@fastagent-sh/voicenote 0.18.7 → 0.19.0

package/README.md

@@ -78,7 +78,7 @@ setx VOICENOTE_RECORD_DIR "E:\RECORD"
 ## Dependencies
 
 - **Bun >= 1.3 (required at runtime)** — the code uses `Bun.Glob` / `Bun.file`; plain Node cannot run it
-- Node / npm — only used to install the pi CLI (pi-codex backend)
+- Node / npm — only used to install the pi CLI (the notes backend)
 - ffmpeg / ffprobe (audio duration detection):
 
 ```bash
@@ -113,50 +113,33 @@ Optional settings:
   "VOICENOTE_RECORD_DIR": "/Volumes/VTR6500/RECORD",
   "VOICENOTE_MAX_AGE_HOURS": "48",
   "VOICENOTE_PI_BIN": "pi",
-  "VOICENOTE_PI_PROVIDER": "openai-codex",
-  "VOICENOTE_PI_MODEL": "gpt-5.5",
   "VOICENOTE_PI_THINKING": "high",
   "VOICENOTE_PI_SUMMARY_TOOLS": "read,grep",
   "VOICENOTE_CONTEXT_DIR": "/Users/you/vault"
 }
 ```
 
-`VOICENOTE_PI_PROVIDER` is a fallback chain, tried left to right; it defaults to
-`openai-codex` alone. Add the paid API path explicitly (`openai-codex,openai`) if
-you keep an OpenAI key around. Credentials are
-resolved by `pi auth check` (covering OAuth, keys stored by `pi` → `/login`, and
-each provider's own API-key env var). A provider that deterministically cannot
-work — no credentials, or not a provider pi knows — is dropped from the chain,
-because its inevitable "No API key found" would replace the real error from the
-provider that actually failed. When a chain still fails everywhere, the reported
-error lists every provider's failure, so a fallback's missing key never hides why
-the first provider broke. If pruning empties the chain, `vn run --mode notes`
-skips instead of paying for a transcript whose summary cannot happen.
-`vn doctor` prints the effective chain and the status of anything not ready.
+### Which model writes the notes
 
-### DeepSeek notes
+voicenote does not choose one. It runs `pi -p` with no `--provider`/`--model`, so
+the provider, model and credentials are whatever pi itself is configured to use
+(`pi` → `/login <provider>`, pi's settings, or a provider API key in the
+environment). Change the model in pi, not here. There is no fallback to a second
+provider: if pi fails, the transcript is kept and the summary can be retried with
+`vn run --latest`.
 
-In the desktop app, open **Settings → Notes generation**, select **DeepSeek API**, enter your API key, and save. The model defaults to `deepseek-v4-flash`; enter `deepseek-v4-pro` to use Pro. ChatGPT sign-in is only shown for configurations that use ChatGPT. Audio transcription continues to use Volcano.
+`DEEPSEEK_API_KEY` and `OPENAI_API_KEY` in the config are only forwarded to pi's
+environment for providers that read them.
 
-For the CLI, merge these values into `~/.config/voicenote/config.json`:
-
-```json
-{
-  "VOICENOTE_PI_PROVIDER": "deepseek",
-  "VOICENOTE_PI_MODEL_SUMMARY": "deepseek-v4-flash",
-  "DEEPSEEK_API_KEY": "..."
-}
-```
-
-The notes-specific model setting takes precedence over `VOICENOTE_PI_MODEL`. When switching providers in the GUI, the model resets to that provider's default. API keys can also come from pi's authentication file or the environment; pi's authentication file takes priority over API-key environment variables.
-
-Save changes, then check `vn doctor` or the app's Status panel. Credential checks confirm configuration, not API connectivity or account balance. Each provider in a fallback chain receives the same model ID, so configure DeepSeek on its own rather than mixing it with OpenAI.
+Transient failures (dropped socket, 5xx, 429) are retried on the same provider up
+to `VOICENOTE_PI_RETRIES` times (default 3). Quota and auth errors are not
+retried.
 
 ## Usage
 
 ```bash
 vn doctor                       # check environment and config
-vn run                          # default: Volcano ASR + pi-codex notes
+vn run                          # default: Volcano ASR + pi notes
 vn run --mode transcript        # transcript only, skip semantic notes
 vn run --latest                 # process only the latest valid recording
 vn run --latest --force         # re-run the latest one
@@ -284,7 +267,7 @@ A self-contained macOS `.app` (Tauri v2) for **non-terminal users**: the target
 
 **Positioning**: the GUI is only a "status dashboard + quick access to output" — it does **not** drive processing. The full pipeline runs autonomously every 60s via the background LaunchAgent using the bundled engine (it keeps running with the GUI closed).
 
-- First run: settings (identity / Volcano keys / notes provider / proxy). Choose DeepSeek with an API key, or ChatGPT with browser sign-in (`vn login`'s browser-callback flow).
+- First run: settings (identity / Volcano keys / proxy). The notes model comes from pi; ChatGPT users can sign in from the Status panel (`vn login`'s browser-callback flow).
 - After that: the main view shows agent activity + recent notes (open note / open folder)
 
 ### What's bundled
@@ -342,7 +325,7 @@ irm https://raw.githubusercontent.com/fastagent-sh/voicenote/main/scripts/instal
 
 `install-app.sh` downloads the packaged `.app` from GitHub Releases → installs to `/Applications` → **removes the quarantine flag for the user** (Gatekeeper bypass for un-notarized builds) → opens it. The target machine needs no bun/pi/ffprobe/global vn (all bundled).
 
-**First launch**: the app lands on Settings. Fill in identity, your Volcano ASR/TOS keys, notes provider/model, and proxy as needed. For DeepSeek or OpenAI API, enter the corresponding API key; for ChatGPT, save and click "Sign in to ChatGPT" in the Status panel. Saving installs and loads the background LaunchAgent using the bundled engine. Once credentials are configured, plug in the recorder for automatic transcription and notes.
+**First launch**: the app lands on Settings. Fill in identity, your Volcano ASR/TOS keys, and proxy as needed. Notes are written by pi with pi's own provider and model; for ChatGPT, click "Sign in to ChatGPT" in the Status panel. Saving installs and loads the background LaunchAgent using the bundled engine. Once credentials are configured, plug in the recorder for automatic transcription and notes.
 
 > The background agent label is `sh.fastagent.voicenote` (same as the CLI version; only one exists per machine). If the `.app` is moved, open it once to recalibrate the plist.
 

package/README.zh-CN.md

@@ -78,7 +78,7 @@ setx VOICENOTE_RECORD_DIR "E:\RECORD"
 ## 依赖
 
 - **Bun >= 1.3(运行时必需)** -- 代码用到 `Bun.Glob` / `Bun.file`,纯 Node 无法运行
-- Node / npm -- 仅用于安装 pi CLI(pi-codex 后端)
+- Node / npm -- 仅用于安装 pi CLI(纪要后端)
 - ffmpeg / ffprobe(音频时长检测):
 
 ```bash
@@ -113,28 +113,29 @@ brew install ffmpeg
   "VOICENOTE_RECORD_DIR": "/Volumes/VTR6500/RECORD",
   "VOICENOTE_MAX_AGE_HOURS": "48",
   "VOICENOTE_PI_BIN": "pi",
-  "VOICENOTE_PI_PROVIDER": "openai-codex",
-  "VOICENOTE_PI_MODEL": "gpt-5.5",
   "VOICENOTE_PI_THINKING": "high",
   "VOICENOTE_PI_SUMMARY_TOOLS": "read,grep",
   "VOICENOTE_CONTEXT_DIR": "/Users/you/vault"
 }
 ```
 
-`VOICENOTE_PI_PROVIDER` 是从左到右尝试的回退链, 默认只有 `openai-codex`。如果你确实配了
- OpenAI API key, 可以显式写成 `openai-codex,openai`。凭证由 `pi auth check` 判定(覆盖
-OAuth、`pi` → `/login` 存下的 key、以及各 provider 自己的 API key 环境变量)。
-确定不可能工作的 provider(没凭证, 或 pi 根本不认识这个名字)会被剔除 —— 否则
-它必然抛出的 "No API key found" 会覆盖掉真正失败的那个 provider 的错误。整条链都失败时,
-报错会列出每个 provider 的失败原因, 回退项缺 key 不会再掩盖第一个 provider 的真正错误。
-若剪枝后链变空, `vn run --mode notes` 会直接跳过, 而不是花钱转写一个注定无法生成纪要的录音。
-实际生效的链和非 ready 项的状态由 `vn doctor` 打印。
+### 纪要用哪个模型
+
+voicenote 不选。它执行 `pi -p`, 不传 `--provider`/`--model`, 所以 provider、模型和凭证
+全部来自 pi 自己的配置(`pi` → `/login <provider>`、pi 的设置, 或环境里的 provider
+API key)。要换模型就去 pi 里改。也不会回退到第二个 provider: pi 失败时 transcript 会
+保留, 用 `vn run --latest` 重试纪要即可。
+
+配置里的 `DEEPSEEK_API_KEY` / `OPENAI_API_KEY` 只是透传给 pi 的环境变量。
+
+瞬时性失败(断连、5xx、429)会在同一个 provider 上重试, 次数由 `VOICENOTE_PI_RETRIES`
+控制(默认 3)。额度和鉴权错误不重试。
 
 ## 用法
 
 ```bash
 vn doctor                       # 检查环境与配置
-vn run                          # 默认:Volcano ASR + pi-codex 纪要
+vn run                          # 默认:Volcano ASR + pi 纪要
 vn run --mode transcript        # 只生成 transcript,跳过语义整理
 vn run --latest                 # 只处理最新有效录音
 vn run --latest --force         # 重跑最新条
@@ -186,7 +187,7 @@ vn uninstall-launch-agent
 3. 复制原始音频到 `${VOICENOTE_WORKSPACE}/_audio/YYYY-MM/`
 4. 转写:火山豆包【大模型录音文件识别标准版 API】,本地音频先传到 TOS,提交任务后轮询结果,完成后默认删除 TOS 对象
 5. 转写完成后立刻落盘原始 transcript(不做 lossy 清洗),避免后面步骤失败导致 ASR 费用白付
-6. summary 模型(默认 pi codex 走 ChatGPT Plus)直接看原始 transcript,在纪要生成阶段内部完成必要清理、说话人还原、观点/争论/共识形成过程还原;如果 summary 失败,下一次 `vn run` / `vn run --latest` 会复用已保存 transcript,直接重试纪要生成,不需要 `vn forget`
+6. summary 模型(由 pi 自身配置决定)直接看原始 transcript,在纪要生成阶段内部完成必要清理、说话人还原、观点/争论/共识形成过程还原;如果 summary 失败,下一次 `vn run` / `vn run --latest` 会复用已保存 transcript,直接重试纪要生成,不需要 `vn forget`
 7. 写出 notes / metadata；系统不做任何归档决定，文件留在配置的 workspace 中
 
 失败的录音会在后续运行中重试，但**最多 3 次**（转写失败、纪要失败、以及被中途 kill 的运行都算）。超过后标记为 `Gave up` 并不再自动重试，避免一个坏文件每个调度周期都烧一次 ASR/LLM 额度 —— `vn forget <name>` 会删掉该记录并重新入队。重新入队不等于重新转写：磁盘上已有 transcript 时会直接复用，所以 `vn forget` 不会让你再付一次 ASR。（`vn forget` 需要 run lock，因此在某次 run 进行中时会拒绝执行 —— 等该次 run 结束后重试即可。）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastagent-sh/voicenote",
-  "version": "0.18.7",
+  "version": "0.19.0",
   "description": "Voice recordings → diarized transcripts → integrated semantic Markdown notes. Currently optimized for the PHILIPS VTR6500 recorder, but the workflow is generic.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,6 @@
     "src/envConfig.ts",
     "src/jobs.ts",
     "src/runLock.ts",
-    "src/piProvider.ts",
     "README.md",
     "LICENSE"
   ],

package/src/cli.ts

@@ -2,7 +2,6 @@
 import { cac } from 'cac'
 import { deriveNoProxy, envKeysToEmbed, hydrateFromFileEnv, parseFileEnv } from './envConfig'
 import { parseLockOwner } from './runLock'
-import { defaultPiModel, parsePiAuthStatus, parseProviderChain, usableChain, type PiAuthStatus } from './piProvider'
 import { applyOutcome, buildJobsView, classify, emptyState, localIso, MAX_ATTEMPTS, migrateLegacyState, ownsOutput, parseJobsLimit, parseStateFile, parseStrictJson, patchJob, pruneUnseen, reconcileInterrupted, startAttempt, SUMMARY_FAILED_STATUS, type CurrentJob, type JobRecord, type StateFile } from './jobs'
 import { createHash, createHmac, randomUUID } from 'node:crypto'
 import { appendFile, chmod, mkdir, readFile, writeFile, copyFile, rename, unlink, stat, readdir, rm } from 'node:fs/promises'
@@ -13,7 +12,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { spawn, spawnSync } from 'node:child_process'
 import os from 'node:os'
 
-const VERSION = '0.18.7'
+const VERSION = '0.19.0'
 const LAUNCH_AGENT_LABEL = 'sh.fastagent.voicenote'
 const LAUNCH_AGENT_LABEL_LEGACY = 'com.kid7st.voicenote' // pre-fastagent installs; cleaned up on install
 const TASK_NAME = 'VoiceNote'   // Windows Task Scheduler name (mac uses LAUNCH_AGENT_LABEL)
@@ -127,9 +126,6 @@ const ENV_KEYS = [
   'VOICENOTE_PI_BIN',
   'VOICENOTE_PI_CLI',
   'VOICENOTE_FFPROBE_BIN',
-  'VOICENOTE_PI_PROVIDER',
-  'VOICENOTE_PI_MODEL',
-  'VOICENOTE_PI_MODEL_SUMMARY',
   'VOICENOTE_PI_THINKING',
   'VOICENOTE_PI_SUMMARY_TOOLS',
   'VOICENOTE_CONTEXT_DIR',
@@ -1135,7 +1131,7 @@ async function volcanoTranscribeAudio(volc: VolcanoConfig, audioPath: string, re
       if (queryFailures >= 10) throw new Error(`Volcano query failed ${queryFailures}x in a row: ${desc}`)
       if (Date.now() - started > maxWaitMs) throw new Error(`Volcano: timeout after ${formatElapsed(Date.now() - started)} (last error: ${desc})`)
       // console.error (not log) so wireDailyLog tags it [ERROR] and `vn errors`
-      // surfaces it — matching chatCompleteViaPiCodex's transient-retry logging.
+      // surfaces it — matching chatCompleteViaPi's transient-retry logging.
       // A repeatedly-near-threshold ASR wobble is exactly what ops wants to see.
       console.error(`… Volcano: transient query failure (attempt ${queryFailures}/10, will retry): ${desc}`)
     }
@@ -1280,7 +1276,9 @@ ${transcript}`
 }
 
 // ───────────────────────────────────────────────────────────────────────
-// Summary via pi (pi-codex — ChatGPT Plus/Pro OAuth, no OpenAI API key)
+// Summary via pi. Provider, model and credentials are pi's own configuration:
+// we invoke `pi -p` with no --provider/--model and never fall back elsewhere,
+// so whatever the user selected in pi is what writes the notes.
 // ───────────────────────────────────────────────────────────────────────
 
 function piCodexBin(): string {
@@ -1300,21 +1298,6 @@ function piInvocation(args: string[]): { bin: string; args: string[] } {
   return cli ? { bin, args: [cli, ...args] } : { bin, args }
 }
 
-// Gate before ASR is spent. "May work", not "will": only a chain pruned to
-// nothing (every provider deterministically unusable) stops a run — see
-// usableChain for why an unanswerable probe does not.
-function summaryMayWork(): boolean {
-  return piProviderCandidates().length > 0
-}
-
-// The one diagnostic for an empty chain, shared by the pre-ASR gate and the
-// summary call itself. Both must name the same cause: a generic "exhausted" here
-// would overwrite the truth exactly the way "No API key found for openai" did.
-function noUsableProviderMessage(): string {
-  const statuses = piConfiguredProviders().map(p => `${p}:${piProviderAuthStatus(p)}`).join(' ')
-  return `no usable summary provider (${statuses}) — each has no credentials, or is not a provider pi knows. Sign in (\`vn login\` for openai-codex, else \`pi\` → \`/login <provider>\` or its API key), or fix VOICENOTE_PI_PROVIDER.`
-}
-
 // ───────────────────────────────────────────────────────────────────────
 // ChatGPT (OpenAI Codex) OAuth login — headless device-code flow.
 // Today the only way to authenticate the pi summary backend is to open pi's
@@ -1484,57 +1467,6 @@ async function configSet(): Promise<void> {
   }
 }
 
-// A healthy probe takes ~0.5s and the chain is re-read many times per run, so
-// cache it — but briefly: `vn serve` is long-lived, and the answer changes out of
-// band when the user runs `pi` → `/login` elsewhere, or an OAuth token expires.
-const PI_AUTH_TTL_MS = 60_000
-// Refresh is deliberately left on (no --no-refresh) so an expired OAuth that
-// cannot be renewed reads as broken rather than ready — which means the probe
-// touches the network and can hang. Probes are serial, so a hung pi blocks a
-// scheduler tick for this × the chain length. Kept impatient (a healthy probe is
-// ~0.5s) because a timeout yields 'unknown', which is neutral: the run proceeds
-// and pi reports the real error, so cutting it short costs nothing.
-const PI_AUTH_PROBE_MS = 2000
-const piAuthStatusCache = new Map<string, { status: PiAuthStatus; at: number }>()
-function piProviderAuthStatus(provider: string): PiAuthStatus {
-  const cached = piAuthStatusCache.get(provider)
-  if (cached && Date.now() - cached.at < PI_AUTH_TTL_MS) return cached.status
-  const inv = piInvocation(['auth', 'check', '--provider', provider, '--json'])
-  // Bun's spawnSync needs an explicit env to inherit keys loaded from config.json.
-  const out = spawnSync(inv.bin, inv.args, { encoding: 'utf8', timeout: PI_AUTH_PROBE_MS, windowsHide: true, env: process.env })
-  // No pi binary is deterministic evidence in its own right — next run gets the
-  // same answer — so it belongs with 'unusable', not with a probe that timed out.
-  const status = (out.error as NodeJS.ErrnoException | undefined)?.code === 'ENOENT'
-    ? 'unusable'
-    : parsePiAuthStatus(out.stdout || '')
-  // 'unknown' is neutral by design, so nothing downstream reports it. Say it here
-  // — throttled, not once-per-process: `vn serve` re-probes every TTL and a probe
-  // that never answers would otherwise go silent after its first tick.
-  if (status !== 'ready' && shouldLogIdleStatus(`pi-auth-probe:${provider}:${status}`)) {
-    console.error(`pi auth check ${provider} → ${status}: ${String(out.error?.message || out.stderr || out.stdout || 'no output').slice(0, 200)}`)
-  }
-  piAuthStatusCache.set(provider, { status, at: Date.now() })
-  return status
-}
-
-function piConfiguredProviders(): string[] {
-  return parseProviderChain(process.env.VOICENOTE_PI_PROVIDER)
-}
-
-function piProviderCandidates(): string[] {
-  return usableChain(piConfiguredProviders(), piProviderAuthStatus)
-}
-
-function piProviderFor(): string {
-  // Label for logs and metadata.llm_backend. Empty chain is a real state now, and
-  // naming a provider we already know is unusable would put a lie in the record.
-  return piProviderCandidates()[0] || 'none-usable'
-}
-
-function piCodexModelFor(): string {
-  return process.env.VOICENOTE_PI_MODEL_SUMMARY || process.env.VOICENOTE_PI_MODEL || defaultPiModel(piConfiguredProviders()[0]!)
-}
-
 function stripJsonFences(text: string): string {
   const trimmed = text.trim()
   const fence = trimmed.match(/^```(?:json)?\s*([\s\S]*?)\s*```\s*$/i)
@@ -1562,21 +1494,18 @@ function extractFirstJsonObject(text: string): string {
   return trimmed
 }
 
-async function chatCompleteViaPiProvider(opts: {
+async function runPi(opts: {
   systemPrompt: string
   userPrompt: string
-  model: string
-  provider: string
   timeoutMs?: number
   thinking?: string
   tools?: string  // e.g. 'read,grep'; empty/undefined = --no-tools
   appendSystemPrompt?: string
   cwd?: string  // agent working dir: the knowledge base, so read/grep/find default there
 }): Promise<string> {
+  // No --provider/--model: pi's own configuration picks the model and credentials.
   const args = [
     '-p',
-    '--provider', opts.provider,
-    '--model', opts.model,
     '--mode', 'text',
     '--no-extensions', '--no-skills', '--no-context-files', '--no-session', '--no-prompt-templates', '--no-themes',
     '--system-prompt', opts.systemPrompt,
@@ -1595,62 +1524,42 @@ async function chatCompleteViaPiProvider(opts: {
     child.on('error', err => { if (timer) clearTimeout(timer); reject(err) })
     child.on('close', code => {
       if (timer) clearTimeout(timer)
-      if (code !== 0) return reject(new Error(`pi ${opts.provider} exited ${code}: ${(stderr || stdout).slice(0, 800)}`))
+      if (code !== 0) return reject(new Error(`pi exited ${code}: ${(stderr || stdout).slice(0, 800)}`))
       const text = stdout.trim()
-      if (!text) return reject(new Error(`pi ${opts.provider} returned empty output`))
+      if (!text) return reject(new Error('pi returned empty output'))
       resolve(text)
     })
+    // A pi that dies before draining stdin (bad flags, crash on startup) closes the
+    // pipe mid-write. Without this handler the EPIPE is an unhandled 'error' event
+    // that kills the whole run, hiding pi's actual error; 'close' below reports it.
+    child.stdin.on('error', (e: NodeJS.ErrnoException) => {
+      if (e.code !== 'EPIPE') warnSideEffect('write prompt to pi stdin', e)
+    })
     child.stdin.end(opts.userPrompt)
   })
 }
 
-// A transient pi failure (proxy reset, dropped socket, upstream 5xx/429) must be
-// retried on the SAME provider before falling back. Otherwise a momentary blip on
-// the free codex path cascades straight into the paid OpenAI API and, if that is
-// out of quota, a hard failure + stub — exactly what looks like a "quota problem"
-// when the real cause was one closed socket. Quota/auth/4xx are NOT transient:
-// retrying them just wastes time, so they fall through to the next provider.
+// A transient pi failure (proxy reset, dropped socket, upstream 5xx/429) is
+// retried: a momentary blip must not cost a run its notes. Quota/auth/4xx are NOT
+// transient — retrying them only wastes time, so they fail the summary at once.
 function isTransientPiError(e: any): boolean {
   const msg = String(e?.message || e).toLowerCase()
   if (/quota|unauthorized|invalid.*(key|token|credential)|forbidden|\b40[0-4]\b/.test(msg)) return false
   return /socket connection was closed|socket hang up|econnreset|etimedout|esockettimedout|enetunreach|econnrefused|eai_again|fetch failed|network error|timed ?out|temporarily|overloaded|\b(429|500|502|503|504)\b/.test(msg)
 }
 
-// Returns the provider that actually answered, not the one we started with: the
-// chain falls back, and metadata recording the head would misname the run.
-async function chatCompleteViaPiCodex(opts: Omit<Parameters<typeof chatCompleteViaPiProvider>[0], 'provider'>): Promise<{ text: string; provider: string }> {
-  const providers = piProviderCandidates()
-  // Reachable past the pre-ASR gate: credentials can lapse mid-run, or the caller
-  // may not go through it at all.
-  if (!providers.length) throw new Error(noUsableProviderMessage())
+async function chatCompleteViaPi(opts: Parameters<typeof runPi>[0]): Promise<string> {
   const maxAttempts = Math.max(1, Number(process.env.VOICENOTE_PI_RETRIES || 3))
-  let lastError: any = null
-  const failures: string[] = []
-  for (const [idx, provider] of providers.entries()) {
-    if (idx > 0) console.error(`pi provider fallback: trying ${provider} after ${providers[idx - 1]} failed: ${lastError?.message || lastError}`)
-    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-      try {
-        return { text: await chatCompleteViaPiProvider({ ...opts, provider }), provider }
-      } catch (e: any) {
-        lastError = e
-        if (attempt < maxAttempts && isTransientPiError(e)) {
-          const backoffMs = Math.min(30000, 2000 * 2 ** (attempt - 1))
-          console.error(`pi ${provider} transient error (attempt ${attempt}/${maxAttempts}); retrying in ${backoffMs}ms: ${e?.message || e}`)
-          await new Promise(res => setTimeout(res, backoffMs))
-          continue
-        }
-        break // non-transient, or retries exhausted → fall back to next provider
-      }
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await runPi(opts)
+    } catch (e: any) {
+      if (attempt >= maxAttempts || !isTransientPiError(e)) throw e
+      const backoffMs = Math.min(30000, 2000 * 2 ** (attempt - 1))
+      console.error(`pi transient error (attempt ${attempt}/${maxAttempts}); retrying in ${backoffMs}ms: ${e?.message || e}`)
+      await new Promise(res => setTimeout(res, backoffMs))
     }
-    failures.push(`${provider}: ${String(lastError?.message || lastError).slice(0, 400)}`)
   }
-  // Report EVERY provider's error, not just the chain's last one. The last link is
-  // usually the fallback nobody signed into, so its "No API key found for openai"
-  // buried the actual reason openai-codex failed (usage limit, expired token, 5xx)
-  // in the notes stub and in the GUI — which then disagreed with a dashboard that
-  // correctly showed ChatGPT as connected.
-  if (failures.length > 1) throw new Error(`pi summary failed on every provider — ${failures.join(' | ')}`)
-  throw lastError || new Error('pi provider fallback exhausted')
 }
 
 function piThinkingLevel(): string {
@@ -1677,20 +1586,19 @@ function piSummaryToolsHint(contextDir: string): string {
   return `Before writing the notes you have two read-only tools: read and grep. Your current working directory (cwd) is \`${contextDir}\` (the configured notes/reference directory); use relative paths for grep/read.\n\nGoal: use existing context to align names, speakers, client/project names, product names, and domain terms in this note; do not maintain or assume a separate glossary.\n\nSuggested flow:\n- First extract the most likely client/project/product keywords from the title, filename, and transcript.\n- If a clear topic matches, prefer grep/read on related index pages, project docs, status records, or the 3-5 most recent related notes in the same directory; use them to identify Speaker B/C/F etc., common aliases, product names, and term spellings.\n- If no clear topic matches, grep the current directory with keywords and read only the few most relevant files.\n- Before output, do one names/terms lint pass: eliminate leftover Speaker A/B/C, obviously misheard names, product-name variants, and outdated names; when context is insufficient, keep the uncertainty — never guess.\n\nConstraints:\n- At most 10 tool calls total; if the transcript alone is sufficient, make none.\n- Read only within \`${contextDir}\`; skip directories that clearly involve personal privacy/credentials/finance (e.g. identity / credentials / finance).\n- Found information is only for consistency and background calibration; never write content absent from this transcript into the notes as new meeting facts.\n- Do not attempt to write files or call bash (those tools are not enabled).`
 }
 
-// Summary runs through pi with the configured provider. The agent's working dir IS the knowledge
+// Summary runs through pi. The agent's working dir IS the knowledge
 // base, so read/grep/find operate there directly. If a configured context dir is
 // missing, say so loudly and run without tools rather than searching the wrong
 // tree (tools, the cwd hint, and the spawn cwd move together).
-async function chatComplete(opts: { systemPrompt: string; userPrompt: string; config: Config }): Promise<{ text: string; provider: string }> {
+async function chatComplete(opts: { systemPrompt: string; userPrompt: string; config: Config }): Promise<string> {
   const wantTools = !!piSummaryTools()
   const ctx = wantTools ? summaryContextDir(opts.config) : undefined
   const ctxExists = ctx ? existsSync(ctx) : false
   if (ctx && !ctxExists) console.error(`Warning: context dir ${ctx} does not exist; summary agent runs WITHOUT read/grep cross-reference.`)
   const toolsActive = wantTools && ctxExists
-  return chatCompleteViaPiCodex({
+  return chatCompleteViaPi({
     systemPrompt: opts.systemPrompt,
     userPrompt: opts.userPrompt,
-    model: piCodexModelFor(),
     timeoutMs: 60 * 60 * 1000,
     thinking: piThinkingLevel(),
     tools: toolsActive ? piSummaryTools() : undefined,
@@ -1699,14 +1607,14 @@ async function chatComplete(opts: { systemPrompt: string; userPrompt: string; co
   })
 }
 
-async function summarizeTranscript(config: Config, transcript: string, rec: Recording, localAudioPath: string): Promise<{ meta: Json; provider: string }> {
+async function summarizeTranscript(config: Config, transcript: string, rec: Recording, localAudioPath: string): Promise<Json> {
   const messages = summaryMessages(config, transcript, rec, localAudioPath)
   const systemPrompt = String(messages[0]!.content)
   const userPrompt = String(messages[1]!.content)
-  const { text, provider } = await chatComplete({ systemPrompt, userPrompt, config })
+  const text = await chatComplete({ systemPrompt, userPrompt, config })
   const jsonText = extractFirstJsonObject(text)
   try {
-    return { meta: JSON.parse(jsonText || '{}') as Json, provider }
+    return JSON.parse(jsonText || '{}') as Json
   } catch (e: any) {
     throw new Error(`summary returned non-JSON output (${e?.message || e}). First 400 chars: ${text.slice(0, 400)}`)
   }
@@ -1797,9 +1705,7 @@ async function processRecording(config: Config, rec: Recording, opts: any): Prom
   const needsNotes = mode === 'notes'
   const resumeSummary = needsNotes && Boolean(opts.resumeFromTranscriptFiles)
   const transcribeBackendLabel = `volcano:${config.volcano?.resourceId || 'volc.seedasr.auc'}`
-  // Lazy: resolving it probes pi (network, and `auth check` refreshes tokens on
-  // disk). Transcript mode never calls pi, and --dry-run promises no side effects.
-  const llmBackendLabel = needsNotes && !opts.dryRun ? `pi:${piProviderFor()}` : null
+  const llmBackendLabel = needsNotes && !opts.dryRun ? 'pi' : null
   const plan = resumeSummary
     ? 'reuse saved transcript → integrated semantic notes → write metadata/index (no auto move)'
     : `copy audio → transcribe → write transcript${needsNotes ? ' → integrated semantic notes' : ''} → write metadata/index (no auto move)`
@@ -1851,13 +1757,10 @@ async function processRecording(config: Config, rec: Recording, opts: any): Prom
   }
 
   let summaryError: any = null
-  let summaryProvider: string | null = null
   if (needsNotes) {
-    progressStep(nextStep(), totalSteps, 'Generate integrated semantic notes', `model=${piCodexModelFor()} via ${llmBackendLabel}`)
+    progressStep(nextStep(), totalSteps, 'Generate integrated semantic notes', 'via pi (pi\'s own provider/model config)')
     try {
-      const summary = await withHeartbeat('generate integrated semantic notes', () => summarizeTranscript(config, transcript, rec, files.audio), 60)
-      meta = summary.meta
-      summaryProvider = summary.provider
+      meta = await withHeartbeat('generate integrated semantic notes', () => summarizeTranscript(config, transcript, rec, files.audio), 60)
     } catch (e: any) {
       summaryError = e
       console.error(`Summary step failed; transcript is preserved. Error: ${e?.message || e}`)
@@ -1874,10 +1777,9 @@ async function processRecording(config: Config, rec: Recording, opts: any): Prom
   meta.duration_seconds = rec.durationSeconds
   meta.asr_provider = 'volcano'
   meta.transcribe_model = config.volcano?.resourceId || 'volc.seedasr.auc'
-  meta.summary_model = needsNotes && !summaryError ? piCodexModelFor() : null
-  // The provider that actually answered, not the head of the chain it may have
-  // fallen back from. Null when no summary ran — summary_error says why.
-  meta.llm_backend = summaryProvider ? `pi:${summaryProvider}` : null
+  // pi picks the model, so we cannot name it here. Null when no summary ran —
+  // summary_error says why.
+  meta.llm_backend = needsNotes && !summaryError ? 'pi' : null
   meta.processed_at = nowIso()
   if (summaryError) meta.summary_error = String(summaryError?.message || summaryError)
 
@@ -2161,10 +2063,6 @@ async function runPipelineLocked(config: Config, opts: any): Promise<void> {
       if (shouldLogIdleStatus(`asr-misconfig:${config.recordDir}`)) console.error('ASR not configured: Volcano needs VOLCANO_ASR_KEY / VOLCANO_TOS_*. Skipping; run `vn doctor`, fix config, then re-run.')
       return
     }
-    if (mode === 'notes' && !summaryMayWork()) {
-      if (shouldLogIdleStatus(`pi-noauth:${config.recordDir}`)) console.error(`Skipping to avoid spending ASR on notes whose summary would fail: ${noUsableProviderMessage()}`)
-      return
-    }
   }
   if (!targets.length) {
     if (verboseSkips || shouldLogIdleStatus(`idle:${config.recordDir}:${recordings.length}:${skipSummary}:${samplesLine}`)) {
@@ -2773,12 +2671,6 @@ async function collectDoctor() {
   const ff = await runCommand(ffprobeBin(), ['-version'], 5000)
   const v = config.volcano
   const tools = piSummaryTools()
-  // An explicit status refresh must see newly saved keys and OAuth logins.
-  piAuthStatusCache.clear()
-  const configuredProviders = piConfiguredProviders()
-  const effectiveProviders = piProviderCandidates()
-  const providerStatus = Object.fromEntries(configuredProviders.map(p => [p, piProviderAuthStatus(p)]))
-  const summaryReady = effectiveProviders.length > 0
   return {
     version: VERSION,
     bun: process.versions.bun || null,
@@ -2794,7 +2686,9 @@ async function collectDoctor() {
           language: v.language ?? null,
         }
       : { configured: false as const },
-    summary: { backend: `pi:${effectiveProviders.join('→') || 'none-usable'}`, ready: summaryReady, configuredProviders, effectiveProviders, providerStatus, model: piCodexModelFor(), thinking: piThinkingLevel(), tools: tools || null, contextDir: tools ? summaryContextDir(config) : null },
+    // Provider/model/credentials are pi's own configuration; `pi.available` is
+    // all we can honestly report about whether a summary can run.
+    summary: { backend: 'pi', thinking: piThinkingLevel(), tools: tools || null, contextDir: tools ? summaryContextDir(config) : null },
     pi: { bin: piCodexBin(), version: piCheck.code === 0 ? (piCheck.stdout.trim() || piCheck.stderr.trim() || null) : null, available: piCheck.code === 0, auth: existsSync(PI_AUTH_PATH) },
     // Outbound proxy for HTTPS endpoints (updater/GitHub): honor the standard
     // env chain, not just lowercase http_proxy — an https_proxy-only setup must
@@ -2861,17 +2755,14 @@ async function doctor(opts: { json?: boolean } = {}): Promise<void> {
   } else {
     console.log(`volcano=not configured`)
   }
-  console.log(`summaryBackend=${s.summary.backend}`)
-  console.log(`pi.bin=${s.pi.bin} providers=${s.summary.effectiveProviders.join(',') || '<none usable>'} model.summary=${s.summary.model}`)
-  const notReady = Object.entries(s.summary.providerStatus).filter(([, st]) => st !== 'ready')
-  if (notReady.length) console.log(`pi.providerStatus=${notReady.map(([p, st]) => `${p}:${st}`).join(' ')} (unusable=pi not installed, no credentials, or no such provider — dropped from the chain; unknown=pi ran but gave no usable answer, kept anyway)`)
-  if (!s.summary.ready) console.log('summary.ready=NO — every configured provider is unusable; `vn run --mode notes` will skip rather than spend ASR')
+  console.log(`summaryBackend=${s.summary.backend} (provider/model come from pi's own config)`)
+  console.log(`pi.bin=${s.pi.bin}`)
   console.log(`pi.thinking=${s.summary.thinking}`)
   console.log(`pi.summaryTools=${s.summary.tools || '<disabled>'}`)
   if (s.summary.contextDir) console.log(`pi.contextDir=${s.summary.contextDir} (summary agent cwd + read/grep cross-reference root)`)
   console.log(`pi.version=${s.pi.version || 'missing'}`)
   // Neutral fact, not an instruction: an API-key user has no auth.json and needs
-  // nothing fixed. summary.ready above is what says whether anything is wrong.
+  // nothing fixed.
   console.log(`pi.auth=${s.pi.auth ? 'logged-in (auth.json present)' : 'no ~/.pi/agent/auth.json (fine if a provider API key is set)'}`)
   console.log(`defaultMode=notes`)
   console.log(`proxy=${s.proxy.url || '<unset>'}`)

package/src/piProvider.ts

@@ -1,62 +0,0 @@
-// Which pi providers the summary chain tries. Credential *detection* lives in
-// cli.ts (it shells out to `pi auth check`); only the pure logic is here.
-
-// Only the free ChatGPT OAuth path by default. The paid OpenAI API fallback is
-// opt-in (VOICENOTE_PI_PROVIDER='openai-codex,openai', or the GUI dropdown):
-// shipping it in the default chain meant every codex failure was retried against
-// a provider almost nobody has a key for, and that second failure was the one the
-// user saw.
-export const DEFAULT_PI_PROVIDERS = ['openai-codex']
-
-export function defaultPiModel(provider: string): string {
-  return provider === 'deepseek' ? 'deepseek-v4-flash' : 'gpt-5.5'
-}
-
-export function parseProviderChain(raw: string | undefined): string[] {
-  const parsed = Array.from(new Set((raw ?? '').split(',').map(s => s.trim()).filter(Boolean)))
-  return parsed.length ? parsed : [...DEFAULT_PI_PROVIDERS]
-}
-
-export type PiAuthStatus = 'ready' | 'unusable' | 'unknown'
-
-// `pi auth check --json` is the one source of truth for credentials — OAuth, keys
-// stored by `/login`, and each provider's own env var (OPENAI_API_KEY,
-// GEMINI_API_KEY, …), names we must not reimplement guessing.
-//
-// 'unusable' is a DETERMINISTIC failure: no credentials, or no such provider —
-// next run gets the same answer. Note an OAuth token that has expired beyond
-// refresh lands here too: with refresh on, pi reports `credentials_not_configured`.
-//
-// 'unknown' is pi running but giving no usable answer: a timeout, non-JSON
-// output, or pi's own `status:"invalid"` — which per pi's auth-check means its
-// model runtime is in an error state or checkAuth threw, i.e. a pi-side fault,
-// not a verdict about this provider's credentials. (A missing pi binary is not
-// in here: the caller maps ENOENT to 'unusable', since it is deterministic.)
-export function parsePiAuthStatus(stdout: string): PiAuthStatus {
-  try {
-    const r = JSON.parse(stdout) as { status?: unknown; reason?: unknown }
-    if (r.status === 'ready') return 'ready'
-    if (r.reason === 'credentials_not_configured' || r.reason === 'provider_not_found') return 'unusable'
-  } catch { /* not JSON → unknown */ }
-  return 'unknown'
-}
-
-// One rule: only a deterministic failure justifies a decision.
-//
-// An 'unusable' provider can only fail — and because the chain throws its LAST
-// error, that failure ("No API key found for openai") would overwrite the real
-// error from the provider that actually broke, which is the bug this exists to
-// kill. So it is pruned, and a chain left with nothing blocks the run before ASR
-// is spent.
-//
-// 'unknown' is deliberately neutral: it neither prunes nor blocks. A probe that
-// could not answer is not evidence, and guessing on its behalf is the same
-// mistake in the other direction — let the run proceed and pi report the truth.
-//
-// Hence "may work": surviving this filter only means "not known to be broken",
-// and nothing downstream may read it as authenticated.
-const mayWork = (status: PiAuthStatus) => status !== 'unusable'
-
-export function usableChain(configured: string[], statusOf: (provider: string) => PiAuthStatus): string[] {
-  return configured.filter(p => mayWork(statusOf(p)))
-}