comisai 1.0.23 → 1.0.25

package/node_modules/@comis/agent/dist/executor/pi-executor.js

@@ -324,6 +324,23 @@ export function createPiExecutor(config, deps) {
             if (normalizedPrimary.normalized) {
                 deps.logger.debug({ original: config.model, resolved: normalizedPrimary.modelId }, "Model ID normalized via shortcut");
             }
+            // Surface the silent-fallback case where pi-coding-agent picks a different
+            // provider than the user configured. When find() returns undefined for an
+            // explicit (non-default) provider/model, pi will silently shop `findInitialModel`
+            // and pick whatever built-in has env-var auth -- e.g., GEMINI_API_KEY → google.
+            // The wiring fix in setup-agents.ts should cover the YAML-provider case; this
+            // log catches stragglers (typos, disabled providers, missing API keys).
+            if (!resolvedModel
+                && config.provider.toLowerCase() !== "default"
+                && config.model.toLowerCase() !== "default") {
+                deps.logger.warn({
+                    agentId,
+                    configuredProvider: config.provider,
+                    configuredModel: normalizedPrimary.modelId,
+                    hint: "Provider not registered in pi ModelRegistry. Check providers.entries.<name> in config.yaml has type/baseUrl/apiKeyName set, the API key resolves via SecretManager, and the provider is enabled. Without a match, pi-coding-agent silently falls back to whatever built-in provider has env-var credentials.",
+                    errorKind: "config",
+                }, "Configured provider/model not found in registry; pi-coding-agent will fall back");
+            }
             if (executionOverrides?.model) {
                 // Model override format: "provider:modelId" (same as compactionModel pattern)
                 const parts = executionOverrides.model.split(":");

package/node_modules/@comis/agent/dist/index.d.ts

@@ -135,7 +135,8 @@ export { createPiEventBridge } from "./bridge/pi-event-bridge.js";
 export type { PiEventBridgeDeps, PiEventBridgeResult } from "./bridge/pi-event-bridge.js";
 export { createAuthStorageAdapter, DEFAULT_PROVIDER_KEYS } from "./model/auth-storage-adapter.js";
 export type { AuthStorageAdapterOptions } from "./model/auth-storage-adapter.js";
-export { createModelRegistryAdapter, resolveInitialModel } from "./model/model-registry-adapter.js";
+export { createModelRegistryAdapter, registerCustomProviders, resolveInitialModel } from "./model/model-registry-adapter.js";
+export type { CustomProviderRegistration, CustomProviderLogger } from "./model/model-registry-adapter.js";
 export { sessionKeyToPath, pathToSessionKey } from "./session/session-key-mapper.js";
 export { detectBrokenFollowThrough, FOLLOW_THROUGH_PATTERNS } from "./safety/response-safety-checks.js";
 export type { FollowThroughResult } from "./safety/response-safety-checks.js";

package/node_modules/@comis/agent/dist/index.js

@@ -135,7 +135,7 @@ export { createPiEventBridge } from "./bridge/pi-event-bridge.js";
 // Auth storage adapter (SecretManager to pi-coding-agent AuthStorage)
 export { createAuthStorageAdapter, DEFAULT_PROVIDER_KEYS } from "./model/auth-storage-adapter.js";
 // Model registry adapter (ModelRegistry creation + initial model resolution)
-export { createModelRegistryAdapter, resolveInitialModel } from "./model/model-registry-adapter.js";
+export { createModelRegistryAdapter, registerCustomProviders, resolveInitialModel } from "./model/model-registry-adapter.js";
 // Session key mapper (SessionKey to/from filesystem path)
 export { sessionKeyToPath, pathToSessionKey } from "./session/session-key-mapper.js";
 // ---------------------------------------------------------------------------

package/node_modules/@comis/agent/dist/model/auth-storage-adapter.d.ts

@@ -10,12 +10,33 @@ import { AuthStorage } from "@mariozechner/pi-coding-agent";
 import type { SecretManager } from "@comis/core";
 /** Default provider-to-env-var mapping for known LLM providers. */
 export declare const DEFAULT_PROVIDER_KEYS: Record<string, string>;
+/**
+ * Custom YAML provider entry projection used to populate AuthStorage with
+ * runtime API keys for providers declared under `providers.entries.*`.
+ *
+ * Only the fields needed for credential wiring are included -- the full
+ * ProviderEntry lives in @comis/core but importing it here would pull
+ * the entire config domain into the agent package.
+ */
+export interface CustomProviderAuth {
+    /** SecretManager key name for the API key (e.g., "NVIDIA_API_KEY"). */
+    apiKeyName: string;
+    /** Whether the provider is enabled. Disabled entries are skipped. */
+    enabled: boolean;
+}
 /** Options for creating an AuthStorage adapter. */
 export interface AuthStorageAdapterOptions {
     /** SecretManager to read API keys from. */
     secretManager: SecretManager;
     /** Additional provider-to-env-var mappings beyond the defaults. */
     additionalProviderKeys?: Record<string, string>;
+    /**
+     * Custom YAML provider entries (`providers.entries.*`). Each entry's
+     * `apiKeyName` is resolved through `secretManager` and registered as a
+     * runtime override on the returned AuthStorage. Disabled entries and
+     * entries with empty `apiKeyName` are skipped silently.
+     */
+    customProviderEntries?: Record<string, CustomProviderAuth>;
 }
 /**
  * Create an AuthStorage populated with API keys from SecretManager.

package/node_modules/@comis/agent/dist/model/auth-storage-adapter.js

@@ -24,7 +24,7 @@ export const DEFAULT_PROVIDER_KEYS = {
  * setRuntimeApiKey() for found keys. Missing keys are silently skipped.
  */
 export function createAuthStorageAdapter(options) {
-    const { secretManager, additionalProviderKeys } = options;
+    const { secretManager, additionalProviderKeys, customProviderEntries } = options;
     const storage = AuthStorage.fromStorage(new InMemoryAuthStorageBackend());
     const allProviderKeys = { ...DEFAULT_PROVIDER_KEYS, ...additionalProviderKeys };
     for (const [provider, envKey] of Object.entries(allProviderKeys)) {
@@ -33,5 +33,19 @@ export function createAuthStorageAdapter(options) {
             storage.setRuntimeApiKey(provider, apiKey);
         }
     }
+    // Custom YAML providers (providers.entries.*). Runtime overrides take
+    // priority over auth.json and env-var fallback in pi-coding-agent, so
+    // YAML config wins over any stray env keys (e.g., GEMINI_API_KEY) that
+    // might otherwise satisfy hasAuth() for an unrelated built-in provider.
+    if (customProviderEntries) {
+        for (const [providerName, entry] of Object.entries(customProviderEntries)) {
+            if (!entry.enabled || !entry.apiKeyName)
+                continue;
+            const apiKey = secretManager.get(entry.apiKeyName);
+            if (apiKey) {
+                storage.setRuntimeApiKey(providerName, apiKey);
+            }
+        }
+    }
     return storage;
 }

package/node_modules/@comis/agent/dist/model/model-registry-adapter.d.ts

@@ -12,6 +12,7 @@ import { ModelRegistry } from "@mariozechner/pi-coding-agent";
 import type { AuthStorage } from "@mariozechner/pi-coding-agent";
 import type { Api, Model } from "@mariozechner/pi-ai";
 import type { ThinkingLevel } from "@mariozechner/pi-agent-core";
+import type { SecretManager } from "@comis/core";
 import type { ModelAllowlist } from "./model-allowlist.js";
 /** Result of initial model resolution. */
 export interface InitialModelResult {
@@ -30,6 +31,51 @@ export interface InitialModelResult {
  * have API keys configured in AuthStorage.
  */
 export declare function createModelRegistryAdapter(authStorage: AuthStorage): ModelRegistry;
+/** Subset of `ProviderEntry` (from `@comis/core`) we read for pi registration. */
+export interface CustomProviderRegistration {
+    type: string;
+    baseUrl: string;
+    apiKeyName: string;
+    enabled: boolean;
+    headers: Record<string, string>;
+    models: ReadonlyArray<{
+        id: string;
+        name?: string;
+        contextWindow?: number;
+        maxTokens?: number;
+        reasoning?: boolean;
+        input?: ReadonlyArray<"text" | "image">;
+        cost?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+        };
+    }>;
+}
+/** Logger surface accepted by `registerCustomProviders`. Subset of Pino. */
+export interface CustomProviderLogger {
+    warn(obj: Record<string, unknown>, msg: string): void;
+    debug(obj: Record<string, unknown>, msg: string): void;
+}
+/**
+ * Register YAML `providers.entries.*` with pi-coding-agent's ModelRegistry.
+ *
+ * Without this, custom OpenAI-compatible providers (NVIDIA NIM, Together,
+ * ollama, etc.) are not findable via `registry.find(provider, modelId)`,
+ * which causes pi's `findInitialModel` to silently fall back to whatever
+ * built-in provider has env-var auth (e.g., GEMINI_API_KEY → google).
+ *
+ * Per-entry behavior:
+ *   - Skipped if `enabled === false`.
+ *   - Skipped if no models declared and no `baseUrl` override.
+ *   - On `registerProvider` error (missing baseUrl, missing apiKey, etc.),
+ *     a WARN is logged and the loop continues -- one bad entry must not
+ *     prevent the daemon from starting.
+ *
+ * @returns Number of entries successfully registered.
+ */
+export declare function registerCustomProviders(registry: ModelRegistry, entries: Record<string, CustomProviderRegistration>, secretManager: SecretManager, logger: CustomProviderLogger): number;
 /**
  * Resolve the initial model for an agent session.
  *

package/node_modules/@comis/agent/dist/model/model-registry-adapter.js

@@ -20,6 +20,114 @@ import { ModelRegistry } from "@mariozechner/pi-coding-agent";
 export function createModelRegistryAdapter(authStorage) {
     return ModelRegistry.inMemory(authStorage);
 }
+/**
+ * YAML provider type → pi-ai API identifier. Mirrors the
+ * `OPENAI_COMPATIBLE_TYPES` set in `model-scanner.ts`. Unknown types
+ * default to `openai-completions` so arbitrary OpenAI-compatible
+ * proxies (NVIDIA NIM, Together, ollama, lm-studio, etc.) work without
+ * code changes.
+ */
+const PROVIDER_TYPE_TO_API = {
+    openai: "openai-completions",
+    groq: "openai-completions",
+    mistral: "openai-completions",
+    together: "openai-completions",
+    deepseek: "openai-completions",
+    cerebras: "openai-completions",
+    xai: "openai-completions",
+    openrouter: "openai-completions",
+    anthropic: "anthropic-messages",
+    google: "google-generative-ai",
+};
+/**
+ * Register YAML `providers.entries.*` with pi-coding-agent's ModelRegistry.
+ *
+ * Without this, custom OpenAI-compatible providers (NVIDIA NIM, Together,
+ * ollama, etc.) are not findable via `registry.find(provider, modelId)`,
+ * which causes pi's `findInitialModel` to silently fall back to whatever
+ * built-in provider has env-var auth (e.g., GEMINI_API_KEY → google).
+ *
+ * Per-entry behavior:
+ *   - Skipped if `enabled === false`.
+ *   - Skipped if no models declared and no `baseUrl` override.
+ *   - On `registerProvider` error (missing baseUrl, missing apiKey, etc.),
+ *     a WARN is logged and the loop continues -- one bad entry must not
+ *     prevent the daemon from starting.
+ *
+ * @returns Number of entries successfully registered.
+ */
+export function registerCustomProviders(registry, entries, secretManager, logger) {
+    let registered = 0;
+    for (const [providerName, entry] of Object.entries(entries)) {
+        if (!entry.enabled) {
+            logger.debug({ providerName }, "Custom provider skipped (disabled)");
+            continue;
+        }
+        const hasModels = entry.models.length > 0;
+        const hasBaseUrlOverride = !!entry.baseUrl;
+        if (!hasModels && !hasBaseUrlOverride) {
+            logger.debug({ providerName }, "Custom provider skipped (no models and no baseUrl override)");
+            continue;
+        }
+        const apiKey = entry.apiKeyName ? secretManager.get(entry.apiKeyName) : undefined;
+        if (hasModels && !apiKey) {
+            logger.warn({
+                providerName,
+                apiKeyName: entry.apiKeyName,
+                hint: "Set the named secret in ~/.comis/.env or remove the provider entry from config.yaml",
+                errorKind: "config",
+            }, "Custom provider has models but no API key -- skipping registration");
+            continue;
+        }
+        const api = PROVIDER_TYPE_TO_API[entry.type] ?? "openai-completions";
+        const headersResolved = Object.keys(entry.headers).length > 0 ? entry.headers : undefined;
+        try {
+            registry.registerProvider(providerName, {
+                api,
+                baseUrl: entry.baseUrl || undefined,
+                apiKey,
+                headers: headersResolved,
+                // pi's ProviderModelConfig requires concrete values for name/cost/
+                // contextWindow/maxTokens. Comis's UserModelSchema lets users omit
+                // these (defaults to optional/undefined), so we fill in zeros and
+                // a generous default context window. Cost is informational only
+                // and our CostTracker uses pi-ai's own catalog where it can.
+                models: hasModels
+                    ? entry.models.map((m) => ({
+                        id: m.id,
+                        name: m.name ?? m.id,
+                        contextWindow: m.contextWindow ?? 128_000,
+                        maxTokens: m.maxTokens ?? 4_096,
+                        reasoning: m.reasoning ?? false,
+                        input: m.input ? [...m.input] : ["text"],
+                        cost: {
+                            input: m.cost?.input ?? 0,
+                            output: m.cost?.output ?? 0,
+                            cacheRead: m.cost?.cacheRead ?? 0,
+                            cacheWrite: m.cost?.cacheWrite ?? 0,
+                        },
+                    }))
+                    : undefined,
+            });
+            registered += 1;
+            logger.debug({
+                providerName,
+                api,
+                baseUrl: entry.baseUrl,
+                modelCount: entry.models.length,
+            }, "Custom provider registered with pi ModelRegistry");
+        }
+        catch (error) {
+            logger.warn({
+                providerName,
+                err: error instanceof Error ? error.message : String(error),
+                hint: "Check providers.entries config: baseUrl required when defining models; apiKey required unless oauth configured",
+                errorKind: "config",
+            }, "Custom provider registration failed");
+        }
+    }
+    return registered;
+}
 /**
  * Resolve the initial model for an agent session.
  *

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/dist/bootstrap.js

@@ -2,6 +2,7 @@ import { ok, err } from "@comis/shared";
 import os from "node:os";
 import path from "node:path";
 import { loadLayered } from "./config/layered.js";
+import { buildGatewayEnvLayer } from "./config/env-layer.js";
 import { TypedEventBus } from "./event-bus/index.js";
 import { createSecretManager, safePath } from "./security/index.js";
 import { createPluginRegistry } from "./hooks/plugin-registry.js";
@@ -44,12 +45,16 @@ export function bootstrap(options) {
     // Wrap getSecret to record every name referenced by the config — the set
     // becomes container.platformSecretNames and is used by the exec tool to
     // refuse secretRefs access to platform-managed credentials.
+    // envLayer projects operational env vars (COMIS_GATEWAY_HOST/PORT) into
+    // the config layer stack at lower priority than YAML files, so explicit
+    // user config wins over env — see config/env-layer.ts.
     const referencedNames = new Set();
     const configResult = loadLayered(options.configPaths, {
         getSecret: (key) => {
             referencedNames.add(key);
             return secretManager.get(key);
         },
+        envLayer: buildGatewayEnvLayer(env),
     });
     if (!configResult.ok) {
         return err(configResult.error);

package/node_modules/@comis/core/dist/config/env-layer.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Operational env-var → config-layer projection.
+ *
+ * Bridges container/systemd/pm2 deployments to layered config without a
+ * config.yaml. Currently supported:
+ *
+ *   COMIS_GATEWAY_HOST → gateway.host (e.g. "0.0.0.0" inside the Docker image)
+ *   COMIS_GATEWAY_PORT → gateway.port
+ *
+ * The returned object is a partial config layer fed to mergeLayered() at
+ * lower priority than YAML files: schema defaults < env layer < config.yaml.
+ * This keeps explicit user config authoritative — a `gateway.host: 127.0.0.1`
+ * in config.yaml is never silently broadened to 0.0.0.0 by an inherited env
+ * var, preserving the secure-by-default contract on `gateway.host`.
+ *
+ * Empty-string host and non-numeric / out-of-range ports are dropped so a
+ * typo never silently relocates the daemon.
+ *
+ * @module
+ */
+/** Subset of env vars consumed by this projection. */
+export interface GatewayEnvSource {
+    COMIS_GATEWAY_HOST?: string | undefined;
+    COMIS_GATEWAY_PORT?: string | undefined;
+}
+/**
+ * Build a partial config layer from env vars. Returns an empty object when
+ * no relevant env vars are set (callers can pass through to mergeLayered
+ * unconditionally without affecting precedence).
+ */
+export declare function buildGatewayEnvLayer(env: GatewayEnvSource): Record<string, unknown>;

package/node_modules/@comis/core/dist/config/env-layer.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Operational env-var → config-layer projection.
+ *
+ * Bridges container/systemd/pm2 deployments to layered config without a
+ * config.yaml. Currently supported:
+ *
+ *   COMIS_GATEWAY_HOST → gateway.host (e.g. "0.0.0.0" inside the Docker image)
+ *   COMIS_GATEWAY_PORT → gateway.port
+ *
+ * The returned object is a partial config layer fed to mergeLayered() at
+ * lower priority than YAML files: schema defaults < env layer < config.yaml.
+ * This keeps explicit user config authoritative — a `gateway.host: 127.0.0.1`
+ * in config.yaml is never silently broadened to 0.0.0.0 by an inherited env
+ * var, preserving the secure-by-default contract on `gateway.host`.
+ *
+ * Empty-string host and non-numeric / out-of-range ports are dropped so a
+ * typo never silently relocates the daemon.
+ *
+ * @module
+ */
+/**
+ * Build a partial config layer from env vars. Returns an empty object when
+ * no relevant env vars are set (callers can pass through to mergeLayered
+ * unconditionally without affecting precedence).
+ */
+export function buildGatewayEnvLayer(env) {
+    const gateway = {};
+    const rawHost = env.COMIS_GATEWAY_HOST;
+    if (typeof rawHost === "string" && rawHost.length > 0) {
+        gateway["host"] = rawHost;
+    }
+    const rawPort = env.COMIS_GATEWAY_PORT;
+    if (typeof rawPort === "string" && rawPort.length > 0) {
+        const parsed = Number.parseInt(rawPort, 10);
+        if (Number.isFinite(parsed) && parsed >= 1 && parsed <= 65_535) {
+            gateway["port"] = parsed;
+        }
+    }
+    return Object.keys(gateway).length > 0 ? { gateway } : {};
+}

package/node_modules/@comis/core/dist/config/layered.d.ts

@@ -24,7 +24,16 @@ export declare function mergeLayered(layers: Record<string, unknown>[]): Result<
  * This supports the common pattern: defaults.yaml < config.yaml < config.local.yaml
  *
  * If any file fails to load, returns the error immediately.
+ *
+ * `envLayer` (when provided) is prepended to the layer sequence so it sits
+ * between Zod schema defaults and YAML files in precedence order:
+ *   defaults < envLayer < config files
+ * Explicit user config in YAML always wins over env-derived values, which
+ * preserves secure-by-default semantics for security-sensitive fields like
+ * `gateway.host` — an inherited env var can never silently broaden a bind
+ * the operator pinned in config.yaml.
  */
 export declare function loadLayered(configPaths: string[], options?: {
     getSecret?: (key: string) => string | undefined;
+    envLayer?: Record<string, unknown>;
 }): Result<AppConfig, ConfigError>;

package/node_modules/@comis/core/dist/config/layered.js

@@ -73,9 +73,20 @@ export function mergeLayered(layers) {
  * This supports the common pattern: defaults.yaml < config.yaml < config.local.yaml
  *
  * If any file fails to load, returns the error immediately.
+ *
+ * `envLayer` (when provided) is prepended to the layer sequence so it sits
+ * between Zod schema defaults and YAML files in precedence order:
+ *   defaults < envLayer < config files
+ * Explicit user config in YAML always wins over env-derived values, which
+ * preserves secure-by-default semantics for security-sensitive fields like
+ * `gateway.host` — an inherited env var can never silently broaden a bind
+ * the operator pinned in config.yaml.
  */
 export function loadLayered(configPaths, options) {
     const layers = [];
+    if (options?.envLayer && Object.keys(options.envLayer).length > 0) {
+        layers.push(options.envLayer);
+    }
     for (const configPath of configPaths) {
         const result = loadConfigFile(configPath, options?.getSecret ? { getSecret: options.getSecret } : undefined);
         if (!result.ok) {

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon.js

@@ -1044,6 +1044,9 @@ export async function main(overrides = {}) {
     };
     wireDispatch(rpcDispatchDeps);
     // 7. Gateway
+    // gateway.host / .port are resolved through the layered config in bootstrap:
+    // schema defaults < env layer (COMIS_GATEWAY_HOST/PORT) < config.yaml.
+    // See packages/core/src/config/env-layer.ts.
     const gwConfig = container.config.gateway;
     const { gatewayHandle, activeExecutions, getActiveConnectionCount, wsConnections } = await setupGateway({
         container, gwConfig, webhooksConfig: container.config.webhooks, agents, defaultAgentId,

package/node_modules/@comis/daemon/dist/wiring/setup-agents.js

@@ -12,7 +12,7 @@ import { createHmac } from "node:crypto";
 import { homedir } from "node:os";
 import { existsSync, mkdirSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, createProviderHealthMonitor, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
+import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
 import { agentToolsToToolDefinitions, createSkillRegistry, createRuntimeEligibilityContext, TOOL_PROFILES, } from "@comis/skills";
 // ---------------------------------------------------------------------------
 // Single-agent setup (extracted for hot-add reuse)
@@ -60,9 +60,21 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         eventBus: container.eventBus,
     });
     agentLogger.debug({ agentId, allowPatterns: agentSecrets.allow }, "Per-agent ScopedSecretManager created");
-    // Per-agent auth + model registry (moved from shared to per-agent for credential isolation)
-    const piAuthStorage = createAuthStorageAdapter({ secretManager: scopedManager });
+    // Per-agent auth + model registry (moved from shared to per-agent for credential isolation).
+    // Custom YAML providers under `providers.entries.*` are wired into both auth (runtime API
+    // key overrides) and the registry (so `find(provider, modelId)` succeeds) -- without this,
+    // pi-coding-agent silently falls back to whatever built-in provider has env-var auth (e.g.,
+    // GEMINI_API_KEY → google), bypassing the configured provider entirely.
+    const customProviderEntries = container.config.providers?.entries ?? {};
+    const piAuthStorage = createAuthStorageAdapter({
+        secretManager: scopedManager,
+        customProviderEntries,
+    });
     const piModelRegistry = createModelRegistryAdapter(piAuthStorage);
+    const customProviderCount = registerCustomProviders(piModelRegistry, customProviderEntries, scopedManager, agentLogger);
+    if (customProviderCount > 0) {
+        agentLogger.debug({ agentId, customProviderCount }, "Custom YAML providers registered with pi ModelRegistry");
+    }
     // Create JSONL session adapter for this agent
     const lockDir = safePath(dir, ".locks");
     const sessionAdapter = createComisSessionManager({

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.23",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",