@oh-my-pi/pi-coding-agent 17.1.2 → 17.1.4

package/src/cli/usage-cli.ts

@@ -8,7 +8,9 @@
  * always covers the full credential pool.
  */
 import {
+	ANTHROPIC_OAUTH_GRANT_TTL_MS,
 	type AuthStorage,
+	type DisabledCredentialSummary,
 	resolveUsedFraction,
 	type UsageHistoryEntry,
 	type UsageLimit,
@@ -44,6 +46,8 @@ export interface UsageAccountIdentity {
 	/** Organization/workspace the credential is scoped to (Anthropic multi-subscription). */
 	orgId?: string;
 	orgName?: string;
+	/** Epoch ms of the interactive login that minted the OAuth grant (see `OAuthCredentials.authorizedAt`). */
+	authorizedAt?: number;
 }
 
 /**
@@ -126,7 +130,11 @@ function findDistinguishingInfix(value: string, peers: string[]): string | undef
 }
 
 /** Every identity string the output could surface — input for {@link buildRedactionMap}. */
-function collectIdentityStrings(reports: UsageReport[], accounts: UsageAccountIdentity[]): string[] {
+function collectIdentityStrings(
+	reports: UsageReport[],
+	accounts: UsageAccountIdentity[],
+	disabled: DisabledCredentialSummary[] = [],
+): string[] {
 	const values: string[] = [];
 	const add = (value: unknown): void => {
 		if (typeof value === "string" && value) values.push(value);
@@ -152,6 +160,12 @@ function collectIdentityStrings(reports: UsageReport[], accounts: UsageAccountId
 		add(account.orgName);
 		add(account.enterpriseUrl);
 	}
+	for (const summary of disabled) {
+		add(summary.email);
+		add(summary.accountId);
+		add(summary.orgId);
+		add(summary.orgName);
+	}
 	return values;
 }
 
@@ -312,13 +326,15 @@ export function collectUnreportedAccounts(
 		// multi-subscription): two orgs share every other identifier, so an
 		// org-scoped account is covered only by its own org's report, and an
 		// org-less legacy account is never covered by an org-attributed sibling
-		// report — its own fetch failing must surface as "no usage data". The
-		// shared org is a GATE, not a match: two Team members share the org id
-		// while drawing on per-user pools, so coverage also requires the
-		// account's own base identity inside the same-org subset (an org-only
-		// account, with no base identifiers, is covered by any same-org
-		// report). The email/account fallback below applies only when both
-		// sides are org-less.
+		// report — its own fetch failing must surface as "no usage data". Its
+		// own ORG-LESS report still covers it, though: a mixed pool (fresh
+		// org-scoped logins beside pre-org-capture rows) must not duplicate
+		// every legacy account. The shared org is a GATE, not a match: two Team
+		// members share the org id while drawing on per-user pools, so coverage
+		// also requires the account's own base identity inside the same-org
+		// subset (an org-only account, with no base identifiers, is covered by
+		// any same-org report). The email/account fallback below applies only
+		// when both sides are org-less.
 		const accountOrg = account.orgId?.toLowerCase();
 		const ids = [account.email, account.accountId, account.projectId]
 			.filter((value): value is string => typeof value === "string" && value.length > 0)
@@ -333,9 +349,15 @@ export function collectUnreportedAccounts(
 			}
 		}
 		if (accountOrg || sawReportOrg) {
-			if (!accountOrg || sameOrgReports.length === 0) return true;
+			const candidates = accountOrg
+				? sameOrgReports
+				: providerReports.filter(report => {
+						const metaOrg = report.metadata?.orgId;
+						return !(typeof metaOrg === "string" && metaOrg);
+					});
+			if (candidates.length === 0) return true;
 			if (ids.length === 0) return false;
-			return !sameOrgReports.some(report => {
+			return !candidates.some(report => {
 				const identifiers = reportIdentifiers(report);
 				return ids.some(id => identifiers.has(id));
 			});
@@ -509,6 +531,58 @@ export function computeProviderWindowStats(reports: UsageReport[]): ProviderWind
 		});
 }
 
+/** Re-login warnings render once remaining grant life drops below this. */
+const RELOGIN_WARN_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;
+
+/**
+ * Re-login deadline line for providers whose OAuth grants expire a fixed
+ * period after the interactive login (today: Anthropic, ~30 days regardless
+ * of refresh rotation). Silent until the deadline is under a week out — a
+ * nudge before the broker auto-disables the row, not a permanent countdown.
+ */
+function formatReloginDeadline(
+	account: UsageAccountIdentity,
+	nowMs: number,
+	redaction?: Map<string, string>,
+): string | undefined {
+	if (account.provider !== "anthropic" || account.type !== "oauth" || !account.authorizedAt) return undefined;
+	const remaining = account.authorizedAt + ANTHROPIC_OAUTH_GRANT_TTL_MS - nowMs;
+	if (remaining > RELOGIN_WARN_WINDOW_MS) return undefined;
+	const label = accountIdentityLabel(account, redaction);
+	if (remaining <= 0) {
+		return `  ${chalk.red(`⚠ ${label} — grant is past Anthropic's ~30d lifetime; re-login now`)}`;
+	}
+	return `  ${chalk.yellow(`⚠ ${label} — re-login within ${formatDuration(remaining)} (Anthropic expires OAuth grants ~30d after login)`)}`;
+}
+
+/**
+ * Tombstones worth a row in `omp usage`: OAuth credentials torn down
+ * automatically (refresh failure, upstream invalidation). Rows the user
+ * replaced or deleted deliberately are lifecycle noise, not lost capacity.
+ */
+function isActionableDisable(summary: DisabledCredentialSummary): boolean {
+	if (summary.type !== "oauth") return false;
+	return !/^(replaced by|deleted by user)/i.test(summary.cause);
+}
+
+/** Human-sized disable cause: the upstream `error_description` when embedded, else the first clause. */
+function shortDisableCause(cause: string): string {
+	const description = cause.match(/\\?"error_description\\?"\s*:\s*\\?"([^"\\]+)/)?.[1];
+	if (description) return description;
+	const stripped = cause.replace(/^oauth refresh failed:\s*/i, "");
+	const clause = stripped.split(/[;\n]/, 1)[0] ?? stripped;
+	return clause.length > 80 ? `${clause.slice(0, 77)}…` : clause;
+}
+
+/** Label for a disabled tombstone, masking each identity part under `--redact`. */
+function disabledIdentityLabel(summary: DisabledCredentialSummary, redaction?: Map<string, string>): string {
+	const base = summary.email ?? summary.accountId ?? "OAuth account";
+	const masked = redaction?.get(base) ?? base;
+	const org = summary.orgName ?? summary.orgId;
+	if (!org || org === base) return masked;
+	return `${masked} · ${redaction?.get(org) ?? org}`;
+}
+
 /**
  * Render the full text breakdown: per provider, per account, every limit
  * with a bar, amounts, and reset times; unattributed credentials trail
@@ -519,6 +593,7 @@ export function formatUsageBreakdown(
 	accounts: UsageAccountIdentity[],
 	nowMs: number,
 	redaction?: Map<string, string>,
+	disabled: DisabledCredentialSummary[] = [],
 ): string {
 	const reportsByProvider = new Map<string, UsageReport[]>();
 	for (const report of reports) {
@@ -533,10 +608,17 @@ export function formatUsageBreakdown(
 		list.push(account);
 		unreportedByProvider.set(account.provider, list);
 	}
+	const disabledByProvider = new Map<string, DisabledCredentialSummary[]>();
+	for (const summary of disabled) {
+		if (!isActionableDisable(summary)) continue;
+		const list = disabledByProvider.get(summary.provider) ?? [];
+		list.push(summary);
+		disabledByProvider.set(summary.provider, list);
+	}
 
-	const providers = [...new Set([...reportsByProvider.keys(), ...unreportedByProvider.keys()])].sort((a, b) =>
-		a.localeCompare(b),
-	);
+	const providers = [
+		...new Set([...reportsByProvider.keys(), ...unreportedByProvider.keys(), ...disabledByProvider.keys()]),
+	].sort((a, b) => a.localeCompare(b));
 
 	const lines: string[] = [];
 	const latestFetchedAt = Math.max(0, ...reports.map(report => report.fetchedAt ?? 0));
@@ -582,6 +664,20 @@ export function formatUsageBreakdown(
 			lines.push(`  ${chalk.dim("○")} ${chalk.dim(`${label} — no usage data`)}`);
 		}
 
+		for (const summary of disabledByProvider.get(provider) ?? []) {
+			const label = disabledIdentityLabel(summary, redaction);
+			const ago = summary.disabledAtMs !== undefined ? ` ${formatDuration(nowMs - summary.disabledAtMs)} ago` : "";
+			lines.push(
+				`  ${chalk.red(`✗ ${label} — disabled${ago}: ${sanitizeText(shortDisableCause(summary.cause))}`)} ${chalk.dim("(re-login to restore)")}`,
+			);
+		}
+
+		for (const account of accounts) {
+			if (account.provider !== provider) continue;
+			const warning = formatReloginDeadline(account, nowMs, redaction);
+			if (warning) lines.push(warning);
+		}
+
 		const stats = computeProviderWindowStats(providerReports);
 		if (stats.length > 0) {
 			const parts = stats.map(
@@ -750,6 +846,7 @@ function collectStoredAccounts(authStorage: AuthStorage): UsageAccountIdentity[]
 					enterpriseUrl: credential.enterpriseUrl,
 					orgId: credential.orgId,
 					orgName: credential.orgName,
+					authorizedAt: credential.authorizedAt,
 				});
 			} else {
 				accounts.push({ provider, type: "api_key" });
@@ -862,20 +959,41 @@ export async function runUsageCommand(cmd: UsageCommandArgs): Promise<void> {
 			(await authStorage.fetchUsageReports({
 				baseUrlResolver: provider => modelRegistry.getProviderBaseUrl(provider),
 			})) ?? [];
+		// Reports are always fresh (broker-side fetch) but the account list can
+		// come from a disk-cached snapshot up to an hour old — revalidate so a
+		// just-logged-in (or just-rotated-identity) credential isn't rendered
+		// as a stale duplicate. Best-effort: offline broker keeps the cache.
+		try {
+			await authStorage.revalidateCredentials();
+		} catch {
+			// Stale identities beat no output.
+		}
 		const storedAccounts = collectStoredAccounts(authStorage);
 		let accounts = selectReportableAccounts(
 			storedAccounts,
 			provider => authStorage.usageProviderFor(provider) !== undefined,
 			cmd.provider,
 		);
+		// Tombstones ride alongside the live pool so an auto-disabled account
+		// (e.g. an expired Anthropic grant) is loudly visible instead of just
+		// missing. Best-effort: a broker predating the endpoint yields [].
+		let disabled: DisabledCredentialSummary[] = [];
+		try {
+			disabled = await authStorage.listDisabledCredentials();
+		} catch {
+			// Usage output must not fail because tombstone listing did.
+		}
 		let filteredReports = reports;
 		if (cmd.provider) {
 			const wanted = cmd.provider.toLowerCase();
 			filteredReports = reports.filter(report => report.provider.toLowerCase() === wanted);
 			accounts = accounts.filter(account => account.provider.toLowerCase() === wanted);
+			disabled = disabled.filter(summary => summary.provider.toLowerCase() === wanted);
 		}
 
-		const redaction = cmd.redact ? buildRedactionMap(collectIdentityStrings(filteredReports, accounts)) : undefined;
+		const redaction = cmd.redact
+			? buildRedactionMap(collectIdentityStrings(filteredReports, accounts, disabled))
+			: undefined;
 
 		if (cmd.json) {
 			// Drop the heavy provider-specific `raw` payload — same shape as the
@@ -900,10 +1018,21 @@ export async function runUsageCommand(cmd: UsageCommandArgs): Promise<void> {
 				const stats = computeProviderWindowStats(filteredReports.filter(peer => peer.provider === report.provider));
 				if (stats.length > 0) capacity[report.provider] = stats;
 			}
+			let disabledForJson = disabled.filter(isActionableDisable);
+			if (redaction) {
+				disabledForJson = disabledForJson.map(summary => ({
+					...summary,
+					email: maskIdentity(redaction, summary.email),
+					accountId: maskIdentity(redaction, summary.accountId),
+					orgId: maskIdentity(redaction, summary.orgId),
+					orgName: maskIdentity(redaction, summary.orgName),
+				}));
+			}
 			const payload = {
 				generatedAt: Date.now(),
 				reports: trimmed,
 				accountsWithoutUsage: unreportedAccounts,
+				disabledCredentials: disabledForJson,
 				capacity,
 			};
 			process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
@@ -923,7 +1052,7 @@ export async function runUsageCommand(cmd: UsageCommandArgs): Promise<void> {
 			return;
 		}
 
-		process.stdout.write(`${formatUsageBreakdown(filteredReports, accounts, Date.now(), redaction)}\n`);
+		process.stdout.write(`${formatUsageBreakdown(filteredReports, accounts, Date.now(), redaction, disabled)}\n`);
 	} finally {
 		authStorage.close();
 	}

package/src/cli.ts

@@ -24,10 +24,16 @@ import {
 	setProfile,
 	VERSION,
 } from "@oh-my-pi/pi-utils/dirs";
-import { declareWorkerHostEntry, installWorkerInbox } from "@oh-my-pi/pi-utils/worker-host";
+import { interceptUnhandledRejections } from "@oh-my-pi/pi-utils/postmortem";
+import { declareWorkerHostEntry, installWorkerInbox, isWorkerHostSelector } from "@oh-my-pi/pi-utils/worker-host";
 import { installProfileAlias, resolveProfileAliasCommandFromProcess } from "./cli/profile-alias";
 import { extractProfileFlags } from "./cli/profile-bootstrap";
+import { startJsEvalProcess } from "./eval/js/process-entry";
+import type { WorkerInbound as JsWorkerInbound, WorkerOutbound as JsWorkerOutbound } from "./eval/js/worker-protocol";
 import { DAEMON_BROKER_WORKER_ARG } from "./launch/protocol";
+import { COMPUTER_WORKER_ARG } from "./tools/computer/protocol";
+import { smokeTestComputerWorker } from "./tools/computer/supervisor";
+import { startComputerWorker } from "./tools/computer/worker-entry";
 
 if (Bun.semver.order(Bun.version, MIN_BUN_VERSION) < 0) {
 	process.stderr.write(
@@ -79,8 +85,7 @@ async function runSmokeTest(): Promise<void> {
 	const { smokeTestTtsWorker } = await import("./tts/tts-client");
 	const { smokeTestMnemopiEmbedWorker } = await import("./mnemopi/embed-client");
 	const { smokeTestJsEvalWorker } = await import("./eval/js/context-manager");
-	const { smokeTestComputerWorker } = await import("./tools/computer/supervisor");
-	// Smoke dependencies stay lazy so normal CLI startup does not load worker clients.
+	// Other smoke dependencies stay lazy so normal CLI startup does not load their worker clients.
 	const { smokeTestDaemonBroker } = await import("./launch/client");
 	await smokeTestSyncWorker();
 
@@ -109,7 +114,6 @@ async function runSmokeTest(): Promise<void> {
 const TINY_WORKER_ARG = "__omp_worker_tiny_inference";
 const STATS_SYNC_WORKER_ARG = "__omp_worker_stats_sync";
 const TAB_WORKER_ARG = "__omp_worker_tab";
-const COMPUTER_WORKER_ARG = "__omp_worker_computer";
 const JS_EVAL_WORKER_ARG = "__omp_worker_js_eval";
 const JS_EVAL_PROCESS_ARG = "__omp_worker_js_eval_process";
 const STT_WORKER_ARG = "__omp_worker_stt";
@@ -129,7 +133,7 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 		// spawning (the smoke ping, the first parse request) would be dropped.
 		// Park early events and replay them once the module's handler is live.
 		// Worker-thread entries using `parentPort` need the same sync-prefix
-		// buffering; the tab/eval cases install that inbox below before import.
+		// buffering; the computer/tab/eval cases install that inbox below.
 		const scope = globalThis as unknown as { onmessage: ((event: MessageEvent) => void) | null };
 		const pending: MessageEvent[] = [];
 		const buffer = (event: MessageEvent): void => {
@@ -144,12 +148,10 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 		return true;
 	}
 	// Bun flushes messages the parent posted before spawn once this entry's
-	// top-level evaluation completes, delivering them only to listeners present
-	// at that moment. These worker modules are imported dynamically below, so
-	// their own `parentPort.on("message")` lands after the flush and the parent's
-	// synchronous `init` is dropped. Install a buffering inbox synchronously here
-	// (still inside the entry's sync prefix) so the handshake survives; the worker
-	// module binds the real handler once loaded.
+	// top-level evaluation completes. Install a buffering inbox synchronously
+	// before binding the selected worker's real handler so the parent's
+	// synchronous `init` survives. The dynamically imported tab/eval modules
+	// consume the same inbox after their module evaluation begins.
 	if (arg === TAB_WORKER_ARG) {
 		if (parentPort) installWorkerInbox(parentPort);
 		await import("./tools/browser/tab-worker-entry");
@@ -157,7 +159,7 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 	}
 	if (arg === COMPUTER_WORKER_ARG) {
 		if (parentPort) installWorkerInbox(parentPort);
-		await import("./tools/computer/worker-entry");
+		startComputerWorker();
 		return true;
 	}
 	if (arg === JS_EVAL_WORKER_ARG) {
@@ -166,11 +168,15 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 		return true;
 	}
 	if (arg === JS_EVAL_PROCESS_ARG) {
-		const { startJsEvalProcess } = await import("./eval/js/process-entry");
+		// The bootstrap-safe interceptor seam is linked statically so this selector
+		// cannot load profile-scoped environment state after dispatch has begun.
 		// The JS evaluator forwards user-controlled payloads (tool-call args,
 		// display outputs); a non-serializable one must fail that cell, not
 		// SIGKILL the kernel and erase the eval session's state.
-		await runIpcSubprocessWorker(startJsEvalProcess, { rethrowConnectedSendErrors: true });
+		await runIpcSubprocessWorker<JsWorkerInbound, JsWorkerOutbound>(
+			transport => startJsEvalProcess(transport, interceptUnhandledRejections),
+			{ rethrowConnectedSendErrors: true },
+		);
 		return true;
 	}
 	if (arg === STT_WORKER_ARG) {
@@ -345,7 +351,7 @@ export async function runCli(argv: string[]): Promise<void> {
 	// synchronous prefix of `runWorkerEntrypoint`, and Bun flushes the
 	// worker's parked initial messages as soon as the entry module's
 	// top-level evaluation finishes.
-	if (resolvedArgv[0]?.startsWith("__omp_worker_")) {
+	if (isWorkerHostSelector(resolvedArgv[0])) {
 		const dispatched = await runWorkerEntrypoint(resolvedArgv[0]);
 		if (!dispatched) {
 			process.stderr.write(`Error: unknown worker selector: ${resolvedArgv[0]}\n`);

package/src/commands/update.ts

@@ -15,6 +15,12 @@ export default class Update extends Command {
 		plugins: Flags.boolean({ char: "l", description: "Update installed plugins", default: false }),
 	};
 
+	static examples = [
+		"omp update",
+		"omp update --check",
+		"# If GitHub rate-limits release metadata, set GITHUB_TOKEN or GH_TOKEN\n  GITHUB_TOKEN=... omp update",
+	];
+
 	async run(): Promise<void> {
 		const { flags } = await this.parse(Update);
 		await initTheme();

package/src/config/__tests__/model-registry.test.ts

@@ -3,24 +3,34 @@ import { mkdtempSync, rmSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { buildModel } from "@oh-my-pi/pi-catalog/build";
 import { ModelRegistry } from "../model-registry";
 
-/**
- * Stub AuthStorage that satisfies the surface used by ModelRegistry's
- * constructor (#loadModels → clearConfigApiKeys, constructor →
- * setFallbackResolver). The awaiter under test never reaches auth-gated code
- * paths, so no real credential store is required.
- */
+/** Stub auth storage for registry lifecycle and missing-credential coverage. */
 function createStubAuthStorage(): AuthStorage {
 	const stub = {
 		setFallbackResolver: () => {},
 		clearConfigApiKeys: () => {},
 		hasAuth: () => false,
+		getApiKey: async () => undefined,
 	};
 	return stub as unknown as AuthStorage;
 }
 
-describe("ModelRegistry.awaitBackgroundRefresh", () => {
+const testModel = buildModel({
+	id: "test-model",
+	name: "Test Model",
+	api: "openai-completions",
+	provider: "test",
+	baseUrl: "https://example.test",
+	reasoning: false,
+	input: ["text"],
+	cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+	contextWindow: 1000,
+	maxTokens: 100,
+});
+
+describe("ModelRegistry", () => {
 	let tmpDir: string;
 	let registry: ModelRegistry;
 
@@ -144,4 +154,29 @@ describe("ModelRegistry.awaitBackgroundRefresh", () => {
 		secondResolve();
 		await registry.awaitBackgroundRefresh();
 	});
+	test("resolves API keys and provider headers for legacy extensions", async () => {
+		const model = testModel;
+		vi.spyOn(registry, "getApiKey").mockResolvedValue("test-key");
+		vi.spyOn(registry, "getProviderHeaders").mockReturnValue({ "x-test": "value" });
+
+		expect(await registry.getApiKeyAndHeaders(model)).toEqual({
+			ok: true,
+			apiKey: "test-key",
+			headers: { "x-test": "value" },
+		});
+	});
+
+	test("returns an error when authentication resolves without a credential", async () => {
+		expect(await registry.getApiKeyAndHeaders(testModel)).toEqual({
+			ok: false,
+			error: 'No API key found for "test"',
+		});
+	});
+
+	test("maps legacy extension auth failures into the result contract", async () => {
+		const model = testModel;
+		vi.spyOn(registry, "getApiKey").mockRejectedValue(new Error("auth failed"));
+
+		expect(await registry.getApiKeyAndHeaders(model)).toEqual({ ok: false, error: "auth failed" });
+	});
 });

package/src/config/model-registry.ts

@@ -763,6 +763,16 @@ function getDisabledProviderIdsFromSettings(): Set<string> {
 	}
 }
 
+/** Authentication material returned to legacy extensions for one model request. */
+export type ResolvedRequestAuth =
+	| {
+			ok: true;
+			apiKey?: string;
+			headers?: Record<string, string>;
+			env?: Record<string, string>;
+	  }
+	| { ok: false; error: string };
+
 /**
  * Model registry - loads and manages models, resolves API keys via AuthStorage.
  */
@@ -793,6 +803,7 @@ export class ModelRegistry {
 	// Runtime model managers registered by extensions via fetchDynamicModels.
 	// Keyed by provider name; use the same SQLite cache path as builtins.
 	#runtimeModelManagers: Map<string, { options: ModelManagerOptions<Api>; sourceId: string }> = new Map();
+	#ignoreLocalModelConfig: boolean;
 	#fetch: FetchImpl;
 
 	#resolveCommandBackedApiKey(provider: string): CommandApiKeyResolution {
@@ -829,8 +840,18 @@ export class ModelRegistry {
 	constructor(
 		readonly authStorage: AuthStorage,
 		modelsPath?: string,
-		options?: { fetch?: FetchImpl },
+		options?: {
+			/**
+			 * Gateway mode: ignore local `models.yml` entirely (provider overrides,
+			 * config API keys, custom models, custom discovery). A broker-backed
+			 * gateway serves only bundled + broker-discovered catalog metadata and
+			 * must never apply client-side credential or routing overrides.
+			 */
+			ignoreLocalModelConfig?: boolean;
+			fetch?: FetchImpl;
+		},
 	) {
+		this.#ignoreLocalModelConfig = options?.ignoreLocalModelConfig ?? false;
 		this.#fetch =
 			options?.fetch ??
 			(isBunTestRuntime()
@@ -1367,6 +1388,24 @@ export class ModelRegistry {
 	}
 
 	#loadCustomModels(): CustomModelsResult {
+		// Gateway mode: serve bundled + broker-discovered catalog metadata only.
+		// Local models.yml provider overrides (baseUrl/apiKey/headers/transport),
+		// custom models, custom discovery, and config API keys are all client-side
+		// routing that MUST NOT reach a broker-backed gateway — applying them would
+		// send broker bearers to a configured endpoint, install config keys that
+		// shadow broker credentials (bypassing account pooling/refresh/accounting),
+		// or route a pi-native gateway back into itself.
+		if (this.#ignoreLocalModelConfig) {
+			return {
+				models: [],
+				overrides: new Map(),
+				modelOverrides: new Map(),
+				keylessProviders: new Set(),
+				discoverableProviders: [],
+				configuredProviders: new Set(),
+				found: false,
+			};
+		}
 		const { value, error, status } = this.#modelsConfigFile.tryLoad();
 
 		if (status === "error") {
@@ -1958,12 +1997,22 @@ export class ModelRegistry {
 			remoteCompaction: mergeProviderRemoteCompactionConfig(entry.remoteCompaction, override.remoteCompaction),
 		};
 	}
+	#applyProviderTransportOverrideToModel(
+		model: Model<Api>,
+		override: Pick<
+			ProviderOverride,
+			"baseUrl" | "headers" | "authHeader" | "apiKey" | "remoteCompaction" | "transport"
+		>,
+	): Model<Api> {
+		return buildModel(this.#applyProviderTransportOverride(toModelSpec(model), override));
+	}
+
 	#applyRuntimeProviderOverrides(models: Model<Api>[]): Model<Api>[] {
 		if (this.#runtimeProviderOverrides.size === 0) return models;
 		return models.map(model => {
 			const override = this.#runtimeProviderOverrides.get(model.provider);
 			if (!override) return model;
-			return this.#applyProviderTransportOverride(model, override);
+			return this.#applyProviderTransportOverrideToModel(model, override);
 		});
 	}
 	#resolveLiveModelOverride(model: Model<Api>): ModelOverride | undefined {
@@ -2194,6 +2243,20 @@ export class ModelRegistry {
 		});
 	}
 
+	/** Resolve request authentication through the historical Pi extension facade. */
+	async getApiKeyAndHeaders(model: Model<Api>): Promise<ResolvedRequestAuth> {
+		try {
+			const apiKey = await this.getApiKey(model);
+			if (apiKey === undefined) {
+				return { ok: false, error: `No API key found for "${model.provider}"` };
+			}
+			const headers = this.getProviderHeaders(model.provider);
+			return { ok: true, apiKey, headers };
+		} catch (error) {
+			return { ok: false, error: error instanceof Error ? error.message : String(error) };
+		}
+	}
+
 	/**
 	 * Get API key for a provider (e.g., "openai").
 	 *
@@ -2404,7 +2467,7 @@ export class ModelRegistry {
 			const withRuntimeTransportOverride = runtimeTransportOverride
 				? nextModels.map(model => {
 						if (model.provider !== providerName) return model;
-						return this.#applyProviderTransportOverride(model, runtimeTransportOverride);
+						return this.#applyProviderTransportOverrideToModel(model, runtimeTransportOverride);
 					})
 				: nextModels;
 
@@ -2488,7 +2551,7 @@ export class ModelRegistry {
 			this.#models = this.#applyLlamaCppQwenThinkingToModels(
 				this.#models.map(m => {
 					if (m.provider !== providerName) return m;
-					return this.#applyProviderTransportOverride(m, transportOverride);
+					return this.#applyProviderTransportOverrideToModel(m, transportOverride);
 				}),
 			);
 		}