@mono-agent/agent-app 0.20.11 → 0.21.0

package/dist/provider-setup.d.ts

@@ -13,11 +13,6 @@ export interface ProviderSetupPiLoginAction extends ProviderSetupCommandAction {
     readonly id: `pi-login:${string}`;
     readonly piAuthPath: string;
 }
-export type CodexLoginMode = "browser" | "device";
-export interface ProviderSetupCodexLoginAction extends ProviderSetupCommandAction {
-    readonly id: "codex-login";
-    readonly authMode: CodexLoginMode;
-}
 export interface ProviderSetupHttpAction {
     readonly id: string;
     readonly kind: ProviderSetupKind;
@@ -39,7 +34,7 @@ export interface ProviderSetupPiApiKeyAction {
     readonly cwd: string;
     readonly detail: string;
 }
-export type ProviderSetupAction = ProviderSetupPiLoginAction | ProviderSetupCodexLoginAction | ProviderSetupCommandAction | ProviderSetupHttpAction | ProviderSetupPiApiKeyAction;
+export type ProviderSetupAction = ProviderSetupPiLoginAction | ProviderSetupCommandAction | ProviderSetupHttpAction | ProviderSetupPiApiKeyAction;
 export interface ProviderSetupPlan {
     readonly actions: readonly ProviderSetupAction[];
     /** Auth actions omitted because a credential/sign-in was detected. */
@@ -75,12 +70,10 @@ export interface PlanProviderSetupOptions {
     readonly piAuthPath?: string;
     /** Internal test seam for verifying bundled Pi CLI resolution in packed layouts. */
     readonly piCliPath?: string;
-    /** Credential/status observations keyed by `claude`, `codex`, `pi:<provider>`, or provider id. */
+    /** Credential/status observations keyed by provider id or exact model reference. */
     readonly credentialStates?: Readonly<Record<string, ProviderCredentialState | undefined>>;
     /** Explicit repair path: rerun authentication even when a credential was detected. */
     readonly forceAuthentication?: boolean;
-    /** Direct Codex never guesses headless mode; callers select this explicitly. */
-    readonly codexAuthMode?: CodexLoginMode;
     /** Select OAuth or API-key setup for Pi providers that support both. */
     readonly piAuthMethods?: Readonly<Record<string, "oauth" | "api-key" | undefined>>;
     /** API keys can be used from env without being copied into Pi's secure store. */
@@ -119,6 +112,21 @@ export interface ExecuteProviderSetupOptions {
     /** Stop before launching the next independent action after user interruption. */
     readonly abortSignal?: AbortSignal;
 }
+type PiAuthPromotionHooks = Pick<ExecuteProviderSetupOptions, "beforePiAuthPromotion" | "afterPiAuthLink" | "beforeStalePiAuthLockRemoval" | "afterStalePiAuthLockRemoval" | "beforePiAuthCleanup" | "afterPiAuthLockCreated" | "beforePiAuthMissingLockSync" | "beforePiAuthTempCleanup" | "beforePiAuthBackupCleanup" | "beforePiAuthPostMutationSync">;
+export interface PersistPiProviderCredentialOptions extends PiAuthPromotionHooks {
+    readonly authPath: string;
+    readonly provider: string;
+    readonly platform?: NodeJS.Platform;
+    /**
+     * Called only while the cross-process auth-store lock is held. The returned
+     * credential is validated, merged into the latest store snapshot, and never
+     * included in an error message.
+     */
+    readonly resolveCredential: (signal?: AbortSignal) => Promise<unknown>;
+    readonly abortSignal?: AbortSignal;
+    /** Secret-free signal that target-store mutation began; the callback must not throw. */
+    readonly onCredentialStoreMutation?: () => void;
+}
 export declare function resolvePiCliPath(): string;
 export declare function piLoginCommand(provider: string, piCliPath?: string): readonly [string, ...string[]];
 export declare function piAuthRecoveryCommand(provider: string, piAuthPath?: string): string;
@@ -130,14 +138,12 @@ export declare function piAuthPathForSetup(piAuthPath: string | undefined, cwd?:
  * to `verified`.
  */
 export declare function detectProviderCredentialStates(options: DetectProviderCredentialStatesOptions): Promise<Readonly<Record<string, ProviderCredentialState>>>;
-/** Whether a selected route has a credential in the destination agent's durable environment. */
-export declare function hasDurableProviderEnvironmentCredential(rawModelRef: string, persistedEnv: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build the minimal operational environment needed to inspect durable CLI login
  * state. A positive allowlist prevents unrelated shell credentials from being
- * inherited by Codex or Claude while retaining their standard config roots.
+ * inherited by provider discovery commands.
  */
-export declare function credentialNeutralProviderStatusEnvironment(source?: Readonly<Record<string, string | undefined>>, durableEnvironment?: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
+export declare function credentialNeutralProviderStatusEnvironment(source?: Readonly<Record<string, string | undefined>>, _durableEnvironment?: Readonly<Record<string, string | undefined>>): Record<string, string | undefined>;
 export interface BoundedProviderCommandResult {
     readonly stdout: string;
 }
@@ -159,6 +165,12 @@ export declare function providerSetupActionCommandLine(action: ProviderSetupActi
 export declare function isProviderSetupPiApiKeyAction(action: ProviderSetupAction): action is ProviderSetupPiApiKeyAction;
 export declare function isProviderSetupPiLoginAction(action: ProviderSetupAction): action is ProviderSetupPiLoginAction;
 export declare function executeProviderSetupPlan(plan: ProviderSetupPlan, options?: ExecuteProviderSetupOptions): Promise<ProviderSetupResult[]>;
+/**
+ * The single mutation path for Pi provider credentials. Login remains inside
+ * the lock so two processes cannot both authenticate from the same snapshot
+ * and silently clobber each other's successful result.
+ */
+export declare function persistPiProviderCredential(options: PersistPiProviderCredentialOptions): Promise<void>;
 export type StalePiAuthLockRepairResult = "removed" | "active" | "unverifiable";
 /**
  * Remove only a secure, identity-stable lock whose recorded process is proven
@@ -171,4 +183,5 @@ export declare function repairStalePiAuthLock(path: string, ownerUid: number, op
     readonly beforeRemoval?: (lockPath: string) => void | Promise<void>;
     readonly afterRemoval?: (lockPath: string) => void | Promise<void>;
 }): Promise<StalePiAuthLockRepairResult>;
+export {};
 //# sourceMappingURL=provider-setup.d.ts.map

package/dist/provider-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-setup.d.ts","sourceRoot":"","sources":["../src/provider-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA0BrD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,CAAC;AAErD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,0BAA0B;IAC5E,QAAQ,CAAC,EAAE,EAAE,YAAY,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,6BAA8B,SAAQ,0BAA0B;IAC/E,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,aAAa,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B,0BAA0B,GAC1B,6BAA6B,GAC7B,0BAA0B,GAC1B,uBAAuB,GACvB,2BAA2B,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,sEAAsE;IACtE,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,qBAAqB,GAAG,UAAU,CAAC;AAE3F,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;QACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;KACpC,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,GAAG,gBAAgB,CAAC;AAEnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kGAAkG;IAClG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAAC,CAAC;IAC1F,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;IACnF,iFAAiF;IACjF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IAC9D,mFAAmF;IACnF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAChE,wEAAwE;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,mEAAmE;IACnE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,8EAA8E;IAC9E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,0EAA0E;IAC1E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,2EAA2E;IAC3E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,qEAAqE;IACrE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,gFAAgF;IAChF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,wEAAwE;IACxE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kFAAkF;IAClF,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAsED,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAE/G;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAgB,GAAG,MAAM,CAElG;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAgB,GAAG,MAAM,CAY9F;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAiE5D;AAED,gGAAgG;AAChG,wBAAgB,uCAAuC,CACrD,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACzD,OAAO,CAgBT;AAaD;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,EAClE,kBAAkB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GACpE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAiBpC;AAeD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IACP,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,GACA,OAAO,CAAC,4BAA4B,CAAC,CAwFvC;AAeD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAiKtF;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAWlF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,IAAI,2BAA2B,CAEhH;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,IAAI,0BAA0B,CAE9G;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAqBhC;AAygBD,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEhF;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,GACL,OAAO,CAAC,2BAA2B,CAAC,CAsDtC"}
+{"version":3,"file":"provider-setup.d.ts","sourceRoot":"","sources":["../src/provider-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA0BrD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,WAAW,CAAC;AAErD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,0BAA0B;IAC5E,QAAQ,CAAC,EAAE,EAAE,YAAY,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,cAAc,GAAG,aAAa,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B,0BAA0B,GAC1B,0BAA0B,GAC1B,uBAAuB,GACvB,2BAA2B,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,sEAAsE;IACtE,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,qBAAqB,GAAG,UAAU,CAAC;AAE3F,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;QACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;KACpC,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,GAAG,gBAAgB,CAAC;AAEnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACjD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAAC,CAAC;IAC1F,sFAAsF;IACtF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;IACnF,iFAAiF;IACjF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IAC9D,mFAAmF;IACnF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAChE,wEAAwE;IACxE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,mEAAmE;IACnE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,8EAA8E;IAC9E,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,0EAA0E;IAC1E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,2EAA2E;IAC3E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,qEAAqE;IACrE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,gFAAgF;IAChF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,wEAAwE;IACxE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kFAAkF;IAClF,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,KAAK,oBAAoB,GAAG,IAAI,CAC9B,2BAA2B,EACzB,uBAAuB,GACvB,iBAAiB,GACjB,8BAA8B,GAC9B,6BAA6B,GAC7B,qBAAqB,GACrB,wBAAwB,GACxB,6BAA6B,GAC7B,yBAAyB,GACzB,2BAA2B,GAC3B,8BAA8B,CACjC,CAAC;AAEF,MAAM,WAAW,kCAAmC,SAAQ,oBAAoB;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,wFAAwF;IACxF,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjD;AAkDD,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAE/G;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAInF;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAgB,GAAG,MAAM,CAElG;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAgB,GAAG,MAAM,CAY9F;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC,CA0B5D;AAMD;;;;GAIG;AACH,wBAAgB,0CAA0C,CACxD,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,EAClE,mBAAmB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GACrE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAapC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IACP,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B,GACA,OAAO,CAAC,4BAA4B,CAAC,CAwFvC;AAeD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAuHtF;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAWlF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,IAAI,2BAA2B,CAEhH;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,IAAI,0BAA0B,CAE9G;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,iBAAiB,EACvB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAqBhC;AAsDD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAmgBD,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEhF;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IACP,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D,GACL,OAAO,CAAC,2BAA2B,CAAC,CAsDtC"}

package/dist/provider-setup.js

@@ -8,18 +8,12 @@ import { isDeepStrictEqual } from "node:util";
 import { fileURLToPath } from "node:url";
 import { builtinModels } from "@earendil-works/pi-ai/providers/all";
 import { modelReferenceKey, parseMonoRuntimeModelReference } from "@mono-agent/runtime-adapter";
-import { inspectPiAuthStore } from "./pi-auth-store-inspection.js";
+import { inspectPiAuthStore, MAX_PI_AUTH_STORE_BYTES } from "./pi-auth-store-inspection.js";
 const DEFAULT_PI_AUTH_PATH = join(homedir(), ".pi", "agent", "auth.json");
 const PI_API_KEY_PROVIDERS = {
     "opencode-go": "OPENCODE_API_KEY",
 };
-const DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS = {
-    codex: ["OPENAI_API_KEY"],
-    claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"],
-};
 const PROVIDER_STATUS_SECRET_ENV_KEYS = [
-    ...DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.codex,
-    ...DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.claude,
     ...Object.values(PI_API_KEY_PROVIDERS),
 ];
 const PROVIDER_STATUS_ENV_ALLOWLIST = new Set([
@@ -107,86 +101,29 @@ export async function detectProviderCredentialStates(options) {
             return [];
         }
     });
-    const timeout = typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
-        ? Math.trunc(options.timeoutMs)
-        : 2_000;
-    const run = options.execFile ?? runProviderStatusCommand;
     const persistedEnv = options.persistedEnv ?? {};
-    const statusEnv = credentialNeutralProviderStatusEnvironment(process.env, persistedEnv);
-    const checks = [];
-    if (refs.some((ref) => ref.sdk === "codex")) {
-        if (hasAnyNonEmptyPersistedValue(persistedEnv, DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.codex)) {
-            states.codex = "credential_detected";
-        }
-        else {
-            checks.push(run("codex", ["login", "status"], {
-                cwd: options.cwd,
-                timeout,
-                env: statusEnv,
-                ...(options.abortSignal === undefined ? {} : { abortSignal: options.abortSignal }),
-            }).then(() => { states.codex = "credential_detected"; }, () => { states.codex = "auth_required"; }));
-        }
-    }
-    if (refs.some((ref) => ref.sdk === "claude")) {
-        if (hasAnyNonEmptyPersistedValue(persistedEnv, DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.claude)) {
-            states.claude = "credential_detected";
-        }
-        else {
-            checks.push(run("claude", ["auth", "status", "--json"], {
-                cwd: options.cwd,
-                timeout,
-                env: statusEnv,
-                ...(options.abortSignal === undefined ? {} : { abortSignal: options.abortSignal }),
-            }).then(() => { states.claude = "credential_detected"; }, () => { states.claude = "auth_required"; }));
-        }
-    }
-    const piProviders = new Set(refs.filter((ref) => ref.sdk === "pi" && typeof ref.provider === "string")
-        .map((ref) => ref.provider));
+    const piProviders = new Set(refs.map((ref) => ref.provider));
     if (piProviders.size > 0) {
         const detected = await safelyDetectedPiCredentialProviders(piAuthPathForSetup(options.piAuthPath, options.cwd));
         for (const provider of piProviders) {
             const apiKeyEnv = PI_API_KEY_PROVIDERS[provider];
-            states[`pi:${provider}`] = detected.has(provider)
+            states[provider] = detected.has(provider)
                 || (apiKeyEnv !== undefined && hasNonEmptyPersistedValue(persistedEnv[apiKeyEnv]))
                 ? "credential_detected"
                 : "auth_required";
         }
     }
-    await Promise.all(checks);
     return states;
 }
-/** Whether a selected route has a credential in the destination agent's durable environment. */
-export function hasDurableProviderEnvironmentCredential(rawModelRef, persistedEnv) {
-    let ref;
-    try {
-        ref = parseMonoRuntimeModelReference(rawModelRef);
-    }
-    catch {
-        return false;
-    }
-    if (ref.sdk === "codex") {
-        return hasAnyNonEmptyPersistedValue(persistedEnv, DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.codex);
-    }
-    if (ref.sdk === "claude") {
-        return hasAnyNonEmptyPersistedValue(persistedEnv, DIRECT_PROVIDER_CREDENTIAL_ENV_KEYS.claude);
-    }
-    if (ref.sdk !== "pi" || typeof ref.provider !== "string")
-        return false;
-    const apiKeyEnv = PI_API_KEY_PROVIDERS[ref.provider];
-    return apiKeyEnv !== undefined && hasNonEmptyPersistedValue(persistedEnv[apiKeyEnv]);
-}
-function hasAnyNonEmptyPersistedValue(persistedEnv, names) {
-    return names.some((name) => hasNonEmptyPersistedValue(persistedEnv[name]));
-}
 function hasNonEmptyPersistedValue(value) {
     return value !== undefined && value.trim().length > 0;
 }
 /**
  * Build the minimal operational environment needed to inspect durable CLI login
  * state. A positive allowlist prevents unrelated shell credentials from being
- * inherited by Codex or Claude while retaining their standard config roots.
+ * inherited by provider discovery commands.
  */
-export function credentialNeutralProviderStatusEnvironment(source = process.env, durableEnvironment = {}) {
+export function credentialNeutralProviderStatusEnvironment(source = process.env, _durableEnvironment = {}) {
     const sanitized = {};
     for (const [name, value] of Object.entries(source)) {
         const normalizedName = name.toUpperCase();
@@ -195,18 +132,10 @@ export function credentialNeutralProviderStatusEnvironment(source = process.env,
             sanitized[name] = value;
         }
     }
-    for (const name of ["CLAUDE_CONFIG_DIR", "CODEX_HOME"]) {
-        const value = durableEnvironment[name];
-        if (hasNonEmptyPersistedValue(value))
-            sanitized[name] = value;
-    }
     for (const name of PROVIDER_STATUS_SECRET_ENV_KEYS)
         delete sanitized[name];
     return sanitized;
 }
-function runProviderStatusCommand(file, args, options) {
-    return runBoundedProviderCommand(file, args, options).then(() => undefined);
-}
 /**
  * Run a non-interactive provider probe with a hard process-lifecycle bound.
  * Node's execFile timeout sends only SIGTERM and can wait forever when a CLI
@@ -360,46 +289,7 @@ export function planProviderSetup(options) {
                 modelRefs: [...new Set([...existing.modelRefs, ...action.modelRefs])],
             });
         };
-        if (ref.sdk === "claude") {
-            if (authAlreadyDetected(["claude", refKey])) {
-                detectedModelRefs.add(refKey);
-                continue;
-            }
-            add({
-                id: "claude-login",
-                kind: "auth",
-                label: "Claude login",
-                modelRefs: [refKey],
-                command: ["claude", "/login"],
-                cwd: options.cwd,
-                detail: "Runs the Claude Code login flow for Claude model references.",
-            });
-            continue;
-        }
-        if (ref.sdk === "codex") {
-            if (authAlreadyDetected(["codex", refKey])) {
-                detectedModelRefs.add(refKey);
-                continue;
-            }
-            const authMode = options.codexAuthMode ?? "browser";
-            add({
-                id: "codex-login",
-                kind: "auth",
-                label: "Codex login",
-                modelRefs: [refKey],
-                command: authMode === "device" ? ["codex", "login", "--device-auth"] : ["codex", "login"],
-                authMode,
-                cwd: options.cwd,
-                detail: authMode === "device"
-                    ? "Runs Codex device-code login for a remote or headless machine."
-                    : "Runs Codex browser login with a localhost callback server.",
-            });
-            continue;
-        }
-        if (ref.sdk !== "pi" || typeof ref.provider !== "string") {
-            continue;
-        }
-        if (authAlreadyDetected([`pi:${ref.provider}`, ref.provider, refKey])) {
+        if (authAlreadyDetected([ref.provider, refKey])) {
             detectedModelRefs.add(refKey);
             continue;
         }
@@ -532,15 +422,13 @@ async function runPiApiKeyAction(action, apiKeys, platform, hooks) {
         };
     }
     try {
-        assertOwnerOnlyPersistenceSupported(platform);
-        await withPiAuthFileLock(action.piAuthPath, async (authPath, ownerUid, assertLockHeld) => {
-            const original = await readPiAuthStore(authPath, piAuthSingleLinkPolicy(ownerUid));
-            const next = {
-                ...original.auth,
-                [action.provider]: { type: "api_key", key },
-            };
-            await writePiAuthStoreAtomically(authPath, next, original, ownerUid, assertLockHeld, hooks);
-        }, hooks);
+        await persistPiProviderCredential({
+            authPath: action.piAuthPath,
+            provider: action.provider,
+            platform,
+            resolveCredential: async () => ({ type: "api_key", key }),
+            ...hooks,
+        });
         return {
             action,
             status: "ok",
@@ -556,6 +444,55 @@ async function runPiApiKeyAction(action, apiKeys, platform, hooks) {
         };
     }
 }
+/**
+ * The single mutation path for Pi provider credentials. Login remains inside
+ * the lock so two processes cannot both authenticate from the same snapshot
+ * and silently clobber each other's successful result.
+ */
+export async function persistPiProviderCredential(options) {
+    assertOwnerOnlyPersistenceSupported(options.platform ?? process.platform);
+    const hooks = options;
+    await withPiAuthFileLock(options.authPath, async (authPath, ownerUid, assertLockHeld) => {
+        const original = await readPiAuthStore(authPath, piAuthSingleLinkPolicy(ownerUid));
+        throwIfProviderAuthAborted(options.abortSignal);
+        const credential = await resolveProviderCredentialWithAbort(options.resolveCredential, options.abortSignal);
+        throwIfProviderAuthAborted(options.abortSignal);
+        if (!isUsableStoredPiCredential(options.provider, credential)) {
+            throw new Error(`Provider authentication returned an invalid credential for ${options.provider}.`);
+        }
+        const next = { ...original.auth, [options.provider]: credential };
+        if (!isBoundedCredentialValue(next)) {
+            throw new Error(`Provider authentication would exceed the Pi credential store safety limit for ${options.provider}.`);
+        }
+        await writePiAuthStoreAtomically(authPath, next, original, ownerUid, assertLockHeld, hooks, options.abortSignal, options.onCredentialStoreMutation);
+    }, hooks);
+}
+async function resolveProviderCredentialWithAbort(resolveCredential, signal) {
+    throwIfProviderAuthAborted(signal);
+    const pending = Promise.resolve().then(async () => await resolveCredential(signal));
+    if (signal === undefined)
+        return await pending;
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (callback) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", abort);
+            callback();
+        };
+        const abort = () => finish(() => reject(signal.reason ?? new Error("Provider authentication was cancelled.")));
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
+        pending.then((credential) => finish(() => resolve(credential)), (error) => finish(() => reject(error)));
+    });
+}
+function throwIfProviderAuthAborted(signal) {
+    if (signal?.aborted === true) {
+        throw signal.reason ?? new Error("Provider authentication was cancelled.");
+    }
+}
 function isBoundedCredentialString(value) {
     return typeof value === "string"
         && value.trim().length > 0
@@ -565,10 +502,32 @@ function isBoundedCredentialString(value) {
 function isUsableStoredPiCredential(_provider, value) {
     if (!isRecord(value))
         return false;
+    if (!isBoundedCredentialValue(value))
+        return false;
     if (value.type === "oauth") {
-        return isBoundedCredentialString(value.access) || isBoundedCredentialString(value.refresh);
+        return (isBoundedCredentialString(value.access) || isBoundedCredentialString(value.refresh))
+            && (value.expires === undefined || (typeof value.expires === "number" && Number.isFinite(value.expires)));
+    }
+    if (value.type !== "api_key")
+        return false;
+    if (Object.keys(value).some((key) => key !== "type" && key !== "key" && key !== "env"))
+        return false;
+    if (isBoundedCredentialString(value.key))
+        return true;
+    if (value.env === undefined)
+        return Object.keys(value).length === 1;
+    if (!isRecord(value.env))
+        return false;
+    const entries = Object.entries(value.env);
+    return entries.length > 0 && entries.length <= 64 && entries.every(([key, entry]) => /^[A-Z][A-Z0-9_]{0,127}$/u.test(key) && isBoundedCredentialString(entry));
+}
+function isBoundedCredentialValue(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value), "utf8") <= MAX_PI_AUTH_STORE_BYTES;
+    }
+    catch {
+        return false;
     }
-    return value.type === "api_key" && isBoundedCredentialString(value.key);
 }
 async function runCommandAction(action, spawnImpl, platform, hooks, preflightTimeoutMs, abortSignal) {
     if (isProviderSetupPiLoginAction(action)) {
@@ -1153,19 +1112,26 @@ function assertPiAuthStoreStat(path, value, policy) {
         throw new Error(`Refusing to use Pi auth path ${path} because its hard-link identity is unsafe.`);
     }
 }
-async function writePiAuthStoreAtomically(path, auth, original, ownerUid, assertLockHeld, hooks) {
+async function writePiAuthStoreAtomically(path, auth, original, ownerUid, assertLockHeld, hooks, abortSignal, onCredentialStoreMutation) {
+    throwIfProviderAuthAborted(abortSignal);
     await assertPiAuthStoreUnchanged(path, original, ownerUid);
+    throwIfProviderAuthAborted(abortSignal);
     const dir = dirname(path);
     await mkdir(dir, { recursive: true, mode: 0o700 });
+    throwIfProviderAuthAborted(abortSignal);
     const tempDir = await mkdtemp(join(dir, ".mono-agent-pi-auth-write-"));
     const tempPath = join(tempDir, "auth.json");
     let promotionInstalled = false;
     let operationError;
     try {
+        throwIfProviderAuthAborted(abortSignal);
         await writeFile(tempPath, `${JSON.stringify(auth, null, 2)}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        throwIfProviderAuthAborted(abortSignal);
         await syncFile(tempPath);
+        throwIfProviderAuthAborted(abortSignal);
         await assertPiAuthStoreUnchanged(path, original, ownerUid);
-        await promotePiAuthStoreWithoutClobber(tempPath, path, original, ownerUid, assertLockHeld, undefined, hooks);
+        throwIfProviderAuthAborted(abortSignal);
+        await promotePiAuthStoreWithoutClobber(tempPath, path, original, ownerUid, assertLockHeld, undefined, hooks, abortSignal, onCredentialStoreMutation);
         promotionInstalled = true;
         try {
             await hooks.beforePiAuthPostMutationSync?.(path);
@@ -1208,8 +1174,9 @@ function samePiAuthStoreSnapshot(left, right) {
         left.size === right.size &&
         left.contents === right.contents;
 }
-async function promotePiAuthStoreWithoutClobber(stagedPath, targetPath, expected, ownerUid, assertLockHeld, intendedInput, hooks = {}) {
+async function promotePiAuthStoreWithoutClobber(stagedPath, targetPath, expected, ownerUid, assertLockHeld, intendedInput, hooks = {}, abortSignal, onCredentialStoreMutation) {
     const intended = intendedInput ?? await readPiAuthStore(stagedPath, piAuthSingleLinkPolicy(ownerUid));
+    throwIfProviderAuthAborted(abortSignal);
     if (!intended.exists) {
         throw new Error(`Pi auth staging file ${stagedPath} disappeared before promotion.`);
     }
@@ -1218,10 +1185,14 @@ async function promotePiAuthStoreWithoutClobber(stagedPath, targetPath, expected
         try {
             await hooks.beforePiAuthPromotion?.(targetPath, stagedPath);
             await assertLockHeld();
+            // This is the last safe cancellation point. Once target mutation starts,
+            // the existing promotion/recovery transaction must run to completion.
+            throwIfProviderAuthAborted(abortSignal);
             installed = await linkPiFileIfAbsent(stagedPath, targetPath);
             if (!installed) {
                 throw new Error(`Pi auth file ${targetPath} changed during credential setup; the newer file was preserved.`);
             }
+            onCredentialStoreMutation?.();
             await hooks.afterPiAuthLink?.(targetPath, stagedPath);
             await assertPromotedPiAuthStore(intended, stagedPath, targetPath, ownerUid);
             return;
@@ -1241,10 +1212,15 @@ async function promotePiAuthStoreWithoutClobber(stagedPath, targetPath, expected
     try {
         await hooks.beforePiAuthPromotion?.(targetPath, stagedPath);
         await assertLockHeld();
+        // Abort cannot safely split the rename/install/recovery sequence below.
+        throwIfProviderAuthAborted(abortSignal);
         try {
             await rename(targetPath, backupPath);
             backupCreated = true;
             targetMutationStarted = true;
+            // Renaming the existing target is the first credential mutation, even
+            // if a later validation fails and recovery restores that same inode.
+            onCredentialStoreMutation?.();
         }
         catch (error) {
             if (error.code === "ENOENT") {