@agents-ensemble/core 0.8.0 → 0.9.1

package/dist/conductor/conductor-pi-auth.d.ts

@@ -1,4 +1,4 @@
-import { AuthStorage, ModelRegistry } from '@earendil-works/pi-coding-agent';
+import { ModelRegistry, ModelRuntime } from '@earendil-works/pi-coding-agent';
 import { type OAuthLoginCallbacks } from '@earendil-works/pi-ai/compat';
 import { type PiResourceLoaderOptions, type PiResources } from './pi-resource-loader.js';
 /** Auth and model services for the Pi conductor's user resource layer. */
@@ -6,7 +6,7 @@ export interface PiConductorAuthContext {
     agentDir: string;
     authPath: string;
     modelsPath: string;
-    authStorage: AuthStorage;
+    modelRuntime: ModelRuntime;
     modelRegistry: ModelRegistry;
 }
 export interface PiProviderAuthStatus {
@@ -41,8 +41,8 @@ export interface PiConductorAuthOptions extends PiResourceLoaderOptions {
     provider?: string;
     modelId?: string;
 }
-/** Create the Pi credential store and model registry for the user root. */
-export declare function createPiConductorAuthContext(options: PiResourceLoaderOptions): PiConductorAuthContext;
+/** Create the Pi 1.x model runtime and registry for the resolved resource roots. */
+export declare function createPiConductorAuthContext(options: PiResourceLoaderOptions, resources?: PiResources): Promise<PiConductorAuthContext>;
 /** Resolve the provider used by `ensemble auth` from an explicit/default model. */
 export declare function resolvePiConductorProvider(options: PiConductorAuthOptions): Promise<string>;
 /** Login to a Pi provider. API-key login persists only in the user auth file. */
@@ -60,7 +60,7 @@ export declare function getPiConductorAuthStatus(options: PiConductorAuthOptions
 export declare function listPiConductorModels(options?: PiConductorAuthOptions): Promise<PiConductorModelListEntry[]>;
 /** Resolve a key while retaining project-over-user auth precedence. */
 export declare function resolvePiConductorApiKey(options: {
-    authStorage: AuthStorage;
+    modelRuntime: ModelRuntime;
     resources: Pick<PiResources, 'roots' | 'authLayers' | 'settings' | 'models'>;
     provider: string;
     explicitApiKey?: string;

package/dist/conductor/conductor-pi-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conductor-pi-auth.d.ts","sourceRoot":"","sources":["../../src/conductor/conductor-pi-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,aAAa,EAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,sBAAsB,CAYxB;AAED,mFAAmF;AACnF,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,sBAAsB,GAAG;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GACA,OAAO,CAAC,sBAAsB,CAAC,CAoCjC;AAED,6EAA6E;AAC7E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,oDAAoD;AACpD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAUlC;AAED,4EAA4E;AAC5E,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED,qEAAqE;AACrE,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,sBAA+C,GACvD,OAAO,CAAC,yBAAyB,EAAE,CAAC,CA0CtC;AAED,uEAAuE;AACvE,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwC9B;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,sBAAsB,EAC/B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,EAC5E,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAkC3E;AA4YD,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkBhE"}
+{"version":3,"file":"conductor-pi-auth.d.ts","sourceRoot":"","sources":["../../src/conductor/conductor-pi-auth.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,YAAY,EACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAML,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,uBAAuB,EAChC,SAAS,CAAC,EAAE,WAAW,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAajC;AAED,mFAAmF;AACnF,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,sBAAsB,GAAG;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC,GACA,OAAO,CAAC,sBAAsB,CAAC,CAuCjC;AAED,6EAA6E;AAC7E,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED,oDAAoD;AACpD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAUlC;AAED,4EAA4E;AAC5E,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED,qEAAqE;AACrE,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,sBAA+C,GACvD,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAgCtC;AAED,uEAAuE;AACvE,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,YAAY,EAAE,YAAY,CAAC;IAC3B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA0E9B;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,sBAAsB,EAC/B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,EAC5E,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAkC3E;AAglBD,iFAAiF;AACjF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkBhE"}

package/dist/conductor/conductor-pi-auth.js

@@ -1,41 +1,41 @@
 import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { AuthStorage, ModelRegistry, } from '@earendil-works/pi-coding-agent';
-import { findEnvKeys, getEnvApiKey, } from '@earendil-works/pi-ai/compat';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { ModelRegistry, ModelRuntime, } from '@earendil-works/pi-coding-agent';
+import { findEnvKeys, getEnvApiKey, getModels, getProviders, } from '@earendil-works/pi-ai/compat';
 import { loadPiResources, resolvePiResourceRoots, } from './pi-resource-loader.js';
-/** Create the Pi credential store and model registry for the user root. */
-export function createPiConductorAuthContext(options) {
+/** Create the Pi 1.x model runtime and registry for the resolved resource roots. */
+export async function createPiConductorAuthContext(options, resources) {
     const roots = resolvePiResourceRoots(options);
     const authPath = join(roots.agentDir, 'auth.json');
     const modelsPath = join(roots.agentDir, 'models.json');
-    const authStorage = AuthStorage.create(authPath);
+    const resolvedResources = resources ?? (await loadPiResources(options));
+    const modelRuntime = await createPiModelRuntime(options, resolvedResources);
     return {
         agentDir: roots.agentDir,
         authPath,
         modelsPath,
-        authStorage,
-        modelRegistry: ModelRegistry.create(authStorage, modelsPath),
+        modelRuntime,
+        modelRegistry: new ModelRegistry(modelRuntime),
     };
 }
 /** Resolve the provider used by `ensemble auth` from an explicit/default model. */
 export async function resolvePiConductorProvider(options) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
+    const context = await createPiConductorAuthContext(options, resources);
     return resolvePiConductorProviderFromResources(options, resources, context);
 }
 /** Login to a Pi provider. API-key login persists only in the user auth file. */
 export async function loginPiConductor(options) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
-    const provider = resolveConductorProviderOrThrow(options, resources, context);
-    const oauthProvider = context.authStorage
-        .getOAuthProviders()
-        .some((candidate) => candidate.id === provider);
+    const context = await createPiConductorAuthContext(options, resources);
+    const provider = await resolveConductorProviderOrThrow(options, resources, context);
+    const oauthProvider = Boolean(context.modelRuntime.getProvider(provider)?.auth.oauth);
     if (oauthProvider) {
         if (!options.oauthCallbacks) {
             throw new Error(`Pi provider "${provider}" uses OAuth. Run this command from a TTY so the OAuth login flow can interact with you.`);
         }
-        await context.authStorage.login(provider, options.oauthCallbacks);
+        await context.modelRuntime.login(provider, 'oauth', toPiAuthInteraction(options.oauthCallbacks));
         return {
             backend: 'pi',
             provider,
@@ -47,7 +47,8 @@ export async function loginPiConductor(options) {
     if (!apiKey) {
         throw new Error(`Pi provider "${provider}" requires an API key. Pass a secret API-key prompt value or set ${formatPiProviderEnvHint(provider)}.`);
     }
-    context.authStorage.set(provider, { type: 'api_key', key: apiKey });
+    await writePiApiKey(context.authPath, provider, apiKey);
+    await context.modelRuntime.setRuntimeApiKey(provider, apiKey);
     return {
         backend: 'pi',
         provider,
@@ -58,18 +59,16 @@ export async function loginPiConductor(options) {
 /** Whether the selected Pi provider exposes Pi's native OAuth login flow. */
 export async function isPiConductorOAuthProvider(options) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
-    const provider = resolveConductorProviderOrThrow(options, resources, context);
-    return context.authStorage
-        .getOAuthProviders()
-        .some((candidate) => candidate.id === provider);
+    const context = await createPiConductorAuthContext(options, resources);
+    const provider = await resolveConductorProviderOrThrow(options, resources, context);
+    return Boolean(context.modelRuntime.getProvider(provider)?.auth.oauth);
 }
 /** Remove a Pi provider's user-layer credential. */
 export async function logoutPiConductor(options) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
-    const provider = resolveConductorProviderOrThrow(options, resources, context);
-    context.authStorage.logout(provider);
+    const context = await createPiConductorAuthContext(options, resources);
+    const provider = await resolveConductorProviderOrThrow(options, resources, context);
+    await context.modelRuntime.logout(provider);
     return {
         backend: 'pi',
         provider,
@@ -79,8 +78,8 @@ export async function logoutPiConductor(options) {
 /** Return non-secret Pi auth metadata for the selected/default provider. */
 export async function getPiConductorAuthStatus(options) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
-    const providers = resolveStatusProviders(options, resources, context);
+    const context = await createPiConductorAuthContext(options, resources);
+    const providers = await resolveStatusProviders(options, resources, context);
     return {
         backend: 'pi',
         authPath: context.authPath,
@@ -90,12 +89,11 @@ export async function getPiConductorAuthStatus(options) {
 /** List only Pi models whose provider has usable configured auth. */
 export async function listPiConductorModels(options = { cwd: process.cwd() }) {
     const resources = await loadPiResources(options);
-    const context = createPiConductorAuthContext(options);
+    const context = await createPiConductorAuthContext(options, resources);
     const requestedProvider = normalizeProvider(options.provider) ?? providerFromModelId(options.modelId);
     const entries = new Map();
-    // ModelRegistry's fast `getAvailable()` only sees its user AuthStorage. The
-    // conductor also honors project auth.json, so filter the complete registry
-    // through the merged project-over-user auth view before listing models.
+    // Filter the complete Pi 1.x runtime catalog through the merged
+    // project-over-user auth view before listing models.
     for (const model of context.modelRegistry.getAll()) {
         if (requestedProvider && model.provider !== requestedProvider)
             continue;
@@ -104,18 +102,8 @@ export async function listPiConductorModels(options = { cwd: process.cwd() }) {
         }
         addPiModelEntry(entries, model);
     }
-    // ModelRegistry reads the user models.json. Project models remain governed by
-    // the existing resource loader, so add those merged definitions explicitly.
-    for (const [provider, config] of Object.entries(resources.models.providers)) {
-        if (requestedProvider && provider !== requestedProvider)
-            continue;
-        if (!hasPiProviderAuth(provider, context, resources, options.env ?? process.env)) {
-            continue;
-        }
-        for (const model of config.models ?? []) {
-            addPiCustomModelEntry(entries, provider, model);
-        }
-    }
+    // The runtime is built from the merged models resource, so custom models are
+    // already included in the registry above.
     const result = [...entries.values()].sort((left, right) => left.id.localeCompare(right.id));
     if (result.length === 0) {
         const providerHint = requestedProvider ? ` for provider "${requestedProvider}"` : '';
@@ -131,27 +119,56 @@ export async function resolvePiConductorApiKey(options) {
     if (options.explicitApiKey !== undefined)
         return options.explicitApiKey;
     // A project auth file intentionally remains above the user auth layer. When
-    // both roots point at the same file, AuthStorage is the canonical reader so
+    // both roots point at the same file, ModelRuntime is the canonical reader so
     // OAuth refresh is not bypassed by the resource-layer compatibility parser.
+    const projectEntry = options.resources.authLayers.at(-1)?.[options.provider];
+    const projectKey = options.resources.roots.agentDir !== options.resources.roots.projectDir
+        ? resolvePiAuthEntry(projectEntry, env)
+        : undefined;
+    const settingsKey = resolvePiSettingsApiKey(options.resources.settings, options.provider, env);
+    const modelsKey = resolvePiModelsApiKey(options.resources.models.providers[options.provider], env);
     if (options.resources.roots.agentDir !== options.resources.roots.projectDir) {
-        const projectEntry = options.resources.authLayers.at(-1)?.[options.provider];
         if (isPiOAuthAuthEntry(projectEntry)) {
             throw new Error(formatProjectOAuthAuthError(options.provider));
         }
-        const projectKey = resolvePiAuthEntry(projectEntry, env);
-        if (projectKey !== undefined)
+        if (projectKey !== undefined && !isPiCommandConfigValue(projectKey)) {
             return projectKey;
+        }
+        if (projectKey !== undefined) {
+            // A project auth entry intentionally outranks the user credential. Use
+            // the Pi resolver through an isolated provider id so ModelRuntime does
+            // not select the lower-precedence user auth.json entry first.
+            return resolvePiProjectCommandApiKey(options.modelRuntime, options.provider, projectKey);
+        }
     }
-    const userStatus = options.authStorage.getAuthStatus(options.provider);
-    if (userStatus.source === 'stored' || userStatus.source === 'runtime') {
-        // AuthStorage owns OAuth refresh and locking. Keep this call dynamic per
-        // request rather than capturing its result during agent construction.
-        return options.authStorage.getApiKey(options.provider);
+    // Pi resolves command references from the provider configuration at request
+    // time. Settings/auth are loaded by ensemble rather than Pi's resource
+    // loader, so register command references through the same public runtime API
+    // before asking the runtime for the request credential. Project auth keeps
+    // its higher precedence over settings and models.
+    if (settingsKey !== undefined && isPiCommandConfigValue(settingsKey)) {
+        options.modelRuntime.registerProvider(options.provider, { apiKey: settingsKey });
+    }
+    // ModelRuntime owns the Pi 1.x credential store, OAuth refresh, and locking.
+    // Resolve it on every request instead of capturing the key at construction.
+    let runtimeError;
+    try {
+        const runtimeAuth = await options.modelRuntime.getAuth(options.provider);
+        if (runtimeAuth?.auth.apiKey !== undefined)
+            return runtimeAuth.auth.apiKey;
+    }
+    catch (error) {
+        runtimeError = error;
+        // Non-command references can still use the ensemble fallback chain. A
+        // command reference is reported below instead of returning the raw command
+        // as an API key.
+    }
+    const commandKey = [settingsKey, modelsKey].find((value) => value !== undefined && isPiCommandConfigValue(value));
+    if (commandKey !== undefined) {
+        throw formatPiCommandResolutionError(options.provider, commandKey, runtimeError);
     }
-    const settingsKey = resolvePiSettingsApiKey(options.resources.settings, options.provider, env);
     if (settingsKey !== undefined)
         return settingsKey;
-    const modelsKey = resolvePiModelsApiKey(options.resources.models.providers[options.provider], env);
     if (modelsKey !== undefined)
         return modelsKey;
     return getEnvApiKey(options.provider, toProviderEnv(env));
@@ -163,18 +180,18 @@ export function hasPiProviderAuth(provider, context, resources, env = process.en
 }
 /** Synchronous readiness check used by CLI/e2e guards before async loading. */
 export function hasPiConductorAuth(options) {
-    const context = createPiConductorAuthContext(options);
     const env = options.env ?? process.env;
     const roots = resolvePiResourceRoots(options);
+    const userAuth = readPiJsonSync(join(roots.agentDir, 'auth.json'));
     const projectAuth = readPiJsonSync(join(roots.projectDir, 'auth.json'));
     const settings = readPiSettingsSync(roots);
     const models = readPiModelsSync(roots);
-    const selection = resolvePiConductorSelectionSync(options, settings, models, context);
+    const selection = resolvePiConductorSelectionSync(options, settings, models, userAuth);
     if (selection.provider) {
         return hasPiProviderAuthSync({
             provider: selection.provider,
-            context,
             roots,
+            userAuth,
             projectAuth,
             settings,
             models,
@@ -187,8 +204,8 @@ export function hasPiConductorAuth(options) {
     if (selection.modelId)
         return false;
     return hasAnyPiConductorAuthSync({
-        context,
         roots,
+        userAuth,
         projectAuth,
         settings,
         models,
@@ -199,7 +216,7 @@ export function hasPiConductorAuth(options) {
  * Mirror PiConductorAgent's synchronous provider/model selection for guards.
  * The async agent receives the same merged settings and model layers.
  */
-function resolvePiConductorSelectionSync(options, settings, models, context) {
+function resolvePiConductorSelectionSync(options, settings, models, userAuth) {
     const requestedModel = normalizeModelId(options.modelId);
     const configuredModel = normalizeModelId(firstString(settings.defaultModel, settings.model, settings.modelId));
     const selectedModel = requestedModel ?? configuredModel;
@@ -216,7 +233,7 @@ function resolvePiConductorSelectionSync(options, settings, models, context) {
         provider = normalizeProvider(settings.defaultProvider);
     if (!provider && modelId) {
         const matches = new Set();
-        for (const model of context.modelRegistry.getAll()) {
+        for (const model of knownPiModelsSync(models, userAuth)) {
             if (model.id === modelId)
                 matches.add(model.provider);
         }
@@ -241,14 +258,7 @@ function hasPiProviderAuthSync(options) {
     }
     if (resolvePiAuthEntry(projectEntry, options.env) !== undefined)
         return true;
-    if (options.context.authStorage.has(options.provider))
-        return true;
-    // Keep readiness aligned with ModelRegistry, including command-backed or
-    // otherwise registry-native user models, while the explicit checks below
-    // honor the injected test/runtime environment.
-    if (options.context.modelRegistry
-        .getAvailable()
-        .some((model) => model.provider === options.provider)) {
+    if (resolvePiAuthEntry(options.userAuth?.[options.provider], options.env) !== undefined) {
         return true;
     }
     if (resolvePiSettingsApiKey(options.settings, options.provider, options.env) !== undefined) {
@@ -260,14 +270,12 @@ function hasPiProviderAuthSync(options) {
     return getEnvApiKey(options.provider, toProviderEnv(options.env)) !== undefined;
 }
 function hasAnyPiConductorAuthSync(options) {
-    if (options.context.modelRegistry.getAvailable().length > 0)
-        return true;
     const providers = new Set([
-        ...options.context.authStorage.list(),
-        ...options.context.modelRegistry.getAll().map((model) => model.provider),
+        ...Object.keys(options.userAuth ?? {}),
+        ...knownPiModelsSync(options.models, options.userAuth).map((model) => model.provider),
         ...Object.keys(options.models.providers),
         ...Object.keys(options.projectAuth ?? {}),
-        ...options.context.authStorage.getOAuthProviders().map((provider) => provider.id),
+        ...getProviders(),
     ]);
     for (const provider of providers) {
         if (hasPiProviderAuthSync({ ...options, provider }))
@@ -291,7 +299,7 @@ function readPiModelsSync(roots) {
             : {},
     };
 }
-function resolveConductorProviderOrThrow(options, resources, context) {
+async function resolveConductorProviderOrThrow(options, resources, context) {
     const provider = resolvePiConductorProviderFromResources(options, resources, context);
     if (provider)
         return provider;
@@ -326,7 +334,7 @@ function resolvePiConductorProviderFromResources(options, resources, context) {
     }
     return '';
 }
-function resolveStatusProviders(options, resources, context) {
+async function resolveStatusProviders(options, resources, context) {
     const explicit = normalizeProvider(options.provider);
     if (explicit)
         return [explicit];
@@ -334,10 +342,9 @@ function resolveStatusProviders(options, resources, context) {
     if (configured)
         return [configured];
     const providers = new Set([
-        ...context.authStorage.list(),
+        ...(await context.modelRuntime.listCredentials()).map((entry) => entry.providerId),
         ...context.modelRegistry.getAll().map((model) => model.provider),
         ...Object.keys(resources.models.providers),
-        ...context.authStorage.getOAuthProviders().map((provider) => provider.id),
     ]);
     return [...providers].sort();
 }
@@ -356,7 +363,7 @@ function getPiProviderAuthStatus(provider, context, resources, env) {
             return { provider, configured: true, source: 'project_stored' };
         }
     }
-    const registryStatus = context.modelRegistry.getProviderAuthStatus(provider);
+    const registryStatus = context.modelRuntime.getProviderAuthStatus(provider);
     if (registryStatus.configured || registryStatus.source === 'stored') {
         return normalizePiAuthStatus(provider, registryStatus, true);
     }
@@ -423,7 +430,7 @@ function isPiOAuthAuthEntry(entry) {
 function formatProjectOAuthAuthError(provider) {
     return (`Project Pi OAuth credentials for provider "${provider}" are not supported in ` +
         'project .ensemble/pi/auth.json because that layer cannot refresh them safely. ' +
-        `Run ensemble auth login --provider ${provider} to store the credential in the user AuthStorage.`);
+        `Run ensemble auth login --provider ${provider} to store the credential in the user Pi runtime.`);
 }
 function resolvePiSettingsApiKey(settings, provider, env) {
     if (typeof settings.apiKey === 'string') {
@@ -440,14 +447,188 @@ function resolvePiModelsApiKey(providerConfig, env) {
         : undefined;
 }
 function expandEnvReference(value, env) {
-    if (value.startsWith('!'))
-        return undefined;
+    // Keep Pi command references opaque here. ModelRuntime's public provider
+    // registration path resolves `!command` with Pi's resolver at request time.
     const variable = /^\$\{([^}]+)\}$/.exec(value) ?? /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(value);
     return variable ? env[variable[1]] : value;
 }
+function isPiCommandConfigValue(value) {
+    return value.startsWith('!');
+}
+function formatPiCommandResolutionError(provider, command, cause) {
+    const causeMessage = cause instanceof Error ? ` (${cause.message})` : '';
+    return new Error(`Failed to resolve API key for Pi provider "${provider}" from shell command: ${command.slice(1)}${causeMessage}`, cause instanceof Error ? { cause } : undefined);
+}
+async function resolvePiProjectCommandApiKey(modelRuntime, provider, command) {
+    const isolatedProvider = `__agents_ensemble_project_auth__${provider}`;
+    modelRuntime.registerProvider(isolatedProvider, { apiKey: command });
+    try {
+        const runtimeAuth = await modelRuntime.getAuth(isolatedProvider);
+        if (runtimeAuth?.auth.apiKey !== undefined) {
+            // Keep the resolved project credential as an in-memory runtime override
+            // so the actual conductor request also uses project-over-user auth.
+            await modelRuntime.setRuntimeApiKey(provider, runtimeAuth.auth.apiKey);
+            return runtimeAuth.auth.apiKey;
+        }
+    }
+    catch (error) {
+        throw formatPiCommandResolutionError(provider, command, error);
+    }
+    throw formatPiCommandResolutionError(provider, command, undefined);
+}
 function toProviderEnv(env) {
     return Object.fromEntries(Object.entries(env).filter((entry) => typeof entry[1] === 'string'));
 }
+/** Build the Pi 1.x runtime from the already-resolved ensemble resource view. */
+async function createPiModelRuntime(options, resources) {
+    const roots = resolvePiResourceRoots(options);
+    const runtime = await ModelRuntime.create({
+        authPath: join(roots.agentDir, 'auth.json'),
+        // The ensemble resource loader has already merged user and project models.
+        // Avoid letting ModelRuntime read an unmerged second view of models.json.
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false,
+    });
+    const env = options.env ?? process.env;
+    for (const [provider, config] of Object.entries(resources.models.providers)) {
+        runtime.registerProvider(provider, toPiRuntimeProviderConfig(config, env));
+    }
+    if (roots.agentDir !== roots.projectDir) {
+        for (const [provider, entry] of Object.entries(resources.authLayers.at(-1) ?? {})) {
+            if (isPiOAuthAuthEntry(entry))
+                continue;
+            const key = resolvePiAuthEntry(entry, env);
+            if (key !== undefined && !isPiCommandConfigValue(key)) {
+                await runtime.setRuntimeApiKey(provider, key);
+            }
+        }
+    }
+    if (isRecord(resources.settings.apiKeys)) {
+        for (const [provider, value] of Object.entries(resources.settings.apiKeys)) {
+            if (typeof value !== 'string')
+                continue;
+            const key = expandEnvReference(value, env);
+            if (key !== undefined && !isPiCommandConfigValue(key)) {
+                await runtime.setRuntimeApiKey(provider, key);
+            }
+        }
+    }
+    await runtime.refresh({ allowNetwork: false });
+    return runtime;
+}
+function toPiRuntimeProviderConfig(config, env) {
+    const models = config.models?.map((model) => ({
+        type: 'chat',
+        id: model.id,
+        name: model.name ?? model.id,
+        ...(model.api ?? config.api ? { api: model.api ?? config.api } : {}),
+        ...(model.baseUrl ?? config.baseUrl
+            ? { baseUrl: model.baseUrl ?? config.baseUrl }
+            : {}),
+        input: model.input ?? ['text'],
+        reasoning: model.reasoning ?? false,
+        ...(model.thinkingLevelMap ? { thinkingLevelMap: model.thinkingLevelMap } : {}),
+        cost: model.cost ?? emptyPiModelCost(),
+        contextWindow: model.contextWindow ?? 128000,
+        maxTokens: model.maxTokens ?? 16384,
+        ...(model.headers ? { headers: model.headers } : {}),
+        ...(model.compat ? { compat: model.compat } : {}),
+    }));
+    return {
+        ...(config.name ? { name: config.name } : {}),
+        ...(config.baseUrl ? { baseUrl: config.baseUrl } : {}),
+        ...(config.apiKey
+            ? { apiKey: expandEnvReference(config.apiKey, env) ?? undefined }
+            : {}),
+        ...(config.api ? { api: config.api } : {}),
+        ...(config.headers ? { headers: config.headers } : {}),
+        ...(config.authHeader !== undefined ? { authHeader: config.authHeader } : {}),
+        ...(models ? { models } : {}),
+    };
+}
+async function writePiApiKey(authPath, provider, apiKey) {
+    await mkdir(dirname(authPath), { recursive: true });
+    let auth = {};
+    try {
+        const parsed = JSON.parse(await readFile(authPath, 'utf8'));
+        if (isRecord(parsed))
+            auth = parsed;
+    }
+    catch (error) {
+        if (!isRecord(error) || error.code !== 'ENOENT')
+            throw error;
+    }
+    auth[provider] = { type: 'api_key', key: apiKey };
+    await writeFile(authPath, `${JSON.stringify(auth, null, 2)}\n`, 'utf8');
+}
+function toPiAuthInteraction(callbacks) {
+    return {
+        signal: callbacks.signal,
+        prompt: async (prompt) => {
+            if (prompt.type === 'select') {
+                const selected = await callbacks.onSelect({
+                    message: prompt.message,
+                    options: prompt.options.map((option) => ({
+                        id: option.id,
+                        label: option.label,
+                    })),
+                });
+                if (selected === undefined)
+                    throw new Error('OAuth login was cancelled.');
+                return selected;
+            }
+            if (prompt.type === 'manual_code' && callbacks.onManualCodeInput) {
+                return callbacks.onManualCodeInput();
+            }
+            return callbacks.onPrompt({
+                message: prompt.message,
+                ...(prompt.placeholder ? { placeholder: prompt.placeholder } : {}),
+            });
+        },
+        notify: (event) => {
+            if (event.type === 'auth_url') {
+                callbacks.onAuth({ url: event.url, instructions: event.instructions });
+            }
+            else if (event.type === 'device_code') {
+                callbacks.onDeviceCode({
+                    userCode: event.userCode,
+                    verificationUri: event.verificationUri,
+                    ...(event.intervalSeconds !== undefined
+                        ? { intervalSeconds: event.intervalSeconds }
+                        : {}),
+                    ...(event.expiresInSeconds !== undefined
+                        ? { expiresInSeconds: event.expiresInSeconds }
+                        : {}),
+                });
+            }
+            else if (callbacks.onProgress) {
+                callbacks.onProgress(event.message);
+            }
+        },
+    };
+}
+function knownPiModelsSync(models, _userAuth) {
+    const result = [];
+    for (const provider of getProviders()) {
+        try {
+            for (const model of getModels(provider) ?? [])
+                result.push(model);
+        }
+        catch {
+            // A static provider catalog failure must not make the sync auth guard fail.
+        }
+    }
+    for (const [provider, config] of Object.entries(models.providers)) {
+        for (const model of config.models ?? []) {
+            result.push({ provider, id: model.id, name: model.name });
+        }
+    }
+    return result;
+}
+function emptyPiModelCost() {
+    return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+}
 function normalizeProvider(value) {
     if (typeof value !== 'string')
         return undefined;