@schlessera/brain-ui-server 0.21.0 → 0.24.0

package/dist/ws/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/ws/routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB7E"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/ws/routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC7E"}

package/dist/ws/routing.js

@@ -23,6 +23,15 @@ export async function resolveTurnTarget(registry, catalog, sessionId, requested)
                 return { backend, profileId: requested };
         }
     }
+    // No explicit choice (fresh client, share, host-initiated action): the
+    // preferred default — the Settings-stored default model, else a connected
+    // subscription-auth profile — before the default backend's own first profile.
+    const preferred = await registry.getPreferredProfileId();
+    if (preferred) {
+        const backend = await registry.getBackendForProfile(preferred);
+        if (backend)
+            return { backend, profileId: preferred };
+    }
     const backend = await registry.getDefaultBackend();
     const profileId = (await backend.listProfiles())[0]?.id;
     return { backend, ...(profileId ? { profileId } : {}) };

package/dist/ws/routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../src/ws/routing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAuB,EACvB,SAA6B,EAC7B,SAA6B;IAE7B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"routing.js","sourceRoot":"","sources":["../../src/ws/routing.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAuB,EACvB,SAA6B,EAC7B,SAA6B;IAE7B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACpD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC/D,IAAI,OAAO;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,qBAAqB,EAAE,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schlessera/brain-ui-server",
-  "version": "0.21.0",
+  "version": "0.24.0",
   "description": "brain-kit chat-UI server: Hono app factory, WebSocket turn coordinator, auth (password/passkeys/tailscale/proxy), session catalog, and brain/files/voice routes",
   "license": "MIT",
   "keywords": [
@@ -44,13 +44,15 @@
   ],
   "scripts": {
     "test": "bun test tests --timeout 30000",
-    "prepublishOnly": "bun ../../scripts/check-dist.ts"
+    "prepublishOnly": "bun ../../scripts/check-dist.ts",
+    "eval:triage": "bun run evals/triage/run.ts",
+    "eval:triage:validate": "bun run evals/triage/validate.ts"
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "0.221.0",
-    "@schlessera/brain-render-template": "0.21.0",
-    "@schlessera/brain-ui-sdk": "0.21.0",
+    "@schlessera/brain-render-template": "0.24.0",
+    "@schlessera/brain-ui-sdk": "0.24.0",
     "@simplewebauthn/server": "^13.3.2",
     "hono": "^4",
     "ignore": "^7.0.5",

package/src/agent/backend.ts

@@ -97,6 +97,30 @@ export interface ClaudeProfileInput {
   source?: "builtin" | "declared" | "discovered";
 }
 
+/** Reasoning levels pi accepts (mirror of pi-agent-core's `ThinkingLevel`). */
+export const PI_THINKING_LEVELS = [
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max",
+] as const;
+export type PiThinkingLevel = (typeof PI_THINKING_LEVELS)[number];
+
+/** Mirror of the pi package's `PiProfile` (declarative shape). */
+export interface PiProfileInput {
+  id: string;
+  label: string;
+  /** pi provider id, e.g. "openai-codex", "anthropic", "google". */
+  vendor: string;
+  /** pi model id within the vendor, e.g. "gpt-5.6-sol". */
+  model: string;
+  /** Reasoning level for new sessions; pi clamps to the model's capability. */
+  thinkingLevel?: PiThinkingLevel;
+}
+
 /** Mirror of the Claude package's resolved `InferenceProfile`. */
 export interface ClaudeProfile {
   id: string;
@@ -175,6 +199,17 @@ export interface BackendRegistryOptions {
    * sessions pinned to it. Defaults to "nothing hidden".
    */
   getHiddenModelIds?: () => string[];
+  /**
+   * Settings-stored default profile id (Settings → Models). Null/absent =
+   * auto (a connected subscription-auth profile, else the default backend's
+   * own default).
+   */
+  getDefaultModelId?: () => string | null;
+  /**
+   * User-managed OpenRouter model ids (from the app's settings table), added
+   * to the Claude roster as declared OpenRouter profiles at runtime.
+   */
+  getCustomOpenRouterModels?: () => string[];
   /**
    * Per-profile billing-mode overrides (from the app's settings table).
    * Consulted LAST: an override wins over both the declared-credential rule
@@ -210,6 +245,17 @@ export interface BackendRegistry {
    * catalog.
    */
   listAllProviders(options?: { includeHidden?: boolean }): Promise<ProviderInfo[]>;
+  /**
+   * The profile new sessions and host-initiated turns (shares, actions)
+   * default to when the client named none, or null for "the default
+   * backend's own default". Resolution: the Settings-stored default model
+   * (when it still exists on the roster) wins; otherwise AUTO — a
+   * subscription-auth profile (pi vendor "openai-codex") that is on the
+   * roster, not hidden, and whose account is actually connected. The
+   * resolved profile is also listed FIRST by `listAllProviders`, so a fresh
+   * client's picker lands on it.
+   */
+  getPreferredProfileId(): Promise<string | null>;
   /** Per-backend capability metadata exposed by the providers route. */
   getBackendsInfo(): Promise<
     Record<string, { id: string; capabilities: BackendCapabilities }>
@@ -354,6 +400,94 @@ export async function loadBackendModule(
   }
 }
 
+/**
+ * Parse + validate the pi roster from BRAIN_UI_PI_PROFILES (a JSON array of
+ * {id,label,vendor,model,thinkingLevel?}). Malformed input THROWS rather than
+ * silently dropping the roster; `assertBackendResolvable` runs this at boot so
+ * a bad config refuses to start instead of reporting healthy and 500ing later.
+ *
+ * Ids Claude's side of the picker uses or can mint later ("default",
+ * "claude", "claude-*" — discovery canonicalizes every Anthropic model to a
+ * claude-* alias) are rejected, as is any collision with an id declared in
+ * BRAIN_UI_CLAUDE_PROFILES — a cross-backend collision otherwise surfaces as
+ * a 500 on first request. Claude's own JSON is parsed leniently here: when it
+ * is malformed, the Claude loader raises its own (more precise) boot error.
+ */
+export function parsePiProfiles(
+  raw: string | null,
+  claudeProfilesRaw?: string | null
+): PiProfileInput[] {
+  if (!raw) return [];
+
+  let inputs: unknown;
+  try {
+    inputs = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `BRAIN_UI_PI_PROFILES is not valid JSON: ${
+        err instanceof Error ? err.message : String(err)
+      }`
+    );
+  }
+  if (!Array.isArray(inputs)) {
+    throw new Error("BRAIN_UI_PI_PROFILES must be a JSON array.");
+  }
+
+  const claudeIds = new Set<string>();
+  if (claudeProfilesRaw) {
+    try {
+      const claudeInputs = JSON.parse(claudeProfilesRaw);
+      if (Array.isArray(claudeInputs)) {
+        for (const entry of claudeInputs) {
+          if (entry && typeof entry.id === "string") claudeIds.add(entry.id);
+        }
+      }
+    } catch {
+      // Malformed Claude JSON is the Claude loader's error to raise.
+    }
+  }
+
+  const seen = new Set<string>();
+  for (const input of inputs as PiProfileInput[]) {
+    if (!input || typeof input !== "object") {
+      throw new Error("Each BRAIN_UI_PI_PROFILES entry must be an object.");
+    }
+    for (const field of ["id", "label", "vendor", "model"] as const) {
+      if (typeof input[field] !== "string" || input[field].length === 0) {
+        throw new Error(
+          `Each BRAIN_UI_PI_PROFILES entry needs a non-empty string ${field}.`
+        );
+      }
+    }
+    if (input.id === "default" || /^claude(-|$)/.test(input.id)) {
+      throw new Error(
+        `BRAIN_UI_PI_PROFILES id "${input.id}" is reserved for the Claude ` +
+          "roster (built-in default and discovered claude-* aliases)."
+      );
+    }
+    if (claudeIds.has(input.id)) {
+      throw new Error(
+        `BRAIN_UI_PI_PROFILES id "${input.id}" collides with a ` +
+          "BRAIN_UI_CLAUDE_PROFILES entry."
+      );
+    }
+    if (seen.has(input.id)) {
+      throw new Error(`Duplicate profile id in BRAIN_UI_PI_PROFILES: "${input.id}".`);
+    }
+    seen.add(input.id);
+    if (
+      input.thinkingLevel !== undefined &&
+      !PI_THINKING_LEVELS.includes(input.thinkingLevel)
+    ) {
+      throw new Error(
+        `BRAIN_UI_PI_PROFILES entry "${input.id}" has invalid thinkingLevel ` +
+          `"${input.thinkingLevel}" (expected one of ${PI_THINKING_LEVELS.join(", ")}).`
+      );
+    }
+  }
+  return inputs as PiProfileInput[];
+}
+
 export function assertBackendResolvable(
   agent: AgentConfig,
   resolve: (specifier: string) => void = (specifier) => {
@@ -368,6 +502,23 @@ export function assertBackendResolvable(
   } catch {
     throw missingBackendError(key);
   }
+  // BRAIN_UI_PI_PROFILES opts the pi backend in ALONGSIDE the primary — its
+  // package must resolve at boot too, or the roster silently loses those
+  // profiles on first request instead of refusing to start.
+  if (agent.piProfilesJson && key !== "pi") {
+    try {
+      resolve(BACKEND_SPECIFIERS.pi);
+    } catch {
+      throw new Error(
+        'BRAIN_UI_PI_PROFILES is set but "@schlessera/brain-backend-pi" is not ' +
+          "installed. Add it (with its pi SDK dependencies) or unset the variable."
+      );
+    }
+  }
+  // Validate the pi roster itself at boot too — the registry is built lazily,
+  // so without this a malformed BRAIN_UI_PI_PROFILES would still report a
+  // healthy startup and only fail on first request.
+  parsePiProfiles(agent.piProfilesJson, agent.profilesJson);
 }
 
 export function createBackendRegistry(
@@ -387,21 +538,26 @@ export function createBackendRegistry(
    * before any profile can be listed or run.
    */
   const declaredApiProfileIds = new Set<string>();
-  /** The Claude backend's id, once built — profiles on any OTHER backend (pi) have no subscription path. */
+  /** The Claude backend's id, once built — Claude's subscription path only applies to its own profiles. */
   let claudeBackendId: string | null = null;
 
   /**
    * Base billing classification for one roster entry, BEFORE the settings
    * override (applied last by the shared accessor surface):
-   *   - a non-Claude backend (pi) → "api";
-   *   - a declared profile with explicit credentials → "api";
+   *   - a non-Claude backend profile → by VENDOR: pi's "openai-codex" runs
+   *     only against a ChatGPT-subscription OAuth credential (the provider
+   *     has no API-key path at all) → "subscription"; every other vendor
+   *     resolves ambient API keys → "api";
+   *   - a declared Claude profile with explicit credentials → "api";
    *   - everything ambient (built-in default, discovered models, declared
    *     entries without their own credentials) → the env-resolved ambient
    *     mode (subscription iff the OAuth token is present and no
    *     ANTHROPIC_API_KEY — the Agent SDK's own precedence).
    */
   function classifyBilling(profile: ProviderInfo & { backendId: string }): BillingMode {
-    if (claudeBackendId === null || profile.backendId !== claudeBackendId) return "api";
+    if (claudeBackendId === null || profile.backendId !== claudeBackendId) {
+      return profile.vendor === "openai-codex" ? "subscription" : "api";
+    }
     if (declaredApiProfileIds.has(profile.id)) return "api";
     return agent.ambientBilling;
   }
@@ -418,26 +574,54 @@ export function createBackendRegistry(
   let mergeCache: {
     declared: ClaudeProfile[];
     discovered: ClaudeProfileInput[];
+    customKey: string;
     result: ClaudeProfile[];
   } | null = null;
 
+  /**
+   * User-managed OpenRouter models (Settings → Models) as declared Claude
+   * profiles — same shape a BRAIN_UI_CLAUDE_PROFILES OpenRouter entry has,
+   * but editable at runtime without an env change or redeploy.
+   */
+  function customOpenRouterInputs(): ClaudeProfileInput[] {
+    const models = options.getCustomOpenRouterModels?.() ?? [];
+    return models.map((model) => ({
+      id: `openrouter:${model}`,
+      label: `${model} (OpenRouter)`,
+      vendor: "openrouter",
+      model,
+      baseUrl: "https://openrouter.ai/api",
+      authTokenEnv: "OPENROUTER_API_KEY",
+      modelAliases: true,
+      source: "declared" as const,
+    }));
+  }
+
   function mergeDiscovered(
     claude: ClaudeBackendModule,
     declared: ClaudeProfile[],
     discovered: ClaudeProfileInput[]
   ): ClaudeProfile[] {
+    const custom = customOpenRouterInputs();
+    const customKey = custom.map((profile) => profile.id).join("\n");
     if (
       mergeCache &&
       mergeCache.declared === declared &&
-      mergeCache.discovered === discovered
+      mergeCache.discovered === discovered &&
+      mergeCache.customKey === customKey
     ) {
       return mergeCache.result;
     }
 
     const declaredIds = new Set(declared.map((profile) => profile.id));
-    const extra = discovered.filter((input) => !declaredIds.has(input.id));
-    const result = [...declared, ...claude.defineProfiles(extra)];
-    mergeCache = { declared, discovered, result };
+    const customExtra = custom.filter((input) => !declaredIds.has(input.id));
+    // OpenRouter runs on its own key: always api-billed, like an env-declared
+    // profile with explicit credentials.
+    for (const input of customExtra) declaredApiProfileIds.add(input.id);
+    const knownIds = new Set([...declaredIds, ...customExtra.map((input) => input.id)]);
+    const extra = discovered.filter((input) => !knownIds.has(input.id));
+    const result = [...declared, ...claude.defineProfiles([...customExtra, ...extra])];
+    mergeCache = { declared, discovered, customKey, result };
     return result;
   }
 
@@ -515,6 +699,7 @@ export function createBackendRegistry(
     return [...base, ...claude.defineProfiles(declared)];
   }
 
+
   /**
    * NEITHER backend package is a hard dependency — a deployment installs the
    * one its AGENT_BACKEND names (both, if it switches). Loaded lazily through
@@ -560,15 +745,23 @@ export function createBackendRegistry(
 
   async function buildPiBackend(): Promise<AgentBackend> {
     const mod = (await loadBackendModule("pi")) as {
-      createPiBackend?: (opts: { brainPath: string; log?: BackendLogFn }) => AgentBackend;
+      createPiBackend?: (opts: {
+        brainPath: string;
+        profiles?: PiProfileInput[];
+        log?: BackendLogFn;
+      }) => AgentBackend;
     };
     if (typeof mod.createPiBackend !== "function") {
       throw new Error(
         '"@schlessera/brain-backend-pi" does not export createPiBackend.'
       );
     }
+    // Re-parsed here (assertBackendResolvable already validated at boot) so an
+    // injected-registry path without the boot assert still fails loudly.
+    const profiles = parsePiProfiles(agent.piProfilesJson, agent.profilesJson);
     return mod.createPiBackend({
       brainPath,
+      ...(profiles.length > 0 ? { profiles } : {}),
       ...(backendLog ? { log: backendLog } : {}),
     });
   }
@@ -583,6 +776,14 @@ export function createBackendRegistry(
 
     const backends = [await buildClaudeBackend()];
 
+    // BRAIN_UI_PI_PROFILES opts the pi backend in ALONGSIDE claude: its
+    // profiles join the picker (e.g. OpenAI models under a ChatGPT
+    // subscription via pi's "openai-codex" vendor) while claude stays the
+    // default backend. Without the variable, behavior is unchanged.
+    if (agent.piProfilesJson) {
+      backends.push(await buildPiBackend());
+    }
+
     // AGENT_BACKEND must name a configured backend. The in-process options are
     // "claude" (default) and "pi" (handled above). An unrecognized value is a
     // misconfiguration — fail loudly instead of silently coercing to claude and
@@ -598,6 +799,33 @@ export function createBackendRegistry(
     return cachedRegistry;
   }
 
+  /**
+   * Whether the openai-codex (ChatGPT subscription) account is connected —
+   * a cheap file probe through the pi package, memoized briefly so provider
+   * listings and turn routing don't re-read the auth store on every call.
+   */
+  let codexCredentialCache: { at: number; value: boolean } | null = null;
+  async function hasCodexCredential(): Promise<boolean> {
+    const piInPlay = Boolean(agent.piProfilesJson) || (agent.backend || "claude") === "pi";
+    if (!piInPlay) return false;
+    if (codexCredentialCache && Date.now() - codexCredentialCache.at < PROFILE_MEMO_MS) {
+      return codexCredentialCache.value;
+    }
+    let value = false;
+    try {
+      const mod = (await loadBackendModule("pi")) as {
+        hasStoredCredential?: (providerId: string) => boolean;
+      };
+      value =
+        typeof mod.hasStoredCredential === "function" &&
+        mod.hasStoredCredential("openai-codex");
+    } catch {
+      value = false;
+    }
+    codexCredentialCache = { at: Date.now(), value };
+    return value;
+  }
+
   return makeRegistry(
     getRegistry,
     getHidden,
@@ -611,6 +839,10 @@ export function createBackendRegistry(
       ...(options.getBillingOverrides
         ? { getOverrides: options.getBillingOverrides }
         : {}),
+    },
+    {
+      ...(options.getDefaultModelId ? { getOverride: options.getDefaultModelId } : {}),
+      auto: { vendor: "openai-codex", hasCredential: hasCodexCredential },
     }
   );
 }
@@ -626,6 +858,7 @@ export function createStaticBackendRegistry(
   defaultBackendId = backends[0]?.id ?? "",
   options: {
     getHiddenModelIds?: () => string[];
+    getDefaultModelId?: () => string | null;
     getBillingOverrides?: () => Record<string, BillingMode>;
     log?: Logger;
   } = {}
@@ -640,7 +873,9 @@ export function createStaticBackendRegistry(
     // registry could reason about, so only an explicit override sets a mode.
     options.getBillingOverrides
       ? { getOverrides: options.getBillingOverrides }
-      : {}
+      : {},
+    // No auto rule either — only the stored default applies here.
+    options.getDefaultModelId ? { getOverride: options.getDefaultModelId } : {}
   );
 }
 
@@ -655,6 +890,12 @@ function makeRegistry(
     classify?: (profile: ProviderInfo & { backendId: string }) => BillingMode;
     /** Settings overrides, consulted LAST — an override wins over `classify`. */
     getOverrides?: () => Record<string, BillingMode>;
+  } = {},
+  defaults: {
+    /** Settings-stored default profile id; null/absent = auto. */
+    getOverride?: () => string | null;
+    /** Auto rule: prefer this vendor's profile while its account is connected. */
+    auto?: { vendor: string; hasCredential: () => Promise<boolean> };
   } = {}
 ): BackendRegistry {
   let profileSnapshot: ProfileSnapshot | null = null;
@@ -715,6 +956,36 @@ function makeRegistry(
     }
   }
 
+  /**
+   * The preferred-default profile. The stored Settings override wins while it
+   * still names a roster profile (a vanished profile falls through to auto
+   * rather than pinning turns to nothing); auto is the first non-hidden
+   * roster entry of the auto vendor, but only while its credential exists.
+   * Any failure degrades to "no preference" — this must never take routing
+   * down.
+   */
+  async function getPreferredProfileId(): Promise<string | null> {
+    try {
+      const snapshot = await getProfileSnapshot();
+      const override = defaults.getOverride?.() ?? null;
+      if (override && snapshot.owners.has(override)) return override;
+
+      const auto = defaults.auto;
+      if (!auto) return null;
+      const registry = await getRegistry();
+      const hidden = hiddenIds();
+      for (const backend of registry.backends) {
+        const match = (snapshot.byBackend.get(backend.id) ?? []).find(
+          (profile) => profile.vendor === auto.vendor && !hidden.has(profile.id)
+        );
+        if (match) return (await auto.hasCredential()) ? match.id : null;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
   return {
     async getBackends() {
       return (await getRegistry()).backends;
@@ -759,7 +1030,7 @@ function makeRegistry(
       // saved override is live for the very next run without invalidation.
       const overrides = billingOverrides();
 
-      return registry.backends.flatMap((backend) =>
+      const providers = registry.backends.flatMap((backend) =>
         (snapshot.byBackend.get(backend.id) ?? [])
           .filter((profile) => !hidden.has(profile.id))
           .map((profile) => {
@@ -768,8 +1039,19 @@ function makeRegistry(
             return billingMode ? { ...entry, billingMode } : entry;
           })
       );
+
+      // A connected subscription-auth profile leads the list: a fresh client
+      // with no stored selection defaults to providers[0].
+      const preferredId = await getPreferredProfileId();
+      if (preferredId) {
+        const index = providers.findIndex((provider) => provider.id === preferredId);
+        if (index > 0) providers.unshift(...providers.splice(index, 1));
+      }
+      return providers;
     },
 
+    getPreferredProfileId,
+
     async getBackendsInfo() {
       const backends = (await getRegistry()).backends;
       return Object.fromEntries(

package/src/app.ts

@@ -15,6 +15,7 @@ import { createShareRoutes, shareTargetFallbackRoutes } from "./routes/share.js"
 import { createRenderRoutes, type AppRenderer } from "./routes/render.js";
 import { createProviderRoutes } from "./routes/providers.js";
 import { createModelRoutes } from "./routes/models.js";
+import { createPiAuthRoutes } from "./routes/pi-auth.js";
 import { createGraphRoutes } from "./routes/graph.js";
 import {
   resolveAuthMode,
@@ -33,7 +34,12 @@ import {
   type PasskeyContext,
 } from "./middleware/passkeys.js";
 import { createUiDb } from "./db/client.js";
-import { getBillingOverrides, getHiddenModelIds } from "./db/settings.js";
+import {
+  getBillingOverrides,
+  getCustomOpenRouterModels,
+  getDefaultModelId,
+  getHiddenModelIds,
+} from "./db/settings.js";
 import { createActivityRuntime } from "./activity/runtime.js";
 import { createModelPricing } from "./pricing/model-pricing.js";
 import { createPushRoutes } from "./routes/push.js";
@@ -199,6 +205,8 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
       brainPath: config.brainPath,
       agent: config.agent,
       getHiddenModelIds: () => getHiddenModelIds(db, dbLog),
+      getDefaultModelId: () => getDefaultModelId(db, dbLog),
+      getCustomOpenRouterModels: () => getCustomOpenRouterModels(db, dbLog),
       getBillingOverrides: () => getBillingOverrides(db, dbLog),
       log: observability.logger("agent"),
     });
@@ -344,6 +352,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     "/api",
     createModelRoutes({ registry, db, pricing, log: observability.logger("models") })
   );
+  app.route("/api", createPiAuthRoutes({ agent: config.agent }));
   app.route(
     "/api",
     createGraphRoutes({ brainRoot: config.brainPath, log: observability.logger("graph") })

package/src/config/env.ts

@@ -259,6 +259,16 @@ export const ENV_VARS: readonly EnvVarDescriptor[] = [
     default: "(none)",
     required: false,
   },
+  {
+    name: "BRAIN_UI_PI_PROFILES",
+    description:
+      "JSON array of pi-backend model profiles ({id,label,vendor,model,thinkingLevel?}). " +
+      "When set (and AGENT_BACKEND is claude), the pi backend runs ALONGSIDE " +
+      "the Claude backend and these profiles join the picker — e.g. OpenAI " +
+      'models under a ChatGPT subscription via vendor "openai-codex".',
+    default: "(none)",
+    required: false,
+  },
   {
     name: "CLAUDE_CODE_OAUTH_TOKEN",
     description:
@@ -379,6 +389,12 @@ export interface AgentConfig {
   defaultModel: string;
   /** Raw BRAIN_UI_CLAUDE_PROFILES JSON, parsed lazily by the registry. */
   profilesJson: string | null;
+  /**
+   * Raw BRAIN_UI_PI_PROFILES JSON, parsed by the registry. When set, the pi
+   * backend runs alongside the Claude backend and these profiles join the
+   * picker.
+   */
+  piProfilesJson: string | null;
   modelDiscovery: boolean;
   modelTtlMs: number;
   /**
@@ -575,6 +591,7 @@ export function resolveServerConfig(env: EnvRecord = process.env): ServerConfig
       claudeCodePath: env.CLAUDE_CODE_PATH || "/usr/local/bin/claude",
       defaultModel: env.BRAIN_UI_CLAUDE_DEFAULT_MODEL?.trim() || "claude-sonnet-4-6",
       profilesJson: env.BRAIN_UI_CLAUDE_PROFILES?.trim() || null,
+      piProfilesJson: env.BRAIN_UI_PI_PROFILES?.trim() || null,
       modelDiscovery,
       modelTtlMs: ttlHours * 60 * 60 * 1000,
       ambientBilling: resolveAmbientBillingMode(env),

package/src/db/settings.ts

@@ -12,6 +12,8 @@ import { isBillingMode, type BillingMode } from "@schlessera/brain-ui-sdk/protoc
 
 const HIDDEN_MODELS_KEY = "models.hidden";
 const BILLING_OVERRIDES_KEY = "models.billing";
+const DEFAULT_MODEL_KEY = "models.default";
+const CUSTOM_OPENROUTER_KEY = "models.customOpenRouter";
 const DETAIL_RETENTION_KEY = "activity.retention.detailDays";
 const DETAIL_RETENTION_DEFAULT_DAYS = 7;
 
@@ -89,6 +91,34 @@ export function setBillingOverrides(
   setSetting(db, BILLING_OVERRIDES_KEY, clean);
 }
 
+/**
+ * The user's chosen default model profile, used when a turn names none (new
+ * conversations from a fresh client, shares, host-initiated actions). Null =
+ * auto (a connected subscription-auth profile, else the default backend's
+ * own default).
+ */
+export function getDefaultModelId(db: Database, log?: Logger): string | null {
+  const value = getSetting<unknown>(db, DEFAULT_MODEL_KEY, null, log);
+  return typeof value === "string" && value ? value : null;
+}
+
+export function setDefaultModelId(db: Database, id: string | null): void {
+  setSetting(db, DEFAULT_MODEL_KEY, id);
+}
+
+/** User-managed OpenRouter model ids (e.g. "z.ai/glm-5.3-flash"). */
+export function getCustomOpenRouterModels(db: Database, log?: Logger): string[] {
+  const value = getSetting<unknown>(db, CUSTOM_OPENROUTER_KEY, [], log);
+  if (!Array.isArray(value)) return [];
+  return value.filter((id): id is string => typeof id === "string" && id.length > 0);
+}
+
+/** Replace the custom OpenRouter list (full list, not a delta). */
+export function setCustomOpenRouterModels(db: Database, models: string[]): void {
+  const unique = [...new Set(models.filter((id) => typeof id === "string" && id))];
+  setSetting(db, CUSTOM_OPENROUTER_KEY, unique);
+}
+
 /** Minimum days a finished run keeps its detail (spans/events) before the
  *  digest-covered prune may take it. 0 is valid (prune as soon as covered);
  *  anything non-numeric or negative degrades to the default. */