
+                ? [
+                    createMcpExtension({
+                        loadConfig: () => loadPiMcpConfig(mcpLifecycleState.enabled ? options.mcpServers : undefined, piMcpResolution),
+                    }),
+                    createCodemodeExtension({ mode: 'on' }),
+                    createToolSearchExtension(),
+                ]
+                : []),
             createPiSystemPromptExtension(systemPromptRef),
         ],
     });
@@ -551,11 +732,11 @@ async function createPiConductorSession(agentId, options, reason) {
                 }
             },
         });
-        await observePiMcpStartup(session, options.mcpServers, mcpStartupState);
+        await observePiMcpStartup(session, piInternalExtensions ? options.mcpServers : undefined, mcpStartupState);
         if (mcpStartupState.error) {
             throw new Error(mcpStartupState.error);
         }
-        return new PiConductorAgent(session, resources, settingsManager, headlessSettingsOverrides, systemPromptRef, agentId, resolved.modelId, mcpStartupState, mcpLifecycleState, piSkills, options.onStreamText, options.onContextCompaction);
+        return new PiConductorAgent(session, resources, settingsManager, headlessSettingsOverrides, systemPromptRef, agentId, resolved.modelId, mcpStartupState, mcpLifecycleState, commandAuthRequestGate, piSkills, piPromptResources, options.onStreamText, options.onContextCompaction);
     }
     catch (error) {
         if (!session)
@@ -965,7 +1146,49 @@ function addConductorTokenUsage(current, usage) {
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
-function errorMessage(error) {
+function piConductorErrorMessage(error) {
+    if (isPiCommandResolutionError(error)) {
+        return PI_COMMAND_RESOLUTION_ERROR_MESSAGE;
+    }
     return error instanceof Error ? error.message : String(error);
 }
+function isPiCommandResolutionError(error) {
+    if (typeof error === 'string' &&
+        /failed to resolve api key|from shell command/i.test(error)) {
+        return true;
+    }
+    if (!error || typeof error !== 'object')
+        return false;
+    if (error instanceof ModelsError && error.code !== 'auth')
+        return false;
+    const isAuthModelsError = error instanceof ModelsError && error.code === 'auth';
+    const errorMessage = 'message' in error && typeof error.message === 'string' ? error.message : '';
+    if (/failed to resolve api key|from shell command/i.test(errorMessage)) {
+        return true;
+    }
+    const topLevelDetails = error;
+    if (isAuthModelsError &&
+        (topLevelDetails.stdout !== undefined || topLevelDetails.stderr !== undefined)) {
+        return true;
+    }
+    const pending = [error.cause];
+    const seen = new Set();
+    while (pending.length > 0) {
+        const cause = pending.pop();
+        if (!cause || typeof cause !== 'object' || seen.has(cause))
+            continue;
+        seen.add(cause);
+        const details = cause;
+        if (isAuthModelsError &&
+            (details.stdout !== undefined || details.stderr !== undefined)) {
+            return true;
+        }
+        if (typeof details.message === 'string' &&
+            /failed to resolve api key|from shell command/i.test(details.message)) {
+            return true;
+        }
+        pending.push(details.cause);
+    }
+    return false;
+}
 //# sourceMappingURL=pi-conductor-agent.js.map