@code-yeongyu/senpi 2026.10.25-4 → 2026.10.26-2

package/dist/core/extensions/builtin/permission-system/parsers.d.ts

@@ -7,6 +7,8 @@ export type PermissionRequest = Pick<Request, "permission" | "patterns" | "alway
 };
 /** Parser function that extracts permission requests from tool input */
 export type ToolPermissionParser = (toolName: string, input: Record<string, unknown>, cwd: string) => PermissionRequest[];
+/** Marks a bash request target that no command-specific rule can match: only a `*` rule decides it. */
+export declare const UNPARSED_BASH_PREFIX = "(unparsed) ";
 /** The `eval` class a cell carries on its own, used when its tool-owned parser names anything narrower. */
 export declare function fallbackEvalPermissionRequest(): PermissionRequest;
 /**

package/dist/core/extensions/builtin/permission-system/parsers.js

@@ -2,6 +2,7 @@ import { dirname, resolve } from "node:path";
 import { realpathWithoutOpen } from "../../../../utils/paths.js";
 import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { BashArity } from "../permission-system/arity.js";
+import { analyzeBashCommand, bestEffortCommandLines } from "../permission-system/bash-command-segments.js";
 import { extractExternalPaths, isExternalPath, toParentDirectoryPattern, } from "../permission-system/external-dir.js";
 import { setApprovedMonitorParent } from "../terminal/monitor-permission.js";
 import { urlOriginAlias, widerAlwaysScope } from "./always-scope.js";
@@ -73,6 +74,48 @@ function withExternalDirectoryRequests(requests, paths, cwd, scope) {
         },
     ];
 }
+const uniq = (values) => [...new Set(values)];
+/**
+ * The targets an "Allow always" answer may store. Stored rules are matched as globs, so a target holding
+ * its own `*` or `?` would be remembered as a wildcard that matches other commands; such a target is
+ * allowed once and never stored. Request patterns stay raw, so existing rules match exactly as before.
+ */
+const rememberable = (targets) => targets.filter((target) => !/[*?]/.test(target));
+/** Marks a bash request target that no command-specific rule can match: only a `*` rule decides it. */
+export const UNPARSED_BASH_PREFIX = "(unparsed) ";
+/**
+ * The `bash` requests for one command. Every simple command it runs is decided, so the call is as
+ * strict as its strictest command: one pattern per command (its arity prefix), all of which must be
+ * allowed, and "Allow always" stores exactly those prefixes. A command the lexer cannot parse is one
+ * target only a `*` rule (a preset, a blanket setting) can decide, so no grant for one command can
+ * allow it; its plain words are still checked against deny rules.
+ */
+function bashCommandRequests(command) {
+    const analysis = analyzeBashCommand(command);
+    if (analysis.kind === "unparsed") {
+        const target = `${UNPARSED_BASH_PREFIX}${command}`;
+        const candidates = uniq(bestEffortCommandLines(command)
+            .map((words) => BashArity.prefix(words).join(" "))
+            .filter(Boolean));
+        // The deny-only check runs first, so a denied call is refused before anyone is asked.
+        return [
+            ...(candidates.length === 0
+                ? []
+                : [{ permission: "bash", patterns: candidates, always: [], autoApproveAsk: true }]),
+            { permission: "bash", patterns: [target], always: rememberable([target]) },
+        ];
+    }
+    const prefixes = uniq(analysis.segments.map((words) => BashArity.prefix([...words]).join(" ")).filter(Boolean));
+    if (prefixes.length === 0)
+        return [{ permission: "bash", patterns: [command], always: rememberable([command]) }];
+    return [
+        {
+            permission: "bash",
+            patterns: prefixes,
+            always: rememberable(prefixes).flatMap((prefix) => [prefix, `${prefix} *`]),
+        },
+    ];
+}
 /** The `eval` class a cell carries on its own, used when its tool-owned parser names anything narrower. */
 export function fallbackEvalPermissionRequest() {
     return { permission: "eval", patterns: ["*"], always: ["*"] };
@@ -135,16 +178,7 @@ export function createBuiltinParserRegistry() {
         if (!command) {
             return [fallbackPermissionRequest("bash")];
         }
-        const tokens = command.split(/\s+/).filter(Boolean);
-        const prefix = BashArity.prefix(tokens).join(" ");
-        const always = prefix ? [prefix, `${prefix} *`] : ["*"];
-        const requests = [
-            {
-                permission: "bash",
-                patterns: [prefix || command],
-                always,
-            },
-        ];
+        const requests = bashCommandRequests(command);
         const externalPaths = extractExternalPaths(command, cwd);
         if (externalPaths.length > 0) {
             requests.push({

package/dist/core/extensions/builtin/terminal/extension-state.js

@@ -58,8 +58,9 @@ export function bundleSinks(pi, state) {
             pi.events?.emit(WAKE_SOURCE_STATE_EVENT, {
                 source: "terminal-monitors",
                 activeCount: snapshot.length,
+                // The stable "mon_" id: runtime ids churn on restore, and item ids feed the custody signature.
                 monitors: snapshot.map((entry) => ({
-                    id: entry.id,
+                    id: entry.monitorId ?? entry.id,
                     description: entry.description,
                     startedAtMs: entry.startedAtMs,
                 })),

package/dist/core/extensions/builtin/vertex-model-garden/auth.d.ts

@@ -8,9 +8,18 @@ export declare const VERTEX_MODEL_GARDEN_ADC_SOURCE = "gcloud application defaul
  * gcloud tooling too, so the lane is selectable but never outranks a provider the
  * user configured, and it reports nothing while the chain is absent — the failure
  * belongs at selection time, not at the first request.
+ *
+ * The target project is resolved here so it rides the ambient auth result into
+ * the request env: process env first, then the sibling google-vertex profile,
+ * which shares this ADC chain and already names the project the user entered at
+ * its login. With neither source the lane stays available and the request-time
+ * ADC fallbacks (quota project, discovered project) decide, so a missing project
+ * remains a first-request failure with the actionable error, not a hidden lane.
  */
 export declare function resolveVertexModelGardenAmbient(input: {
     ctx: AuthContext;
     signal: AbortSignal;
+    /** Read-only env of another provider's stored credential; routing metadata only, never keys. */
+    storedProviderEnv?(providerId: string): Promise<Record<string, string> | undefined>;
 }): Promise<AuthResult | undefined>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/core/extensions/builtin/vertex-model-garden/auth.js

@@ -7,6 +7,13 @@ export const VERTEX_MODEL_GARDEN_ADC_SOURCE = "gcloud application default creden
  * gcloud tooling too, so the lane is selectable but never outranks a provider the
  * user configured, and it reports nothing while the chain is absent — the failure
  * belongs at selection time, not at the first request.
+ *
+ * The target project is resolved here so it rides the ambient auth result into
+ * the request env: process env first, then the sibling google-vertex profile,
+ * which shares this ADC chain and already names the project the user entered at
+ * its login. With neither source the lane stays available and the request-time
+ * ADC fallbacks (quota project, discovered project) decide, so a missing project
+ * remains a first-request failure with the actionable error, not a hidden lane.
  */
 export async function resolveVertexModelGardenAmbient(input) {
     input.signal.throwIfAborted();
@@ -14,6 +21,15 @@ export async function resolveVertexModelGardenAmbient(input) {
     input.signal.throwIfAborted();
     if (!(await input.ctx.fileExists(path)))
         return undefined;
-    return { auth: {}, source: VERTEX_MODEL_GARDEN_ADC_SOURCE, ambient: true };
+    input.signal.throwIfAborted();
+    const project = (await input.ctx.env("GOOGLE_CLOUD_PROJECT")) ??
+        (await input.ctx.env("GCLOUD_PROJECT")) ??
+        (await input.storedProviderEnv?.("google-vertex"))?.GOOGLE_CLOUD_PROJECT;
+    return {
+        auth: {},
+        ...(project ? { env: { GOOGLE_CLOUD_PROJECT: project } } : {}),
+        source: VERTEX_MODEL_GARDEN_ADC_SOURCE,
+        ambient: true,
+    };
 }
 //# sourceMappingURL=auth.js.map

package/dist/core/extensions/builtin/websearch/websearch/providers/google.d.ts

@@ -1,3 +1,9 @@
 import type { ProviderModule } from "./shared.ts";
+/**
+ * Catalog GA flash alias: it tracks the current stable flash model, so the default
+ * cannot age into a retired generation (gemini-2.5-flash 404s for new accounts).
+ * An entry-level `model` still overrides it.
+ */
+export declare const DEFAULT_MODEL = "gemini-flash-latest";
 export declare const googleProvider: ProviderModule;
 //# sourceMappingURL=google.d.ts.map

package/dist/core/extensions/builtin/websearch/websearch/providers/google.js

@@ -1,6 +1,11 @@
 import { providerUrl } from "../provider-endpoints.js";
 import { appendDomainFilters, collect, contentHeaders, getArray, getNumber, getObject, getString, result, withConfigHeaders, } from "./shared.js";
-const DEFAULT_MODEL = "gemini-2.5-flash";
+/**
+ * Catalog GA flash alias: it tracks the current stable flash model, so the default
+ * cannot age into a retired generation (gemini-2.5-flash 404s for new accounts).
+ * An entry-level `model` still overrides it.
+ */
+export const DEFAULT_MODEL = "gemini-flash-latest";
 function generateContentUrl(config) {
     const root = providerUrl(config).replace(/\/+$/, "");
     if (root.endsWith(":generateContent"))

package/dist/core/extensions/types.d.ts

@@ -2369,6 +2369,8 @@ export interface ProviderConfig {
         resolve(input: {
             ctx: AuthContext;
             signal: AbortSignal;
+            /** Read-only env of another provider's stored credential; routing metadata only, never keys. */
+            storedProviderEnv?(providerId: string): Promise<Record<string, string> | undefined>;
         }): Promise<AuthResult | undefined>;
     };
     /** OAuth provider for /login support. The `id` is set automatically from the provider name. */

package/dist/core/lifecycle-children.d.ts

@@ -1,4 +1,4 @@
-import type { ChildLifecycleReport, SessionLifecycleState } from "./session-lifecycle-types.ts";
+import type { ChildLifecycleReport, LifecycleWaits, SessionLifecycleState } from "./session-lifecycle-types.ts";
 import type { SessionEntry } from "./session-manager.ts";
 export interface ChildLifecycleStore {
     readonly entries: readonly SessionEntry[];
@@ -15,4 +15,6 @@ export declare class LifecycleChildren {
     private accept;
 }
 export declare function readLifecycleState(value: unknown): SessionLifecycleState | undefined;
+/** The one reader of a durable or reported `waitingOn`; named detail never invalidates the counts. */
+export declare function readWaits(value: unknown): LifecycleWaits | undefined;
 //# sourceMappingURL=lifecycle-children.d.ts.map

package/dist/core/lifecycle-children.js

@@ -1,3 +1,5 @@
+import { readHumanWait } from "./lifecycle-attention.js";
+import { readWaitItems } from "./lifecycle-wait-items.js";
 import { isRecord } from "./work-custody-record.js";
 export class LifecycleChildren {
     constructor(store) {
@@ -60,6 +62,80 @@ export function readLifecycleState(value) {
             return undefined;
     }
 }
+/** The one reader of a durable or reported `waitingOn`; named detail never invalidates the counts. */
+export function readWaits(value) {
+    if (!isRecord(value) || typeof value.children !== "number")
+        return undefined;
+    const background = [];
+    if (Array.isArray(value.background)) {
+        for (const source of value.background) {
+            if (!isRecord(source) || typeof source.source !== "string" || typeof source.activeCount !== "number")
+                continue;
+            background.push({
+                source: source.source,
+                activeCount: source.activeCount,
+                ...readWaitItems(source.items, source.omittedItems),
+                ...(typeof source.retryAtMs === "number" ? { retryAtMs: source.retryAtMs } : {}),
+            });
+        }
+    }
+    const human = Array.isArray(value.human)
+        ? value.human.flatMap((request) => {
+            const wait = readHumanWait(request);
+            return wait ? [wait] : [];
+        })
+        : [];
+    const childSources = [];
+    if (Array.isArray(value.childSources))
+        for (const source of value.childSources) {
+            if (!isRecord(source) || typeof source.source !== "string" || typeof source.activeCount !== "number")
+                continue;
+            childSources.push({
+                source: source.source,
+                activeCount: source.activeCount,
+                ...readWaitItems(source.items, source.omittedItems),
+            });
+        }
+    const reports = [];
+    if (Array.isArray(value.childReports))
+        for (const report of value.childReports) {
+            if (!isRecord(report))
+                continue;
+            const state = readLifecycleState(report.state);
+            if (!state ||
+                typeof report.taskId !== "string" ||
+                typeof report.childSessionId !== "string" ||
+                typeof report.runEpoch !== "number" ||
+                !Number.isSafeInteger(report.runEpoch) ||
+                report.runEpoch < 0)
+                continue;
+            reports.push({
+                taskId: report.taskId,
+                childSessionId: report.childSessionId,
+                runEpoch: report.runEpoch,
+                state,
+                ...(typeof report.label === "string" ? { label: report.label } : {}),
+                ...(typeof report.since === "string" && Number.isFinite(Date.parse(report.since))
+                    ? { since: report.since }
+                    : {}),
+            });
+        }
+    reports.sort((a, b) => (a.taskId < b.taskId ? -1 : a.taskId > b.taskId ? 1 : 0));
+    const childReportsOmitted = Math.max(0, reports.length - 32) +
+        (typeof value.childReportsOmitted === "number" &&
+            Number.isSafeInteger(value.childReportsOmitted) &&
+            value.childReportsOmitted > 0
+            ? value.childReportsOmitted
+            : 0);
+    return {
+        children: value.children,
+        background,
+        human,
+        ...(childSources.length ? { childSources } : {}),
+        ...(reports.length ? { childReports: reports.slice(0, 32) } : {}),
+        ...(childReportsOmitted ? { childReportsOmitted } : {}),
+    };
+}
 function readChildReport(value) {
     if (!isRecord(value))
         return undefined;
@@ -75,27 +151,15 @@ function readChildReport(value) {
         value.generation < 0)
         return undefined;
     const terminal = readTerminal(value.terminal);
-    let waitingOn;
-    if (isRecord(value.waitingOn) && typeof value.waitingOn.children === "number") {
-        const background = [];
-        if (Array.isArray(value.waitingOn.background))
-            for (const item of value.waitingOn.background) {
-                if (!isRecord(item) || typeof item.source !== "string" || typeof item.activeCount !== "number")
-                    continue;
-                background.push({
-                    source: item.source,
-                    activeCount: item.activeCount,
-                    ...(typeof item.retryAtMs === "number" ? { retryAtMs: item.retryAtMs } : {}),
-                });
-            }
-        waitingOn = { children: value.waitingOn.children, background, human: [] };
-    }
+    const waitingOn = readWaits(value.waitingOn);
     return {
         taskId: value.taskId,
         childSessionId: value.childSessionId,
         runEpoch: value.runEpoch,
         generation: value.generation,
         state,
+        ...(typeof value.label === "string" ? { label: value.label } : {}),
+        ...(typeof value.since === "string" && Number.isFinite(Date.parse(value.since)) ? { since: value.since } : {}),
         ...(waitingOn ? { waitingOn } : {}),
         ...(terminal === undefined ? {} : { terminal }),
     };

package/dist/core/lifecycle-record.js

@@ -1,5 +1,5 @@
 import { readHumanWait } from "./lifecycle-attention.js";
-import { readLifecycleState } from "./lifecycle-children.js";
+import { readLifecycleState, readWaits } from "./lifecycle-children.js";
 import { readLastStop } from "./lifecycle-stop.js";
 import { isRecord } from "./work-custody-record.js";
 /** Restore the wire snapshot and its private high-water marks from owned JSONL. */
@@ -97,29 +97,6 @@ function readTurnEnd(value) {
             return undefined;
     }
 }
-function readWaits(value) {
-    if (!isRecord(value) || typeof value.children !== "number")
-        return undefined;
-    const background = [];
-    if (Array.isArray(value.background)) {
-        for (const source of value.background) {
-            if (!isRecord(source) || typeof source.source !== "string" || typeof source.activeCount !== "number")
-                continue;
-            background.push({
-                source: source.source,
-                activeCount: source.activeCount,
-                ...(typeof source.retryAtMs === "number" ? { retryAtMs: source.retryAtMs } : {}),
-            });
-        }
-    }
-    const human = Array.isArray(value.human)
-        ? value.human.flatMap((request) => {
-            const wait = readHumanWait(request);
-            return wait ? [wait] : [];
-        })
-        : [];
-    return { children: value.children, background, human };
-}
 function readHolds(value) {
     if (!Array.isArray(value))
         return undefined;

package/dist/core/lifecycle-session-binding.js

@@ -9,6 +9,7 @@ import { lifecycleHistory } from "./lifecycle-history.js";
 import { bindLifecycleHumanInput } from "./lifecycle-human-input.js";
 import { readLifecycleRuntimeFacts } from "./lifecycle-runtime-facts.js";
 import { goalGuardAfter } from "./lifecycle-stop.js";
+import { wakeSourceItems } from "./lifecycle-wait-items.js";
 import { SessionLifecycleController } from "./session-lifecycle.js";
 import { isRecord } from "./work-custody-record.js";
 /** Attaches durable lifecycle to the real session event/admission boundaries. */
@@ -310,7 +311,7 @@ export class LifecycleSessionBinding {
             return;
         if (!Number.isFinite(data.activeCount))
             return;
-        this.controller.obligations.syncSource(data.source, data.kind === "children" ? "children" : "background", data.activeCount);
+        this.controller.obligations.syncSource(data.source, data.kind === "children" ? "children" : "background", data.activeCount, wakeSourceItems(data));
     }
     dispose() {
         this.disposed = true;

package/dist/core/lifecycle-wait-items.d.ts

@@ -0,0 +1,17 @@
+import type { WakeSourceStateItem } from "./extensions/builtin/monitor-state-event.ts";
+import type { LifecycleWaitItem } from "./session-lifecycle-types.ts";
+export interface WaitSourceItems {
+    readonly items?: readonly WakeSourceStateItem[];
+    readonly omittedItems?: number;
+}
+/** Optional producer detail never determines custody. Lists are snapshots, bounded independently of activeCount. */
+export declare function normalizeWaitItems(value: unknown, omitted?: unknown): WaitSourceItems;
+/** The one rule for a wake_source_state producer's item list: `items` when set, else the legacy `monitors`. */
+export declare function wakeSourceItems(data: object): unknown;
+export declare function waitItemSignature(detail: WaitSourceItems): string;
+export declare function projectWaitItems(detail: WaitSourceItems): {
+    readonly items?: readonly LifecycleWaitItem[];
+    readonly omittedItems?: number;
+};
+export declare function readWaitItems(value: unknown, omitted?: unknown): ReturnType<typeof projectWaitItems>;
+//# sourceMappingURL=lifecycle-wait-items.d.ts.map

package/dist/core/lifecycle-wait-items.js

@@ -0,0 +1,72 @@
+/** Optional producer detail never determines custody. Lists are snapshots, bounded independently of activeCount. */
+export function normalizeWaitItems(value, omitted) {
+    const byId = new Map();
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (typeof entry !== "object" || entry === null || !("id" in entry))
+                continue;
+            if (typeof entry.id !== "string" || entry.id.trim().length === 0)
+                continue;
+            const item = {
+                id: entry.id,
+                ...("description" in entry && typeof entry.description === "string"
+                    ? { description: entry.description }
+                    : {}),
+                ...("startedAtMs" in entry &&
+                    typeof entry.startedAtMs === "number" &&
+                    Number.isFinite(entry.startedAtMs) &&
+                    Math.abs(entry.startedAtMs) <= 8.64e15
+                    ? { startedAtMs: entry.startedAtMs }
+                    : {}),
+            };
+            const previous = byId.get(item.id);
+            if (!previous || JSON.stringify(item) < JSON.stringify(previous))
+                byId.set(item.id, item);
+        }
+    }
+    const items = [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const omittedItems = Math.max(0, items.length - 32) +
+        (typeof omitted === "number" && Number.isSafeInteger(omitted) && omitted > 0 ? omitted : 0);
+    return {
+        ...(items.length ? { items: items.slice(0, 32) } : {}),
+        ...(omittedItems ? { omittedItems } : {}),
+    };
+}
+/** The one rule for a wake_source_state producer's item list: `items` when set, else the legacy `monitors`. */
+export function wakeSourceItems(data) {
+    return ("items" in data ? data.items : undefined) ?? ("monitors" in data ? data.monitors : undefined);
+}
+export function waitItemSignature(detail) {
+    return JSON.stringify([detail.items?.map((item) => [item.id, item.description]), detail.omittedItems]);
+}
+export function projectWaitItems(detail) {
+    return {
+        ...(detail.items
+            ? {
+                items: detail.items.map((item) => ({
+                    id: item.id,
+                    ...(item.description === undefined ? {} : { label: item.description }),
+                    ...(item.startedAtMs === undefined ? {} : { startedAt: new Date(item.startedAtMs).toISOString() }),
+                })),
+            }
+            : {}),
+        ...(detail.omittedItems ? { omittedItems: detail.omittedItems } : {}),
+    };
+}
+export function readWaitItems(value, omitted) {
+    const items = Array.isArray(value)
+        ? value.map((item) => {
+            if (typeof item !== "object" || item === null)
+                return item;
+            return {
+                ...("id" in item ? { id: item.id } : {}),
+                ...("label" in item ? { description: item.label } : {}),
+                ...("startedAt" in item && typeof item.startedAt === "string"
+                    ? { startedAtMs: Date.parse(item.startedAt) }
+                    : {}),
+            };
+        })
+        : undefined;
+    return projectWaitItems(normalizeWaitItems(items, omitted));
+}
+//# sourceMappingURL=lifecycle-wait-items.js.map

package/dist/core/model-runtime.js

@@ -245,7 +245,12 @@ export class ModelRuntime {
             return base;
         }
         try {
-            const provider = composeModelProvider(providerId, base, this.config, extension);
+            // The reader runs only inside ambient auth resolution; composition itself stays credential-free.
+            const storedProviderEnv = async (sourceId) => {
+                const credential = await this.credentials.read(sourceId);
+                return credential?.type === "api_key" && credential.env ? { ...credential.env } : undefined;
+            };
+            const provider = composeModelProvider(providerId, base, this.config, extension, { storedProviderEnv });
             this.compositionErrors.delete(providerId);
             return provider;
         }

package/dist/core/provider-api-key-auth.d.ts

@@ -1,11 +1,14 @@
 import { type ApiKeyAuth, type AuthContext, type AuthResult, type ModelAuth, type Provider, type ProviderHeaders } from "@earendil-works/pi-ai";
 import type { ConfigValue } from "@earendil-works/pi-ai/utils/config-reference";
 import type { ModelsJsonProvider } from "./model-config.ts";
+/** Reads another provider's stored credential env: routing metadata only, never keys. */
+export type StoredProviderEnvReader = (providerId: string) => Promise<Record<string, string> | undefined>;
 interface AmbientAuthExtensionInput {
     name?: string;
     resolve(input: {
         ctx: AuthContext;
         signal: AbortSignal;
+        storedProviderEnv?: StoredProviderEnvReader;
     }): Promise<AuthResult | undefined>;
 }
 interface ProviderAuthExtensionInput {
@@ -19,7 +22,9 @@ interface ProviderAuthExtensionInput {
     oauth?: unknown;
     ambientAuth?: AmbientAuthExtensionInput;
 }
-export declare function composeApiKeyAuth(providerId: string, base: Provider | undefined, config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined): ApiKeyAuth | undefined;
+export declare function composeApiKeyAuth(providerId: string, base: Provider | undefined, config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined, options?: {
+    storedProviderEnv?: StoredProviderEnvReader;
+}): ApiKeyAuth | undefined;
 export declare function configuredApiKey(config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined): ConfigValue | undefined;
 export declare function configuredHeaders(config: ModelsJsonProvider | undefined, extension: ProviderAuthExtensionInput | undefined): Record<string, ConfigValue> | undefined;
 export declare function withConfiguredAuth(auth: ModelAuth, headers: ProviderHeaders | undefined, authHeader: boolean): ModelAuth;

package/dist/core/provider-api-key-auth.js

@@ -2,7 +2,7 @@ import { hasCredentialHeaders, } from "@earendil-works/pi-ai";
 import { assertConfigReferenceAuthority } from "./config-reference-resolver.js";
 import { checkConfiguredHeaderAuth, headerAuthResolutionSource } from "./provider-header-auth.js";
 import { getConfigValueEnvVarNames, isCommandConfigValue, resolveConfigValueOrThrow, resolveHeadersOrThrow, } from "./resolve-config-value.js";
-export function composeApiKeyAuth(providerId, base, config, extension) {
+export function composeApiKeyAuth(providerId, base, config, extension, options) {
     const inherited = base?.auth.apiKey;
     const rawKey = configuredApiKey(config, extension);
     const oauth = extension?.oauth ?? base?.auth.oauth;
@@ -15,7 +15,7 @@ export function composeApiKeyAuth(providerId, base, config, extension) {
         // explicitly configured key, credential headers, or a base provider still
         // win, and a resolution marked ambient never outranks a configured
         // provider in automatic default selection (senpi#2327).
-        return ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader);
+        return ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader, options?.storedProviderEnv);
     }
     if (!inherited && rawKey === undefined && !headerSource && oauth) {
         // An OAuth provider with no key, no credential headers and no base normally
@@ -119,16 +119,23 @@ function ambientOnlyAuth(providerId, oauth, rawHeaders, headerSource, authHeader
  * is the only source — and `Models.checkAuth` resolves this auth, so the
  * `ambient` marker reaches the provider's auth status.
  */
-function ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader) {
+function ambientApiKeyAuth(providerId, ambient, rawHeaders, headerSource, authHeader, storedProviderEnv) {
     const resolve = async (input) => {
-        const result = await ambient.resolve({ ctx: input.ctx, signal: input.signal });
+        const result = await ambient.resolve({
+            ctx: input.ctx,
+            signal: input.signal,
+            ...(storedProviderEnv ? { storedProviderEnv } : {}),
+        });
         if (!result)
             return undefined;
         const explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };
         const headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);
         const headers = await resolveHeadersOrThrow(rawHeaders, `provider "${providerId}"`, headerEnv);
+        // Stored-then-env (helpers.ts invariant): the provider's own stored env wins over ambient-resolved env.
+        const env = result.env || input.credential?.env ? { ...(result.env ?? {}), ...(input.credential?.env ?? {}) } : undefined;
         return {
             ...result,
+            ...(env ? { env } : {}),
             auth: withConfiguredAuth(result.auth, headers, authHeader),
             source: result.source ?? headerSource,
         };

package/dist/core/provider-composer.d.ts

@@ -1,6 +1,7 @@
 import { type AnyModel, type Api, type AssistantMessageEventStream, type AuthCheck, type AuthContext, type AuthResult, type ClassifierApi, type ImageApi, type Model, type OAuthCredential, type OAuthCredentials, type OAuthLoginCallbacks, type Provider, type ProviderClassifier, type ProviderImages, type RefreshModelsContext, type SimpleStreamOptions, type TranscriptContext } from "@earendil-works/pi-ai";
 import type { RetryPolicyProfile } from "@earendil-works/pi-ai/utils/retry-profile/types";
 import type { ModelConfig, ModelsJsonProvider } from "./model-config.ts";
+import { type StoredProviderEnvReader } from "./provider-api-key-auth.ts";
 import type { HeaderAuthStatusSource } from "./provider-header-auth.ts";
 import { clearConfigValueCache } from "./resolve-config-value.ts";
 export interface ExtensionOAuthConfig {
@@ -120,6 +121,8 @@ export interface ProviderAmbientAuth {
     resolve(input: {
         ctx: AuthContext;
         signal: AbortSignal;
+        /** Read-only env of another provider's stored credential; routing metadata only, never keys. */
+        storedProviderEnv?(providerId: string): Promise<Record<string, string> | undefined>;
     }): Promise<AuthResult | undefined>;
 }
 export type AuthStatus = {
@@ -133,7 +136,11 @@ export { configuredRequestAuthStatus, resolveCompatibilityRequestHeaders, resolv
 export declare const clearApiKeyCache: typeof clearConfigValueCache;
 export declare function validateExtensionProvider(providerId: string, base: Provider | undefined, modelsConfig: ModelsJsonProvider | undefined, extension: ProviderConfigInput): void;
 /** Compose built-in, models.json, and extension layers without reading credentials. */
-export declare function composeModelProvider(providerId: string, base: Provider | undefined, modelConfig: ModelConfig, extension: ProviderConfigInput | undefined): Provider;
+export declare function composeModelProvider(providerId: string, base: Provider | undefined, modelConfig: ModelConfig, extension: ProviderConfigInput | undefined, 
+/** Deferred ambient reads; the reader runs during auth resolution, never at composition. */
+options?: {
+    storedProviderEnv?: StoredProviderEnvReader;
+}): Provider;
 /**
  * Request shape a compatibility provider needs beside its credential. Headers are NOT
  * part of it: a configured header value can be a `!command`, and resolving one requires

package/dist/core/provider-composer.js

@@ -1,6 +1,6 @@
 import { getApiProvider, getCurrentTools, getProtocol, getToolCallFormat, isModelType, lazyStream, transformContext, wrapStreamWithToolCallMiddleware, } from "@earendil-works/pi-ai";
 import { classifierErrorResult, imageErrorResult } from "@earendil-works/pi-ai/utils/model-operations";
-import { composeApiKeyAuth, configuredHeaders, withConfiguredAuth } from "./provider-api-key-auth.js";
+import { composeApiKeyAuth, configuredHeaders, withConfiguredAuth, } from "./provider-api-key-auth.js";
 import { clearConfigValueCache, resolveHeadersOrThrow } from "./resolve-config-value.js";
 export { configuredRequestAuthStatus, resolveCompatibilityRequestHeaders, resolveConfiguredModelHeaders, } from "./provider-request-auth.js";
 export const clearApiKeyCache = clearConfigValueCache;
@@ -286,7 +286,9 @@ export function validateExtensionProvider(providerId, base, modelsConfig, extens
     applyExtension(providerId, applyModelsJson(providerId, getAllProviderModels(base), modelsConfig, extension), extension, new Set((modelsConfig?.models ?? []).map((definition) => definition.id)));
 }
 /** Compose built-in, models.json, and extension layers without reading credentials. */
-export function composeModelProvider(providerId, base, modelConfig, extension) {
+export function composeModelProvider(providerId, base, modelConfig, extension, 
+/** Deferred ambient reads; the reader runs during auth resolution, never at composition. */
+options) {
     const config = modelConfig.getProvider(providerId);
     let extensionOAuthCredential;
     let refreshedExtensionModels;
@@ -309,7 +311,9 @@ export function composeModelProvider(providerId, base, modelConfig, extension) {
     };
     // Validate eagerly so registration/reload reports structural errors immediately.
     getAllModels();
-    const apiKey = composeApiKeyAuth(providerId, base, config, extension);
+    const apiKey = composeApiKeyAuth(providerId, base, config, extension, {
+        storedProviderEnv: options?.storedProviderEnv,
+    });
     const oauth = composeOAuthAuth(providerId, base, config, extension);
     if (!apiKey && !oauth)
         throw new Error(`Provider ${providerId}: no authentication method configured.`);

package/dist/core/sdk.js

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { Agent, setDefaultStreamFn } from "@earendil-works/pi-agent-core";
+import { Agent, createInternalAgentChannel, setDefaultStreamFn, } from "@earendil-works/pi-agent-core";
 import { modelsAreEqual, streamSimple } from "@earendil-works/pi-ai/compat";
 import { getAgentDir } from "../config.js";
 import { resolvePath } from "../utils/paths.js";
@@ -283,7 +283,9 @@ export async function createAgentSession(options = {}) {
             model: model.id,
         });
     };
+    const internalChannel = createInternalAgentChannel();
     agent = new Agent({
+        internalChannel,
         initialState: {
             systemPrompt: "",
             model,
@@ -382,6 +384,7 @@ export async function createAgentSession(options = {}) {
         : options.sessionStartEvent;
     const session = new AgentSession({
         agent,
+        internalChannel,
         serviceTier: options.serviceTier,
         sessionManager,
         settingsManager,