@pwguler/pi-pengepul-provider 0.3.0 → 0.5.0

package/README.md

@@ -53,6 +53,11 @@ prefixed `pengepul/<id>`. To try it without installing, use
   `max_output_tokens`, `input_modalities`, `pricing`). Fields the relay omits
   fall back to pi's builtin catalog for the same id, then to family
   heuristics.
+- Names the extended thinking levels (`xhigh`, `max`) that a model's own family
+  publishes. An id the catalogs have not caught up with — a point release the
+  relay already serves — takes them from the same family's previous minor, so
+  it does not sit at `high` until the next pi catalog update. Nothing to
+  configure: `thinkingLevelMap` is resolved per id here.
 - Caches the catalog in pi's model store, so startup does not wait on the
   network and a briefly absent relay is covered. The cached models are
   re-pointed at the relay base configured now, so moving the relay does not
@@ -84,25 +89,45 @@ To reach a relay on another machine, put that machine's address in `baseUrl`
 `~/.pengepul/config.yaml` on the relay, or forward the port over SSH). The key
 is the relay's own key — `pengepul config api-key` prints it.
 
-Optional overrides, for CI or a one-off shell. Each is a fallback: the
-credential wins when it carries a value.
+Optional overrides, for CI or a one-off shell. The first two outrank the
+credential: set either and it wins, whatever `auth.json` holds.
 
 | Setting | Env var | Default |
 |---|---|---|
-| Relay base URL | `PENGEPUL_BASE_URL` | `http://127.0.0.1:8317`, or the relay's own `config.yaml` |
-| API key | `PENGEPUL_API_KEY` | `api-keys[0]` in `~/.pengepul/config.yaml` |
-| Config path | `PENGEPUL_CONFIG` | `~/.pengepul/config.yaml` |
-| Legacy cache path | `PENGEPUL_MODELS_CACHE` | `<agent-dir>/pengepul-models.json` |
+| Relay base URL | `PENGEPUL_BASE_URL` | `http://127.0.0.1:8317`, or the credential's `baseUrl` |
+| API key | `PENGEPUL_API_KEY` | the credential's `key` |
 | Discovery timeout | `PENGEPUL_MODELS_TIMEOUT_MS` | `10000` |
 
-`PENGEPUL_MODELS_CACHE` names the pre-0.3 cache file. It is read once, when pi's
-model store has no pengepul catalog yet, and never written again.
+```sh
+PENGEPUL_BASE_URL=http://10.0.0.9:8317 PENGEPUL_API_KEY=sk-local-... pi
+```
 
 Do not set `providers.pengepul.baseUrl` in `models.json`. pi applies that value
 to every model of the provider, which collapses the two wires onto one URL —
 Anthropic Messages traffic would be sent to `/v1` and Chat Completions traffic
 to `/`.
 
+## Upgrading from 0.4.0 or earlier
+
+This release is breaking: the relay's own `~/.pengepul/config.yaml` is no longer
+a source. That file belongs to the machine running the relay, and reading it let
+a key on that box configure every client sharing it.
+
+- A key that came from `api-keys:` in it is no longer picked up. Run
+  `/login pengepul`, or put it in `auth.json` as `"pengepul".key`, or export
+  `PENGEPUL_API_KEY`. `pengepul config api-key` prints it.
+- The relay base built from its `host` and `port` is no longer picked up
+  either. Set `baseUrl` in `auth.json`, or `PENGEPUL_BASE_URL`, if the relay is
+  not on `http://127.0.0.1:8317`.
+- A pre-0.3 `<agent-dir>/pengepul-models.json` is no longer imported. The
+  catalog now comes from the relay on the next start, so the relay has to be
+  reachable once; pi's model store covers the rest.
+
+Resolution order changed as well, and that is the part to check after an
+upgrade: `PENGEPUL_BASE_URL` and `PENGEPUL_API_KEY` now win over `auth.json`,
+where they previously lost to it. An exported key from an old shell now
+overrides the one in the credential.
+
 ## Notes
 
 - pengepul >= 0.6.0 advertises per-model context windows, output caps,

package/extensions/config.ts

@@ -1,34 +1,17 @@
 /**
- * Where the pengepul provider's fallback sources live.
+ * The environment overrides this provider reads.
  *
- * `auth.json` is the configuration surface. These are the escape hatches kept
- * for tests, CI, and a machine that happens to run the relay itself: env vars
- * for the relay base and key, and pengepul's own config on disk.
+ * `~/.pi/agent/auth.json` is the configuration surface: the pengepul entry
+ * carries the relay API key and the relay base it applies to, and
+ * `/login pengepul` writes both. These variables outrank it, so a shell or a CI
+ * run can re-point the provider without editing the file.
  */
 
-import { join } from "node:path"
-
-import { CONFIG_PATH_ENV, DEFAULT_CONFIG_PATH } from "./api-key.ts"
-
-export { CONFIG_PATH_ENV, DEFAULT_CONFIG_PATH }
-
+/** Relay base URL. Outranks the credential's `baseUrl`. */
 export const RELAY_BASE_ENV = "PENGEPUL_BASE_URL"
-export const MODELS_CACHE_ENV = "PENGEPUL_MODELS_CACHE"
-export const MODELS_TIMEOUT_MS_ENV = "PENGEPUL_MODELS_TIMEOUT_MS"
 
-export interface PengepulSettings {
-  /** Where pengepul's own config lives, when this machine runs the relay. */
-  configPath: string
-  /** Where the pre-0.3 catalog cache lives; read once to seed pi's store. */
-  legacyCachePath: string
-}
+/** Relay API key. Outranks the credential's `key`. */
+export const API_KEY_ENV = "PENGEPUL_API_KEY"
 
-export function resolveSettings(
-  env: Record<string, string | undefined>,
-  agentDir: string,
-): PengepulSettings {
-  return {
-    configPath: env[CONFIG_PATH_ENV] ?? DEFAULT_CONFIG_PATH,
-    legacyCachePath: env[MODELS_CACHE_ENV] ?? join(agentDir, "pengepul-models.json"),
-  }
-}
+/** Milliseconds before model discovery gives up. */
+export const MODELS_TIMEOUT_MS_ENV = "PENGEPUL_MODELS_TIMEOUT_MS"

package/extensions/credential.ts

@@ -4,13 +4,13 @@
  * The credential is the pengepul entry in pi's `auth.json`: an API key for the
  * relay plus the relay base it applies to. pi core resolves the key itself but
  * knows nothing about `baseUrl`, so the extension reads it here. Everything in
- * this module is pure: an env map and config text in, a value out.
+ * this module is pure: an env map and credential fields in, a value out.
  *
- * Precedence, highest first: credential, then environment, then the relay's own
- * config file (which only exists on the machine running the relay), then the
- * loopback default pengepul binds to.
+ * Precedence is the same for both, highest first: the `PENGEPUL_*` environment
+ * override, then the credential, then the loopback default pengepul binds to.
  */
 
+import { API_KEY_ENV } from "./config.ts"
 import { normalizeRootBaseUrl } from "./dialect.ts"
 import { DEFAULT_RELAY_BASE } from "./models.ts"
 
@@ -38,76 +38,52 @@ export function credentialApiKey(credential: PengepulCredential | undefined): st
   return nonEmptyString(credential?.key)
 }
 
-/**
- * Build a relay base from pengepul's own `config.yaml`. Only the machine running
- * the relay has this file; clients reach a relay elsewhere and skip this source.
- *
- * pengepul writes `host: ''` when it binds loopback ("empty binds 127.0.0.1, not
- * every interface"), so an empty host means loopback rather than "unset". A
- * bind-all address is not a connect address either: `0.0.0.0`, `::`, and `*` mean
- * "every interface", and a client reaches that listener on loopback.
- */
-export function relayBaseFromConfigText(configText: string | undefined): string | undefined {
-  if (configText === undefined) return undefined
-
-  let host = "127.0.0.1"
-  let port: number | undefined
-
-  for (const line of configText.split(/\r?\n/)) {
-    const hostMatch = /^\s*host:\s*(.*)$/.exec(line)
-    if (hostMatch) {
-      const value = (hostMatch[1] ?? "").trim().replace(/^["']|["']$/g, "")
-      if (value !== "" && !isBindAll(value)) host = value
-      continue
-    }
-
-    const portMatch = /^\s*port:\s*(.*)$/.exec(line)
-    if (portMatch) {
-      const value = (portMatch[1] ?? "").trim().replace(/^["']|["']$/g, "")
-      const parsed = Number(value)
-      if (Number.isInteger(parsed) && parsed > 0 && parsed <= 65_535) port = parsed
-    }
-  }
-
-  return port === undefined ? undefined : `http://${host}:${port}`
-}
-
-/** Whether a configured host is a bind-all address rather than a destination. */
-function isBindAll(host: string): boolean {
-  return host === "0.0.0.0" || host === "::" || host === "[::]" || host === "*"
-}
-
 export interface RelayBaseSources {
-  /** The relay base stored on the pengepul credential. */
-  credential?: string | undefined
   /** The `PENGEPUL_BASE_URL` environment value. */
   environment?: string | undefined
-  /** The relay base derived from pengepul's own config file. */
-  config?: string | undefined
+  /** The relay base stored on the pengepul credential. */
+  credential?: string | undefined
 }
 
 /**
- * The relay root every wire appends to: highest-precedence non-blank source, or
- * loopback. A trailing `/v1` is accepted and stripped, so a base copied from a
- * client config cannot produce `/v1/v1` downstream.
+ * The relay root every wire appends to: the environment override, else the
+ * credential, else loopback. A trailing `/v1` is accepted and stripped, so a
+ * base copied from a client config cannot produce `/v1/v1` downstream.
  */
 export function resolveRelayBase(sources: RelayBaseSources): string {
   const chosen =
-    nonEmptyString(sources.credential) ??
     nonEmptyString(sources.environment) ??
-    nonEmptyString(sources.config) ??
+    nonEmptyString(sources.credential) ??
     DEFAULT_RELAY_BASE
   return normalizeRootBaseUrl(chosen)
 }
 
 export interface ApiKeySources {
+  /** The `PENGEPUL_API_KEY` environment value. */
+  environment?: string | undefined
   /** The key stored on the pengepul credential. */
   credential?: string | undefined
-  /** The key resolved from `PENGEPUL_API_KEY` or pengepul's own config file. */
-  ambient?: string | undefined
 }
 
-/** The key requests and catalog fetches use, or undefined when none is configured. */
-export function resolveApiKey(sources: ApiKeySources): string | undefined {
-  return nonEmptyString(sources.credential) ?? nonEmptyString(sources.ambient)
+/** Which source answered, as the auth status labels it. */
+export type ApiKeySource = "PENGEPUL_API_KEY" | "stored credential"
+
+export interface ResolvedApiKey {
+  key: string
+  source: ApiKeySource
+}
+
+/**
+ * The key requests and catalog fetches use, or undefined when none is
+ * configured. The value and the label it reports come from one walk, so the
+ * status UI cannot name a source the request did not use.
+ */
+export function resolveApiKey(sources: ApiKeySources): ResolvedApiKey | undefined {
+  const environment = nonEmptyString(sources.environment)
+  if (environment) return { key: environment, source: API_KEY_ENV }
+
+  const credential = nonEmptyString(sources.credential)
+  if (credential) return { key: credential, source: "stored credential" }
+
+  return undefined
 }

package/extensions/index.ts

@@ -4,36 +4,18 @@
  * Registers pengepul as a pi provider. pengepul is a relay that pools your
  * Claude/Codex subscriptions and speaks both native wires. The provider itself
  * lives in `./provider.ts`: pi resolves auth through it and hands the credential
- * back on every refresh, so `auth.json` carries the key and the relay base. The
- * pure core is `./credential.ts`, `./dialect.ts`, and `./models.ts`; this file
- * adapts them to the pi ExtensionAPI seam and reads the one file pi cannot.
+ * back on every refresh, so `auth.json` carries the key and the relay base, and
+ * the `PENGEPUL_*` environment variables override both. The pure core is
+ * `./credential.ts`, `./dialect.ts`, and `./models.ts`; this file adapts them to
+ * the pi ExtensionAPI seam and reads nothing of its own.
  */
 
-import {
-  getAgentDir,
-  type ExtensionAPI,
-} from "@earendil-works/pi-coding-agent"
+import { type ExtensionAPI } from "@earendil-works/pi-coding-agent"
 import { getBuiltinModel, getBuiltinModels, getBuiltinProviders } from "@earendil-works/pi-ai/providers/all"
-import { readFileSync } from "node:fs"
 
-import { resolveSettings } from "./config.ts"
 import { catalogIdForms, type PengepulModel } from "./models.ts"
 import { createPengepulProvider } from "./provider.ts"
 
-function expandHome(path: string): string {
-  if (path === "~") return process.env.HOME ?? path
-  if (path.startsWith("~/")) return `${process.env.HOME ?? ""}${path.slice(1)}`
-  return path
-}
-
-function readConfigText(path: string): string | undefined {
-  try {
-    return readFileSync(expandHome(path), "utf-8")
-  } catch {
-    return undefined
-  }
-}
-
 /** The metadata fields the lookup extracts from a pi catalog entry. */
 function metaFromModel(model: NonNullable<ReturnType<typeof getBuiltinModel>>) {
   return {
@@ -88,17 +70,13 @@ function createBuiltinLookup(): (id: string, dialect: string) => ReturnType<type
 
 /**
  * Model discovery belongs to pi: it calls `refreshModels` with the resolved
- * credential, first against pi's cached catalog and then, when the network is
+ * credential, first against pi's model store and then, when the network is
  * allowed, against the relay. Registration is synchronous; nothing here waits
  * on the relay, and the catalog survives a restart through pi's model store.
  */
 export default function (pi: ExtensionAPI) {
-  const settings = resolveSettings(process.env, getAgentDir())
-
   const provider = createPengepulProvider({
     env: process.env,
-    configText: readConfigText(settings.configPath),
-    legacyCachePath: settings.legacyCachePath,
     lookupBuiltin: createBuiltinLookup(),
   })
 

package/extensions/models.ts

@@ -2,10 +2,11 @@
  * pengepul model discovery.
  *
  * Fetches the relay's model catalog (`GET /v1/models`) and maps it into the
- * pi-ai `ProviderModelConfig` shape, mirroring the commandcode provider's
- * cached-catalog design: a fresh fetch wins, a valid cache covers a briefly
- * absent relay, and an empty result leaves pengepul models unavailable until
- * the next successful startup refresh.
+ * pi-ai `ProviderModelConfig` shape. Discovery is pi's to drive: the catalog
+ * lives in pi's model store between runs, so a briefly absent relay is covered
+ * by the store the provider registered rather than by a file this module owns.
+ * An empty result leaves pengepul models unavailable until the next successful
+ * startup refresh.
  *
  * The relay advertises id/owned_by and, since pengepul 0.6.0, optional
  * per-model metadata: `context_window`, `max_output_tokens`,
@@ -17,11 +18,10 @@
  * next best source - and then family heuristics. The catalog lookup is
  * injected, so this module imports nothing from pi-ai and tests pin it.
  *
- * The network/cache are injected so the catalog logic stays testable.
+ * The catalog fetch is injected as well, so this module holds no hidden
+ * network access and tests pin the transport.
  */
 
-import { readFile } from "node:fs/promises"
-
 import { MODELS_TIMEOUT_MS_ENV } from "./config.ts"
 import { baseUrlForDialect, dialectForModelId } from "./dialect.ts"
 import type { PengepulDialect } from "./dialect.ts"
@@ -32,8 +32,6 @@ export const DEFAULT_MODELS_TIMEOUT_MS = 10_000
 const DEFAULT_CONTEXT_WINDOW = 200_000
 const DEFAULT_MAX_TOKENS = 64_000
 const ZERO_COST: ModelCostRates = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }
-/** v5 cached entries predate the relay-uniform off/minimal overlay (foreign catalog maps offered levels the relay 400s); reject it. */
-const MODEL_CACHE_VERSION = 6
 
 export type ModelInput = ("text" | "image")[]
 
@@ -259,6 +257,63 @@ function fallbackLevelMap(id: string): Record<string, string | null> | undefined
   return id.toLowerCase().startsWith("commandcode/") ? { max: "max" } : undefined
 }
 
+/** The levels pi hides unless a map names them. */
+const INHERITED_LEVELS = ["xhigh", "max"] as const
+
+/**
+ * Extended levels a family's previous minor already carries.
+ *
+ * pi hides `xhigh` and `max` unless a model's map names them, so an id the
+ * catalogs have not caught up with - a Claude point release the relay serves
+ * today, before pi's catalog carries it - dropped to low/medium/high and could
+ * never send the top of a ladder its own family publishes: in the catalog Opus
+ * 4.5 names neither extension, 4.6 names max, and 4.7, 4.8 and 5 name xhigh and
+ * max. The previous minor's own entry is that answer, and the only evidence
+ * there is: the relay advertises no effort metadata, so `GET /v1/models` has
+ * nothing to say about levels and pi's map is the whole vocabulary.
+ *
+ * Add-only by construction. Only levels the sibling maps to a string come
+ * across, so an id that reaches this path can gain the top of the scale but
+ * never lose a level that works today, and never takes on a sibling's spelling
+ * for off/low/medium/high - the dialect rules downstream own those.
+ *
+ * Measured against the live catalog at the time of writing: exactly two ids
+ * enter this path, `anthropic/claude-opus-5-5` and
+ * `openrouter/anthropic/claude-opus-5.5`, each inheriting xhigh and max from
+ * `claude-opus-5`. No other family in that catalog was touched.
+ */
+function inheritedLevelMap(
+  id: string,
+  dialect: PengepulDialect,
+  lookup: BuiltinModelLookup | undefined,
+): Record<string, string | null> | undefined {
+  const siblingId = previousMinorId(id)
+  const siblingMap = siblingId ? lookup?.(siblingId, dialect)?.thinkingLevelMap : undefined
+  if (!siblingMap) return undefined
+
+  const inherited: Record<string, string | null> = {}
+  for (const level of INHERITED_LEVELS) {
+    const mapped = siblingMap[level]
+    if (typeof mapped === "string") inherited[level] = mapped
+  }
+  return Object.keys(inherited).length > 0 ? inherited : undefined
+}
+
+/**
+ * The same id one minor older, keeping the routing namespace:
+ * `anthropic/claude-opus-5-5` -> `anthropic/claude-opus-5`, and the dotted
+ * `claude-opus-5.5` -> `claude-opus-5` for the Chat Completions spelling.
+ * Undefined when the name carries no trailing version segment to drop, which
+ * keeps qualifiers (`-preview`, `-flash`, `-fast`) out of the derivation.
+ */
+function previousMinorId(id: string): string | undefined {
+  const slash = id.lastIndexOf("/")
+  const name = slash === -1 ? id : id.slice(slash + 1)
+  const stripped = name.replace(/[.-]\d+$/, "")
+  if (stripped === name || stripped === "") return undefined
+  return slash === -1 ? stripped : `${id.slice(0, slash + 1)}${stripped}`
+}
+
 /**
  * Resolve a model's metadata, most trustworthy source first:
  *   1. what pengepul advertises (first-party for this relay),
@@ -266,6 +321,11 @@ function fallbackLevelMap(id: string): Record<string, string | null> | undefined
  *   3. family heuristics.
  * Sources merge per field, so a relay that sends only `context_window` still
  * picks up pricing and modalities from the catalog.
+ *
+ * A catalog miss on a reasoning model still gets its extended levels from the
+ * family's previous minor where the catalog carries one (`inheritedLevelMap`);
+ * the namespace fallback for the Chat Completions wire then takes precedence
+ * over both.
  */
 function metaFor(
   entry: Record<string, unknown>,
@@ -294,7 +354,20 @@ function metaFor(
   const fallback =
     known || !reasoning || dialect !== "openai-completions" ? undefined : fallbackLevelMap(id)
 
-  return { ...meta, reasoning, ...(fallback ? { thinkingLevelMap: fallback } : {}) }
+  // A catalog miss is not always silence: the family's previous minor answers
+  // for the levels the catalog has not named yet. Whatever the base resolved
+  // wins over it, so a relay that starts advertising a map still outranks this.
+  const inherited = known || !reasoning ? undefined : inheritedLevelMap(id, dialect, lookup)
+  const levelMap = inherited
+    ? { ...inherited, ...(meta.thinkingLevelMap ?? {}) }
+    : meta.thinkingLevelMap
+
+  return {
+    ...meta,
+    reasoning,
+    ...(levelMap ? { thinkingLevelMap: levelMap } : {}),
+    ...(fallback ? { thinkingLevelMap: fallback } : {}),
+  }
 }
 
 function toPengepulModel(
@@ -416,10 +489,10 @@ function isBatchRoute(id: string): boolean {
 }
 
 /**
- * Drop the ids this relay cannot serve on either wire. Applied on the way in
- * from the relay and on the way in from the cache: the cache is what covers a
- * briefly absent relay, so it must not be the path that resurrects a route
- * the live catalog would have dropped.
+ * Drop the ids this relay cannot serve on either wire, on the way in from the
+ * relay. The store replays what pi persisted, so a route this filter drops
+ * survives in a store written before the filter existed only until the next
+ * successful fetch replaces it.
  */
 function servableModels(models: readonly PengepulModel[]): PengepulModel[] {
   return models.filter((model) => !isBatchRoute(model.id))
@@ -617,11 +690,6 @@ interface FetchModelsOptions {
   lookupBuiltin?: BuiltinModelLookup
 }
 
-interface LoadModelsOptions extends FetchModelsOptions {
-  cachePath: string
-  relayBase: string
-}
-
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error)
 }
@@ -741,95 +809,3 @@ export async function fetchPengepulModels(
 
   return modelsFromApiResponse(body, options.lookupBuiltin)
 }
-
-function numberField(record: Record<string, unknown>, key: string): number {
-  const value = record[key]
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new Error(`Expected ${key} to be a finite number`)
-  }
-  return value
-}
-
-function inputField(record: Record<string, unknown>, key: string): ModelInput {
-  const value = record[key]
-  if (!Array.isArray(value)) throw new Error(`Expected ${key} to be an array`)
-  return value.map((entry) => {
-    if (entry !== "text" && entry !== "image") {
-      throw new Error(`Expected ${key} entries to be "text" or "image"`)
-    }
-    return entry
-  })
-}
-
-function costField(record: Record<string, unknown>, key: string): ModelCostRates {
-  const value = record[key]
-  if (!isRecord(value)) throw new Error(`Expected ${key} to be an object`)
-  return {
-    input: numberField(value, "input"),
-    output: numberField(value, "output"),
-    cacheRead: numberField(value, "cacheRead"),
-    cacheWrite: numberField(value, "cacheWrite"),
-  }
-}
-
-function levelMapField(
-  record: Record<string, unknown>,
-  key: string,
-): Record<string, string | null> {
-  const value = record[key]
-  if (!isRecord(value)) throw new Error(`Expected ${key} to be an object`)
-  const map: Record<string, string | null> = {}
-  for (const [level, mapped] of Object.entries(value)) {
-    if (mapped !== null && typeof mapped !== "string") {
-      throw new Error(`Expected ${key} values to be strings or null`)
-    }
-    map[level] = mapped
-  }
-  return map
-}
-
-export function modelsFromCache(value: unknown): readonly PengepulModel[] {
-  if (!isRecord(value)) throw new Error("Expected model cache to be an object")
-  if (value["version"] !== MODEL_CACHE_VERSION) {
-    throw new Error(`Expected model cache version ${MODEL_CACHE_VERSION}`)
-  }
-  if (!Array.isArray(value["models"])) throw new Error("Expected cached models to be an array")
-
-  const parsed: PengepulModel[] = value["models"].map((entry) => {
-    if (!isRecord(entry)) throw new Error("Expected cached model entry to be an object")
-    return {
-      id: stringField(entry, "id"),
-      name: stringField(entry, "name"),
-      dialect: stringField(entry, "dialect") as PengepulDialect,
-      reasoning: entry["reasoning"] === true,
-      input: inputField(entry, "input"),
-      cost: costField(entry, "cost"),
-      contextWindow: numberField(entry, "contextWindow"),
-      maxTokens: numberField(entry, "maxTokens"),
-      ...(entry["thinkingLevelMap"] !== undefined
-        ? { thinkingLevelMap: levelMapField(entry, "thinkingLevelMap") }
-        : {}),
-    }
-  })
-  const servable = servableModels(parsed)
-  if (servable.length === 0) throw new Error("pengepul cache holds no valid models")
-  return servable
-}
-
-async function readCache(cachePath: string): Promise<readonly PengepulModel[]> {
-  const contents = await readFile(cachePath, "utf-8")
-  return modelsFromCache(JSON.parse(contents))
-}
-
-/** Reads the cached catalog without touching the network; empty when missing/invalid. */
-export async function loadCachedPengepulModels(
-  cachePath: string,
-): Promise<readonly PengepulModel[]> {
-  try {
-    return await readCache(cachePath)
-  } catch {
-    return []
-  }
-}
-
-

package/extensions/provider.ts

@@ -2,11 +2,11 @@
  * The pengepul provider, as pi-ai sees it.
  *
  * Registered as a native provider, so pi resolves auth through this module and
- * hands the credential back to `refreshModels`. That closes two gaps the
- * config-value form had: model discovery now uses the same resolved key pi uses
- * for requests (it used to read only `PENGEPUL_API_KEY` and pengepul's own
- * config, so a key stored in `auth.json` produced a 401), and the relay base
- * comes from the credential instead of the environment.
+ * hands the credential back to `refreshModels`. Discovery and requests
+ * therefore resolve the same key and the same relay base: environment first,
+ * then the credential. A provider declared as plain config values has no
+ * credential at discovery time, so a key stored in `auth.json` left its
+ * catalog fetch with nothing to send but an environment variable, and a 401.
  *
  * The relay base lives on the credential as `baseUrl`, a field pi core does not
  * read. Per-model base URLs are derived from it, because pi applies a base URL
@@ -27,12 +27,10 @@ import type {
 } from "@earendil-works/pi-ai"
 import { anthropicMessagesApi, lazyStream, openAICompletionsApi } from "@earendil-works/pi-ai/compat"
 
-import { API_KEY_ENV, extractApiKeys } from "./api-key.ts"
-import { RELAY_BASE_ENV } from "./config.ts"
+import { API_KEY_ENV, RELAY_BASE_ENV } from "./config.ts"
 import {
   credentialApiKey,
   credentialRelayBase,
-  relayBaseFromConfigText,
   resolveApiKey,
   resolveRelayBase,
   type PengepulCredential,
@@ -43,7 +41,6 @@ import {
   fetchPengepulModels,
   getModelsTimeoutMs,
   isPengepulModelEntry,
-  loadCachedPengepulModels,
   PENGEPUL_PROVIDER_ID,
   restampRelayBase,
   toPengepulModels,
@@ -58,16 +55,9 @@ export interface PengepulApiKeyCredential extends ApiKeyCredential {
   baseUrl?: string
 }
 
-/** Where the config-file fallback key comes from, for the status label. */
-const CONFIG_FILE_LABEL = "~/.pengepul/config.yaml"
-
 export interface PengepulProviderOptions {
   /** Environment map holding the optional `PENGEPUL_*` overrides. */
   env?: Record<string, string | undefined>
-  /** Text of pengepul's own config, when this machine happens to run the relay. */
-  configText?: string
-  /** Where the pre-0.3 catalog cache lives; read once to seed pi's store. */
-  legacyCachePath: string
   /** Catalog fetch transport, for tests. */
   fetchImpl?: typeof fetch
   /** Builtin metadata lookup, injected so the catalog logic stays free of pi imports. */
@@ -90,9 +80,9 @@ function isPengepulDialect(api: Api): api is PengepulDialect {
 /**
  * A provider whose catalog comes from pengepul and whose auth is the relay key.
  *
- * Ambient sources are read from the captured environment and config text, not
- * from `AuthContext.env`, because `refreshModels` receives no auth context and
- * both paths must agree on what the key and base are.
+ * The environment overrides are read from the captured environment, not from
+ * `AuthContext.env`, because `refreshModels` receives no auth context and both
+ * paths must agree on what the key and base are.
  */
 export function createPengepulProvider(options: PengepulProviderOptions): Provider {
   const env = options.env ?? process.env
@@ -104,23 +94,23 @@ export function createPengepulProvider(options: PengepulProviderOptions): Provid
 
   const environmentRelayBase = env[RELAY_BASE_ENV]
   const environmentApiKey = env[API_KEY_ENV]
-  const configText = options.configText
-  const configRelayBase = relayBaseFromConfigText(configText)
-  const configApiKey = configText ? extractApiKeys(configText)[0] : undefined
 
   let models: PengepulModelEntry[] = []
 
-  /** The key from outside auth.json, with the label the status UI shows. */
-  function ambientKey(): { key?: string; source?: string } {
-    if (environmentApiKey?.trim()) return { key: environmentApiKey.trim(), source: API_KEY_ENV }
-    if (configApiKey) return { key: configApiKey, source: CONFIG_FILE_LABEL }
-    return {}
+  /** The relay base in force: the environment override, else the credential, else loopback. */
+  function relayBaseFor(credential: unknown): string {
+    return resolveRelayBase({
+      environment: environmentRelayBase,
+      credential: credentialRelayBase(credential as PengepulCredential | undefined),
+    })
   }
 
-  function resolveKey(credential: unknown): { key?: string; source?: string } {
-    const stored = credentialApiKey(credential as PengepulCredential | undefined)
-    if (stored) return { key: stored, source: "stored credential" }
-    return ambientKey()
+  /** The key in force, with the label the status UI shows for it. */
+  function resolveKey(credential: unknown) {
+    return resolveApiKey({
+      environment: environmentApiKey,
+      credential: credentialApiKey(credential as PengepulCredential | undefined),
+    })
   }
 
   const streams: Record<PengepulDialect, ProviderStreams> = {
@@ -138,38 +128,26 @@ export function createPengepulProvider(options: PengepulProviderOptions): Provid
     })
   }
 
-  async function restoreOrSeed(context: RefreshModelsContext): Promise<boolean> {
-    const relayBase = resolveRelayBase({
-      credential: credentialRelayBase(context.credential as PengepulCredential | undefined),
-      environment: environmentRelayBase,
-      config: configRelayBase,
-    })
-
+  /**
+   * Re-publish pi's stored catalog with every base URL re-derived from the
+   * base in force, so a relay that moved is not reached at its old address.
+   * Returns false only when pi refused the publication, the one case that
+   * skips the network phase.
+   */
+  async function restoreStored(context: RefreshModelsContext): Promise<boolean> {
     const stored = (context.stored?.models ?? []).filter(isPengepulModelEntry)
-    if (stored.length > 0) {
-      const restored = restampRelayBase(stored, relayBase)
-      return context.publish({ update: () => { models = restored } })
-    }
-
-    // Pre-0.3 installs kept their own cache file. Read it once so an upgrade
-    // does not start blind; pi's store owns the catalog from here on.
-    const legacy = await loadCachedPengepulModels(options.legacyCachePath)
-    if (legacy.length === 0) return true
-    const seeded = toPengepulModels(legacy, relayBase)
-    return context.publish({ update: () => { models = seeded } })
+    if (stored.length === 0) return true
+    const restored = restampRelayBase(stored, relayBaseFor(context.credential))
+    return context.publish({ update: () => { models = restored } })
   }
 
   async function refreshFromRelay(context: RefreshModelsContext): Promise<void> {
-    const relayBase = resolveRelayBase({
-      credential: credentialRelayBase(context.credential as PengepulCredential | undefined),
-      environment: environmentRelayBase,
-      config: configRelayBase,
-    })
+    const relayBase = relayBaseFor(context.credential)
 
     const resolved = resolveKey(context.credential)
-    if (!resolved.key) {
+    if (!resolved) {
       logWarning(
-        `No pengepul API key is configured (${API_KEY_ENV}, ${CONFIG_FILE_LABEL}, or auth.json), so the model catalog cannot be refreshed. Run /login pengepul.`,
+        `No pengepul API key is configured (${API_KEY_ENV} or auth.json), so the model catalog cannot be refreshed. Run /login pengepul.`,
       )
       return
     }
@@ -201,10 +179,7 @@ export function createPengepulProvider(options: PengepulProviderOptions): Provid
   return {
     id: PENGEPUL_PROVIDER_ID,
     name: "Pengepul",
-    baseUrl: resolveRelayBase({
-      environment: environmentRelayBase,
-      config: configRelayBase,
-    }),
+    baseUrl: resolveRelayBase({ environment: environmentRelayBase }),
     auth: {
       apiKey: {
         name: "Pengepul relay",
@@ -231,25 +206,20 @@ export function createPengepulProvider(options: PengepulProviderOptions): Provid
         },
         check: async (input): Promise<AuthCheck | undefined> => {
           const resolved = resolveKey(input.credential)
-          return resolved.key
-            ? { type: "api_key", ...(resolved.source ? { source: resolved.source } : {}) }
-            : undefined
+          return resolved ? { type: "api_key", source: resolved.source } : undefined
         },
         resolve: async (input): Promise<AuthResult | undefined> => {
           const resolved = resolveKey(input.credential)
-          if (!resolved.key) return undefined
+          if (!resolved) return undefined
           // No `baseUrl` here on purpose: pi would apply it to every model and
           // collapse the two dialect base URLs into one.
-          return {
-            auth: { apiKey: resolved.key },
-            ...(resolved.source ? { source: resolved.source } : {}),
-          }
+          return { auth: { apiKey: resolved.key }, source: resolved.source }
         },
       },
     },
     getModels: () => models,
     refreshModels: async (context) => {
-      if (!(await restoreOrSeed(context))) return
+      if (!(await restoreStored(context))) return
       if (!context.allowNetwork || context.signal.aborted) return
       await refreshFromRelay(context)
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pwguler/pi-pengepul-provider",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "type": "module",
   "description": "pi custom provider for pengepul, a relay that pools your Claude/Codex subscriptions. Key and relay base live in auth.json; both native wires (Anthropic Messages, OpenAI Chat Completions) come from one catalog.",
   "license": "MIT",

package/extensions/api-key.ts

@@ -1,70 +0,0 @@
-/**
- * Read pengepul's own API key.
- *
- * pengepul authenticates every request with a static key from its config:
- * `~/.pengepul/config.yaml`, under `api-keys:` (the first is generated on first
- * run and is `sk-local-...`). Clients send it as `Authorization: Bearer <key>`
- * or `x-api-key: <key>`.
- *
- * This is the fallback for the machine that runs the relay itself: a client box
- * configures the key in `auth.json`, which pi resolves and hands to the
- * provider. Only extraction lives here, so the file read stays with the caller
- * and this module stays io-free.
- */
-
-export const DEFAULT_CONFIG_PATH = "~/.pengepul/config.yaml"
-
-export const API_KEY_ENV = "PENGEPUL_API_KEY"
-export const CONFIG_PATH_ENV = "PENGEPUL_CONFIG"
-
-/**
- * Extract `api-keys:` entries from pengepul's YAML config, without a YAML
- * dependency. Handles both the inline-flow form and the block-sequence form:
- *
- *   api-keys: [sk-local-a, sk-local-b]
- *   api-keys:
- *     - sk-local-a
- *     - sk-local-b
- */
-export function extractApiKeys(configText: string): string[] {
-  const lines = configText.split(/\r?\n/)
-  const keys: string[] = []
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
-    if (line === undefined) continue
-
-    const match = /^\s*api-keys:\s*(.*)$/.exec(line)
-    if (!match) continue
-
-    const rest = (match[1] ?? "").trim()
-    if (rest.startsWith("[")) {
-      // Inline flow sequence: [a, b, c]
-      for (const token of rest.slice(1, -1).split(",")) {
-        const key = token.trim().replace(/^["']|["']$/g, "")
-        if (key) keys.push(key)
-      }
-    } else if (rest === "" || rest === "|" || rest === ">") {
-      // Block sequence follows. Sequence entries may sit at any indent —
-      // pengepul itself writes them flush with the key (`- sk-local-…`) —
-      // so scan forward through blanks, comments, and `- ` entries and
-      // stop at the first line that starts another key.
-      for (let j = i + 1; j < lines.length; j++) {
-        const item = lines[j]
-        if (item === undefined) continue
-        const token = item.trim()
-        if (token === "" || token.startsWith("#")) continue
-        if (!token.startsWith("-")) break
-        const value = token.slice(1).trim().replace(/^["']|["']$/g, "")
-        if (value) keys.push(value)
-      }
-    } else {
-      // Single inline scalar: api-keys: sk-local-a
-      const value = rest.replace(/^["']|["']$/g, "")
-      if (value) keys.push(value)
-    }
-    break
-  }
-
-  return keys
-}