cozyclay 2.1.0 → 3.0.0

package/bin/agent/cliproxy-provider.mjs

@@ -0,0 +1,135 @@
+// CLIProxyAPI, the one provider CozyClay adds to pi's built-ins (moved out of providers.mjs for #pi-login).
+// Its login is pi's own api-key login shape: the flow asks for the server address and then the key, and
+// returns one api-key credential that carries the address as provider env (CLIPROXY_BASE_URL), so an app
+// opened from the Dock needs no shell variable. The address is read when the registry is built: the
+// environment wins, then the stored credential's env, then the default local port.
+
+const CLIPROXY_DEFAULT_BASE = "http://127.0.0.1:8317";
+const BASE_ENV = "CLIPROXY_BASE_URL";
+const KEY_ENV = "CLIPROXY_API_KEY";
+
+/** A server address as typed, cleaned: http(s), no trailing slash, no trailing /v1 (the models add it). */
+function cleanBase(value) {
+	const url = new URL(String(value ?? "").trim());
+	if (!["http:", "https:"].includes(url.protocol)) throw new Error("The server address must start with http:// or https://.");
+	return url.href.replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
+/** The address the registry builds CLIProxyAPI's models on: environment, then the stored credential, then the default. */
+export function cliproxyBase({ env = process.env, credential } = {}) {
+	const fromEnv = typeof env?.[BASE_ENV] === "string" ? env[BASE_ENV].trim() : "";
+	return (fromEnv || credential?.env?.[BASE_ENV] || CLIPROXY_DEFAULT_BASE).replace(/\/$/, "");
+}
+
+/** pi ApiKeyAuth: login asks for the address, then the key; resolve prefers the stored key, then CLIPROXY_API_KEY. */
+function cliproxyAuth() {
+	return {
+		name: "CLIProxyAPI server and key",
+		login: async (interaction) => {
+			interaction.signal.throwIfAborted();
+			const address = await interaction.prompt({ type: "text", message: "CLIProxyAPI server address", placeholder: CLIPROXY_DEFAULT_BASE });
+			const base = cleanBase(address.trim() || CLIPROXY_DEFAULT_BASE);
+			interaction.signal.throwIfAborted();
+			const key = await interaction.prompt({ type: "secret", message: "CLIProxyAPI key" });
+			interaction.signal.throwIfAborted();
+			return { type: "api_key", key, env: { [BASE_ENV]: base } };
+		},
+		resolve: async ({ ctx, credential, signal }) => {
+			signal.throwIfAborted();
+			if (credential?.key) return { auth: { apiKey: credential.key }, env: credential.env, source: "stored credential" };
+			const key = await ctx.env(KEY_ENV);
+			return key ? { auth: { apiKey: key }, source: KEY_ENV } : undefined;
+		},
+	};
+}
+
+export async function cliproxyProvider({ baseUrl, env = process.env } = {}) {
+	const base = (baseUrl ?? cliproxyBase({ env })).replace(/\/$/, "");
+	const [{ createProvider }, { openaiProvider }, { anthropicProvider }, openaiResponsesApi, anthropicMessagesApi] = await Promise.all([
+		import("@earendil-works/pi-ai"),
+		import("@earendil-works/pi-ai/providers/openai"),
+		import("@earendil-works/pi-ai/providers/anthropic"),
+		import("@earendil-works/pi-ai/api/openai-responses"),
+		import("@earendil-works/pi-ai/api/anthropic-messages"),
+	]);
+	const ids = new Set();
+	const models = [
+		...openaiProvider().getModels().map((model) => ({ ...model, provider: "cliproxy", baseUrl: `${base}/v1` })),
+		...anthropicProvider().getModels().map((model) => ({
+			...model,
+			provider: "cliproxy",
+			baseUrl: base,
+			// CLIProxyAPI's /v1/messages rejects messages[].output_config and thinking.block_binding, so keep
+			// adaptive thinking (forceAdaptiveThinking) but drop the mid-conversation output_config shape.
+			compat: { ...model.compat, supportsMidConvoEffort: false },
+		})),
+	].filter((model) => !ids.has(model.id) && ids.add(model.id));
+	return createProvider({
+		id: "cliproxy",
+		name: "CLIProxyAPI",
+		baseUrl: base,
+		auth: { apiKey: cliproxyAuth() },
+		models,
+		api: { "openai-responses": openaiResponsesApi, "anthropic-messages": anthropicMessagesApi },
+	});
+}
+
+/** The proxy's own /v1/models (id -> owner), fetched once per registry; a failed fetch is asked again next time. */
+export async function registryLiveCliproxy(models, apiKey, state) {
+	if (!state.cliproxyFetch) {
+		state.cliproxyFetch = Promise.resolve().then(async () => {
+			const provider = models?.getProvider?.("cliproxy");
+			const model = provider?.getModels?.().find((entry) => entry.api === "openai-responses");
+			if (!model?.baseUrl || !apiKey) throw new Error("CLIProxyAPI is not configured");
+			const response = await fetch(`${model.baseUrl}/models`, {
+				headers: { Authorization: `Bearer ${apiKey}` },
+				signal: AbortSignal.timeout(5000),
+			});
+			if (!response.ok) throw new Error(`CLIProxyAPI models request failed: ${response.status}`);
+			const body = await response.json();
+			// id -> owned_by: the owner is how CLIProxyAPI routes a model (openai, anthropic, or an
+			// openai-compatibility upstream name), so it picks the wire format for models pi does not know.
+			return new Map((Array.isArray(body?.data) ? body.data : [])
+				.map((entry) => typeof entry === "string" ? [entry, undefined] : [entry?.id, typeof entry?.owned_by === "string" ? entry.owned_by : undefined])
+				.filter(([id]) => id));
+		}).catch(() => { state.cliproxyFetch = null; return null; });
+	}
+	return state.cliproxyFetch;
+}
+
+const CLIPROXY_NON_CHAT = /^gpt-image-|-auto-review$/;
+
+/** A live CLIProxyAPI model pi's catalogue does not know yet (#400 follow-up), built on the newest
+ * catalogue model of the same family and wire format: `owned_by: openai` rides openai-responses,
+ * `owned_by: anthropic` rides anthropic-messages. Other owners (openai-compatibility upstreams such as
+ * opencode-go) are left out: they need upstream-specific headers the proxy does not pass through. */
+export function cliproxyLiveModel(id, owner, knownModels) {
+	if (CLIPROXY_NON_CHAT.test(id)) return null;
+	const api = owner === "openai" ? "openai-responses" : owner === "anthropic" ? "anthropic-messages" : null;
+	if (!api) return null;
+	const candidates = knownModels.filter((model) => model.api === api);
+	const family = owner === "anthropic" ? id.match(/^claude-[a-z]+/)?.[0] : id.match(/^gpt-\d+/)?.[0];
+	const sameFamily = family ? candidates.filter((model) => model.id.startsWith(family)) : [];
+	const template = [...(sameFamily.length ? sameFamily : candidates)].sort((a, b) => b.id.localeCompare(a.id, undefined, { numeric: true }))[0];
+	if (!template) return null;
+	// The 5-5 claude generation rejects thinking {type:"disabled"}; a null "off" makes pi-ai send no thinking block (#723).
+	const generation = owner === "anthropic" ? id.match(/-(\d+)-(\d+)$/) : null;
+	if (generation && Number(generation[1]) >= 5) return { ...template, id, name: id, thinkingLevelMap: { ...template.thinkingLevelMap, off: null } };
+	return { ...template, id, name: id };
+}
+
+export function extendCliproxyProvider(provider, live, state) {
+	if (state.extendedProviders.has(provider)) return false;
+	const getModels = provider.getModels.bind(provider);
+	const knownModels = getModels();
+	const known = new Set(knownModels.map((model) => model.id));
+	const additions = [...live]
+		.filter(([id]) => !known.has(id))
+		.map(([id, owner]) => cliproxyLiveModel(id, owner, knownModels))
+		.filter(Boolean)
+		.sort((a, b) => b.id.localeCompare(a.id, undefined, { numeric: true }));
+	if (!additions.length) return false;
+	provider.getModels = () => [...getModels(), ...additions];
+	state.extendedProviders.add(provider);
+	return true;
+}

package/bin/agent/credential-store.mjs

@@ -1,4 +1,5 @@
 import { PROVIDERS } from "./providers.mjs";
+import { readCredentials, removeCredential, setCredential } from "./provider-keys.mjs";
 
 const codexId = "openai-codex";
 const apiProvider = (id) => PROVIDERS.find((provider) => provider.id === id);
@@ -44,7 +45,12 @@ function rawOAuth(credential) {
 	};
 }
 
-export function createCredentialStore({ auth, keys, env = process.env }) {
+// pi's CredentialStore for every provider pi can log in to (#pi-login): ChatGPT stays in codex-auth's file (its
+// id_token carries the plan and account the image routes need), a bare api key in providers.json, and what pi's
+// login flows return beyond that (OAuth tokens, api keys with provider env) in auth.json. A credential that
+// lands in one file is removed from the other, so one provider never has two.
+
+export function createCredentialStore({ auth, keys, env = process.env, credentialFile = { read: readCredentials, set: setCredential, remove: removeCredential } }) {
 	const configured = (id) => apiProvider(id);
 	return {
 		async read(providerId, { signal } = {}) {
@@ -54,8 +60,11 @@ export function createCredentialStore({ auth, keys, env = process.env }) {
 				return mapOAuth(stored);
 			}
 			const provider = configured(providerId);
-			if (!provider) return undefined;
-			const key = envValue(provider, env) ?? keys.readKeys()[providerId];
+			const fromEnv = provider && envValue(provider, env);
+			if (fromEnv) return { type: "api_key", key: fromEnv };
+			const credential = credentialFile.read()[providerId];
+			if (credential) return credential;
+			const key = keys.readKeys()[providerId];
 			return key ? { type: "api_key", key } : undefined;
 		},
 		async list({ signal } = {}) {
@@ -68,8 +77,13 @@ export function createCredentialStore({ auth, keys, env = process.env }) {
 					if (stored) result.push({ providerId: provider.id, type: "oauth", source: "chatgpt" });
 					continue;
 				}
-				const source = envValue(provider, env) ? "env" : saved[provider.id] ? "file" : null;
-				if (source) result.push({ providerId: provider.id, type: "api_key", source });
+				const source = envValue(provider, env) ? "env" : saved[provider.id] || credentialFile.read()[provider.id] ? "file" : null;
+				if (source) result.push({ providerId: provider.id, type: credentialFile.read()[provider.id]?.type ?? "api_key", source });
+			}
+			// providers outside the curated list that a pi login stored
+			const listed = new Set(result.map((entry) => entry.providerId));
+			for (const [providerId, credential] of Object.entries({ ...Object.fromEntries(Object.keys(saved).map((id) => [id, { type: "api_key" }])), ...credentialFile.read() })) {
+				if (!listed.has(providerId)) result.push({ providerId, type: credential.type, source: "file" });
 			}
 			return result;
 		},
@@ -79,14 +93,23 @@ export function createCredentialStore({ auth, keys, env = process.env }) {
 				const next = await fn(current);
 				if (next === undefined) return current;
 				if (providerId === codexId) await auth.writeStored(rawOAuth(next));
-				else keys.setKey(providerId, next.key);
+				else if (next.type === "api_key" && !next.env) {
+					keys.setKey(providerId, next.key);
+					credentialFile.remove(providerId);
+				} else {
+					credentialFile.set(providerId, next);
+					if (keys.readKeys()[providerId]) keys.removeKey(providerId);
+				}
 				return next;
 			}, signal);
 		},
 		async delete(providerId, { signal } = {}) {
 			await serialized(providerId, async () => {
 				if (providerId === codexId) await auth.logout();
-				else if (configured(providerId)) keys.removeKey(providerId);
+				else {
+					if (keys.readKeys()[providerId]) keys.removeKey(providerId);
+					credentialFile.remove(providerId);
+				}
 			}, signal);
 		},
 	};

package/bin/agent/pi-tools.mjs

@@ -1,6 +1,7 @@
 import { Value } from "typebox/value";
 import { STUDIO_TOOL_LABELS } from "../../src/studio-agent-protocol.js";
 import { toTypeBox } from "./schema-to-typebox.mjs";
+import { toolArgumentPreparer } from "./tool-arguments.mjs";
 
 
 function dataUrlImage(dataUrl) {
@@ -28,12 +29,14 @@ function formatToolError(error) {
 /** Convert CozyClay's handler catalogue into pi AgentTools. */
 export function toAgentTools(tools, { emit, signal, labels = STUDIO_TOOL_LABELS } = {}) {
 	return (Array.isArray(tools) ? tools : []).map((tool) => {
-		const parameters = toTypeBox(tool.parameters || { type: "object", properties: {}, additionalProperties: false });
+		const schema = tool.parameters || { type: "object", properties: {}, additionalProperties: false }, parameters = toTypeBox(schema);
 		return {
 			name: tool.name,
 			label: labels?.[tool.name] ?? tool.label ?? tool.name.replaceAll("_", " "),
 			description: tool.description || tool.name,
 			parameters,
+			// Before pi's own check: array texts parsed, unknown fields named (tool-arguments.mjs).
+			prepareArguments: toolArgumentPreparer(tool.name, schema),
 			// pi's low-level `Agent` calls `execute(id, params, signal, onUpdate)`;
 			// pi's `AgentHarness` calls `execute(id, params, onUpdate, toolContext,
 			// invocation, context)` where `context.abortSignal` is the REAL abort

package/bin/agent/provider-keys.mjs

@@ -54,3 +54,35 @@ export function removeKey(id) {
 	return next;
 }
 
+// Credentials pi's login flows return that are more than a bare key (#pi-login): OAuth tokens (Claude Pro/Max,
+// GitHub Copilot, xAI, Kimi, OpenRouter) and api-key credentials that carry provider env (CLIProxyAPI's server
+// address). They are kept as pi's canonical Credential, one per provider id, in auth.json beside providers.json;
+// a bare api key stays in providers.json as before. credential-store.mjs decides which file a write goes to.
+function authPath() {
+	return join(configDir(), "auth.json");
+}
+
+/** { [providerId]: Credential } from auth.json; a missing or unreadable file is {}. */
+export function readCredentials() {
+	try {
+		const value = JSON.parse(readFileSync(authPath(), "utf8"));
+		if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+		return Object.fromEntries(Object.entries(value).filter(([id, entry]) => id && entry && typeof entry === "object" && ["api_key", "oauth"].includes(entry.type)));
+	} catch {
+		return {};
+	}
+}
+
+export function setCredential(id, credential) {
+	const next = { ...readCredentials(), [id]: credential };
+	writeSecureJson(authPath(), next);
+	return next;
+}
+
+export function removeCredential(id) {
+	const current = readCredentials();
+	if (!(id in current)) return current;
+	delete current[id];
+	writeSecureJson(authPath(), current);
+	return current;
+}

package/bin/agent/provider-login.mjs

@@ -0,0 +1,110 @@
+// pi's provider login (the coding agent's /login) over HTTP for the agent panel (#pi-login). The sidecar
+// runs `models.login(providerId, type, interaction)` itself; the interaction is a queue the panel reads:
+//   { type: "prompt", promptId, prompt: { type: text|secret|select|manual_code, message, placeholder?, options? } }
+//   { type: "event", event: pi AuthEvent (info, auth_url, device_code, progress) }
+//   { type: "prompt_closed", promptId }      pi withdrew a prompt (e.g. a callback beat the pasted code)
+//   { type: "done", ok, message? }
+// and answers with the prompt's value. Nothing the user types is ever put in the queue. pi persists the
+// credential through the registry's CredentialStore (credential-store.mjs); onSignedIn rebuilds the registry.
+import { randomUUID } from "node:crypto";
+
+const WAIT_MS = 25_000;
+const KEEP_MS = 60_000;
+
+/** The login methods pi offers for each provider, as the panel lists them (subscriptions first). */
+export async function loginOptions(models, { chatgpt } = {}) {
+	const options = [];
+	for (const provider of models.getProviders()) {
+		const auth = provider.auth ?? {};
+		// ChatGPT keeps CozyClay's own sign-in: its id_token carries the plan and account the image routes read.
+		const methods = provider.id === "openai-codex"
+			? [{ type: "chatgpt", label: "Sign in with ChatGPT (Plus/Pro)", subscription: true }]
+			: [
+				...(auth.oauth?.login ? [{ type: "oauth", label: auth.oauth.loginLabel || auth.oauth.name, subscription: !!auth.oauth.isSubscription }] : []),
+				...(auth.apiKey?.login ? [{ type: "api_key", label: auth.apiKey.name }] : []),
+			];
+		if (!methods.length) continue;
+		const check = provider.id === "openai-codex"
+			? (chatgpt?.() ? { type: "oauth", source: "ChatGPT" } : undefined)
+			: await models.checkAuth(provider.id).catch(() => undefined);
+		options.push({ id: provider.id, name: provider.name ?? provider.id, methods, connected: !!check, via: check?.type ?? null, source: check?.source ?? null });
+	}
+	const rank = (entry) => (entry.connected ? 0 : entry.methods.some((method) => method.subscription) ? 1 : 2);
+	return options.sort((a, b) => rank(a) - rank(b) || a.name.localeCompare(b.name));
+}
+
+export function createLoginFlows({ getModels, onSignedIn }) {
+	const flows = new Map();
+	const wake = (flow) => { for (const waiter of [...flow.waiters]) waiter(); };
+	const push = (flow, entry) => { flow.events.push(entry); wake(flow); };
+	const finish = (flow, entry) => {
+		flow.done = true;
+		for (const pending of flow.pending.values()) pending.reject(new Error("The login ended."));
+		flow.pending.clear();
+		push(flow, entry);
+		setTimeout(() => flows.delete(flow.id), KEEP_MS).unref?.();
+	};
+
+	function start(providerId, type) {
+		const flow = { id: randomUUID(), providerId, type, events: [], waiters: new Set(), pending: new Map(), controller: new AbortController(), done: false };
+		const interaction = {
+			signal: flow.controller.signal,
+			prompt(prompt) {
+				return new Promise((resolve, reject) => {
+					const promptId = randomUUID();
+					flow.pending.set(promptId, { resolve, reject });
+					const { signal, ...shown } = prompt;
+					push(flow, { type: "prompt", promptId, prompt: shown });
+					signal?.addEventListener("abort", () => {
+						if (!flow.pending.delete(promptId)) return;
+						push(flow, { type: "prompt_closed", promptId });
+						reject(signal.reason ?? new Error("The prompt was withdrawn."));
+					}, { once: true });
+				});
+			},
+			notify(event) { push(flow, { type: "event", event }); },
+		};
+		flows.set(flow.id, flow);
+		void (async () => {
+			try {
+				await (await getModels()).login(providerId, type, interaction);
+				await onSignedIn?.(providerId);
+				finish(flow, { type: "done", ok: true });
+			} catch (error) {
+				finish(flow, { type: "done", ok: false, message: flow.controller.signal.aborted ? "The login was cancelled." : String(error?.message || error || "The login failed.") });
+			}
+		})();
+		return flow.id;
+	}
+
+	/** Entries after `after`, waiting up to WAIT_MS for the first new one; null for an unknown flow. */
+	async function read(id, after = 0) {
+		const flow = flows.get(id);
+		if (!flow) return null;
+		if (flow.events.length <= after && !flow.done) {
+			await new Promise((resolve) => {
+				const done = () => { clearTimeout(timer); flow.waiters.delete(done); resolve(); };
+				const timer = setTimeout(done, WAIT_MS);
+				flow.waiters.add(done);
+			});
+		}
+		return { events: flow.events.slice(after), next: flow.events.length, done: flow.done };
+	}
+
+	function answer(id, promptId, value) {
+		const pending = flows.get(id)?.pending.get(promptId);
+		if (!pending) return false;
+		flows.get(id).pending.delete(promptId);
+		pending.resolve(String(value ?? ""));
+		return true;
+	}
+
+	function cancel(id) {
+		const flow = flows.get(id);
+		if (!flow || flow.done) return false;
+		flow.controller.abort();
+		return true;
+	}
+
+	return { start, read, answer, cancel };
+}

package/bin/agent/provider-routes.mjs

@@ -0,0 +1,99 @@
+// Provider routes (moved out of agent-routes.mjs):
+//   GET    /agent/providers                 the curated providers' sign-in state (MCP and older panels)
+//   PUT    /agent/providers/:id             { key }: store a bare api key for a curated provider
+//   DELETE /agent/providers/:id             forget a curated provider's key
+// and pi's own login (#pi-login), which the panel uses for every provider pi ships:
+//   GET    /agent/logins                    each provider's login methods and whether it is connected
+//   POST   /agent/logins                    { providerId, type: "oauth" | "api_key" } -> { flowId }
+//   GET    /agent/logins/:flowId?after=n    the flow's prompts and events after n (long poll, provider-login.mjs)
+//   POST   /agent/logins/:flowId/answer     { promptId, value }
+//   DELETE /agent/logins/:flowId            cancel the flow
+//   POST   /agent/logout/:providerId        pi's logout for that provider
+// Every credential change calls onChange, so the model registry is rebuilt with what was just stored.
+import { createLoginFlows, loginOptions } from "./provider-login.mjs";
+
+const KEY_PATH = /^\/agent\/providers\/([^/]+)$/;
+const FLOW_PATH = /^\/agent\/logins\/([^/]+)(\/answer)?$/;
+const LOGOUT_PATH = /^\/agent\/logout\/([^/]+)$/;
+
+/** Returns the route handler for one sidecar; `getModels` is its registry, `onChange` rebuilds it. */
+export function createProviderRoutes({ auth, getModels, onChange, json, readBody }) {
+	const flows = createLoginFlows({ getModels, onSignedIn: () => onChange?.() });
+	return async function handleProviderRoute(req, res, path) {
+		if (path === "/agent/providers" && req.method === "GET") {
+			const { providerStatus } = await import("./providers.mjs");
+			try { json(res, 200, { providers: providerStatus({ auth }) }); }
+			catch { json(res, 500, { error: "provider credentials unavailable" }); }
+			return true;
+		}
+		const keyMatch = KEY_PATH.exec(path);
+		if (keyMatch && ["PUT", "DELETE"].includes(req.method)) return keyRoute(req, res, keyMatch[1]);
+		if (path === "/agent/logins" && req.method === "GET") {
+			try { json(res, 200, { providers: await loginOptions(await getModels(), { chatgpt: () => !!auth.status?.().signedIn }) }); }
+			catch (error) { json(res, 502, { error: String(error?.message || error) }); }
+			return true;
+		}
+		if (path === "/agent/logins" && req.method === "POST") {
+			let value;
+			try { value = await readBody(req); } catch { json(res, 400, { error: "invalid request" }); return true; }
+			const models = await getModels();
+			const provider = models.getProvider(String(value?.providerId ?? ""));
+			const method = value?.type === "oauth" ? provider?.auth?.oauth : value?.type === "api_key" ? provider?.auth?.apiKey : null;
+			if (!provider || !method?.login || provider.id === "openai-codex") { json(res, 400, { error: "That provider has no such login." }); return true; }
+			json(res, 200, { flowId: flows.start(provider.id, value.type) });
+			return true;
+		}
+		const flowMatch = FLOW_PATH.exec(path);
+		if (flowMatch && !flowMatch[2] && req.method === "GET") {
+			const after = Number(new URL(req.url, "http://127.0.0.1").searchParams.get("after")) || 0;
+			const page = await flows.read(flowMatch[1], after);
+			if (!page) json(res, 404, { error: "login not found" }); else json(res, 200, page);
+			return true;
+		}
+		if (flowMatch && flowMatch[2] && req.method === "POST") {
+			let value;
+			try { value = await readBody(req); } catch { json(res, 400, { error: "invalid request" }); return true; }
+			if (!flows.answer(flowMatch[1], String(value?.promptId ?? ""), value?.value)) { json(res, 409, { error: "That prompt is no longer open." }); return true; }
+			json(res, 200, { ok: true });
+			return true;
+		}
+		if (flowMatch && !flowMatch[2] && req.method === "DELETE") {
+			json(res, 200, { ok: flows.cancel(flowMatch[1]) });
+			return true;
+		}
+		const logoutMatch = LOGOUT_PATH.exec(path);
+		if (logoutMatch && req.method === "POST") {
+			if (logoutMatch[1] === "openai-codex") { json(res, 400, { error: "Use Sign out for ChatGPT." }); return true; }
+			try { await (await getModels()).logout(logoutMatch[1]); }
+			catch (error) { json(res, 500, { error: String(error?.message || error) }); return true; }
+			await onChange?.();
+			json(res, 200, { ok: true });
+			return true;
+		}
+		return false;
+	};
+
+	async function keyRoute(req, res, id) {
+		const { PROVIDERS } = await import("./providers.mjs");
+		const keys = await import("./provider-keys.mjs");
+		const { createCredentialStore } = await import("./credential-store.mjs");
+		if (!PROVIDERS.some((provider) => provider.id === id)) { json(res, 404, { error: "provider not found" }); return true; }
+		const credentials = createCredentialStore({ auth, keys });
+		let key;
+		if (req.method === "PUT") {
+			if (id === "openai-codex") { json(res, 400, { error: "Use ChatGPT sign-in for OpenAI Codex." }); return true; }
+			try {
+				const value = await readBody(req);
+				if (typeof value?.key !== "string" || !value.key.trim()) throw new Error("Invalid key.");
+				key = value.key.trim();
+			} catch { json(res, 400, { error: "a non-empty API key is required" }); return true; }
+		}
+		try {
+			if (req.method === "PUT") await credentials.modify(id, async () => ({ type: "api_key", key }));
+			else await credentials.delete(id);
+		} catch { json(res, 500, { error: "provider credentials could not be saved" }); return true; }
+		await onChange?.();
+		json(res, 200, { ok: true });
+		return true;
+	}
+}

package/bin/agent/providers.mjs

@@ -2,6 +2,9 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import * as defaultAuth from "../codex-auth.mjs";
 import * as defaultKeys from "./provider-keys.mjs";
 import { createCredentialStore } from "./credential-store.mjs";
+import { readCredentials } from "./provider-keys.mjs";
+import { cliproxyBase, cliproxyProvider, extendCliproxyProvider, registryLiveCliproxy } from "./cliproxy-provider.mjs";
+export { cliproxyLiveModel } from "./cliproxy-provider.mjs";
 
 // #379 (F2 pass 5 finding 4): pi never forwards a per-request `fetch` to the
 // codex API module — `pi-agent-core`'s `createRequestOptions` (the options
@@ -69,37 +72,6 @@ const factories = {
 	openrouter: "openrouterProvider",
 };
 
-async function cliproxyProvider({ baseUrl, env = process.env } = {}) {
-	const base = (baseUrl ?? env.CLIPROXY_BASE_URL ?? "http://127.0.0.1:8317").replace(/\/$/, "");
-	const [{ createProvider, envApiKeyAuth }, { openaiProvider }, { anthropicProvider }, openaiResponsesApi, anthropicMessagesApi] = await Promise.all([
-		import("@earendil-works/pi-ai"),
-		import("@earendil-works/pi-ai/providers/openai"),
-		import("@earendil-works/pi-ai/providers/anthropic"),
-		import("@earendil-works/pi-ai/api/openai-responses"),
-		import("@earendil-works/pi-ai/api/anthropic-messages"),
-	]);
-	const ids = new Set();
-	const models = [
-		...openaiProvider().getModels().map((model) => ({ ...model, provider: "cliproxy", baseUrl: `${base}/v1` })),
-		...anthropicProvider().getModels().map((model) => ({
-			...model,
-			provider: "cliproxy",
-			baseUrl: base,
-			// CLIProxyAPI's /v1/messages rejects messages[].output_config and thinking.block_binding, so keep
-			// adaptive thinking (forceAdaptiveThinking) but drop the mid-conversation output_config shape.
-			compat: { ...model.compat, supportsMidConvoEffort: false },
-		})),
-	].filter((model) => !ids.has(model.id) && ids.add(model.id));
-	return createProvider({
-		id: "cliproxy",
-		name: "CLIProxyAPI",
-		baseUrl: base,
-		auth: { apiKey: envApiKeyAuth("CLIProxyAPI key", ["CLIPROXY_API_KEY"]) },
-		models,
-		api: { "openai-responses": openaiResponsesApi, "anthropic-messages": anthropicMessagesApi },
-	});
-}
-
 const providerConfig = (id) => PROVIDERS.find((provider) => provider.id === id);
 
 export async function loadProvider(id, options = {}) {
@@ -159,7 +131,7 @@ async function registryLiveCatalogue(models, codex) {
 		state.fetch = Promise.resolve().then(() => codex.listModels()).then((result) => {
 			state.models = liveModelsCodex(result);
 			return state.models;
-		}).catch(() => []);
+		}).catch(() => { state.fetch = null; return []; });
 	}
 	return state.fetch;
 }
@@ -176,75 +148,17 @@ async function registerLiveCodexModels(models, codex) {
 	return live;
 }
 
-async function registryLiveCliproxy(models, apiKey) {
-	const state = catalogueState(models);
-	if (!state.cliproxyFetch) {
-		state.cliproxyFetch = Promise.resolve().then(async () => {
-			const provider = models?.getProvider?.("cliproxy");
-			const model = provider?.getModels?.().find((entry) => entry.api === "openai-responses");
-			if (!model?.baseUrl || !apiKey) throw new Error("CLIProxyAPI is not configured");
-			const response = await fetch(`${model.baseUrl}/models`, {
-				headers: { Authorization: `Bearer ${apiKey}` },
-				signal: AbortSignal.timeout(5000),
-			});
-			if (!response.ok) throw new Error(`CLIProxyAPI models request failed: ${response.status}`);
-			const body = await response.json();
-			// id -> owned_by: the owner is how CLIProxyAPI routes a model (openai, anthropic, or an
-			// openai-compatibility upstream name), so it picks the wire format for models pi does not know.
-			return new Map((Array.isArray(body?.data) ? body.data : [])
-				.map((entry) => typeof entry === "string" ? [entry, undefined] : [entry?.id, typeof entry?.owned_by === "string" ? entry.owned_by : undefined])
-				.filter(([id]) => id));
-		}).catch(() => null);
-	}
-	return state.cliproxyFetch;
-}
-
-const CLIPROXY_NON_CHAT = /^gpt-image-|-auto-review$/;
-
-/** A live CLIProxyAPI model pi's catalogue does not know yet (#400 follow-up), built on the newest
- * catalogue model of the same family and wire format: `owned_by: openai` rides openai-responses,
- * `owned_by: anthropic` rides anthropic-messages. Other owners (openai-compatibility upstreams such as
- * opencode-go) are left out: they need upstream-specific headers the proxy does not pass through. */
-export function cliproxyLiveModel(id, owner, knownModels) {
-	if (CLIPROXY_NON_CHAT.test(id)) return null;
-	const api = owner === "openai" ? "openai-responses" : owner === "anthropic" ? "anthropic-messages" : null;
-	if (!api) return null;
-	const candidates = knownModels.filter((model) => model.api === api);
-	const family = owner === "anthropic" ? id.match(/^claude-[a-z]+/)?.[0] : id.match(/^gpt-\d+/)?.[0];
-	const sameFamily = family ? candidates.filter((model) => model.id.startsWith(family)) : [];
-	const template = [...(sameFamily.length ? sameFamily : candidates)].sort((a, b) => b.id.localeCompare(a.id, undefined, { numeric: true }))[0];
-	if (!template) return null;
-	// The 5-5 claude generation rejects thinking {type:"disabled"}; a null "off" makes pi-ai send no thinking block (#723).
-	const generation = owner === "anthropic" ? id.match(/-(\d+)-(\d+)$/) : null;
-	if (generation && Number(generation[1]) >= 5) return { ...template, id, name: id, thinkingLevelMap: { ...template.thinkingLevelMap, off: null } };
-	return { ...template, id, name: id };
-}
-
-function extendCliproxyProvider(provider, live, state) {
-	if (state.extendedProviders.has(provider)) return false;
-	const getModels = provider.getModels.bind(provider);
-	const knownModels = getModels();
-	const known = new Set(knownModels.map((model) => model.id));
-	const additions = [...live]
-		.filter(([id]) => !known.has(id))
-		.map(([id, owner]) => cliproxyLiveModel(id, owner, knownModels))
-		.filter(Boolean)
-		.sort((a, b) => b.id.localeCompare(a.id, undefined, { numeric: true }));
-	if (!additions.length) return false;
-	provider.getModels = () => [...getModels(), ...additions];
-	state.extendedProviders.add(provider);
-	return true;
-}
-
 export async function createModels({ credentials, auth = defaultAuth, keys = defaultKeys, env = process.env, codexBaseUrl, cliproxyBaseUrl } = {}) {
 	const { createModels: createPiModels } = await import("@earendil-works/pi-ai");
 	const store = credentials ?? createCredentialStore({ auth, keys, env });
 	const models = createPiModels({ credentials: store });
 	for (const provider of PROVIDERS) {
-		const baseUrl = provider.id === "openai-codex" ? codexBaseUrl : provider.id === "cliproxy" ? cliproxyBaseUrl : undefined;
-		const loaded = await loadProvider(provider.id, { baseUrl, env });
-		models.setProvider(loaded);
+		const baseUrl = provider.id === "openai-codex" ? codexBaseUrl : provider.id === "cliproxy" ? cliproxyBaseUrl ?? cliproxyBase({ env, credential: await store.read("cliproxy").catch(() => undefined) }) : undefined;
+		models.setProvider(await loadProvider(provider.id, { baseUrl, env }));
 	}
+	// every other provider pi ships, so each of pi's logins (subscriptions and api keys) has a provider to land on (#pi-login)
+	const { builtinProviders } = await import("@earendil-works/pi-ai/providers/all");
+	for (const provider of builtinProviders()) if (!models.getProvider(provider.id)) models.setProvider(provider);
 	return models;
 }
 
@@ -254,8 +168,9 @@ export async function resolveModel(requested, options = {}) {
 	const slash = value.indexOf("/");
 	const provider = slash === -1 ? "openai-codex" : value.slice(0, slash);
 	const modelId = slash === -1 ? value : value.slice(slash + 1);
-	if (!providerConfig(provider) || !modelId) throw unknownModel(requested);
+	if (!modelId) throw unknownModel(requested);
 	const models = options.models ?? await createModels(options);
+	if (!providerConfig(provider) && !models.getProvider?.(provider)) throw unknownModel(requested);
 	const model = models.getModel(provider, modelId);
 	if (!model) throw unknownModel(requested);
 	return { provider, modelId, model };
@@ -483,7 +398,7 @@ export async function listAgentModels({ models, codex, auth = defaultAuth, keys
 			list = [...list].sort(astraFirst);
 		} else if (provider.id === "cliproxy") {
 			if (signedIn) {
-				const live = await registryLiveCliproxy(resolvedModels, authResult?.auth?.apiKey);
+				const live = await registryLiveCliproxy(resolvedModels, authResult?.auth?.apiKey, catalogueState(resolvedModels));
 				if (live) {
 					// The proxy's own /v1/models is the lineup: register what pi's catalogue has not caught up
 					// with on the shared registry, so the turn route resolves the same ids the dropdown shows.
@@ -496,6 +411,13 @@ export async function listAgentModels({ models, codex, auth = defaultAuth, keys
 		}
 		providers.push({ id: provider.id, label: provider.label, signedIn, authSource, models: list });
 	}
+	// a provider outside the curated list joins the picker once a pi login stored its credential here (#pi-login); ambient
+	// credentials (an AWS profile, cloud ADC files) alone do not list it, so the picker shows what the author connected
+	const stored = new Set([...Object.keys(readCredentials()), ...Object.keys(saved)]);
+	for (const provider of resolvedModels.getProviders?.() ?? []) {
+		const check = providerConfig(provider.id) || !stored.has(provider.id) ? undefined : await resolvedModels.checkAuth?.(provider.id).catch(() => undefined);
+		if (check) providers.push({ id: provider.id, label: provider.name ?? provider.id, signedIn: true, authSource: check.type === "oauth" || /stored/i.test(check.source ?? "") ? "file" : "env", models: catalogModels(resolvedModels, provider.id, getSupportedThinkingLevels) });
+	}
 	// The flat union is what the panel's dropdown reads today (`models[].id`);
 	// with six providers in play the id has to be the provider/id key so two
 	// providers' same-named model never collide there, while each provider's