@autorag/librarian 2.13.10 → 2.13.12

package/dist/agent/decision-backends.d.ts

@@ -1,4 +1,4 @@
-import type { ClassifierApi, ClassifierContext, ClassifierModel, ClassifierResult, ModelsClassifierOptions } from "@earendil-works/pi-ai";
+import { type ClassifierApi, type ClassifierContext, type ClassifierModel, type ClassifierResult, type ModelsClassifierOptions } from "@earendil-works/pi-ai";
 import { type BackendRequest, type BackendResponse, type JevBackend } from "jev-use";
 /**
  * Decision models come from pi's model catalog: pi-ai ships every provider's typed-question

package/dist/cli/config.d.ts

@@ -1,4 +1,4 @@
-import type { Api, Model } from "@earendil-works/pi-ai";
+import { type Api, type Model } from "@earendil-works/pi-ai";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 import type { AutoRAGAgentOptions, AutoRAGRefreshLimits, AutoRAGRetrievalLimits } from "../agent/agent.js";
 import { type LoadLocalAutoRAGModelOptions } from "../agent/local-model.js";

package/dist/cli/index.js

@@ -1740,6 +1740,9 @@ import { homedir as homedir2 } from "node:os";
 import { join as join7 } from "node:path";
 import { parse as parse2 } from "smol-toml";
 function loadLocalAutoRAGModel(options = {}) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment") {
+    throw new Error("External model config discovery is disabled; configure the model endpoint and its environment key explicitly.");
+  }
   const configPath = options.configPath ?? join7(homedir2(), ".codex", "config.toml");
   const config = parse2(readFileSync7(configPath, "utf8"));
   const provider = config.model_provider;
@@ -2667,6 +2670,8 @@ var init_models = __esm(() => {
 import { join as join9 } from "node:path";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 function readDazziLoginToken(agentDir = getAgentDir()) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   return resolveCredentialKey(readStoredCredential(PROVIDER_ID, join9(agentDir, "auth.json")));
 }
 function isDazziSignedIn(agentDir = getAgentDir()) {
@@ -15738,6 +15743,7 @@ var init_types3 = __esm(() => {
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync17, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute6, join as join24, resolve as resolve7 } from "node:path";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { getAgentDir as getAgentDir2, ModelRuntime, SettingsManager } from "@earendil-works/pi-coding-agent";
 function resolveConfigPath(input) {
@@ -16781,10 +16787,20 @@ function resolveAgentDir(options) {
   return options.agentDir ?? getAgentDir2();
 }
 function getModelRuntime(agentDir) {
-  const cached = modelRuntimeCache.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  const cached = modelRuntimeCache.get(cacheKey);
   if (cached !== undefined)
     return cached;
   const created = (async () => {
+    if (environmentOnly) {
+      return ModelRuntime.create({
+        credentials: new InMemoryCredentialStore,
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false
+      });
+    }
     const runtime = await ModelRuntime.create({
       authPath: join24(agentDir, "auth.json"),
       modelsPath: join24(agentDir, "models.json"),
@@ -16793,9 +16809,9 @@ function getModelRuntime(agentDir) {
     await registerDazziProvider(runtime);
     return runtime;
   })();
-  modelRuntimeCache.set(agentDir, created);
+  modelRuntimeCache.set(cacheKey, created);
   created.catch(() => {
-    modelRuntimeCache.delete(agentDir);
+    modelRuntimeCache.delete(cacheKey);
   });
   return created;
 }
@@ -16826,6 +16842,8 @@ function localRuntimeAuth(local) {
   };
 }
 async function resolvePiDefaultModel(runtime, options) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   let provider;
   let id;
   try {
@@ -32152,17 +32170,21 @@ var init_datasource_skill = __esm(() => {
 
 // src/agent/decision-backends.ts
 import { join as join48 } from "node:path";
+import {
+  InMemoryCredentialStore as InMemoryCredentialStore2
+} from "@earendil-works/pi-ai";
 import { getAgentDir as getAgentDir3, ModelRuntime as ModelRuntime3 } from "@earendil-works/pi-coding-agent";
 import { BackendError as BackendError3 } from "jev-use";
 function runtimeFor(agentDir) {
-  let runtime = runtimes.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  let runtime = runtimes.get(cacheKey);
   if (runtime === undefined) {
     runtime = ModelRuntime3.create({
-      authPath: join48(agentDir, "auth.json"),
-      modelsPath: join48(agentDir, "models.json"),
+      ...environmentOnly ? { credentials: new InMemoryCredentialStore2, modelsPath: null, refreshOnCreate: false } : { authPath: join48(agentDir, "auth.json"), modelsPath: join48(agentDir, "models.json") },
       allowModelNetwork: false
     });
-    runtimes.set(agentDir, runtime);
+    runtimes.set(cacheKey, runtime);
   }
   return runtime;
 }

package/dist/core.js

@@ -11569,6 +11569,8 @@ var init_models = __esm(() => {
 import { join as join28 } from "node:path";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 function readDazziLoginToken(agentDir = getAgentDir()) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   return resolveCredentialKey(readStoredCredential(PROVIDER_ID, join28(agentDir, "auth.json")));
 }
 function isDazziSignedIn(agentDir = getAgentDir()) {
@@ -16776,6 +16778,9 @@ import { homedir as homedir3 } from "node:os";
 import { join as join32 } from "node:path";
 import { parse as parse2 } from "smol-toml";
 function loadLocalAutoRAGModel(options = {}) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment") {
+    throw new Error("External model config discovery is disabled; configure the model endpoint and its environment key explicitly.");
+  }
   const configPath = options.configPath ?? join32(homedir3(), ".codex", "config.toml");
   const config = parse2(readFileSync16(configPath, "utf8"));
   const provider = config.model_provider;
@@ -27929,6 +27934,7 @@ var init_factory = __esm(() => {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync27, mkdirSync as mkdirSync21, readFileSync as readFileSync24, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "node:fs";
 import { basename as basename13, dirname as dirname24, isAbsolute as isAbsolute11, join as join43, resolve as resolve15 } from "node:path";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { getAgentDir as getAgentDir2, ModelRuntime, SettingsManager } from "@earendil-works/pi-coding-agent";
 function resolveConfigPath(input) {
@@ -28972,10 +28978,20 @@ function resolveAgentDir(options) {
   return options.agentDir ?? getAgentDir2();
 }
 function getModelRuntime(agentDir) {
-  const cached = modelRuntimeCache.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  const cached = modelRuntimeCache.get(cacheKey);
   if (cached !== undefined)
     return cached;
   const created = (async () => {
+    if (environmentOnly) {
+      return ModelRuntime.create({
+        credentials: new InMemoryCredentialStore,
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false
+      });
+    }
     const runtime = await ModelRuntime.create({
       authPath: join43(agentDir, "auth.json"),
       modelsPath: join43(agentDir, "models.json"),
@@ -28984,9 +29000,9 @@ function getModelRuntime(agentDir) {
     await registerDazziProvider(runtime);
     return runtime;
   })();
-  modelRuntimeCache.set(agentDir, created);
+  modelRuntimeCache.set(cacheKey, created);
   created.catch(() => {
-    modelRuntimeCache.delete(agentDir);
+    modelRuntimeCache.delete(cacheKey);
   });
   return created;
 }
@@ -29017,6 +29033,8 @@ function localRuntimeAuth(local) {
   };
 }
 async function resolvePiDefaultModel(runtime, options) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   let provider;
   let id;
   try {
@@ -33957,17 +33975,21 @@ var init_datasource_skill = __esm(() => {
 
 // src/agent/decision-backends.ts
 import { join as join52 } from "node:path";
+import {
+  InMemoryCredentialStore as InMemoryCredentialStore2
+} from "@earendil-works/pi-ai";
 import { getAgentDir as getAgentDir5, ModelRuntime as ModelRuntime4 } from "@earendil-works/pi-coding-agent";
 import { BackendError as BackendError3 } from "jev-use";
 function runtimeFor(agentDir) {
-  let runtime = runtimes.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  let runtime = runtimes.get(cacheKey);
   if (runtime === undefined) {
     runtime = ModelRuntime4.create({
-      authPath: join52(agentDir, "auth.json"),
-      modelsPath: join52(agentDir, "models.json"),
+      ...environmentOnly ? { credentials: new InMemoryCredentialStore2, modelsPath: null, refreshOnCreate: false } : { authPath: join52(agentDir, "auth.json"), modelsPath: join52(agentDir, "models.json") },
       allowModelNetwork: false
     });
-    runtimes.set(agentDir, runtime);
+    runtimes.set(cacheKey, runtime);
   }
   return runtime;
 }

package/dist/index.js

@@ -11569,6 +11569,8 @@ var init_models = __esm(() => {
 import { join as join28 } from "node:path";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 function readDazziLoginToken(agentDir = getAgentDir()) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   return resolveCredentialKey(readStoredCredential(PROVIDER_ID, join28(agentDir, "auth.json")));
 }
 function isDazziSignedIn(agentDir = getAgentDir()) {
@@ -16776,6 +16778,9 @@ import { homedir as homedir3 } from "node:os";
 import { join as join32 } from "node:path";
 import { parse as parse2 } from "smol-toml";
 function loadLocalAutoRAGModel(options = {}) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment") {
+    throw new Error("External model config discovery is disabled; configure the model endpoint and its environment key explicitly.");
+  }
   const configPath = options.configPath ?? join32(homedir3(), ".codex", "config.toml");
   const config = parse2(readFileSync16(configPath, "utf8"));
   const provider = config.model_provider;
@@ -27929,6 +27934,7 @@ var init_factory = __esm(() => {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync27, mkdirSync as mkdirSync21, readFileSync as readFileSync24, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "node:fs";
 import { basename as basename13, dirname as dirname24, isAbsolute as isAbsolute11, join as join43, resolve as resolve15 } from "node:path";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { getAgentDir as getAgentDir2, ModelRuntime, SettingsManager } from "@earendil-works/pi-coding-agent";
 function resolveConfigPath(input) {
@@ -28972,10 +28978,20 @@ function resolveAgentDir(options) {
   return options.agentDir ?? getAgentDir2();
 }
 function getModelRuntime(agentDir) {
-  const cached = modelRuntimeCache.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  const cached = modelRuntimeCache.get(cacheKey);
   if (cached !== undefined)
     return cached;
   const created = (async () => {
+    if (environmentOnly) {
+      return ModelRuntime.create({
+        credentials: new InMemoryCredentialStore,
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false
+      });
+    }
     const runtime = await ModelRuntime.create({
       authPath: join43(agentDir, "auth.json"),
       modelsPath: join43(agentDir, "models.json"),
@@ -28984,9 +29000,9 @@ function getModelRuntime(agentDir) {
     await registerDazziProvider(runtime);
     return runtime;
   })();
-  modelRuntimeCache.set(agentDir, created);
+  modelRuntimeCache.set(cacheKey, created);
   created.catch(() => {
-    modelRuntimeCache.delete(agentDir);
+    modelRuntimeCache.delete(cacheKey);
   });
   return created;
 }
@@ -29017,6 +29033,8 @@ function localRuntimeAuth(local) {
   };
 }
 async function resolvePiDefaultModel(runtime, options) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   let provider;
   let id;
   try {
@@ -33957,17 +33975,21 @@ var init_datasource_skill = __esm(() => {
 
 // src/agent/decision-backends.ts
 import { join as join52 } from "node:path";
+import {
+  InMemoryCredentialStore as InMemoryCredentialStore2
+} from "@earendil-works/pi-ai";
 import { getAgentDir as getAgentDir5, ModelRuntime as ModelRuntime4 } from "@earendil-works/pi-coding-agent";
 import { BackendError as BackendError3 } from "jev-use";
 function runtimeFor(agentDir) {
-  let runtime = runtimes.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  let runtime = runtimes.get(cacheKey);
   if (runtime === undefined) {
     runtime = ModelRuntime4.create({
-      authPath: join52(agentDir, "auth.json"),
-      modelsPath: join52(agentDir, "models.json"),
+      ...environmentOnly ? { credentials: new InMemoryCredentialStore2, modelsPath: null, refreshOnCreate: false } : { authPath: join52(agentDir, "auth.json"), modelsPath: join52(agentDir, "models.json") },
       allowModelNetwork: false
     });
-    runtimes.set(agentDir, runtime);
+    runtimes.set(cacheKey, runtime);
   }
   return runtime;
 }
@@ -43294,6 +43316,37 @@ function jsonResult(value, isError = false) {
 function toolError(code, message, extra = {}) {
   return jsonResult({ ok: false, errorCode: code, message, ...extra }, true);
 }
+var DIAGNOSTIC_EXAMPLES_PER_CODE = 3;
+function capDiagnostics(diagnostics) {
+  const byCode = new Map;
+  for (const entry of diagnostics) {
+    const list = byCode.get(entry.code);
+    if (list === undefined)
+      byCode.set(entry.code, [entry]);
+    else
+      list.push(entry);
+  }
+  const out = [];
+  for (const [code, entries] of byCode) {
+    out.push(...entries.slice(0, DIAGNOSTIC_EXAMPLES_PER_CODE));
+    const rest = entries.slice(DIAGNOSTIC_EXAMPLES_PER_CODE);
+    if (rest.length === 0)
+      continue;
+    const reasons = new Map;
+    for (const entry of rest) {
+      const key = entry.reason ?? "unspecified";
+      reasons.set(key, (reasons.get(key) ?? 0) + 1);
+    }
+    const split = [...reasons].map(([reason, count]) => `${reason}: ${count}`).join(", ");
+    const severity = entries.some((entry) => entry.severity === "error") ? "error" : entries.some((entry) => entry.severity === "warning") ? "warning" : "info";
+    out.push({
+      code,
+      severity,
+      message: `${rest.length} more ${code} entries omitted (${split}); the first ${DIAGNOSTIC_EXAMPLES_PER_CODE} are shown above.`
+    });
+  }
+  return out;
+}
 function convertResult(details) {
   const { result, links } = details;
   const files = result.files.slice(0, MAX_CONVERT_FILES).map((file) => ({
@@ -43439,7 +43492,10 @@ function createAutoRAGMcpServer(lite, options = {}) {
       inputSchema: emptyInput,
       outputSchema: objectOutput,
       annotations: { readOnlyHint: true, openWorldHint: false }
-    }, async () => jsonResult(await lite.getRefreshStatus()));
+    }, async () => {
+      const status = await lite.getRefreshStatus();
+      return jsonResult({ ...status, diagnostics: capDiagnostics(status.diagnostics) });
+    });
   }
   if (isToolEnabled("autorag.search", options)) {
     server.registerTool("autorag.search", {
@@ -43478,7 +43534,7 @@ function createAutoRAGMcpServer(lite, options = {}) {
             content: result.content
           })),
           unsearched: retrieved.unsearched,
-          diagnostics: [...status.diagnostics, ...retrieved.diagnostics]
+          diagnostics: capDiagnostics([...status.diagnostics, ...retrieved.diagnostics])
         });
       } catch (error) {
         return toolError(error instanceof RetrievalSelectionError ? "invalid-selection" : "search-failed", error instanceof Error ? error.message : String(error), { retryable: !(error instanceof RetrievalSelectionError) });
@@ -43533,7 +43589,7 @@ function createAutoRAGMcpServer(lite, options = {}) {
             content: result.content
           })),
           unsearched: retrieved.unsearched,
-          diagnostics: [...status.diagnostics, ...retrieved.diagnostics]
+          diagnostics: capDiagnostics([...status.diagnostics, ...retrieved.diagnostics])
         });
       } catch (error) {
         return toolError(error instanceof RetrievalSelectionError ? "invalid-selection" : "search-failed", error instanceof Error ? error.message : String(error), { datasourceId: entry.datasourceId, retryable: !(error instanceof RetrievalSelectionError) });

package/dist/mcp/index.js

@@ -11570,6 +11570,8 @@ var init_models = __esm(() => {
 import { join as join28 } from "node:path";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 function readDazziLoginToken(agentDir = getAgentDir()) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   return resolveCredentialKey(readStoredCredential(PROVIDER_ID, join28(agentDir, "auth.json")));
 }
 function isDazziSignedIn(agentDir = getAgentDir()) {
@@ -16777,6 +16779,9 @@ import { homedir as homedir3 } from "node:os";
 import { join as join32 } from "node:path";
 import { parse as parse2 } from "smol-toml";
 function loadLocalAutoRAGModel(options = {}) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment") {
+    throw new Error("External model config discovery is disabled; configure the model endpoint and its environment key explicitly.");
+  }
   const configPath = options.configPath ?? join32(homedir3(), ".codex", "config.toml");
   const config = parse2(readFileSync16(configPath, "utf8"));
   const provider = config.model_provider;
@@ -27930,6 +27935,7 @@ var init_factory = __esm(() => {
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync27, mkdirSync as mkdirSync21, readFileSync as readFileSync24, unlinkSync as unlinkSync3, writeFileSync as writeFileSync14 } from "node:fs";
 import { basename as basename13, dirname as dirname24, isAbsolute as isAbsolute11, join as join43, resolve as resolve15 } from "node:path";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { getAgentDir as getAgentDir2, ModelRuntime, SettingsManager } from "@earendil-works/pi-coding-agent";
 function resolveConfigPath(input) {
@@ -28973,10 +28979,20 @@ function resolveAgentDir(options) {
   return options.agentDir ?? getAgentDir2();
 }
 function getModelRuntime(agentDir) {
-  const cached = modelRuntimeCache.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  const cached = modelRuntimeCache.get(cacheKey);
   if (cached !== undefined)
     return cached;
   const created = (async () => {
+    if (environmentOnly) {
+      return ModelRuntime.create({
+        credentials: new InMemoryCredentialStore,
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false
+      });
+    }
     const runtime = await ModelRuntime.create({
       authPath: join43(agentDir, "auth.json"),
       modelsPath: join43(agentDir, "models.json"),
@@ -28985,9 +29001,9 @@ function getModelRuntime(agentDir) {
     await registerDazziProvider(runtime);
     return runtime;
   })();
-  modelRuntimeCache.set(agentDir, created);
+  modelRuntimeCache.set(cacheKey, created);
   created.catch(() => {
-    modelRuntimeCache.delete(agentDir);
+    modelRuntimeCache.delete(cacheKey);
   });
   return created;
 }
@@ -29018,6 +29034,8 @@ function localRuntimeAuth(local) {
   };
 }
 async function resolvePiDefaultModel(runtime, options) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   let provider;
   let id;
   try {
@@ -33958,17 +33976,21 @@ var init_datasource_skill = __esm(() => {
 
 // src/agent/decision-backends.ts
 import { join as join52 } from "node:path";
+import {
+  InMemoryCredentialStore as InMemoryCredentialStore2
+} from "@earendil-works/pi-ai";
 import { getAgentDir as getAgentDir5, ModelRuntime as ModelRuntime4 } from "@earendil-works/pi-coding-agent";
 import { BackendError as BackendError3 } from "jev-use";
 function runtimeFor(agentDir) {
-  let runtime = runtimes.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  let runtime = runtimes.get(cacheKey);
   if (runtime === undefined) {
     runtime = ModelRuntime4.create({
-      authPath: join52(agentDir, "auth.json"),
-      modelsPath: join52(agentDir, "models.json"),
+      ...environmentOnly ? { credentials: new InMemoryCredentialStore2, modelsPath: null, refreshOnCreate: false } : { authPath: join52(agentDir, "auth.json"), modelsPath: join52(agentDir, "models.json") },
       allowModelNetwork: false
     });
-    runtimes.set(agentDir, runtime);
+    runtimes.set(cacheKey, runtime);
   }
   return runtime;
 }
@@ -43115,6 +43137,37 @@ function jsonResult(value, isError = false) {
 function toolError(code, message, extra = {}) {
   return jsonResult({ ok: false, errorCode: code, message, ...extra }, true);
 }
+var DIAGNOSTIC_EXAMPLES_PER_CODE = 3;
+function capDiagnostics(diagnostics) {
+  const byCode = new Map;
+  for (const entry of diagnostics) {
+    const list = byCode.get(entry.code);
+    if (list === undefined)
+      byCode.set(entry.code, [entry]);
+    else
+      list.push(entry);
+  }
+  const out = [];
+  for (const [code, entries] of byCode) {
+    out.push(...entries.slice(0, DIAGNOSTIC_EXAMPLES_PER_CODE));
+    const rest = entries.slice(DIAGNOSTIC_EXAMPLES_PER_CODE);
+    if (rest.length === 0)
+      continue;
+    const reasons = new Map;
+    for (const entry of rest) {
+      const key = entry.reason ?? "unspecified";
+      reasons.set(key, (reasons.get(key) ?? 0) + 1);
+    }
+    const split = [...reasons].map(([reason, count]) => `${reason}: ${count}`).join(", ");
+    const severity = entries.some((entry) => entry.severity === "error") ? "error" : entries.some((entry) => entry.severity === "warning") ? "warning" : "info";
+    out.push({
+      code,
+      severity,
+      message: `${rest.length} more ${code} entries omitted (${split}); the first ${DIAGNOSTIC_EXAMPLES_PER_CODE} are shown above.`
+    });
+  }
+  return out;
+}
 function convertResult(details) {
   const { result, links } = details;
   const files = result.files.slice(0, MAX_CONVERT_FILES).map((file) => ({
@@ -43260,7 +43313,10 @@ function createAutoRAGMcpServer(lite, options = {}) {
       inputSchema: emptyInput,
       outputSchema: objectOutput,
       annotations: { readOnlyHint: true, openWorldHint: false }
-    }, async () => jsonResult(await lite.getRefreshStatus()));
+    }, async () => {
+      const status = await lite.getRefreshStatus();
+      return jsonResult({ ...status, diagnostics: capDiagnostics(status.diagnostics) });
+    });
   }
   if (isToolEnabled("autorag.search", options)) {
     server.registerTool("autorag.search", {
@@ -43299,7 +43355,7 @@ function createAutoRAGMcpServer(lite, options = {}) {
             content: result.content
           })),
           unsearched: retrieved.unsearched,
-          diagnostics: [...status.diagnostics, ...retrieved.diagnostics]
+          diagnostics: capDiagnostics([...status.diagnostics, ...retrieved.diagnostics])
         });
       } catch (error) {
         return toolError(error instanceof RetrievalSelectionError ? "invalid-selection" : "search-failed", error instanceof Error ? error.message : String(error), { retryable: !(error instanceof RetrievalSelectionError) });
@@ -43354,7 +43410,7 @@ function createAutoRAGMcpServer(lite, options = {}) {
             content: result.content
           })),
           unsearched: retrieved.unsearched,
-          diagnostics: [...status.diagnostics, ...retrieved.diagnostics]
+          diagnostics: capDiagnostics([...status.diagnostics, ...retrieved.diagnostics])
         });
       } catch (error) {
         return toolError(error instanceof RetrievalSelectionError ? "invalid-selection" : "search-failed", error instanceof Error ? error.message : String(error), { datasourceId: entry.datasourceId, retryable: !(error instanceof RetrievalSelectionError) });

package/dist/mcp/server.d.ts

@@ -6,4 +6,20 @@ export interface AutoRAGMcpServerOptions {
     /** Test/embedded override; defaults to the current Node platform. */
     readonly platform?: NodeJS.Platform;
 }
+interface DiagnosticLike {
+    readonly code: string;
+    readonly severity: string;
+    readonly message: string;
+    readonly source?: string;
+    readonly reason?: string;
+}
+/**
+ * Keep an MCP response small when one code repeats once per file. A corpus whose parser changed reports one
+ * `stale-index` entry per source (1,100 of them, about 750 KB, on a real 160k-file index), which the model then has to
+ * read through on every search and status call. Each code keeps its first few entries verbatim and one summary entry
+ * says how many more there were and how they split by `reason`, so "why is it stale" survives and a different code is
+ * never hidden behind a flood of this one. Short lists pass through unchanged.
+ */
+export declare function capDiagnostics<T extends DiagnosticLike>(diagnostics: readonly T[]): (T | DiagnosticLike)[];
 export declare function createAutoRAGMcpServer(lite: AutoRAGLite, options?: AutoRAGMcpServerOptions): McpServer;
+export {};

package/dist/profiles.js

@@ -195,6 +195,9 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { parse } from "smol-toml";
 function loadLocalAutoRAGModel(options = {}) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment") {
+    throw new Error("External model config discovery is disabled; configure the model endpoint and its environment key explicitly.");
+  }
   const configPath = options.configPath ?? join(homedir(), ".codex", "config.toml");
   const config = parse(readFileSync(configPath, "utf8"));
   const provider = config.model_provider;
@@ -1122,6 +1125,8 @@ var init_models = __esm(() => {
 import { join as join3 } from "node:path";
 import { getAgentDir, readStoredCredential } from "@earendil-works/pi-coding-agent";
 function readDazziLoginToken(agentDir = getAgentDir()) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   return resolveCredentialKey(readStoredCredential(PROVIDER_ID, join3(agentDir, "auth.json")));
 }
 function isDazziSignedIn(agentDir = getAgentDir()) {
@@ -15274,6 +15279,7 @@ var init_types3 = __esm(() => {
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync12, readFileSync as readFileSync15, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { basename as basename5, dirname as dirname11, isAbsolute as isAbsolute5, join as join22, resolve as resolve6 } from "node:path";
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { getAgentDir as getAgentDir2, ModelRuntime, SettingsManager } from "@earendil-works/pi-coding-agent";
 function resolveConfigPath(input) {
@@ -16317,10 +16323,20 @@ function resolveAgentDir(options) {
   return options.agentDir ?? getAgentDir2();
 }
 function getModelRuntime(agentDir) {
-  const cached = modelRuntimeCache.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  const cached = modelRuntimeCache.get(cacheKey);
   if (cached !== undefined)
     return cached;
   const created = (async () => {
+    if (environmentOnly) {
+      return ModelRuntime.create({
+        credentials: new InMemoryCredentialStore,
+        modelsPath: null,
+        allowModelNetwork: false,
+        refreshOnCreate: false
+      });
+    }
     const runtime = await ModelRuntime.create({
       authPath: join22(agentDir, "auth.json"),
       modelsPath: join22(agentDir, "models.json"),
@@ -16329,9 +16345,9 @@ function getModelRuntime(agentDir) {
     await registerDazziProvider(runtime);
     return runtime;
   })();
-  modelRuntimeCache.set(agentDir, created);
+  modelRuntimeCache.set(cacheKey, created);
   created.catch(() => {
-    modelRuntimeCache.delete(agentDir);
+    modelRuntimeCache.delete(cacheKey);
   });
   return created;
 }
@@ -16362,6 +16378,8 @@ function localRuntimeAuth(local) {
   };
 }
 async function resolvePiDefaultModel(runtime, options) {
+  if (process.env.AUTORAG_AUTH_MODE === "environment")
+    return;
   let provider;
   let id;
   try {
@@ -32518,17 +32536,21 @@ var init_datasource_skill = __esm(() => {
 
 // src/agent/decision-backends.ts
 import { join as join49 } from "node:path";
+import {
+  InMemoryCredentialStore as InMemoryCredentialStore2
+} from "@earendil-works/pi-ai";
 import { getAgentDir as getAgentDir4, ModelRuntime as ModelRuntime3 } from "@earendil-works/pi-coding-agent";
 import { BackendError as BackendError3 } from "jev-use";
 function runtimeFor(agentDir) {
-  let runtime = runtimes.get(agentDir);
+  const environmentOnly = process.env.AUTORAG_AUTH_MODE === "environment";
+  const cacheKey = `${environmentOnly ? "environment" : "stored"}:${agentDir}`;
+  let runtime = runtimes.get(cacheKey);
   if (runtime === undefined) {
     runtime = ModelRuntime3.create({
-      authPath: join49(agentDir, "auth.json"),
-      modelsPath: join49(agentDir, "models.json"),
+      ...environmentOnly ? { credentials: new InMemoryCredentialStore2, modelsPath: null, refreshOnCreate: false } : { authPath: join49(agentDir, "auth.json"), modelsPath: join49(agentDir, "models.json") },
       allowModelNetwork: false
     });
-    runtimes.set(agentDir, runtime);
+    runtimes.set(cacheKey, runtime);
   }
   return runtime;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autorag/librarian",
-  "version": "2.13.10",
+  "version": "2.13.12",
   "description": "Personal librarian agent for office work on the Pi framework, with pluggable retrieval methods",
   "license": "Apache-2.0",
   "repository": {