@blackbelt-technology/pi-agent-dashboard 0.4.6 → 0.5.1

package/packages/shared/src/index.ts

@@ -0,0 +1,9 @@
+/**
+ * Barrel re-exports for selected shared symbols. Most consumers import
+ * directly from per-file paths (`@blackbelt-technology/pi-dashboard-shared/<file>.js`)
+ * via the package's `exports` map. This barrel exists for symbols that
+ * would otherwise be cumbersome to wire — currently the doctor core.
+ *
+ * Added by change: doctor-rich-output.
+ */
+export * from "./doctor-core.js";

package/packages/shared/src/installable-list.ts

@@ -0,0 +1,152 @@
+/**
+ * installable-list.ts — types and helpers for ~/.pi/dashboard/installable.json.
+ *
+ * This file describes the set of packages the dashboard needs installed.
+ * Electron seeds the file on first run; Bridge / Standalone ignore it (file-absent
+ * path is a no-op in the server bootstrap). The server reads it during bootstrap.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export type InstallableKind = "npm" | "pi-extension";
+
+export interface InstallablePackage {
+  name: string;
+  /** Semver range or "*". */
+  version: string;
+  required: boolean;
+  kind: InstallableKind;
+  deprecated?: boolean;
+  defaultOff?: boolean;
+}
+
+export interface InstallableList {
+  version: string;
+  packages: InstallablePackage[];
+}
+
+export interface MergeResult {
+  list: InstallableList;
+  warnings: string[];
+}
+
+const VALID_KINDS: ReadonlySet<string> = new Set<InstallableKind>(["npm", "pi-extension"]);
+
+function defaultConfigDir(): string {
+  return path.join(os.homedir(), ".pi", "dashboard");
+}
+
+function installablePath(configDir: string): string {
+  return path.join(configDir, "installable.json");
+}
+
+/**
+ * Read `~/.pi/dashboard/installable.json` (or `configDir/installable.json`).
+ *
+ * Returns `null` when the file is absent. Logs a warning and drops entries
+ * with an invalid `kind` field. Does NOT create the file.
+ */
+export async function readInstallableList(
+  configDir?: string,
+): Promise<InstallableList | null> {
+  const dir = configDir ?? defaultConfigDir();
+  const filePath = installablePath(dir);
+
+  let raw: string;
+  try {
+    raw = await fs.promises.readFile(filePath, "utf-8");
+  } catch (err: any) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+
+  const parsed = JSON.parse(raw) as InstallableList;
+
+  const validPackages: InstallablePackage[] = [];
+  for (const pkg of parsed.packages ?? []) {
+    if (!VALID_KINDS.has(pkg.kind)) {
+      console.warn(
+        `[installable-list] Dropping entry "${pkg.name}" with unknown kind "${pkg.kind}".`,
+      );
+      continue;
+    }
+    validPackages.push(pkg);
+  }
+
+  return { version: parsed.version, packages: validPackages };
+}
+
+/**
+ * Atomically write `list` to `configDir/installable.json`.
+ * Writes a temp file then renames so readers never see a partial write.
+ */
+export async function writeInstallableList(
+  list: InstallableList,
+  configDir?: string,
+): Promise<void> {
+  const dir = configDir ?? defaultConfigDir();
+  const filePath = installablePath(dir);
+  const tmpPath = filePath + ".tmp." + process.pid;
+
+  await fs.promises.mkdir(dir, { recursive: true });
+  await fs.promises.writeFile(tmpPath, JSON.stringify(list, null, 2), "utf-8");
+  await fs.promises.rename(tmpPath, filePath);
+}
+
+/**
+ * Pure merge: reconcile a user's `existing` list against the `bundled` defaults.
+ *
+ * Rules:
+ * - Package in both: keep user's pinned version (user wins); emit a warning when
+ *   the bundled default differs.
+ * - Package in existing but NOT in bundled: keep it, set `deprecated: true`, emit warning.
+ * - New `required: true` package in bundled: add it.
+ * - New `required: false` package in bundled: add it with `defaultOff: true`.
+ * - Result version marker comes from `bundled.version`.
+ */
+export function mergeInstallableList(
+  existing: InstallableList,
+  bundled: InstallableList,
+): MergeResult {
+  const warnings: string[] = [];
+  const bundledMap = new Map(bundled.packages.map((p) => [p.name, p]));
+  const existingMap = new Map(existing.packages.map((p) => [p.name, p]));
+
+  const merged: InstallablePackage[] = [];
+
+  // Walk existing packages.
+  for (const pkg of existing.packages) {
+    const bundledPkg = bundledMap.get(pkg.name);
+    if (!bundledPkg) {
+      // Dropped in bundled → deprecate.
+      warnings.push(
+        `Package "${pkg.name}" is no longer in the bundled list and has been marked deprecated.`,
+      );
+      merged.push({ ...pkg, deprecated: true });
+    } else {
+      // Present in both → user version wins.
+      if (pkg.version !== bundledPkg.version) {
+        warnings.push(
+          `Package "${pkg.name}" is pinned at "${pkg.version}" (bundled default: "${bundledPkg.version}"). User pin preserved.`,
+        );
+      }
+      merged.push({ ...pkg });
+    }
+  }
+
+  // Walk bundled packages not yet in existing.
+  for (const bundledPkg of bundled.packages) {
+    if (existingMap.has(bundledPkg.name)) continue;
+    if (!bundledPkg.required) {
+      merged.push({ ...bundledPkg, defaultOff: true });
+    } else {
+      merged.push({ ...bundledPkg });
+    }
+  }
+
+  return {
+    list: { version: bundled.version, packages: merged },
+    warnings,
+  };
+}

package/packages/shared/src/launch-source-flag.ts

@@ -0,0 +1,14 @@
+/**
+ * Feature flag for the LaunchSource V2 resolver.
+ * Default: true (Phase C cutover). Set LAUNCH_SOURCE_V2=false to revert to
+ * the legacy wizard + mode.json path for debugging.
+ *
+ * TODO: remove LAUNCH_SOURCE_V2 flag in follow-up change after Phase C ships
+ * without regressions for one release cycle. The flag and its CI matrix
+ * entry should be deleted at that point.
+ */
+export function isLaunchSourceV2Enabled(env: Record<string, string | undefined>): boolean {
+  const val = env["LAUNCH_SOURCE_V2"];
+  if (val === undefined) return true; // default ON in Phase C
+  return val === "true" || val === "1";
+}

package/packages/shared/src/launch-source-types.ts

@@ -0,0 +1,18 @@
+/**
+ * LaunchSource — discriminated union describing how the dashboard server was (or should be) started.
+ *
+ * "attach"      — a server is already running; Electron attaches to it.
+ * "devMonorepo" — running from a checked-out monorepo (dev workflow).
+ * "piExtension" — the pi bridge extension owns a server package in node_modules.
+ * "npmGlobal"   — `pi-dashboard` is installed globally via npm.
+ * "extracted"   — bundled Electron resources provide the server (managed install).
+ */
+
+export type SourceKind = "attach" | "devMonorepo" | "piExtension" | "npmGlobal" | "extracted";
+
+export type LaunchSource =
+  | { kind: "attach"; url: string; starter: "Bridge" | "Standalone" | "Electron" }
+  | { kind: "devMonorepo"; cliPath: string; cwd: string }
+  | { kind: "piExtension"; cliPath: string; cwd: string }
+  | { kind: "npmGlobal"; cliPath: string; cwd: string }
+  | { kind: "extracted"; cliPath: string; cwd: string; didExtract?: boolean };

package/packages/shared/src/openspec-activity-detector.ts

@@ -40,6 +40,22 @@ const CLI_ARCHIVE_RE = /openspec\s+archive\s+["']?([^\s"']+)["']?/;
 /** Regex to match openspec new change "name" (positional arg) */
 const CLI_NEW_CHANGE_RE = /openspec\s+new\s+change\s+["']?([^\s"']+)["']?/;
 
+/**
+ * OpenSpec change-slug shape: lowercase kebab-case, must start with a letter,
+ * max 64 characters. Mirrors the validation enforced by `openspec new change`.
+ *
+ * Single source of truth for any code that needs to gate a captured token
+ * before treating it as an OpenSpec change name (detector + auto-attach
+ * defense-in-depth in event-wiring.ts).
+ *
+ * See change: fix-uuid-rename-bug.
+ */
+const OPENSPEC_CHANGE_SLUG_RE = /^[a-z][a-z0-9-]{0,63}$/;
+
+export function isValidOpenSpecChangeSlug(name: string): boolean {
+  return OPENSPEC_CHANGE_SLUG_RE.test(name);
+}
+
 export function detectOpenSpecActivity(
   toolName: string,
   args: Record<string, unknown> | undefined,
@@ -63,7 +79,7 @@ export function detectOpenSpecActivity(
 
     // Check for openspec change file read → change name detection (passive)
     const changeMatch = path.match(CHANGE_PATH_RE);
-    if (changeMatch) {
+    if (changeMatch && isValidOpenSpecChangeSlug(changeMatch[1])) {
       return { changeName: changeMatch[1], isActive: false };
     }
 
@@ -75,7 +91,7 @@ export function detectOpenSpecActivity(
     if (!path) return null;
 
     const changeMatch = path.match(CHANGE_PATH_RE);
-    if (changeMatch) {
+    if (changeMatch && isValidOpenSpecChangeSlug(changeMatch[1])) {
       return { changeName: changeMatch[1], isActive: true };
     }
 
@@ -94,11 +110,13 @@ export function detectOpenSpecActivity(
       if (!match) return null;
 
       const name = match[1];
-      // Reject flag-shaped tokens (e.g. `--help`, `-h`). The CLI regex capture
-      // groups use `[^\s"']+` which would otherwise treat `--help` as a change
-      // name and trigger downstream auto-attach + auto-rename.
-      // See change: fix-openspec-flag-rename-bug.
-      if (name.startsWith("-")) return null;
+      // Reject any token that is not a valid OpenSpec change slug. Subsumes the
+      // earlier `-`-prefix guard (a leading `-` fails the `[a-z]` first-char
+      // class) and additionally rejects UUIDs, mixed-case, underscored, or
+      // overlong tokens that the CLI regexes' `[^\s"']+` capture group would
+      // otherwise pass through into auto-attach + auto-rename.
+      // See changes: fix-openspec-flag-rename-bug, fix-uuid-rename-bug.
+      if (!isValidOpenSpecChangeSlug(name)) return null;
 
       return { changeName: name, isActive: true };
     }

package/packages/shared/src/platform/detached-spawn.ts

@@ -47,10 +47,18 @@ export interface SpawnDetachedOptions {
   /** Environment for the child. Defaults to `process.env` via Node. */
   env?: NodeJS.ProcessEnv;
   /**
-   * Optional file descriptor for stderr. When omitted, stderr is "ignore".
+   * Optional file descriptor for combined stdout + stderr. When omitted,
+   * BOTH stdout and stderr are "ignore".
+   *
    * Caller is responsible for `fs.openSync(logPath, "a")` and closing the
    * parent's copy after spawn (the child retains its dup via stdio
    * inheritance). File fds survive parent death; pipes do not.
+   *
+   * Routing both streams to a single fd matches what the standalone CLI
+   * (`packages/server/src/cli.ts`) does directly with raw `spawn()`. Prior
+   * to change `fix-electron-extracted-jiti-and-stdio-capture`, only stderr
+   * was captured and clean-startup `console.log` output was silently
+   * dropped (resulting in 0-byte server.log files).
    */
   logFd?: number;
   /**
@@ -123,7 +131,10 @@ export interface SpawnDetachedResult {
  */
 export async function spawnDetached(opts: SpawnDetachedOptions): Promise<SpawnDetachedResult> {
   const stdioIn: "ignore" | "pipe" = opts.stdinMode ?? "ignore";
-  const stdio: ("ignore" | "pipe" | number)[] = [stdioIn, "ignore", opts.logFd ?? "ignore"];
+  // logFd applies to BOTH stdout and stderr. See JSDoc on logFd above and
+  // change: fix-electron-extracted-jiti-and-stdio-capture.
+  const outFd: "ignore" | number = opts.logFd ?? "ignore";
+  const stdio: ("ignore" | "pipe" | number)[] = [stdioIn, outFd, outFd];
 
   let child: ChildProcess;
   let spawnError: string | null = null;

package/packages/shared/src/platform/managed-node-path.ts

@@ -0,0 +1,77 @@
+/**
+ * Prepend the managed Node runtime directory to a child-process `PATH`.
+ *
+ * The managed Node lives at `<managedDir>/node/` (Windows: binaries at
+ * the root; Unix: binaries under `bin/`). When present, every spawn the
+ * dashboard controls SHALL inherit that directory at the front of its
+ * `PATH` so plain `node` / `npm` invocations inside the child process
+ * resolve to the managed runtime.
+ *
+ * Pure helper: never mutates `process.env`, returns a distinct cloned
+ * env object, no-ops when the managed runtime is absent.
+ *
+ * See change: embed-managed-node-runtime (spec: managed-node-runtime,
+ * Requirement: Spawned children inherit managed Node on PATH).
+ */
+import path from "node:path";
+import { existsSync } from "node:fs";
+import { getManagedDir, type ManagedPathsEnv } from "../managed-paths.js";
+
+/**
+ * Resolve the bin directory inside the managed Node tree.
+ *   Windows: `<managedDir>/node`        (node.exe + npm.cmd live at root)
+ *   Unix:    `<managedDir>/node/bin`    (node, npm, npx live under bin/)
+ *
+ * `platform` defaults to `process.platform`; tests inject `"win32"` from
+ * a Linux host to exercise the Windows layout.
+ */
+export function getManagedNodeBinDir(
+  env?: ManagedPathsEnv,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const root = path.join(getManagedDir(env), "node");
+  return platform === "win32" ? root : path.join(root, "bin");
+}
+
+/** Path to the managed `node` / `node.exe` binary. */
+export function getManagedNodeBinary(
+  env?: ManagedPathsEnv,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const bin = getManagedNodeBinDir(env, platform);
+  return path.join(bin, platform === "win32" ? "node.exe" : "node");
+}
+
+/** True iff the managed Node runtime is installed (binary exists). */
+export function isManagedNodePresent(
+  env?: ManagedPathsEnv,
+  platform: NodeJS.Platform = process.platform,
+): boolean {
+  return existsSync(getManagedNodeBinary(env, platform));
+}
+
+/**
+ * Return a shallow-cloned env with the managed Node bin directory
+ * prepended to `PATH`. No-op (still returns a clone) when the managed
+ * runtime is not installed or its directory is already on PATH.
+ *
+ * Never mutates the input env or `process.env`.
+ */
+export function prependManagedNodeToPath(
+  baseEnv: NodeJS.ProcessEnv = process.env,
+  managedPathsEnv?: ManagedPathsEnv,
+): NodeJS.ProcessEnv {
+  const cloned: NodeJS.ProcessEnv = { ...baseEnv };
+  if (!isManagedNodePresent(managedPathsEnv)) return cloned;
+
+  const dir = getManagedNodeBinDir(managedPathsEnv);
+  const currentPath = cloned.PATH ?? "";
+  // Avoid duplicate prepends when the dir is already at the head; cheap
+  // string contains check matches `buildSpawnEnv` style.
+  if (currentPath.split(path.delimiter).includes(dir)) return cloned;
+
+  cloned.PATH = currentPath
+    ? `${dir}${path.delimiter}${currentPath}`
+    : dir;
+  return cloned;
+}

package/packages/shared/src/platform/node-spawn.ts

@@ -118,29 +118,37 @@ export function toFileUrl(pathOrUrl: string): string {
  * host can exercise the Windows branch without mutating `process.platform`.
  *
  * !! JITI VERSION CONTRACT !!
- * The Windows-non-tsx arm assumes the jiti loader is from
- * `@mariozechner/pi-coding-agent@0.70.x` (jiti 2.x with the `file:///`
- * triple-slash URL handling fix). jiti 2.x correctly handles `file:///`
- * URL entries on Windows — it was the version we carved this contract
- * around in change `fix-windows-entry-script-url`.
- *
- * Newer jiti versions (e.g. jiti 2.6.5 in `pi-coding-agent@0.71.x`)
- * MISBEHAVE on `file:///` entries: they normalize triple-slash to
- * single-slash and prepend cwd as if the entry were a relative
- * specifier, producing `<cwd>/file:/...` ENOENT errors.
- *
- * The Electron Windows codepath defends against this version drift by
- * resolving jiti from the managed dir's `pi-coding-agent@0.70.0` (the
- * version pinned in `packages/electron/offline-packages.json` and
- * extracted into `~/.pi-dashboard/` by `installStandalone()` on first
- * launch — see Defect 1 of change
- * `fix-electron-windows-installer-and-server-bootstrap`). Since the
- * managed-dir tree is pinned, the contract holds regardless of what
- * jiti is on the user's PATH.
+ * The Windows-non-tsx arm relies on jiti's `file:///` triple-slash URL
+ * handling. Verified-good baselines (must be one of these in the
+ * offline cacache):
+ *   • `@earendil-works/pi-coding-agent@0.74.x` (jiti `^2.7.0`)  — current
+ *   • `@mariozechner/pi-coding-agent@0.70.x`  (jiti 2.x)        — legacy
+ *
+ * Both ship a jiti that correctly normalises `file:///` entries on
+ * Windows. The contract was originally carved around 0.70.x in change
+ * `fix-windows-entry-script-url` and re-anchored at 0.74.x in change
+ * `migrate-pi-fork-to-earendil` (E.7).
+ *
+ * Known-broken (do NOT pin): `pi-coding-agent@0.71.x` shipping
+ * `jiti@2.6.5`. That jiti version misnormalises triple-slash to
+ * single-slash and prepends cwd as if the entry were a relative
+ * specifier, producing `<cwd>/file:/...` ENOENT errors. Keep the
+ * 0.71.x / 2.6.5 mention here so contributors recognise the
+ * regression pattern if it recurs in a future jiti.
+ *
+ * The Electron Windows codepath defends against version drift by
+ * resolving jiti from the managed dir's pinned `pi-coding-agent`
+ * (currently `@earendil-works/pi-coding-agent@0.74.0`, pinned in
+ * `packages/electron/offline-packages.json` and extracted into
+ * `~/.pi-dashboard/` by `installStandalone()` on first launch — see
+ * Defect 1 of change `fix-electron-windows-installer-and-server-bootstrap`).
+ * Since the managed-dir tree is pinned, the contract holds regardless
+ * of what jiti is on the user's PATH.
  *
  * If a future change bumps the offline-cacache `pi-coding-agent` pin to
- * a version with a different jiti, RE-VERIFY this contract on Windows
- * manually (run a packaged Electron app on Win10 + Win11) and either:
+ * a version OUTSIDE the verified baselines, RE-VERIFY this contract on
+ * Windows manually (run a packaged Electron app on Win10 + Win11) and
+ * either:
  *   1. Update the contract (fix the file:// URL handling expectation), OR
  *   2. Add a per-jiti-version branch here, OR
  *   3. Switch the bundled loader to tsx (which has its own contract).

package/packages/shared/src/protocol.ts

@@ -1,7 +1,7 @@
 /**
  * Extension ↔ Server WebSocket protocol messages.
  */
-import type { DashboardEvent, CommandInfo, FlowInfo, SessionSource, ImageContent, FileEntry, TurnUsage, ContextUsage, ModelInfo, PiSessionInfo, OpenSpecPhase, RoleInfo, ExtensionUiModule, DecoratorDescriptor } from "./types.js";
+import type { DashboardEvent, CommandInfo, FlowInfo, SessionSource, ImageContent, FileEntry, TurnUsage, ContextUsage, ModelInfo, ProviderInfo, PiSessionInfo, OpenSpecPhase, RoleInfo, ExtensionUiModule, DecoratorDescriptor } from "./types.js";
 
 // ── Extension → Server ──────────────────────────────────────────────
 
@@ -22,6 +22,14 @@ export interface SessionRegisterMessage {
   eventCount?: number;
   /** OS process ID of the pi agent — used for force-kill escalation */
   pid?: number;
+  /**
+   * Server-minted spawn correlation token. Bridge populates this from
+   * `process.env.PI_DASHBOARD_SPAWN_TOKEN` IFF this is the first register
+   * for the bridge process (`bc.hasRegisteredOnce === false`). Subsequent
+   * registers (reattach, in-process new/fork/resume) omit it.
+   * See change: spawn-correlation-token.
+   */
+  spawnToken?: string;
   /**
    * Why the bridge is registering this session. The bridge sets this to
    * `"spawn"` for the very first `session_register` after process boot
@@ -151,6 +159,17 @@ export interface ModelsListMessage {
   models: ModelInfo[];
 }
 
+/**
+ * Bridge -> server: pi's live provider catalogue derived from
+ * `modelRegistry.authStorage` + `modelRegistry.getProviderDisplayName`.
+ * Sent alongside ModelsListMessage. See change: replace-hardcoded-provider-lists.
+ */
+export interface ProvidersListMessage {
+  type: "providers_list";
+  sessionId: string;
+  providers: ProviderInfo[];
+}
+
 export interface SessionNameUpdateMessage {
   type: "session_name_update";
   sessionId: string;
@@ -286,6 +305,27 @@ export interface ExtUiDecoratorMessage {
   removed?: boolean;
 }
 
+// ── Markdown asset inlining (chat-markdown-local-images-and-math) ──
+//
+// Bridge → server: register a base64-encoded image asset under a content
+// hash. Emitted by the bridge BEFORE the `message_update` / `message_end`
+// event whose text references `pi-asset:<hash>`. Bytes ride exactly once
+// per (session, hash) pair — subsequent references in later events emit
+// no further `asset_register`. Persisted in `events.jsonl` alongside the
+// referencing message events so reconnect/replay rebuilds the per-session
+// asset registry deterministically. See change:
+// chat-markdown-local-images-and-math.
+export interface AssetRegisterMessage {
+  type: "asset_register";
+  sessionId: string;
+  /** Content hash (sha256 truncated to 16 hex chars). */
+  hash: string;
+  /** MIME type (one of the bridge's image allowlist). */
+  mimeType: string;
+  /** Base64-encoded file bytes. */
+  data: string;
+}
+
 export type ExtensionToServerMessage =
   | SessionRegisterMessage
   | SessionUnregisterMessage
@@ -299,6 +339,7 @@ export type ExtensionToServerMessage =
   | JjStateUpdateMessage
   | SessionNameUpdateMessage
   | ModelsListMessage
+  | ProvidersListMessage
   | ModelUpdateMessage
   | SessionsListExtensionMessage
   | ExtensionUiDismissMessage
@@ -312,7 +353,8 @@ export type ExtensionToServerMessage =
   | ProcessListMessage
   | UiModulesListMessage
   | UiDataListMessage
-  | ExtUiDecoratorMessage;
+  | ExtUiDecoratorMessage
+  | AssetRegisterMessage;
 
 // ── Server → Extension ──────────────────────────────────────────────
 
@@ -357,6 +399,15 @@ export interface RequestModelsMessage {
   sessionId: string;
 }
 
+/**
+ * Server -> bridge: ask the bridge to push a fresh providers_list.
+ * See change: replace-hardcoded-provider-lists.
+ */
+export interface RequestProvidersMessage {
+  type: "request_providers";
+  sessionId: string;
+}
+
 export interface SetThinkingLevelMessage {
   type: "set_thinking_level";
   sessionId: string;
@@ -514,6 +565,7 @@ export type ServerToExtensionMessage =
   | ListFilesMessage
   | RenameSessionExtensionMessage
   | RequestModelsMessage
+  | RequestProvidersMessage
   | SetThinkingLevelMessage
   | ListSessionsExtensionMessage
   | SetModelMessage

package/packages/shared/src/resolve-jiti.ts

@@ -5,6 +5,18 @@
  * points to pi's CLI entry (e.g., pi-coding-agent/dist/cli.js). Since
  * jiti is a dependency of pi-coding-agent, createRequire(process.argv[1])
  * can resolve it directly.
+ *
+ * Supported jiti providers, in lookup order:
+ *   1. `@mariozechner/jiti` — legacy fork shipped with pi ≤ 0.73.0.
+ *   2. `@oh-my-pi/jiti`     — fork shipped with `@oh-my-pi/pi-coding-agent`.
+ *   3. `jiti`               — upstream package. Pi 0.73.1+ dropped the
+ *                              fork in favour of upstream jiti 2.7,
+ *                              which ships the same `lib/jiti-register.mjs`
+ *                              layout the helpers below assume.
+ *
+ * Forks are tried first to preserve behaviour for users on older pi
+ * versions; upstream is the fallthrough for pi 0.73.1+. See change:
+ * support-upstream-jiti-resolution.
  */
 
 import { createRequire } from "node:module";
@@ -12,9 +24,11 @@ import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-const JITI_PACKAGES = [
+export const JITI_PACKAGES = [
+  // @earendil-works/pi-coding-agent depends on plain `jiti`. Try the
+  // bare name first; fall back to the legacy namespaced fork.
+  "jiti",
   "@mariozechner/jiti",
-  "@oh-my-pi/jiti",
 ];
 
 /**
@@ -44,6 +58,29 @@ export function buildJitiRegisterUrl(pkgJsonPath: string): string {
   return pathToFileURL(registerPath).href;
 }
 
+/**
+ * Test seam: a function that takes a package specifier (e.g.
+ * `"jiti/package.json"`) and returns the resolved path. Production
+ * supplies `createRequire(realpath(process.argv[1])).resolve`; tests
+ * supply a stub.
+ */
+export type JitiResolver = (specifier: string) => string;
+
+/**
+ * Internal: walk the JITI_PACKAGES list using the given resolver and
+ * return the first hit's register URL. Pure function once the
+ * resolver is supplied. Returns null when no provider resolves.
+ */
+export function pickJitiRegisterUrl(resolver: JitiResolver): string | null {
+  for (const jiti of JITI_PACKAGES) {
+    try {
+      const pkgJson = resolver(`${jiti}/package.json`);
+      return buildJitiRegisterUrl(pkgJson);
+    } catch { /* next */ }
+  }
+  return null;
+}
+
 /**
  * Returns jiti's register hook as a file:// URL suitable for `node --import`.
  * Uses process.argv[1] (pi's entry point) to anchor module resolution.
@@ -58,18 +95,14 @@ export function resolveJitiImport(): string {
       // Resolve symlinks — process.argv[1] may be a symlink (e.g., bin/pi → dist/cli.js)
       const resolved = realpathSync(anchor);
       const req = createRequire(resolved);
-      for (const jiti of JITI_PACKAGES) {
-        try {
-          const pkgJson = req.resolve(`${jiti}/package.json`);
-          return buildJitiRegisterUrl(pkgJson);
-        } catch { /* next */ }
-      }
+      const url = pickJitiRegisterUrl((spec) => req.resolve(spec));
+      if (url) return url;
     } catch { /* fall through */ }
   }
 
   throw new Error(
     "Cannot find pi's TypeScript loader (jiti). " +
-    "Is @mariozechner/pi-coding-agent or @oh-my-pi/pi-coding-agent installed?"
+    "Is @earendil-works/pi-coding-agent or @mariozechner/pi-coding-agent installed?"
   );
 }
 
@@ -100,3 +133,23 @@ export function resolveJitiFromAnchor(anchorPath: string): string | null {
   } catch { /* ignore */ }
   return null;
 }
+
+/**
+ * Test seam for `resolveJitiFromAnchor`. Pure function: given a resolver
+ * and a `pathExists` predicate, walk JITI_PACKAGES and return the first
+ * hit's register URL. Production wires `createRequire(anchor).resolve`
+ * and `existsSync`; tests inject stubs.
+ */
+export function pickJitiFromAnchor(
+  resolver: JitiResolver,
+  pathExists: (p: string) => boolean,
+): string | null {
+  for (const jiti of JITI_PACKAGES) {
+    try {
+      const pkgJson = resolver(`${jiti}/package.json`);
+      const registerPath = path.join(path.dirname(pkgJson), "lib", "jiti-register.mjs");
+      if (pathExists(registerPath)) return pathToFileURL(registerPath).href;
+    } catch { /* next */ }
+  }
+  return null;
+}

package/packages/shared/src/rest-api.ts

@@ -255,6 +255,10 @@ export interface ProviderAuthStatus {
   authenticated: boolean;
   expires?: number;
   maskedKey?: string;
+  /** Name of the env var pi-ai consults for this provider (api-key rows only). */
+  envVar?: string;
+  /** True when configured via ambient credential chain (AWS profile / GCP ADC). */
+  ambient?: boolean;
 }
 
 export interface AuthorizeResponse {