@evandu/super-pi 0.1.123 → 0.1.125

package/dist/client/index.html

@@ -8,8 +8,8 @@
     <link rel="alternate icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
     <title>Super Pi</title>
-    <script type="module" crossorigin src="/assets/index-B0TMoUBp.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CCnIvjP6.css">
+    <script type="module" crossorigin src="/assets/index-qTPZ6eno.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CBPWeTvl.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/application/provider-service.d.ts

@@ -33,8 +33,29 @@ export declare class ProviderService {
     private readonly catalogService;
     private readonly store;
     constructor(registry: ProviderRegistry, runtime: AgentRuntime, broadcaster: EventBroadcaster, catalogService: CatalogService, store: Store);
-    /** The providers Super Pi manages, as the browser may see them: no keys, only the fact of one. */
+    /**
+     * Every provider Pi knows about, as the browser may see it: no keys, only the fact of one.
+     *
+     * THREE LISTS, ONE VIEW, because this panel is a view of Pi's model configuration and Pi's
+     * configuration is in three places:
+     *   - `models.json` entries (custom providers, whether this app wrote them or the person did);
+     *   - credentials in `auth.json` with no `models.json` entry (Pi's BUILT-IN providers);
+     *   - the ones turned off, which are in neither of Pi's files any more but are kept here.
+     * A panel built on the first list alone could never answer "turn off my lapsed coding plan",
+     * because that provider is a built-in whose only configuration is a credential.
+     */
     list(): Promise<PublicProvider[]>;
+    /**
+     * Turns a provider off, then makes every LIVE conversation stop pointing at the models it removed.
+     *
+     * WHY THE CONVERSATIONS ARE REPAIRED. A conversation's model is copied at birth and never re-read
+     * from the workspace - that is the rule. But the model it copied can CEASE TO EXIST, and a
+     * conversation holding one does not fail cleanly: Pi runs the turn on its own default, so the
+     * picker names one model while another one answers. Measured before this change: removing the
+     * model in use left the picker empty (`source=unavailable, models=0`).
+     */
+    disable(providerId: string): Promise<PublicProvider[]>;
+    enable(providerId: string): Promise<PublicProvider[]>;
     /**
      * Adds a provider, or adds a model to one, or updates one.
      *
@@ -49,7 +70,17 @@ export declare class ProviderService {
      * asks for it to go.
      */
     set(input: unknown): Promise<PublicProvider[]>;
-    /** Removes a provider from Pi's models.json and auth.json. */
+    /**
+     * Removes a provider for good.
+     *
+     * THREE KINDS, ONE VERB, because the panel is a view of Pi's model configuration and deleting a
+     * provider means the same thing in all three cases:
+     *   - a provider in `models.json`: its entry and its key go (the original behaviour);
+     *   - a BUILT-IN with only a credential: its models are Pi's, so the credential is the only thing
+     *     there is to delete - and deleting it is exactly what makes Pi stop offering it;
+     *   - one that is already switched off: the remembered copy goes, which is what makes "off"
+     *     permanent instead of something that would come back months later.
+     */
     remove(providerId: string): Promise<PublicProvider[]>;
     /**
      * Removes ONE model from a provider, leaving the provider and its other models alone.
@@ -74,6 +105,24 @@ export declare class ProviderService {
      * those rules forbid.
      */
     private afterChange;
+    /**
+     * Drops a conversation's model when the change removed it.
+     *
+     * WHY THIS EXISTS AT ALL. A conversation whose model was just deleted is not merely stale - it is
+     * WRONG in a way that never surfaces: Pi cannot resolve the model and runs the turn on its own
+     * default, so the picker says one thing while another model answers. Clearing the field is the
+     * only honest state: the conversation follows Pi's default again, which is what the next turn
+     * does anyway.
+     *
+     * THE LIST IS PASSED IN, NOT DERIVED FROM A CATALOG READ. The caller knows exactly which models it
+     * just took away (one model, or a whole provider), so asking Pi what it offers would be a slower
+     * and less precise way to learn the same thing - and on a machine where Pi is slow or broken, the
+     * broadcast every open tab is waiting for would wait with it.
+     *
+     * ARCHIVED CONVERSATIONS ARE LEFT ALONE: they are read-only by design, and rewriting a frozen
+     * record's stored model would make the archive describe a past that did not happen.
+     */
+    private repairConversationModels;
     /**
      * Discovers available models from the remote provider endpoint.
      * If apiKey is omitted but providerId is given, uses the stored key.

package/dist/server/application/provider-service.js

@@ -34,9 +34,106 @@ export class ProviderService {
         this.catalogService = catalogService;
         this.store = store;
     }
-    /** The providers Super Pi manages, as the browser may see them: no keys, only the fact of one. */
+    /**
+     * Every provider Pi knows about, as the browser may see it: no keys, only the fact of one.
+     *
+     * THREE LISTS, ONE VIEW, because this panel is a view of Pi's model configuration and Pi's
+     * configuration is in three places:
+     *   - `models.json` entries (custom providers, whether this app wrote them or the person did);
+     *   - credentials in `auth.json` with no `models.json` entry (Pi's BUILT-IN providers);
+     *   - the ones turned off, which are in neither of Pi's files any more but are kept here.
+     * A panel built on the first list alone could never answer "turn off my lapsed coding plan",
+     * because that provider is a built-in whose only configuration is a credential.
+     */
     async list() {
-        return publicProviders(await this.registry.load());
+        const [configured, credentialOnly, disabled] = await Promise.all([
+            this.registry.load(),
+            this.registry.loadCredentialOnly(),
+            this.registry.loadDisabled(),
+        ]);
+        // A built-in's models live in Pi's own catalogue, so the file layer cannot know them. They are
+        // filled in from the catalog the panel already receives, which is the only thing that knows what
+        // a built-in actually offers - and a provider card with an empty model list would misdescribe a
+        // provider that is working perfectly.
+        if (credentialOnly.length) {
+            try {
+                const catalog = await this.runtime.catalog();
+                const byProvider = new Map();
+                for (const model of catalog.models) {
+                    const group = byProvider.get(model.provider) ?? [];
+                    group.push(model);
+                    byProvider.set(model.provider, group);
+                }
+                for (const provider of credentialOnly) {
+                    provider.models = (byProvider.get(provider.id) ?? []).map((model) => ({
+                        id: model.modelId,
+                        name: model.label,
+                        reasoning: model.reasoning,
+                        imageInput: model.imageInput,
+                        contextWindow: model.contextWindow,
+                    }));
+                }
+            }
+            catch {
+                // A catalog that cannot be read leaves a built-in's models unknown, which is the truth - the
+                // provider itself is still listed and can still be switched off.
+            }
+        }
+        const offList = disabled.map((entry) => ({
+            id: entry.id,
+            ...(entry.name ? { name: entry.name } : {}),
+            baseUrl: typeof entry.modelsEntry?.baseUrl === "string" ? entry.modelsEntry.baseUrl : "",
+            api: typeof entry.modelsEntry?.api === "string" ? entry.modelsEntry.api : "",
+            hasAuthKey: Boolean(entry.credential),
+            ...(entry.modelsEntry ? {} : { builtin: true }),
+            disabled: true,
+            models: entry.models,
+        }));
+        return publicProviders([...configured, ...credentialOnly, ...offList]);
+    }
+    /**
+     * Turns a provider off, then makes every LIVE conversation stop pointing at the models it removed.
+     *
+     * WHY THE CONVERSATIONS ARE REPAIRED. A conversation's model is copied at birth and never re-read
+     * from the workspace - that is the rule. But the model it copied can CEASE TO EXIST, and a
+     * conversation holding one does not fail cleanly: Pi runs the turn on its own default, so the
+     * picker names one model while another one answers. Measured before this change: removing the
+     * model in use left the picker empty (`source=unavailable, models=0`).
+     */
+    async disable(providerId) {
+        const active = await this.registry.load();
+        const known = active.find((provider) => provider.id === providerId);
+        let models = known?.models ?? [];
+        if (!known) {
+            // A built-in has no `models.json` entry, so its list comes from Pi's catalogue - and it has to
+            // be captured NOW: once the credential is gone the catalogue no longer offers it, and the
+            // "off" card would have nothing to say about what switching it back on brings.
+            try {
+                const catalog = await this.runtime.catalog();
+                if (catalog.source === "pi") {
+                    models = catalog.models
+                        .filter((model) => model.provider === providerId)
+                        .map((model) => ({
+                        id: model.modelId,
+                        name: model.label,
+                        reasoning: model.reasoning,
+                        imageInput: model.imageInput,
+                        contextWindow: model.contextWindow,
+                    }));
+                }
+            }
+            catch {
+                // Still switchable off with an unknown model list; the record just says less about it.
+            }
+        }
+        await this.registry.disable(providerId, models);
+        await this.afterChange([{ provider: providerId }]);
+        return this.list();
+    }
+    async enable(providerId) {
+        await this.registry.enable(providerId);
+        await this.afterChange();
+        return this.list();
     }
     /**
      * Adds a provider, or adds a model to one, or updates one.
@@ -99,19 +196,42 @@ export class ProviderService {
             throw error;
         }
         await this.afterChange();
-        return publicProviders(next);
+        return this.list();
     }
-    /** Removes a provider from Pi's models.json and auth.json. */
+    /**
+     * Removes a provider for good.
+     *
+     * THREE KINDS, ONE VERB, because the panel is a view of Pi's model configuration and deleting a
+     * provider means the same thing in all three cases:
+     *   - a provider in `models.json`: its entry and its key go (the original behaviour);
+     *   - a BUILT-IN with only a credential: its models are Pi's, so the credential is the only thing
+     *     there is to delete - and deleting it is exactly what makes Pi stop offering it;
+     *   - one that is already switched off: the remembered copy goes, which is what makes "off"
+     *     permanent instead of something that would come back months later.
+     */
     async remove(providerId) {
         const previous = await this.registry.load();
         const existing = previous.find((provider) => provider.id === providerId);
-        if (!existing)
-            throw new Error(`Super Pi 没有管理供应商「${providerId}」`);
+        if (!existing) {
+            const disabled = (await this.registry.loadDisabled()).some((entry) => entry.id === providerId);
+            if (disabled) {
+                await this.registry.forgetDisabled(providerId);
+                await this.afterChange();
+                return this.list();
+            }
+            const builtin = (await this.registry.loadCredentialOnly()).some((provider) => provider.id === providerId);
+            if (builtin) {
+                await this.registry.removeCredential(providerId);
+                await this.afterChange([{ provider: providerId }]);
+                return this.list();
+            }
+            throw new Error(`Pi 的配置里没有供应商「${providerId}」`);
+        }
         const next = previous.filter((provider) => provider.id !== providerId);
         await this.registry.applyToPi(previous, next);
         await this.registry.save(next);
-        await this.afterChange();
-        return publicProviders(next);
+        await this.afterChange([{ provider: providerId }]);
+        return this.list();
     }
     /**
      * Removes ONE model from a provider, leaving the provider and its other models alone.
@@ -139,8 +259,8 @@ export class ProviderService {
         const next = previous.map((provider) => (provider.id === providerId ? { ...provider, models: remaining } : provider));
         await this.registry.applyToPi(previous, next);
         await this.registry.save(next);
-        await this.afterChange();
-        return publicProviders(next);
+        await this.afterChange([{ provider: providerId, modelId }]);
+        return this.list();
     }
     /**
      * What has to happen after the files are written, for the change to be REAL rather than pending.
@@ -150,9 +270,10 @@ export class ProviderService {
      * UNFILTERED one, and handing that to a conversation that has model rules would offer it models
      * those rules forbid.
      */
-    async afterChange() {
+    async afterChange(removed = []) {
         this.runtime.invalidateCatalog?.();
         this.runtime.bumpModelEpoch?.();
+        await this.repairConversationModels(removed);
         for (const conversation of this.store.snapshot().conversations) {
             if (conversation.archivedAt)
                 continue;
@@ -169,6 +290,40 @@ export class ProviderService {
         await this.catalogService.broadcastAllCatalog?.();
         this.broadcaster.broadcast({ type: "providers.list", providers: await this.list(), apis: [...KNOWN_APIS] });
     }
+    /**
+     * Drops a conversation's model when the change removed it.
+     *
+     * WHY THIS EXISTS AT ALL. A conversation whose model was just deleted is not merely stale - it is
+     * WRONG in a way that never surfaces: Pi cannot resolve the model and runs the turn on its own
+     * default, so the picker says one thing while another model answers. Clearing the field is the
+     * only honest state: the conversation follows Pi's default again, which is what the next turn
+     * does anyway.
+     *
+     * THE LIST IS PASSED IN, NOT DERIVED FROM A CATALOG READ. The caller knows exactly which models it
+     * just took away (one model, or a whole provider), so asking Pi what it offers would be a slower
+     * and less precise way to learn the same thing - and on a machine where Pi is slow or broken, the
+     * broadcast every open tab is waiting for would wait with it.
+     *
+     * ARCHIVED CONVERSATIONS ARE LEFT ALONE: they are read-only by design, and rewriting a frozen
+     * record's stored model would make the archive describe a past that did not happen.
+     */
+    async repairConversationModels(removed) {
+        if (!removed.length)
+            return;
+        const gone = new Set(removed.map((item) => `${item.provider}/${item.modelId ?? "*"}`));
+        let changed = false;
+        for (const conversation of this.store.snapshot().conversations) {
+            const model = conversation.model;
+            if (conversation.archivedAt || !model)
+                continue;
+            if (!gone.has(`${model.provider}/${model.modelId}`) && !gone.has(`${model.provider}/*`))
+                continue;
+            await this.store.clearConversationModel(conversation.id);
+            changed = true;
+        }
+        if (changed)
+            this.broadcaster.broadcastState();
+    }
     /**
      * Discovers available models from the remote provider endpoint.
      * If apiKey is omitted but providerId is given, uses the stored key.

package/dist/server/application/run-service.js

@@ -1018,6 +1018,9 @@ export class RunService {
          */
         const onSteerDelivered = (text) => {
             enqueueTools("a queued message being delivered", async () => {
+                // A delayed SDK delivery during abort still belongs to the stopped producer.
+                if (controller.signal.aborted)
+                    return toolCalls;
                 const previous = assistant;
                 // Checkpoint first: the message being left behind is complete - Pi drains its queues at a turn
                 // boundary - and this is the last chance to write it durably with the lane it belongs to.
@@ -1039,7 +1042,7 @@ export class RunService {
                 // server never handed it - the prompt that opened the turn is the obvious case - and inventing an
                 // assistant message for one of those would open an empty bubble before every single turn.
                 if (!delivered)
-                    return [];
+                    return toolCalls;
                 const next = delivered.assistant;
                 this.broadcaster.broadcastState();
                 assistant = next;
@@ -1053,6 +1056,7 @@ export class RunService {
                 toolCalls = [];
                 return [];
             });
+            return pendingTools;
         };
         try {
             for await (const delta of this.runtime.answer({
@@ -1351,10 +1355,10 @@ export class RunService {
             if (error?.__superPiPreflight) {
                 throw error;
             }
-            await this.store.setStatus(conversation.id, "failed");
-            if (!controller.signal.aborted) {
-                await this.store.setFailureReason(conversation.id, formatTurnFailure(error));
-            }
+            await this.store.setStatus(conversation.id, controller.signal.aborted ? "stopped" : "failed");
+            if (controller.signal.aborted)
+                return;
+            await this.store.setFailureReason(conversation.id, formatTurnFailure(error));
             throw error;
         }
         finally {
@@ -1424,6 +1428,8 @@ export class RunService {
             throw new Error("这条消息已不在等待队列中，无法打断并回答");
         this.interruptTargets.set(conversationId, messageId);
         try {
+            // Clear BEFORE abort: Pi can drain follow-ups while the old turn is winding down.
+            await this.clearPiQueues(conversationId);
             if (this.activeRuns.has(conversationId))
                 await this.stopRun(conversationId);
             // PI'S QUEUES ARE EMPTIED BEFORE THE SELECTED MESSAGE IS ANSWERED ON ITS OWN. The message may be
@@ -1483,8 +1489,9 @@ export class RunService {
         }
         catch (error) {
             await this.store.setStatus(conversationId, controller.signal.aborted ? "stopped" : "failed");
-            if (!controller.signal.aborted)
-                await this.store.setFailureReason(conversationId, formatTurnFailure(error));
+            if (controller.signal.aborted)
+                return;
+            await this.store.setFailureReason(conversationId, formatTurnFailure(error));
             throw error;
         }
         finally {

package/dist/server/command-handler.js

@@ -65,6 +65,11 @@ export class CommandHandler {
         this.conversationService.releaseRevert(conversationId);
     }
     async handleCommand(command, sendToSocket, remoteAddress) {
+        if (command.type === "terminal.shell.set") {
+            if (!this.terminalService || !(await this.terminalService.setShell(command.command, remoteAddress)))
+                return;
+            return;
+        }
         if (command.type === "terminal.open" || command.type === "terminal.input" || command.type === "terminal.resize" || command.type === "terminal.close") {
             if (!this.terminalService)
                 return;
@@ -101,6 +106,22 @@ export class CommandHandler {
             await this.providerService.removeModel(command.providerId, command.modelId);
             return;
         }
+        // OFF AND ON. Separate from `providers.remove` because removing is FOREVER - it drops the key -
+        // while switching a provider off keeps everything needed to switch it back on. The lapsed
+        // subscription is the case this exists for: the provider has to leave the picker, and the person
+        // may well renew the plan next month.
+        if (command.type === "providers.disable") {
+            if (!this.providerService)
+                throw new Error("供应商功能不可用");
+            await this.providerService.disable(command.providerId);
+            return;
+        }
+        if (command.type === "providers.enable") {
+            if (!this.providerService)
+                throw new Error("供应商功能不可用");
+            await this.providerService.enable(command.providerId);
+            return;
+        }
         if (command.type === "providers.fetch") {
             if (!this.providerService)
                 throw new Error("供应商功能不可用");

package/dist/server/http-server.js

@@ -786,6 +786,14 @@ export function createHttpServer(options) {
                 .end(JSON.stringify({ enabled, reason: enabled ? "" : (context.terminalDisabledReason?.() ?? "终端未启用。") }));
             return;
         }
+        if (url.pathname === "/api/terminal-shell") {
+            const { defaultShell, shellSource, terminalShellCandidates } = await import("./terminal.js");
+            const configured = context.store.snapshot().terminalShell;
+            const shell = defaultShell(process.env, configured);
+            response.writeHead(200, { "content-type": "application/json; charset=utf-8" })
+                .end(JSON.stringify({ shell, source: shellSource(process.env, configured), candidates: terminalShellCandidates() }));
+            return;
+        }
         if (url.pathname === "/api/git") {
             const json = (status, body) => response.writeHead(status, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(body));
             try {

package/dist/server/index.js

@@ -237,6 +237,8 @@ const workspaceService = new WorkspaceService(store, runtime, broadcaster, catal
 const terminalService = new TerminalService({
     workspaceFor: (workspaceId) => store.snapshot().workspaces.find((workspace) => workspace.id === workspaceId),
     isTrustedPeer: (remoteAddress) => isLocalOrPrivateAddress(remoteAddress),
+    configuredShell: () => store.snapshot().terminalShell,
+    saveConfiguredShell: async (shell) => { await store.setTerminalShell(shell); broadcaster.broadcastState(); },
 });
 /**
  * Background command execution, independent from subagents. Uses node-pty to run shell commands

package/dist/server/pi-session-events.d.ts

@@ -48,6 +48,11 @@ export type TurnItem =
     kind: "text";
     delta: string;
 }
+/** Non-text notices share the text FIFO; delivery may await a transcript boundary. */
+ | {
+    kind: "callback";
+    run: () => void | Promise<void>;
+}
 /** The turn is over. */
  | {
     kind: "end";
@@ -75,7 +80,7 @@ export interface TurnEventHandlers {
     onThinking?(delta: string): void;
     onThinkingEnd?(): void;
     /** A steer this turn delivered - the text Pi picked up from its own queue. */
-    onSteerDelivered?(text: string): void;
+    onSteerDelivered?(text: string): void | Promise<void>;
     /** Pi's own queue, as a full snapshot. */
     onPiQueue?(queue: {
         steering: string[];

package/dist/server/providers.d.ts

@@ -64,6 +64,54 @@ export type ProviderDefinition = {
     apiKey?: string;
     hasAuthKey?: boolean;
     models: ProviderModelDefinition[];
+    /**
+     * The key is written into `models.json` itself rather than into `auth.json`.
+     *
+     * Pi's own documentation leads with it (`"apiKey": "$MY_KEY"`), and it is the only way to point a
+     * provider at a key that lives in the environment. It matters here because such a provider IS
+     * offered by Pi when the variable is set - so the panel must not tell the person it has no
+     * credential, and must not warn that Pi will not offer it.
+     */
+    keyInModelsJson?: boolean;
+    /**
+     * TRUE when the provider is one of Pi's own, with no entry in `models.json`.
+     *
+     * Its models come from Pi itself and the only thing a person has configured for it is the
+     * credential, so it can be switched off but has no address to edit.
+     */
+    builtin?: boolean;
+    /**
+     * TRUE when the provider is switched OFF: Pi does not offer it, and switching it back on restores
+     * exactly what was there.
+     */
+    disabled?: boolean;
+};
+/**
+ * A provider that was switched OFF, and everything needed to switch it back on.
+ *
+ * WHY THIS EXISTS AT ALL. Turning a provider off means taking it out of Pi's files - the
+ * `models.json` entry and the `auth.json` credential - because that is the only thing Pi honours
+ * (a provider is offered exactly when it has a working credential, and `ModelRuntime.getAvailable()`
+ * is what the picker reads). Taking something out of a file is not the same as throwing it away, so
+ * what was taken out is written down HERE, in Super Pi's own directory, with the same restrictive
+ * permissions the registry already has. Switching it back on is then a matter of putting those two
+ * pieces back where Pi reads them.
+ *
+ * THE CREDENTIAL IS IN HERE, and that is deliberate. A provider that is switched off is one a person
+ * may well switch back on - a coding plan that was renewed, a proxy that was moved - and a
+ * credential that cannot be recovered cannot be restored. The file is 0600, it lives in Super Pi's own
+ * data directory, and nothing in it is ever broadcast: the browser is told only that a key exists.
+ */
+export type DisabledProvider = {
+    id: string;
+    /** The provider's name, as it was. */
+    name?: string;
+    /** The `models.json` entry, verbatim, when the provider had one. */
+    modelsEntry?: Record<string, unknown>;
+    /** The `auth.json` entry, verbatim, when the provider had a credential. */
+    credential?: Record<string, unknown>;
+    /** The models the provider offered, so the panel can show what switching it back on brings. */
+    models: ProviderModelDefinition[];
 };
 /** One model, as the browser sees it. No key, no nothing secret - there is nothing secret here. */
 export type { PublicProvider, PublicProviderModel } from "./types.js";
@@ -116,11 +164,69 @@ export declare class ProviderRegistry {
     constructor(dataDir: string, piDir?: string);
     /** Super Pi's own registry: the providers it manages, with their keys. */
     private get registryPath();
+    /** The registry file as one object: the managed providers AND the ones turned off. */
+    private readRegistry;
+    /** Writes one half of the registry file without losing the other. */
+    private writeRegistry;
     /**
      * Reads all configured providers directly from Pi's models.json and auth.json.
      * Super Pi acts as the direct visual management plane for Pi's model configurations.
+     *
+     * PROVIDERS THAT ARE TURNED OFF ARE NOT IN HERE. They have been taken out of Pi's files - that is
+     * what "off" means - so this list is exactly what Pi would offer, which is what the write path
+     * (`set`, `remove`, `applyToPi`) has to reason about. `loadDisabled()` is the other half, for the
+     * panel that has to be able to switch them back on.
      */
     load(): Promise<ProviderDefinition[]>;
+    /**
+     * Pi's OWN providers: the ones that exist because they have a credential in `auth.json` and no
+     * entry in `models.json`.
+     *
+     * WHY THIS IS A SEPARATE READ. A built-in such as `kimi-coding` is defined inside Pi, not in a
+     * file - the only thing a person has configured for it is the credential. Those providers are
+     * invisible to `load()`, which reads `models.json`, and that is correct for the WRITE path:
+     * writing an empty `models.json` entry for a built-in would shadow Pi's own definition with a
+     * broken one. But they are exactly what a person wants to switch off ("I stopped paying for this
+     * plan"), so the panel has to see them. This returns the ids and the fact of a credential; the
+     * models come from Pi's catalogue, which this file layer cannot see.
+     */
+    loadCredentialOnly(): Promise<ProviderDefinition[]>;
+    /** The providers that are switched off, as the panel needs to see them. */
+    loadDisabled(): Promise<DisabledProvider[]>;
+    /**
+     * Takes a provider out of Pi's configuration and remembers exactly what was taken out.
+     *
+     * TWO FILES, and both are needed. `models.json` is where a custom provider's models are defined;
+     * `auth.json` is where its credential is. Pi offers a provider's models only when its auth is
+     * configured (`ModelRuntime.getAvailable()` filters on exactly that), so removing the credential
+     * is what makes a BUILT-IN stop being offered - it has no `models.json` entry to remove - while
+     * removing both is what makes a custom one disappear completely.
+     *
+     * NOTHING IS THROWN AWAY. Both pieces are written into Super Pi's own registry, which is how
+     * `enable` can put them back byte for byte. A person switching off a lapsed subscription provider
+     * is not asking to forget their endpoint and their models.
+     */
+    disable(providerId: string, models?: ProviderModelDefinition[]): Promise<void>;
+    /**
+     * Puts a provider back exactly where `disable` took it from.
+     *
+     * AN EXISTING ENTRY IS NOT OVERWRITTEN. The person may have re-created the provider (or written a
+     * new `models.json` entry for the same id) while it was off; the newer entry is theirs and wins,
+     * and only the missing piece is restored. Refusing would be worse: the switch says "back on", and
+     * the credential is what makes it usable.
+     */
+    enable(providerId: string): Promise<void>;
+    /**
+     * Deletes a BUILT-IN provider's credential from Pi's `auth.json`.
+     *
+     * THE ONLY THING THERE IS TO DELETE. A built-in's models live in Pi itself; what a person has
+     * configured for it is the credential, and removing that is what makes Pi stop offering it. This
+     * is the PERMANENT version: unlike `disable`, nothing is remembered, so switching it back on means
+     * logging in to that provider again (which is what re-subscribing to the plan involves anyway).
+     */
+    removeCredential(providerId: string): Promise<void>;
+    /** Forgets a disabled provider without restoring anything: the permanent form of "off". */
+    forgetDisabled(providerId: string): Promise<void>;
     /** Writes the registry. The key lives here, so the file is 0600. */
     save(providers: ProviderDefinition[]): Promise<void>;
     /**