comisai 1.0.30 → 1.0.31

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/dist/cli.js

@@ -23,6 +23,7 @@ import { registerConfigureCommand } from "./commands/configure.js";
 import { registerStatusCommand } from "./commands/status.js";
 import { registerHealthCommand } from "./commands/health.js";
 import { registerModelsCommand } from "./commands/models.js";
+import { registerProvidersCommand } from "./commands/providers.js";
 import { registerPm2Command } from "./commands/pm2.js";
 import { registerSessionsCommand } from "./commands/sessions.js";
 import { registerResetCommand } from "./commands/reset.js";
@@ -46,6 +47,7 @@ registerConfigureCommand(program);
 registerStatusCommand(program);
 registerHealthCommand(program);
 registerModelsCommand(program);
+registerProvidersCommand(program);
 registerPm2Command(program);
 registerSessionsCommand(program);
 registerResetCommand(program);

package/node_modules/@comis/cli/dist/client/provider-list.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Shared provider-list utility (RPC-first, local catalog fallback).
+ *
+ * Used by BOTH the wizard's provider selection step
+ * (`wizard/steps/03-provider.ts`) AND the `comis providers list` command
+ * (`commands/providers.ts`). The single utility avoids duplicating the
+ * "try daemon, fall back to pi-ai locally" decision tree across two call
+ * sites.
+ *
+ * RPC-first because the daemon's catalog may be enriched with live scan
+ * results that the local pi-ai static registry doesn't know about.
+ *
+ * Local fallback handles the pre-init use case: the wizard runs *before*
+ * the daemon exists for first-time users, and `comis providers list`
+ * remains useful when the daemon is stopped.
+ *
+ * Logging: silent. The catch arms here represent the *normal* fallback
+ * flow (daemon not running, daemon returned an unexpected shape), not
+ * error conditions. Adding a logger would create noise on every wizard
+ * boot. Surfaces above this layer (the wizard prompter, the providers
+ * command's output) report the resulting state to the user.
+ *
+ * @module
+ */
+/**
+ * Load the catalog provider list, preferring the daemon RPC and falling
+ * back to the local pi-ai catalog when the daemon is unreachable.
+ *
+ * Contract:
+ * - Returns `string[]` (the provider IDs).
+ * - Never throws. All error paths are caught internally; the worst-case
+ *   return is `[]`, which callers translate into a "no providers" UX.
+ * - When the RPC succeeds with a valid `{providers, count}` shape, the
+ *   array is returned verbatim (the daemon already sorts; we trust it).
+ * - When the local fallback runs, the result is deduped and sorted.
+ *
+ * @returns A list of provider IDs from the catalog, or `[]` on total
+ *   failure.
+ */
+export declare function loadProvidersWithFallback(): Promise<string[]>;

package/node_modules/@comis/cli/dist/client/provider-list.js

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared provider-list utility (RPC-first, local catalog fallback).
+ *
+ * Used by BOTH the wizard's provider selection step
+ * (`wizard/steps/03-provider.ts`) AND the `comis providers list` command
+ * (`commands/providers.ts`). The single utility avoids duplicating the
+ * "try daemon, fall back to pi-ai locally" decision tree across two call
+ * sites.
+ *
+ * RPC-first because the daemon's catalog may be enriched with live scan
+ * results that the local pi-ai static registry doesn't know about.
+ *
+ * Local fallback handles the pre-init use case: the wizard runs *before*
+ * the daemon exists for first-time users, and `comis providers list`
+ * remains useful when the daemon is stopped.
+ *
+ * Logging: silent. The catch arms here represent the *normal* fallback
+ * flow (daemon not running, daemon returned an unexpected shape), not
+ * error conditions. Adding a logger would create noise on every wizard
+ * boot. Surfaces above this layer (the wizard prompter, the providers
+ * command's output) report the resulting state to the user.
+ *
+ * @module
+ */
+import { withClient } from "./rpc-client.js";
+import { createModelCatalog } from "@comis/agent";
+/**
+ * Defensive shape narrowing for the daemon RPC response.
+ *
+ * The daemon's `models.list_providers` handler is expected to return
+ * `{ providers: string[]; count: number }` (verified in
+ * `packages/daemon/src/rpc/model-handlers.ts:99-106`). We narrow at the
+ * call site so a malformed response (e.g., daemon version skew, future
+ * shape change) cannot crash the wizard.
+ */
+function isValidProvidersResponse(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const candidate = value;
+    if (!Array.isArray(candidate.providers))
+        return false;
+    return candidate.providers.every((p) => typeof p === "string");
+}
+/**
+ * Load the catalog provider list, preferring the daemon RPC and falling
+ * back to the local pi-ai catalog when the daemon is unreachable.
+ *
+ * Contract:
+ * - Returns `string[]` (the provider IDs).
+ * - Never throws. All error paths are caught internally; the worst-case
+ *   return is `[]`, which callers translate into a "no providers" UX.
+ * - When the RPC succeeds with a valid `{providers, count}` shape, the
+ *   array is returned verbatim (the daemon already sorts; we trust it).
+ * - When the local fallback runs, the result is deduped and sorted.
+ *
+ * @returns A list of provider IDs from the catalog, or `[]` on total
+ *   failure.
+ */
+export async function loadProvidersWithFallback() {
+    // RPC-first: daemon may have a richer/scanned catalog.
+    try {
+        const result = await withClient(async (client) => client.call("models.list_providers", {}));
+        if (isValidProvidersResponse(result)) {
+            return result.providers;
+        }
+        // Malformed shape -- fall through to local fallback (defensive).
+    }
+    catch {
+        // Daemon not running, RPC error, or timeout -- fall through.
+    }
+    // Local fallback via pi-ai static catalog.
+    try {
+        const catalog = createModelCatalog();
+        catalog.loadStatic();
+        const providers = [...new Set(catalog.getAll().map((e) => e.provider))].sort();
+        return providers;
+    }
+    catch {
+        // Catastrophic failure (rare): pi-ai SDK boot failure or similar.
+        // Caller's UX layer reports "no providers" on empty result.
+        return [];
+    }
+}

package/node_modules/@comis/cli/dist/commands/providers.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Provider listing CLI command.
+ *
+ * Provides `comis providers list` for browsing available providers from
+ * the live pi-ai catalog (with daemon RPC + local fallback). Status
+ * column indicates whether a provider's API key is resolvable from the
+ * env (mirrors credential-resolver.ts Source B semantics from
+ * 260501-2pz).
+ *
+ * Mirrors `commands/models.ts` shape -- RPC-first, local catalog
+ * fallback, `--format` flag, no `set` subcommand (provider switching
+ * goes through `comis agent configure --provider X`).
+ *
+ * @module
+ */
+import type { Command } from "commander";
+/**
+ * Register the `providers` command group on the program.
+ *
+ * Provides:
+ * - `comis providers list` -- browse available providers
+ *
+ * @param program - The root Commander program
+ */
+export declare function registerProvidersCommand(program: Command): void;

package/node_modules/@comis/cli/dist/commands/providers.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Provider listing CLI command.
+ *
+ * Provides `comis providers list` for browsing available providers from
+ * the live pi-ai catalog (with daemon RPC + local fallback). Status
+ * column indicates whether a provider's API key is resolvable from the
+ * env (mirrors credential-resolver.ts Source B semantics from
+ * 260501-2pz).
+ *
+ * Mirrors `commands/models.ts` shape -- RPC-first, local catalog
+ * fallback, `--format` flag, no `set` subcommand (provider switching
+ * goes through `comis agent configure --provider X`).
+ *
+ * @module
+ */
+import { getEnvApiKey } from "@mariozechner/pi-ai";
+import { withClient } from "../client/rpc-client.js";
+import { loadProvidersWithFallback } from "../client/provider-list.js";
+import { createModelCatalog } from "@comis/agent";
+import { error, info, json } from "../output/format.js";
+import { withSpinner } from "../output/spinner.js";
+import { renderTable } from "../output/table.js";
+/**
+ * Provider IDs that don't need an API key.
+ *
+ * Mirrors `credential-resolver.ts:25 KEYLESS_PROVIDER_TYPES`. Kept as
+ * an independent set here because the CLI's status-column logic must
+ * answer "is this keyless?" without booting the full credential-
+ * resolver dep graph.
+ */
+const KEYLESS_PROVIDERS = new Set(["ollama", "lm-studio"]);
+/**
+ * Load the model count for a single provider via RPC, falling back to
+ * the local catalog. Returns 0 if neither source resolves.
+ *
+ * Mirrors `commands/models.ts:62-83 loadModels()` shape -- same
+ * try/catch ladder, same defensive `Array.isArray` narrow.
+ */
+async function getModelCount(provider) {
+    try {
+        const result = await withClient(async (client) => {
+            return (await client.call("models.list", { provider }));
+        });
+        if (Array.isArray(result))
+            return result.length;
+    }
+    catch {
+        // Daemon not running -- fall through to local catalog.
+    }
+    try {
+        const catalog = createModelCatalog();
+        catalog.loadStatic();
+        return catalog.getByProvider(provider).length;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Resolve the Status column value for a provider.
+ *
+ * - `keyless`     : provider is in `KEYLESS_PROVIDERS` (ollama, lm-studio)
+ * - `configured`  : pi-ai's `getEnvApiKey` resolves a non-empty key
+ * - `missing key` : no env key found
+ *
+ * Mirrors `credential-resolver.ts` Source B semantics from 260501-2pz.
+ * Status reflects only env-key presence; it does NOT include the key
+ * value itself (T-260501-kqq-02 information-disclosure threat).
+ */
+function getProviderStatus(provider) {
+    if (KEYLESS_PROVIDERS.has(provider))
+        return "keyless";
+    const key = getEnvApiKey(provider);
+    return key && key.length > 0 ? "configured" : "missing key";
+}
+/**
+ * Register the `providers` command group on the program.
+ *
+ * Provides:
+ * - `comis providers list` -- browse available providers
+ *
+ * @param program - The root Commander program
+ */
+export function registerProvidersCommand(program) {
+    const providers = program
+        .command("providers")
+        .description("Provider management");
+    providers
+        .command("list")
+        .description("List available providers from the catalog")
+        .option("--format <format>", 'Output format: "table" or "json"', "table")
+        .action(async (options) => {
+        try {
+            const ids = await withSpinner("Loading providers...", () => loadProvidersWithFallback());
+            if (ids.length === 0) {
+                info("No providers found in catalog");
+                return;
+            }
+            // Sequentially fetch model counts. With ~11-23 providers this
+            // is acceptable (single-digit RPC roundtrips). N+1 batching is
+            // a v1.5 enhancement (T-260501-kqq-03 DoS disposition: accept).
+            const rows = [];
+            for (const id of ids) {
+                const modelCount = await getModelCount(id);
+                const status = getProviderStatus(id);
+                rows.push({ provider: id, modelCount, status });
+            }
+            if (options.format === "json") {
+                json(rows);
+                return;
+            }
+            renderTable(["Provider", "Models", "Status"], rows.map((r) => [r.provider, String(r.modelCount), r.status]));
+            info(`${rows.length} provider${rows.length !== 1 ? "s" : ""} listed`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            error(`Failed to list providers: ${msg}`);
+            process.exit(1);
+        }
+    });
+}

package/node_modules/@comis/cli/dist/wizard/index.d.ts

@@ -11,8 +11,8 @@
  *
  * @module
  */
-export type { FlowType, WizardStepId, WizardState, WizardStep, WizardResult, WizardError, ValidationResult, AuthMethod, ChannelConfig, GatewayConfig, ProviderConfig, ToolProviderConfig, SupportedProvider, SupportedToolProvider, } from "./types.js";
-export { INITIAL_STATE, SUPPORTED_PROVIDERS, SUPPORTED_CHANNELS, SUPPORTED_TOOL_PROVIDERS, PROVIDER_ENV_KEYS, CHANNEL_ENV_KEYS, TOOL_PROVIDER_ENV_KEYS, } from "./types.js";
+export type { FlowType, WizardStepId, WizardState, WizardStep, WizardResult, WizardError, ValidationResult, AuthMethod, ChannelConfig, GatewayConfig, ProviderConfig, ToolProviderConfig, SupportedToolProvider, } from "./types.js";
+export { INITIAL_STATE, SUPPORTED_CHANNELS, SUPPORTED_TOOL_PROVIDERS, PROVIDER_ENV_KEYS, CHANNEL_ENV_KEYS, TOOL_PROVIDER_ENV_KEYS, } from "./types.js";
 export type { WizardPrompter, SelectOpts, MultiselectOpts, TextOpts, PasswordOpts, ConfirmOpts, Spinner, } from "./prompter.js";
 export { CancelError } from "./prompter.js";
 export { ClackAdapter, createClackAdapter } from "./clack-adapter.js";

package/node_modules/@comis/cli/dist/wizard/index.js

@@ -12,7 +12,7 @@
  *
  * @module
  */
-export { INITIAL_STATE, SUPPORTED_PROVIDERS, SUPPORTED_CHANNELS, SUPPORTED_TOOL_PROVIDERS, PROVIDER_ENV_KEYS, CHANNEL_ENV_KEYS, TOOL_PROVIDER_ENV_KEYS, } from "./types.js";
+export { INITIAL_STATE, SUPPORTED_CHANNELS, SUPPORTED_TOOL_PROVIDERS, PROVIDER_ENV_KEYS, CHANNEL_ENV_KEYS, TOOL_PROVIDER_ENV_KEYS, } from "./types.js";
 export { CancelError } from "./prompter.js";
 // ---------- Clack Adapter ----------
 export { ClackAdapter, createClackAdapter } from "./clack-adapter.js";

package/node_modules/@comis/cli/dist/wizard/non-interactive.js

@@ -16,7 +16,7 @@
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
 import { safePath } from "@comis/core";
-import { SUPPORTED_PROVIDERS } from "./types.js";
+import { createModelCatalog } from "@comis/agent";
 import { validatePort } from "./validators/port.js";
 import { validateAgentName } from "./validators/agent-name.js";
 // ---------- Error ----------
@@ -36,26 +36,6 @@ export class NonInteractiveError extends Error {
         this.field = field;
     }
 }
-// ---------- Recommended Models ----------
-/**
- * Default model per provider, matching step 05-agent logic.
- *
- * When no --model flag is provided, the build function selects
- * the recommended model for the given provider.
- */
-const RECOMMENDED_MODELS = {
-    anthropic: "claude-sonnet-4-5-20250929",
-    openai: "gpt-4o",
-    google: "gemini-2.0-flash",
-    groq: "llama-3.3-70b-versatile",
-    mistral: "mistral-large-latest",
-    deepseek: "deepseek-chat",
-    xai: "grok-2",
-    together: "meta-llama/Meta-Llama-3.1-70B-Instruct-Turbo",
-    cerebras: "llama-3.3-70b",
-    openrouter: "anthropic/claude-sonnet-4-5-20250929",
-    ollama: "llama3",
-};
 // ---------- Validation ----------
 /**
  * Validate non-interactive options before building state.
@@ -76,11 +56,28 @@ export function validateNonInteractiveOptions(opts) {
     if (!opts.provider || opts.provider.trim().length === 0) {
         throw new NonInteractiveError("--provider is required in non-interactive mode", "provider");
     }
-    // Validate provider is known (allow "custom" and "ollama" for forward compat)
-    const knownIds = SUPPORTED_PROVIDERS.map((p) => p.id);
-    if (!knownIds.includes(opts.provider)) {
-        // Unknown provider is allowed but not silently -- the caller can
-        // decide to warn. We do not throw here for forward compatibility.
+    // Soft validation: warn for unknown providers but do not throw.
+    // Daemon-side guards (260501-2pz credential-resolver, 260501-gyy
+    // builtin-provider-guard) catch genuinely-invalid providers downstream
+    // when the agent attempts to use the config. This loosening enables
+    // forward compat when a new pi-ai version adds a provider before
+    // comis releases. The "custom" provider is always allowed (synthetic).
+    if (opts.provider !== "custom") {
+        try {
+            const catalog = createModelCatalog();
+            catalog.loadStatic();
+            const known = new Set(catalog.getAll().map((e) => e.provider));
+            if (!known.has(opts.provider)) {
+                // Soft WARN to stderr -- do not throw, do not log credentials.
+                // Note: this path runs in CLI bootstrap; we use console.warn
+                // because this function may run before any prompter is wired.
+                console.warn(`  WARN: provider "${opts.provider}" is not in the pi-ai catalog. Continuing for forward compatibility -- daemon-side validation will catch invalid providers.`);
+            }
+        }
+        catch {
+            // Catalog load failed (rare) -- skip the check entirely; let
+            // downstream daemon-side guards catch invalid providers.
+        }
     }
     // Validate gateway port if specified
     if (opts.gatewayPort !== undefined) {
@@ -161,8 +158,12 @@ export function buildNonInteractiveState(opts) {
         ...(opts.apiKey !== undefined && { apiKey: opts.apiKey }),
         validated: !!opts.skipValidation,
     };
-    // Model selection -- use explicit flag or provider default
-    const model = opts.model ?? RECOMMENDED_MODELS[opts.provider] ?? "default";
+    // Model selection -- delegate to daemon when not specified.
+    // The literal "default" is resolved at agent-execution time via the
+    // pi-ai catalog (builtin-provider-guard.ts:45 baseUrl pattern). Pre-
+    // 260501-kqq, this read a hardcoded provider->model map; that lookup
+    // was removed -- the daemon decides at runtime.
+    const model = opts.model ?? "default";
     // Channel configs
     const channels = [];
     if (opts.channels && opts.channels.length > 0) {

package/node_modules/@comis/cli/dist/wizard/steps/03-provider.d.ts

@@ -1,13 +1,19 @@
 /**
  * Provider selection step -- step 03 of the init wizard.
  *
- * Presents all supported LLM providers in a flat select list
- * with per-provider hints. A category overview note is shown
- * before the selection to help the user orient. Anthropic is
+ * Presents the providers from the live pi-ai catalog (loaded via
+ * `loadProvidersWithFallback` -- daemon RPC first, local pi-ai catalog
+ * fallback for the pre-init use case) plus a synthetic "custom" option
+ * appended last for OpenAI-compatible endpoints. A category overview
+ * note is shown before selection to help the user orient. Anthropic is
  * pre-selected as the recommended default.
  *
- * This step only captures the provider choice. API credentials
- * are collected in step 04 (credentials).
+ * Provider IDs not in `PROVIDER_UI_HINTS` render with a capitalize-
+ * fallback label and no hint -- new providers added by future pi-ai
+ * upgrades flow through automatically with no comis code change.
+ *
+ * This step only captures the provider choice. API credentials are
+ * collected in step 04 (credentials).
  *
  * @module
  */

package/node_modules/@comis/cli/dist/wizard/steps/03-provider.js

@@ -2,21 +2,77 @@
 /**
  * Provider selection step -- step 03 of the init wizard.
  *
- * Presents all supported LLM providers in a flat select list
- * with per-provider hints. A category overview note is shown
- * before the selection to help the user orient. Anthropic is
+ * Presents the providers from the live pi-ai catalog (loaded via
+ * `loadProvidersWithFallback` -- daemon RPC first, local pi-ai catalog
+ * fallback for the pre-init use case) plus a synthetic "custom" option
+ * appended last for OpenAI-compatible endpoints. A category overview
+ * note is shown before selection to help the user orient. Anthropic is
  * pre-selected as the recommended default.
  *
- * This step only captures the provider choice. API credentials
- * are collected in step 04 (credentials).
+ * Provider IDs not in `PROVIDER_UI_HINTS` render with a capitalize-
+ * fallback label and no hint -- new providers added by future pi-ai
+ * upgrades flow through automatically with no comis code change.
+ *
+ * This step only captures the provider choice. API credentials are
+ * collected in step 04 (credentials).
  *
  * @module
  */
-import { updateState, sectionSeparator, SUPPORTED_PROVIDERS } from "../index.js";
+import { updateState, sectionSeparator } from "../index.js";
+import { loadProvidersWithFallback } from "../../client/provider-list.js";
+/**
+ * UX-only labels and hints for known providers.
+ *
+ * Keys here are NOT a closed set of supported providers -- the actual
+ * supported set is whatever the pi-ai catalog exposes via
+ * `loadProvidersWithFallback()`. This map provides nicer labels for
+ * commonly-known providers; unknown providers use the capitalize-
+ * fallback path in `getProviderHint`.
+ *
+ * Excluded: `together` and `ollama`. Neither is in pi-ai 0.71.0's
+ * `getProviders()` catalog (`getModels(p)[0]?.baseUrl` is undefined for
+ * both), so an entry here would be dead code -- the live catalog
+ * never returns those IDs. The capitalize-fallback handles them if
+ * pi-ai adds them in a future release.
+ */
+const PROVIDER_UI_HINTS = {
+    anthropic: { label: "Anthropic (Claude)", hint: "Recommended for agents", category: "recommended" },
+    openai: { label: "OpenAI (GPT)", hint: "GPT-4o, o1, o3 models", category: "recommended" },
+    google: { label: "Google (Gemini)", hint: "Gemini models", category: "other" },
+    groq: { label: "Groq", hint: "Fast inference (Llama, Mixtral)", category: "other" },
+    mistral: { label: "Mistral", hint: "Mistral models", category: "other" },
+    deepseek: { label: "DeepSeek", hint: "DeepSeek models", category: "other" },
+    xai: { label: "xAI (Grok)", hint: "Grok models", category: "other" },
+    cerebras: { label: "Cerebras", hint: "Fast inference", category: "other" },
+    openrouter: { label: "OpenRouter", hint: "Multi-provider routing", category: "other" },
+};
+/**
+ * Resolve the UX hint for a provider id. Returns the static hint when
+ * present, otherwise computes a capitalize-fallback (matches the web
+ * wizard's pattern at packages/web/src/views/setup-wizard.ts:180-193).
+ */
+function getProviderHint(id) {
+    // eslint-disable-next-line security/detect-object-injection -- gated by Object.hasOwn against literal record (mirrors web wizard pattern)
+    if (Object.hasOwn(PROVIDER_UI_HINTS, id))
+        return PROVIDER_UI_HINTS[id];
+    return {
+        label: id.charAt(0).toUpperCase() + id.slice(1),
+        hint: undefined,
+        category: "other",
+    };
+}
 // ---------- Category Overview ----------
+/**
+ * Static overview note shown before the provider select.
+ *
+ * May drift from the live catalog (e.g., if pi-ai adds a new provider,
+ * users still see the same note). Computing this from
+ * PROVIDER_UI_HINTS + the loaded catalog is a future enhancement;
+ * static is acceptable for v1 since the categories rarely change.
+ */
 const CATEGORY_NOTE = [
     "Recommended: Anthropic, OpenAI",
-    "Other: Google, Groq, Mistral, DeepSeek, xAI, Together, Cerebras, OpenRouter",
+    "Other: Google, Groq, Mistral, DeepSeek, xAI, Cerebras, OpenRouter",
     "Local: Ollama (no API key)",
     "Custom: Your own endpoint",
 ].join("\n");
@@ -28,12 +84,18 @@ export const providerStep = {
         prompter.note(sectionSeparator("LLM Provider"));
         // Show category grouping overview before selection
         prompter.note(CATEGORY_NOTE, "Available Providers");
-        // Build flat options list from SUPPORTED_PROVIDERS
-        const options = SUPPORTED_PROVIDERS.map((p) => ({
-            value: p.id,
-            label: p.label,
-            hint: p.hint,
-        }));
+        // Build option list from live catalog (RPC-first, local fallback)
+        const providerIds = await loadProvidersWithFallback();
+        const options = providerIds.map((id) => {
+            const hint = getProviderHint(id);
+            return { value: id, label: hint.label, hint: hint.hint };
+        });
+        // Synthetic Custom option (always last, never in catalog)
+        options.push({
+            value: "custom",
+            label: "Custom endpoint",
+            hint: "OpenAI-compatible API",
+        });
         const selectedId = await prompter.select({
             message: "Which LLM provider will you use?",
             options,

package/node_modules/@comis/cli/dist/wizard/steps/04-credentials.js

@@ -16,6 +16,7 @@
  * @module
  */
 import { updateState, sectionSeparator, info, validateApiKey, getKeyPrefix, } from "../index.js";
+import { getModels } from "@mariozechner/pi-ai";
 // ---------- Provider Help URLs ----------
 const PROVIDER_HELP_URLS = {
     anthropic: "https://console.anthropic.com/settings/keys",
@@ -62,18 +63,75 @@ const AUTH_METHOD_PROVIDERS = {
     },
 };
 // ---------- Provider Validation Endpoints ----------
-const PROVIDER_VALIDATION = {
-    anthropic: { baseUrl: "https://api.anthropic.com", path: "/v1/models" },
-    openai: { baseUrl: "https://api.openai.com", path: "/v1/models" },
-    google: { baseUrl: "https://generativelanguage.googleapis.com", path: "/v1/models" },
-    groq: { baseUrl: "https://api.groq.com", path: "/openai/v1/models" },
-    mistral: { baseUrl: "https://api.mistral.ai", path: "/v1/models" },
-    deepseek: { baseUrl: "https://api.deepseek.com", path: "/v1/models" },
-    xai: { baseUrl: "https://api.x.ai", path: "/v1/models" },
-    together: { baseUrl: "https://api.together.xyz", path: "/v1/models" },
-    cerebras: { baseUrl: "https://api.cerebras.ai", path: "/v1/models" },
-    openrouter: { baseUrl: "https://openrouter.ai", path: "/api/v1/models" },
+/**
+ * Path suffixes per provider, RELATIVE to the pi-ai catalog baseUrl.
+ *
+ * Pi-ai's catalog baseUrl shape is NOT uniform across providers:
+ *   - HOST-ONLY for anthropic ("https://api.anthropic.com"), mistral, deepseek
+ *     -> path here must include the version prefix ("/v1/models").
+ *   - PREFIXED with the version segment for openai ("https://api.openai.com/v1"),
+ *     google ("/v1beta"), groq ("/openai/v1"), xai ("/v1"), cerebras ("/v1"),
+ *     openrouter ("/api/v1") -> path here must NOT repeat the version segment;
+ *     append "/models" only.
+ *
+ * Composing entry.baseUrl + entry.path therefore produces the canonical /models
+ * endpoint for each provider (e.g., https://api.openai.com/v1/models,
+ * https://generativelanguage.googleapis.com/v1beta/models,
+ * https://api.groq.com/openai/v1/models).
+ *
+ * Follow-up to 260501-kqq Sub-Fix C: that migration replaced the static
+ * PROVIDER_VALIDATION map (which had host-only baseUrls + correct /v1/models
+ * suffixes) with the catalog-driven `getValidationEndpoint` helper, but the
+ * path-table values were copied verbatim -- producing double-prefixed URLs
+ * (e.g., https://api.openai.com/v1/v1/models -> 404) for the 6 providers
+ * whose catalog baseUrl includes the version segment. 260501-mvw corrects
+ * the table; the helper itself is unchanged.
+ *
+ * Drift risk: if pi-ai upgrades a provider's baseUrl AND its path convention
+ * changes, this table must be updated. Acceptable trade-off -- explicit
+ * beats clever (auto-detection of duplicated path segments could mask
+ * legitimate future shape changes).
+ *
+ * Excluded: `together` and `ollama` are NOT in pi-ai 0.71.0's catalog
+ * (`getModels(p)[0]?.baseUrl` returns undefined for both). The line-130
+ * fallback (`if (!entry) return { valid: true };`) handles them by
+ * skipping live validation entirely. For `together` this is a deliberate
+ * behavior change vs the pre-260501-kqq state -- live validation against
+ * api.together.xyz is now skipped. Users can still target Together via
+ * the synthetic `custom` endpoint route.
+ */
+const PROVIDER_VALIDATION_PATHS = {
+    // Catalog baseUrl is HOST-ONLY for these providers -> path needs the /v1 prefix.
+    anthropic: "/v1/models",
+    mistral: "/v1/models",
+    deepseek: "/v1/models",
+    // Catalog baseUrl ALREADY INCLUDES the version prefix for these providers
+    // (e.g., openai's baseUrl is "https://api.openai.com/v1", openrouter's is
+    // "https://openrouter.ai/api/v1") -- append /models only.
+    openai: "/models",
+    google: "/models",
+    groq: "/models",
+    xai: "/models",
+    cerebras: "/models",
+    openrouter: "/models",
 };
+/**
+ * Resolve the validation endpoint for a provider by reading the catalog
+ * baseUrl from pi-ai (260501-gyy precedent: builtin-provider-guard.ts:45)
+ * and combining it with a known path from PROVIDER_VALIDATION_PATHS.
+ *
+ * Returns `undefined` for providers not in the catalog (or providers
+ * with no models, e.g., ollama with no remote endpoint) -- callers
+ * skip live validation in that case.
+ */
+function getValidationEndpoint(provider) {
+    const baseUrl = getModels(provider)[0]?.baseUrl;
+    if (!baseUrl)
+        return undefined;
+    // eslint-disable-next-line security/detect-object-injection -- read of static const map indexed by validated provider string
+    const path = PROVIDER_VALIDATION_PATHS[provider] ?? "/v1/models";
+    return { baseUrl, path };
+}
 // ---------- Live Validation ----------
 /**
  * Validate an API key against the provider's /models endpoint.
@@ -91,7 +149,7 @@ async function validateKeyLive(provider, apiKey, authMethod) {
     if (authMethod === "oauth") {
         return { valid: true };
     }
-    const entry = PROVIDER_VALIDATION[provider];
+    const entry = getValidationEndpoint(provider);
     if (!entry) {
         return { valid: true };
     }

package/node_modules/@comis/cli/dist/wizard/steps/05-agent.js

@@ -11,20 +11,6 @@
  */
 import { updateState, sectionSeparator, validateAgentName, } from "../index.js";
 import { createModelCatalog } from "@comis/agent";
-// ---------- Recommended Models Per Provider ----------
-const RECOMMENDED_MODELS = {
-    anthropic: "claude-sonnet-4-5-20250929",
-    openai: "gpt-4o",
-    google: "gemini-2.0-flash",
-    groq: "llama-3.3-70b-versatile",
-    mistral: "mistral-large-latest",
-    deepseek: "deepseek-chat",
-    xai: "grok-2",
-    together: "meta-llama/Meta-Llama-3.1-70B-Instruct-Turbo",
-    cerebras: "llama-3.3-70b",
-    openrouter: "anthropic/claude-sonnet-4-5-20250929",
-    ollama: "llama3",
-};
 // ---------- Helpers ----------
 function formatModelHint(m) {
     const parts = [];
@@ -67,8 +53,6 @@ export const agentStep = {
         catch {
             // Fallback: empty catalog, will use recommended default only
         }
-        const providerId = state.provider?.id ?? "";
-        const recommended = RECOMMENDED_MODELS[providerId];
         // 4. QuickStart flow -- use "default" so the daemon picks the model at runtime
         if (state.flow === "quickstart") {
             prompter.log.info("Model: default");
@@ -87,11 +71,13 @@ export const agentStep = {
                 label: "Custom model ID...",
                 hint: "Enter a model ID manually",
             });
+            // Initial value: state.model takes precedence; otherwise the
+            // first catalog entry. No hardcoded recommendation lookup --
+            // pi-ai's catalog ordering is the source of truth.
             const chosen = await prompter.select({
                 message: "Select a model",
                 options,
-                initialValue: state.model
-                    ?? (recommended && catalogModels.some((m) => m.modelId === recommended) ? recommended : undefined),
+                initialValue: state.model ?? catalogModels[0]?.modelId,
             });
             if (chosen === "__custom__") {
                 selectedModel = await prompter.text({
@@ -107,8 +93,8 @@ export const agentStep = {
             // Empty catalog -- go directly to custom text input
             selectedModel = await prompter.text({
                 message: "Model ID",
-                placeholder: recommended ?? "model-name",
-                defaultValue: state.model ?? recommended,
+                placeholder: state.model ?? "model-name",
+                defaultValue: state.model,
             });
         }
         return updateState(state, { agentName, model: selectedModel });

package/node_modules/@comis/cli/dist/wizard/types.d.ts

@@ -134,20 +134,6 @@ export type WizardResult = {
     envPath?: string;
     error?: WizardError;
 };
-/** Supported provider entry for selection prompts. */
-export type SupportedProvider = {
-    id: string;
-    label: string;
-    hint?: string;
-    category: "recommended" | "other" | "local" | "custom";
-};
-/**
- * All supported LLM providers, grouped by category.
- *
- * Categories: recommended (top picks), other (cloud APIs),
- * local (self-hosted), custom (user-defined endpoints).
- */
-export declare const SUPPORTED_PROVIDERS: readonly SupportedProvider[];
 /** Supported channel entry for selection prompts. */
 export type SupportedChannel = {
     type: ChannelConfig["type"];

package/node_modules/@comis/cli/dist/wizard/types.js

@@ -9,30 +9,6 @@
  */
 /** Starting state for a new wizard run. */
 export const INITIAL_STATE = { completedSteps: [] };
-/**
- * All supported LLM providers, grouped by category.
- *
- * Categories: recommended (top picks), other (cloud APIs),
- * local (self-hosted), custom (user-defined endpoints).
- */
-export const SUPPORTED_PROVIDERS = [
-    // Recommended
-    { id: "anthropic", label: "Anthropic (Claude)", hint: "Recommended for agents", category: "recommended" },
-    { id: "openai", label: "OpenAI (GPT)", hint: "GPT-4o, o1, o3 models", category: "recommended" },
-    // Other Providers
-    { id: "google", label: "Google (Gemini)", hint: "Gemini models", category: "other" },
-    { id: "groq", label: "Groq", hint: "Fast inference (Llama, Mixtral)", category: "other" },
-    { id: "mistral", label: "Mistral", hint: "Mistral models", category: "other" },
-    { id: "deepseek", label: "DeepSeek", hint: "DeepSeek models", category: "other" },
-    { id: "xai", label: "xAI (Grok)", hint: "Grok models", category: "other" },
-    { id: "together", label: "Together AI", hint: "Open-source model hosting", category: "other" },
-    { id: "cerebras", label: "Cerebras", hint: "Fast inference", category: "other" },
-    { id: "openrouter", label: "OpenRouter", hint: "Multi-provider routing", category: "other" },
-    // Local
-    { id: "ollama", label: "Ollama (local)", hint: "No API key needed", category: "local" },
-    // Custom
-    { id: "custom", label: "Custom endpoint", hint: "OpenAI-compatible API", category: "custom" },
-];
 /** All supported chat channels with credential guidance. */
 export const SUPPORTED_CHANNELS = [
     { type: "telegram", label: "Telegram", credentialHint: "Bot token from @BotFather" },

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",

package/node_modules/@comis/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comis/web",
-  "version": "1.0.30",
+  "version": "1.0.31",
   "description": "Web dashboard SPA for Comis agent management",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "comisai",
-  "version": "1.0.30",
+  "version": "1.0.31",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "comisai",
-      "version": "1.0.30",
+      "version": "1.0.31",
       "bundleDependencies": [
         "@comis/shared",
         "@comis/core",
@@ -26,18 +26,18 @@
         "@agentclientprotocol/sdk": "0.19.2",
         "@clack/core": "1.2.0",
         "@clack/prompts": "1.2.0",
-        "@comis/agent": "1.0.30",
-        "@comis/channels": "1.0.30",
-        "@comis/cli": "1.0.30",
-        "@comis/core": "1.0.30",
-        "@comis/daemon": "1.0.30",
-        "@comis/gateway": "1.0.30",
-        "@comis/infra": "1.0.30",
-        "@comis/memory": "1.0.30",
-        "@comis/scheduler": "1.0.30",
-        "@comis/shared": "1.0.30",
-        "@comis/skills": "1.0.30",
-        "@comis/web": "1.0.30",
+        "@comis/agent": "1.0.31",
+        "@comis/channels": "1.0.31",
+        "@comis/cli": "1.0.31",
+        "@comis/core": "1.0.31",
+        "@comis/daemon": "1.0.31",
+        "@comis/gateway": "1.0.31",
+        "@comis/infra": "1.0.31",
+        "@comis/memory": "1.0.31",
+        "@comis/scheduler": "1.0.31",
+        "@comis/shared": "1.0.31",
+        "@comis/skills": "1.0.31",
+        "@comis/web": "1.0.31",
         "@elevenlabs/elevenlabs-js": "2.45.0",
         "@fal-ai/client": "1.9.6",
         "@google/genai": "1.50.1",
@@ -851,7 +851,7 @@
       }
     },
     "node_modules/@comis/agent": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -859,7 +859,7 @@
       }
     },
     "node_modules/@comis/channels": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -867,7 +867,7 @@
       }
     },
     "node_modules/@comis/cli": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "bin": {
@@ -878,7 +878,7 @@
       }
     },
     "node_modules/@comis/core": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -886,7 +886,7 @@
       }
     },
     "node_modules/@comis/daemon": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "bin": {
@@ -900,7 +900,7 @@
       }
     },
     "node_modules/@comis/gateway": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -908,7 +908,7 @@
       }
     },
     "node_modules/@comis/infra": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -916,7 +916,7 @@
       }
     },
     "node_modules/@comis/memory": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -924,7 +924,7 @@
       }
     },
     "node_modules/@comis/scheduler": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -932,7 +932,7 @@
       }
     },
     "node_modules/@comis/shared": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -940,7 +940,7 @@
       }
     },
     "node_modules/@comis/skills": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0",
       "engines": {
@@ -948,7 +948,7 @@
       }
     },
     "node_modules/@comis/web": {
-      "version": "1.0.30",
+      "version": "1.0.31",
       "inBundle": true,
       "license": "Apache-2.0"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comisai",
-  "version": "1.0.30",
+  "version": "1.0.31",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Security-first AI agent platform — connects AI agents to Discord, Telegram, Slack, WhatsApp, and more",
@@ -111,18 +111,18 @@
     "@comis/web"
   ],
   "dependencies": {
-    "@comis/shared": "1.0.30",
-    "@comis/core": "1.0.30",
-    "@comis/infra": "1.0.30",
-    "@comis/memory": "1.0.30",
-    "@comis/gateway": "1.0.30",
-    "@comis/skills": "1.0.30",
-    "@comis/scheduler": "1.0.30",
-    "@comis/agent": "1.0.30",
-    "@comis/channels": "1.0.30",
-    "@comis/cli": "1.0.30",
-    "@comis/daemon": "1.0.30",
-    "@comis/web": "1.0.30",
+    "@comis/shared": "1.0.31",
+    "@comis/core": "1.0.31",
+    "@comis/infra": "1.0.31",
+    "@comis/memory": "1.0.31",
+    "@comis/gateway": "1.0.31",
+    "@comis/skills": "1.0.31",
+    "@comis/scheduler": "1.0.31",
+    "@comis/agent": "1.0.31",
+    "@comis/channels": "1.0.31",
+    "@comis/cli": "1.0.31",
+    "@comis/daemon": "1.0.31",
+    "@comis/web": "1.0.31",
     "@agentclientprotocol/sdk": "0.19.2",
     "@clack/core": "1.2.0",
     "@clack/prompts": "1.2.0",