arisa 5.2.17 → 5.2.19

package/README.md

@@ -127,8 +127,10 @@ Slave runs only the IPC host, daemon supervisor and installed tools. Connections
 are authenticated, encrypted, initiated by Slave and restricted by per-Slave
 roots and capability grants.
 
-Linux with systemd is the first supported Slave target. Bootstrap uses a
-single-use URL issued by Master:
+Arisa Slave supports Linux with systemd, macOS with launchd, and Windows with
+Task Scheduler. On desktop systems, run bootstrap as the normal user so the
+persistent background task retains access to that user's browser profile.
+Bootstrap uses a single-use URL issued by Master:
 
 ```bash
 npm i -g arisa && arisa slave tcp://198.51.100.12:4719/arisa_secret_v1_<secret>

package/package.json

@@ -1,12 +1,17 @@
 {
   "name": "arisa",
-  "version": "5.2.17",
+  "version": "5.2.19",
   "description": "Telegram + Pi Agent modular assistant",
   "type": "module",
   "main": "src/index.js",
   "bin": {
     "arisa": "bin/arisa.js"
   },
+  "scripts": {
+    "start": "node src/index.js",
+    "bootstrap": "node src/index.js --bootstrap",
+    "test": "node --test"
+  },
   "keywords": [
     "telegram",
     "pi-agent",
@@ -29,7 +34,7 @@
   "author": "Martin Clasen",
   "license": "MIT",
   "engines": {
-    "node": ">=22.8.0"
+    "node": ">=22.19.0"
   },
   "repository": {
     "type": "git",
@@ -39,14 +44,10 @@
     "url": "https://github.com/clasen/Arisa/issues"
   },
   "homepage": "https://arisa.sh",
+  "packageManager": "pnpm@11.3.0+sha512.2c403d6594527287672b1f7056343a1f7c3634036a67ffabfcc2b3d7595d843768f8787148d1b57cf7956c90606bbd192857c363af19e96d2d0ec9ec5741d215",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.80.6",
+    "@earendil-works/pi-coding-agent": "0.85.1",
     "@sinclair/typebox": "^0.34.41",
     "grammy": "^1.42.0"
-  },
-  "scripts": {
-    "start": "node src/index.js",
-    "bootstrap": "node src/index.js --bootstrap",
-    "test": "node --test"
   }
-}
+}

package/pnpm-workspace.yaml

@@ -1,11 +1,13 @@
 allowBuilds:
   '@google/genai': false
+  esbuild: true
 
 minimumReleaseAgeExclude:
-  - '@earendil-works/pi-agent-core@0.80.6'
-  - '@earendil-works/pi-ai@0.80.6'
-  - '@earendil-works/pi-coding-agent@0.80.6'
-  - '@earendil-works/pi-tui@0.80.6'
+  - '@earendil-works/pi-agent-core@0.85.1'
+  - '@earendil-works/pi-ai@0.85.1'
+  - '@earendil-works/pi-coding-agent@0.85.1'
+  - '@earendil-works/pi-tui@0.85.1'
+  - '@earendil-works/chord@0.85.1'
 
 overrides:
   'node-fetch@2.7.0>whatwg-url': '13.0.0'
@@ -14,7 +16,7 @@ overrides:
   basic-ftp@<=5.2.2: '>=5.3.0'
   basic-ftp@<=5.3.0: '>=5.3.1'
   basic-ftp@=5.2.0: '>=5.2.1'
-  brace-expansion@>=5.0.0 <5.0.6: '>=5.0.6'
+  brace-expansion@>=4.0.0 <5.0.9: '5.0.9'
   ip-address@<=10.1.0: '>=10.1.1'
   protobufjs@<7.5.5: '>=7.5.5'
   protobufjs@<=7.5.5: '>=7.5.6'

package/src/core/agent/agent-manager.js

@@ -323,22 +323,21 @@ export class AgentManager {
 
   async validatePiAgent(config = this.config) {
     this.logger?.log("agent", "validating Pi session");
-    const { authStorage, modelRegistry } = createPiRuntime({
+    const modelRuntime = await createPiRuntime({
       provider: config.pi.provider,
       apiKey: config.pi.apiKey
     });
-    const model = modelRegistry.find(config.pi.provider, config.pi.model);
+    const model = modelRuntime.getModel(config.pi.provider, config.pi.model);
     if (!model) {
       throw new Error(`Model not found: ${config.pi.provider}/${config.pi.model}`);
     }
-    if (requiresProviderAuth(model) && !config.pi.apiKey && !hasProviderAuth(config.pi.provider, { authStorage, modelRegistry })) {
+    if (requiresProviderAuth(model) && !config.pi.apiKey && !hasProviderAuth(config.pi.provider, modelRuntime)) {
       throw new Error(`No auth found for ${config.pi.provider}. Provide a Pi API key in bootstrap, or authenticate with Pi login for this provider during bootstrap.`);
     }
 
     const settingsManager = createPiSettingsManager(config);
     const { session } = await createAgentSession({
-      authStorage,
-      modelRegistry,
+      modelRuntime,
       model,
       settingsManager,
       sessionManager: SessionManager.inMemory()
@@ -386,13 +385,13 @@ export class AgentManager {
       this.pendingNewSessions.add(sessionKey);
     }
 
-    const { authStorage, modelRegistry } = createPiRuntime({
+    const modelRuntime = await createPiRuntime({
       provider: this.config.pi.provider,
       apiKey: this.config.pi.apiKey
     });
-    const model = modelRegistry.find(this.config.pi.provider, effectiveModelId);
+    const model = modelRuntime.getModel(this.config.pi.provider, effectiveModelId);
     if (!model) throw new Error(`Model not found: ${this.config.pi.provider}/${effectiveModelId}`);
-    if (requiresProviderAuth(model) && !this.config.pi.apiKey && !hasProviderAuth(this.config.pi.provider, { authStorage, modelRegistry })) {
+    if (requiresProviderAuth(model) && !this.config.pi.apiKey && !hasProviderAuth(this.config.pi.provider, modelRuntime)) {
       throw new Error(`No auth found for ${this.config.pi.provider}. Re-run bootstrap and complete login for this provider before Telegram starts.`);
     }
     const thinkingLevel = clampModelThinkingLevel(model, modelSelection.thinkingLevel);
@@ -418,7 +417,8 @@ export class AgentManager {
       initializeForumTopic: (...args) => telegramTarget.current.initializeForumTopic(...args),
       prepareRestartReceipt: (...args) => telegramTarget.current.prepareRestartReceipt(...args),
       cancelRestartReceipt: (...args) => telegramTarget.current.cancelRestartReceipt(...args),
-      getTaskContext: (...args) => telegramTarget.current.getTaskContext?.(...args) || null
+      getTaskContext: (...args) => telegramTarget.current.getTaskContext?.(...args) || null,
+      getAgentTaskExecution: (...args) => telegramTarget.current.getAgentTaskExecution?.(...args) || null
     };
     const assertAccess = () => accessGuardTarget.current();
     const customTools = guardTools([
@@ -440,8 +440,7 @@ export class AgentManager {
       cwd: policy.workspaceDir,
       agentDir: arisaHomeDir,
       resourceLoader,
-      authStorage,
-      modelRegistry,
+      modelRuntime,
       model,
       thinkingLevel,
       tools: policy.tools,
@@ -450,8 +449,8 @@ export class AgentManager {
       settingsManager,
       sessionManager
     });
-    const speedController = createModelSpeedController(session.agent.streamFn, speed);
-    session.agent.streamFn = speedController.streamFn;
+    const speedController = createModelSpeedController(session.agent.streamFunction, speed);
+    session.agent.streamFunction = speedController.streamFn;
 
     if (!hasExistingSession) {
       this.logger?.log("agent", `created new session for chat ${sessionKey}`);
@@ -479,7 +478,7 @@ export class AgentManager {
 
   async getAvailableModels(chatId) {
     const { listProviderModels } = await import("./pi-runtime.js");
-    const runtime = createPiRuntime({ provider: this.config.pi.provider, apiKey: this.config.pi.apiKey });
+    const runtime = await createPiRuntime({ provider: this.config.pi.provider, apiKey: this.config.pi.apiKey });
     return listProviderModels(this.config.pi.provider, runtime);
   }
 

package/src/core/agent/auth-flow.js

@@ -33,8 +33,8 @@ export function getPiAuthIssue(error) {
   return null;
 }
 
-export function getPiAuthStatus(config, chatId = null) {
-  const runtime = createPiRuntime({
+export async function getPiAuthStatus(config, chatId = null) {
+  const runtime = await createPiRuntime({
     provider: config.pi.provider,
     apiKey: config.pi.apiKey
   });
@@ -51,8 +51,8 @@ export function getPiAuthStatus(config, chatId = null) {
   };
 }
 
-export function buildPiAuthTelegramMessage({ config, chatId = null, issue = null, verified = false }) {
-  const status = getPiAuthStatus(config, chatId);
+export async function buildPiAuthTelegramMessage({ config, chatId = null, issue = null, verified = false }) {
+  const status = await getPiAuthStatus(config, chatId);
   let title = `Pi authentication status for ${status.provider}/${status.model}.`;
   if (issue) {
     title = `Pi authentication needs attention for ${status.provider}/${status.model}.`;
@@ -95,8 +95,8 @@ export function buildPiAuthTelegramMessage({ config, chatId = null, issue = null
   return lines.join("\n");
 }
 
-export function buildPiAuthRecoveryBlockedMessage({ config, chatId = null, issue = null, renewalActive = false }) {
-  const status = getPiAuthStatus(config, chatId);
+export async function buildPiAuthRecoveryBlockedMessage({ config, chatId = null, issue = null, renewalActive = false }) {
+  const status = await getPiAuthStatus(config, chatId);
   const lines = [
     `Pi authentication is not ready for ${status.provider}/${status.model}.`,
     "I did not send your message to the agent."

package/src/core/agent/model-speed.js

@@ -1,4 +1,4 @@
-export const MODEL_SPEEDS = Object.freeze([1, 1.5]);
+export const MODEL_SPEEDS = Object.freeze([1, 1.5]);
 
 export function normalizeModelSpeed(speed) {
   const value = Number(speed);
@@ -17,6 +17,7 @@ export function modelSupportsSpeed(model) {
       || model.id === "gpt-5.5"
       || model.id === "gpt-5.6"
       || model.id.startsWith("gpt-5.6-")
+      || model.id === "gpt-6-astra"
     );
 }
 
@@ -40,6 +41,7 @@ export function createModelSpeedController(streamFn, initialSpeed) {
       speed = normalizeModelSpeed(nextSpeed);
     },
     streamFn(model, context, options) {
+      if (!modelSupportsSpeed(model)) return streamFn(model, context, options);
       const serviceTier = speedToServiceTier(speed);
       const onPayload = options?.onPayload;
       return streamFn(model, context, {

package/src/core/agent/pi-auth-login.js

@@ -1,13 +1,6 @@
-import { AuthStorage } from "@earendil-works/pi-coding-agent";
-import { piAuthFile } from "../../platform/paths.js";
+import { createPiRuntime, supportsProviderOAuth } from "./pi-runtime.js";
 
 export function createPiOAuthLogin({ provider, onAuth, onDeviceCode, onPrompt, onProgress, onSelect } = {}) {
-  const authStorage = AuthStorage.create(piAuthFile);
-  const oauthProvider = authStorage.getOAuthProviders().find((item) => item.id === provider);
-  if (!oauthProvider) {
-    throw new Error(`No internal OAuth login flow is available for ${provider}.`);
-  }
-
   let resolveManualCode;
   const manualCodePromise = new Promise((resolve) => {
     resolveManualCode = resolve;
@@ -15,7 +8,6 @@ export function createPiOAuthLogin({ provider, onAuth, onDeviceCode, onPrompt, o
 
   const controller = {
     provider,
-    oauthProvider,
     manualInputRequested: false,
     submitManualCode(value) {
       if (!resolveManualCode) return false;
@@ -31,25 +23,33 @@ export function createPiOAuthLogin({ provider, onAuth, onDeviceCode, onPrompt, o
     promise: null
   };
 
-  controller.promise = authStorage.login(provider, {
-    onAuth: async (params) => {
-      await onAuth?.({ ...params, controller });
-    },
-    onDeviceCode: async (params) => {
-      await onDeviceCode?.({ ...params, controller });
-    },
-    onPrompt: async (params) => {
-      if (!onPrompt) return "";
-      return onPrompt({ ...params, controller });
-    },
-    onProgress: (message) => {
-      onProgress?.(message);
-    },
-    onSelect: async (params) => {
-      if (!onSelect) return params.options?.[0]?.id;
-      return onSelect({ ...params, controller });
-    },
-    onManualCodeInput: () => controller.waitForManualCode()
+  controller.promise = createPiRuntime().then(async (runtime) => {
+    if (!supportsProviderOAuth(provider, runtime)) {
+      throw new Error(`No internal OAuth login flow is available for ${provider}.`);
+    }
+    let notifications = Promise.resolve();
+    let notificationError;
+    const credential = await runtime.login(provider, "oauth", {
+      notify(event) {
+        notifications = notifications.then(async () => {
+          if (event.type === "auth_url") await onAuth?.({ ...event, controller });
+          else if (event.type === "device_code") await onDeviceCode?.({ ...event, controller });
+          else await onProgress?.(event.message);
+        }).catch((error) => { notificationError = error; });
+      },
+      async prompt(params) {
+        await notifications;
+        if (notificationError) throw notificationError;
+        if (params.type === "select") {
+          return onSelect ? onSelect({ ...params, controller }) : params.options?.[0]?.id;
+        }
+        if (params.type === "manual_code") return controller.waitForManualCode();
+        return onPrompt ? onPrompt({ ...params, controller }) : "";
+      }
+    });
+    await notifications;
+    if (notificationError) throw notificationError;
+    return credential;
   }).finally(() => {
     controller.submitManualCode("");
   });

package/src/core/agent/pi-capability-tools.js

@@ -47,6 +47,7 @@ export function createPiCapabilityTools({ capabilityService, telegram, chatId, p
     context: {
       ...baseContext,
       taskContext: telegram.getTaskContext(),
+      agentTaskExecution: telegram.getAgentTaskExecution?.() || null,
       ...context
     }
   });

package/src/core/agent/pi-runtime.js

@@ -1,34 +1,29 @@
-import { AuthStorage, ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 import { piAuthFile } from "../../platform/paths.js";
 
 function compareText(a, b) {
   return a.localeCompare(b, undefined, { sensitivity: "base", numeric: true });
 }
 
-export function createPiRuntime({ provider, apiKey } = {}) {
-  const authStorage = AuthStorage.create(piAuthFile);
+export async function createPiRuntime({ provider, apiKey } = {}) {
+  const runtime = await ModelRuntime.create({ authPath: piAuthFile });
   if (provider && apiKey) {
-    authStorage.setRuntimeApiKey(provider, apiKey);
+    await runtime.setRuntimeApiKey(provider, apiKey);
   }
-  const modelRegistry = ModelRegistry.create(authStorage);
-  const oauthProviders = authStorage.getOAuthProviders();
-  return { authStorage, modelRegistry, oauthProviders };
+  return runtime;
 }
 
-export function hasProviderAuth(provider, { authStorage, modelRegistry }) {
-  return modelRegistry.hasConfiguredAuth(provider) || authStorage.hasAuth(provider);
+export function hasProviderAuth(provider, runtime) {
+  return runtime.getProviderAuthStatus(provider).configured;
 }
 
-export function supportsProviderOAuth(provider, { oauthProviders }) {
-  return oauthProviders.some((item) => item.id === provider);
+export function supportsProviderOAuth(provider, runtime) {
+  return Boolean(runtime.getProvider(provider)?.auth.oauth);
 }
 
-export function listPiProviders(runtime = createPiRuntime()) {
-  const { modelRegistry, oauthProviders } = runtime;
-  const allModels = modelRegistry.getAll();
-  const oauthIds = new Set(oauthProviders.map((item) => item.id));
+export function listPiProviders(runtime) {
   const counts = new Map();
-  for (const model of allModels) {
+  for (const model of runtime.getModels()) {
     counts.set(model.provider, (counts.get(model.provider) || 0) + 1);
   }
 
@@ -36,7 +31,7 @@ export function listPiProviders(runtime = createPiRuntime()) {
     .map((provider) => ({
       provider,
       authConfigured: hasProviderAuth(provider, runtime),
-      supportsOAuth: oauthIds.has(provider),
+      supportsOAuth: supportsProviderOAuth(provider, runtime),
       modelCount: counts.get(provider) || 0
     }))
     .sort((a, b) => {
@@ -46,10 +41,8 @@ export function listPiProviders(runtime = createPiRuntime()) {
     });
 }
 
-export function listProviderModels(provider, runtime = createPiRuntime()) {
-  return runtime.modelRegistry
-    .getAll()
-    .filter((model) => model.provider === provider)
+export function listProviderModels(provider, runtime) {
+  return [...runtime.getModels(provider)]
     .sort((a, b) => compareText(a.name || a.id, b.name || b.id));
 }
 

package/src/core/capabilities/capability-service.js

@@ -48,6 +48,17 @@ function normalizeAcknowledgement(value) {
   return acknowledgement;
 }
 
+function recordAgentTaskAuthBlock(execution, toolName, result) {
+  if (!execution || execution.blockedAuth || result?.ok !== false || result?.status !== "blocked_auth") return;
+  execution.blockedAuth = {
+    toolName,
+    error: String(result.error || `${toolName} authentication is required`).slice(0, 1_000),
+    resolution: result.resolution && typeof result.resolution === "object"
+      ? structuredClone(result.resolution)
+      : {}
+  };
+}
+
 function inferDeliveryMethod(artifact) {
   if (artifact.kind === "audio" || (artifact.mimeType || "").startsWith("audio/")) return "audio";
   if (artifact.kind === "image" || (artifact.mimeType || "").startsWith("image/")) return "photo";
@@ -178,6 +189,19 @@ export function createCapabilityService({
       if (!toolExecutor?.runTool) throw new Error("tools.run requires toolExecutor");
       const scopedChatId = requireChatId(chatId, method);
       const targetToolName = requireString(params.name, "name");
+      const blocked = context.agentTaskExecution?.blockedAuth;
+      if (blocked) {
+        return {
+          ok: false,
+          status: "blocked_prerequisite",
+          error: `Authentication for ${blocked.toolName} is blocking this scheduled task.`,
+          resolution: {
+            type: "blocked_prerequisite",
+            prerequisiteStatus: "blocked_auth",
+            toolName: blocked.toolName
+          }
+        };
+      }
       const chatArtifactStore = artifactStore.forChat(scopedChatId);
       const artifact = params.artifactId
         ? await chatArtifactStore.get(requireString(params.artifactId, "artifactId"))
@@ -197,6 +221,7 @@ export function createCapabilityService({
         chatId: scopedChatId,
         taskContext: context.taskContext || null
       });
+      recordAgentTaskAuthBlock(context.agentTaskExecution, targetToolName, result);
       if (params.deliver && result.output?.artifactId) {
         const generated = await chatArtifactStore.get(result.output.artifactId);
         if (generated?.path) {

package/src/core/tasks/task-store.js

@@ -177,7 +177,8 @@ function normalizeAuthResolution(resolution = {}) {
     ? structuredClone(value.probeArgs)
     : {};
   if (JSON.stringify(probeArgs).length > 4_096) throw new Error("Authentication probe arguments are too large");
-  return { retryAfterSeconds, probeArgs };
+  const toolName = typeof value.toolName === "string" ? value.toolName.trim().slice(0, 128) : "";
+  return { retryAfterSeconds, probeArgs, ...(toolName ? { toolName } : {}) };
 }
 
 function failTask(task, error) {

package/src/official-tools.lock.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "repository": "https://github.com/clasen/Arisa.git",
-  "commit": "84b8728dea97871bccc5f9f3c96bbdd876e3766e",
+  "commit": "2256f9e19f26f23826b9a9062d3a9643b511bb3c",
   "tools": {
     "audio-extractor": {
       "version": null,
@@ -13,10 +13,11 @@
       }
     },
     "browser-session-bridge": {
-      "version": "0.2.3",
+      "version": "0.2.5",
       "files": {
-        "bridge-server.js": "7fb628cba4d68fad99ae4dfdc5fab1afa904656a15f336878611ce504e0b89bf",
-        "chrome-web-store.js": "f7a58df8c3a68335e78f965ebbd6d64ed60d7c78dab255cc9200735b9a2722e7",
+        "README.md": "79cb347ead539309429eca19ba6e9c472e4790ec1ab39a20bba71a4149f61f15",
+        "bridge-server.js": "03722a2657ba74bf34de9cae683b8f23242657da87c05771dd413a38fb446eca",
+        "chrome-web-store.js": "4b588d1288dee754c5d8afd609b8c1f67f73d23de7dda247b7a2ff8b68f7ef60",
         "config.js": "45c8e9e9a159b9125d6ea3458c616926c2ba2b5327fdfd750aa05316d3ce5af8",
         "extension/icons/icon-128.png": "a55af49bb570bd5471fc0a2e15a6bcaf3f76a2c5e7439f16bb1829682b343380",
         "extension/icons/icon-16.png": "a4aedb49e2227222a68dc56455812a9e17938fd197b1f30268f02d6c9f7bf95e",
@@ -31,24 +32,26 @@
         "extension/site-permissions.js": "83f9aa4d0295318fc730bd561c2db9d1aacf36152319090e99d12f62deea11ad",
         "index.js": "c01a6b825da4587a550ecec560a558cc6736200e73b6831f5919000c7b81679d",
         "lightpanda-session.js": "57c713dafac531617d7285122b2098c1e0b2f334e43144632f2b1fc79405f789",
-        "package-lock.json": "db39f00e7849631f93050d93670c47797e5d0732330cc0f496c3014c426a94ed",
-        "package.json": "7ea065a7ace16cc51ffd18a07924e42d4cf92be01e43c37f1620bff756f43283",
-        "README.md": "79cb347ead539309429eca19ba6e9c472e4790ec1ab39a20bba71a4149f61f15",
+        "package-lock.json": "b97f5a333df234fecde788d0f90b620d39e02fee6079c1b4347baaabd8010b1b",
+        "package.json": "5c9edd6155b6b4868cc87d474e808dfc23567bc312e0d1e0230d8f9f0a1cc081",
         "session-browser.js": "7af716a1c0d6793b82ebbaaf64ec3e8f73dfc52b3c9aceef2179d2d859e32a9c",
         "session-redaction.js": "c2393023c1d3b7634432606ad82a96d79c1f093d9b0a6440d955d0ae419c8393",
         "session-selection.js": "da5a4f55ccc8ba22791840943288e7aecacd730425c03f05c2bc10fd6a14341f",
-        "session-store.js": "82562ab625f2e72d1b33ea6e59f0e71f3de10fbfedb42b7099e9b1f2e23086be",
-        "test/device-enrollment.test.js": "53f9da425e506de265199a467ff16834fce9441b5482a0c99c7a5170cfd3e91d",
+        "session-store.js": "ee85e5b9696e542bb535a996743ddbbd2093fc66e18873a2f1c7a27707a83994",
+        "test/device-enrollment.test.js": "a4246f4cb19e959ef4b8a83f60664887b624526b0e5646e5ec1fdb93750082b0",
         "test/lightpanda-session.test.js": "1fa6c1693a5008c173ec6c5c97effe001b68c535c7a3d4530500c0c4b691c532",
         "test/onboarding-state.test.js": "889f7746bbdb51320e68447560459d2a5d812e4b135de08a7b6e94ef5a142250",
         "test/session-redaction.test.js": "e45b5cbd19eea7996d57141b5185c3a6e4c79989e4cb7253272fc66cd2cbd719",
-        "test/session-refresh.test.js": "c619a3790d0f1ba9c6fcbd4509d96c43ee0d8c5a292382ffaf744defdc9c5cac",
+        "test/session-refresh.test.js": "ffa688433185c08696761f189df244ed9ac212731b012a3eb9a91da05b43dd56",
         "test/session-selection.test.js": "ee1a15d42b156403d46d789a3ecf0a9c8f0019a00ab908276297d031243a89f5",
         "test/session-send-state.test.js": "c8ccbdf0863c5de85f784e7e32436591fe2db16a2ef4c554f671c6352736d5b6",
         "test/site-permissions.test.js": "27c297475c38ee1cbe7c7df210c767c157e03ecd379cde99a1b502268bda56ab",
-        "tool.manifest.json": "286bfce2e0770bf1f51decedcf974664cd184e1c146c4fdeb40500e346aa7856",
+        "tool.manifest.json": "820f6060f077b95c286168f175e5521bc67b043425cae69c5be40834d5016454",
         "web-store/listing.md": "3e6d7aab1f60142984c3f8c18d92bf23646dc901644c6b71bdb979802bcf320c",
-        "web-store/privacy-policy.md": "3e92198fbf80196a044c1d58d83577d959e91136302f994e3ffe1327013ebda8"
+        "web-store/privacy-policy.md": "eaaaa6066b36ef56896321d62b6ac4596d62104a0591d4edceb8c6040c47fd5c"
+      },
+      "toolDependencies": {
+        "lightpanda-browser": "^0.11.5"
       }
     },
     "campaign-draft-runner": {
@@ -115,6 +118,7 @@
     "creator-scout": {
       "version": "1.4.0",
       "files": {
+        "README.md": "6895b2c0cc3a230ddf3f59f1c4670b12070464f8e742bfdf40a04120a7fefaea",
         "config.js": "bab728665650b986c0eaef8e1be1c259ec42b1f83df4217c9780f5468d3c7666",
         "index.js": "a544e5dbac9cb92e996c2b07690a18481a20b8b10c13c397412581ec9ac6bb04",
         "outcome-contract.js": "5685bd8fbe4fcb608ee43a0148201206283013c1a60855c974a928c1d312480a",
@@ -122,13 +126,16 @@
         "package.json": "19c61d77ec90fce64d1a3baa1acc5b29af23f7c0574964504bc69b19e38aa34f",
         "panda-results.js": "24a31263b4a03e2c2719d9c54be7b5c022b17fb7dcb249eed33b93882518145b",
         "panda-session.js": "69878ff01bfbf26afe4db0e2e6489b211e3aca100ba5353befefaea009636bb5",
-        "README.md": "6895b2c0cc3a230ddf3f59f1c4670b12070464f8e742bfdf40a04120a7fefaea",
         "reference-match.js": "5ceb71bfe57763258d89c60936bb7e5b3166b6aa7127f9d2f8da49f01298f46b",
         "test/outcome-contract.test.js": "dda85d1f56880b30d7fad3e8a27aacbb0808d91fc0addac6e0c38f9f0c4849bf",
         "test/panda-results.test.js": "b918d6341251822292fe3e375ab66694a0f71f3c7a24e91be263ee36e5f3e92c",
         "test/panda-session.test.js": "6cfa4e0543fab77c502c1103c60d8cb7d16040770e7aa5c034a47e0292de8521",
         "test/reference-match.test.js": "38572ee3756f4ff0b0c61942dda0a19c9d06697826051cf0924dd3c47fc99b67",
         "tool.manifest.json": "5368082b6808dc9b5966a46afcc6042cc82aabef0cd55ed65b4e783a4cb2579e"
+      },
+      "toolDependencies": {
+        "lightpanda-browser": "^0.11.4",
+        "browser-session-bridge": "^0.1.3"
       }
     },
     "file-document": {
@@ -177,27 +184,27 @@
     "lightpanda-browser": {
       "version": "0.11.5",
       "files": {
+        "BENCHMARK.md": "9c732c65f6d8bceb4e73c1a03d298d5140d919f50269f982bd0ec6c1b21fa8b6",
+        "COMPATIBILITY-MIGRATION.md": "230e12e8ddac837b7772519693e530c43d2158b69c671036bf246fb3a9e35561",
+        "LIMITS.md": "6c0ec9624c76de8ddf09b82a4da1dba1b89a48a1f0e71a083ffbcf7a3d5401fb",
+        "README.md": "c79a9a24d2fe804a7ce3e160e8308b1ac0039461cbfd012347aaa61f841f5fed",
         "action-policy.js": "66c6ad39f65378ccf8ed54177f5a3665e23ef82818c30fb05d28cd58cba9b2ab",
         "authenticated-profile.js": "2bbb96c4d25a108c44256514c1c9b4e61e1f125e470ab35c5e02515216cd1b33",
         "benchmark-latest.json": "c5524e6d42479578579fd7db0e50857ff0831ca219e611b821ad1e0a4fade303",
         "benchmark-policy.js": "2c3763d7f327293c9d54ca24da9e65b94dc304af44908c1e196a4af45ed49a89",
-        "BENCHMARK.md": "9c732c65f6d8bceb4e73c1a03d298d5140d919f50269f982bd0ec6c1b21fa8b6",
         "binary.js": "accd3f1f536ae7ceee4dbfcee2de9ac56fc1ae343656238d62003233417257f1",
         "browser-operation.js": "51384d146d45fda8c672d3d6672fa223b715ad40c3c5b5878719e9df38151592",
         "capture.js": "b68b198d494c762822c6da079a556dd3463e681557f2abef1387d9cd41abaf4c",
-        "COMPATIBILITY-MIGRATION.md": "230e12e8ddac837b7772519693e530c43d2158b69c671036bf246fb3a9e35561",
         "config.js": "d08eb436df15540a53b02cf72e117c7fc8ead80195dbd53764a17598c9e565c5",
         "daemon-service.js": "10e70ed64f1fe8c7660044f6ce24e78d01da75a50322bfc08f42248c14ad5226",
         "index.js": "5fc54aec13fb27c6b55e20aed132853b79c44041f45ea4b0f4b47b00c205da16",
         "limit-suite-latest.json": "3d30f958d2d6c1e9dfcaf53e40a401ae288bf264a97ba6c3b64a25a08031feb0",
         "limit-suite-policy.js": "61440ee2e7f557ab2f3c74f8ef4ec2ec85fd2fb7fc53a4121e1f0d066670ea17",
-        "LIMITS.md": "6c0ec9624c76de8ddf09b82a4da1dba1b89a48a1f0e71a083ffbcf7a3d5401fb",
         "mcp-session.js": "cd4a1e6d3c9d80c399fda8f313d69e38fa22a9b24789d7919832a56df7dc90c2",
         "output-bounds.js": "08ab730d0d8722c5e0e761911a509653dd23d8eb4d8c2abf2d9c5e8432870bdd",
         "package-lock.json": "815dfdb89ce94b543e520955480e322438abd2b71fad4c4ddd699838b8622b65",
         "package.json": "934ae0f55d1baea305c28f12c0c9faccdd864244d899663c96f9083d96442841",
         "process-metrics.js": "e39d2980abb581ca0b917d0d33a1d71922ce49b679a7e96cf16a6a66b81d879a",
-        "README.md": "c79a9a24d2fe804a7ce3e160e8308b1ac0039461cbfd012347aaa61f841f5fed",
         "recipe-store.js": "358ac391ae86e0bfb82fc5b55bd08cfe3fd4fa56ac12a5ad4ad5abfa43c9a6c6",
         "scripts/benchmark.js": "f1bb939984460d84118317f9b4f811e0df80f590b0a441cd62a56eb97bb69b37",
         "scripts/install-lightpanda.js": "ba4a2f9e5ffae80b9375578731d68eff25997333cb9e3e443b155f7834948205",
@@ -255,6 +262,7 @@
     "master-slave": {
       "version": "0.1.9",
       "files": {
+        "README.md": "a75f87df7906fe143d2ecaddfe9263561db17436df7ec2c4a8d985e1e3e8996e",
         "batch-cancellation.js": "b9ca57dfcca4f1a672d5435536b7eb83547dba98ed3fd09f34376f1d995bb97f",
         "batch-runner.js": "97756a03b36278cd0315cc16da0c34a7821c322149c51ba6666f1c5081dbecbc",
         "chat-state-store.js": "50de39aa33432733bb688eb01968e314a32b169324a66d0f0089b2a19ed9c880",
@@ -271,7 +279,6 @@
         "master-domain.js": "10b7dfb43eb9939eb5baec54f742076cc73a2add6589a0ff57c51bc79c236faf",
         "network-session.js": "6ef332ef9694ff211f4aed1e8b6ff4df3614a1d4c63affe6fdd00409329ec431",
         "package.json": "774af304ec05a24461318172882a28373e568b5240d8eee9a31a286997b9a403",
-        "README.md": "a75f87df7906fe143d2ecaddfe9263561db17436df7ec2c4a8d985e1e3e8996e",
         "remote-runtime.js": "d38b7a28f36e8f1be1d4826a056a03d0ebc2b9b17be277e010be25048797a562",
         "slave-operations.js": "5a8967e2006f3f30ee221614d25fbf7863ffd9c717fd7eeeb0ba981c8c8c367a",
         "state-store.js": "c56849a3f1b9c990128276e17963034a7836abacedc44f2e500d5732ebf9e451",

package/src/runtime/bootstrap-cli.js

@@ -66,7 +66,7 @@ async function runInternalPiLogin(provider, { rl = null } = {}) {
 
 export async function collectCliBootstrapChoices({ telegramApiKey, rl, ask }) {
   const telegramMaxChatIds = Number(await ask("Maximum authorized chat IDs", "1"));
-  const runtime = createPiRuntime();
+  const runtime = await createPiRuntime();
   const providers = sortBootstrapProviders(listPiProviders(runtime));
   console.log("\nAvailable Pi providers:");
   providers.forEach((item, index) => console.log(`${index + 1}. ${formatProviderOption(item)}`));
@@ -89,7 +89,7 @@ export async function collectCliBootstrapChoices({ telegramApiKey, rl, ask }) {
   while (true) {
     piApiKey = (await rl.question(`Pi API key for ${selectedProvider.provider} (optional): `)).trim();
     if (piApiKey) break;
-    if (hasProviderAuth(selectedProvider.provider, createPiRuntime())) break;
+    if (hasProviderAuth(selectedProvider.provider, await createPiRuntime())) break;
     if (!providerSupportsOAuth) {
       console.log(`No existing Pi auth found for ${selectedProvider.provider}. This provider requires an API key.`);
       continue;
@@ -100,7 +100,7 @@ export async function collectCliBootstrapChoices({ telegramApiKey, rl, ask }) {
     } catch (error) {
       console.log(`Internal Pi login failed: ${error instanceof Error ? error.message : String(error)}`);
     }
-    if (hasProviderAuth(selectedProvider.provider, createPiRuntime())) {
+    if (hasProviderAuth(selectedProvider.provider, await createPiRuntime())) {
       console.log(`Detected Pi auth for ${selectedProvider.provider}. Continuing bootstrap.`);
       break;
     }