larkin 0.4.28 → 0.4.29

package/dist/app/agent-config.mjs

@@ -462,7 +462,9 @@ if (kind === "pi-distribution") {
             assertBuiltinPiAgentDirectory(piAgentDirectory(configDir, selectedKey));
         }
         catch {
-            die("内置 Pi provider 尚未为该 Agent 配置；请先运行 larkin setup 完成内置 Pi provider 配置，或使用 --import-external-profile");
+            die(agent.piDistribution === "builtin"
+                ? "内置 Pi provider 尚未为该 Agent 配置。请使用 Dashboard Provider Credentials 或 larkin pi-auth login。"
+                : "内置 Pi provider 尚未为该 Agent 配置。");
         }
     }
     try {

package/dist/app/cli.mjs

@@ -84,8 +84,10 @@ Credentials, internal paths, serverId, activeAgent, and raw config are never exp
        larkin session recover --agent <App ID> --reason context-overflow --json [--wait-ready <seconds>]
 Reset replaces one idle, zero-backlog Runtime session. Recover is an explicit operator-only context-window recovery that preserves and replays canonical Inbox deliveries.`,
     "pi-auth": `Usage: larkin pi-auth status [--agent <App ID>] [--json]
+       larkin pi-auth providers [--json]
+       larkin pi-auth login <preset|custom> --agent <App ID> [--model <model>] [--base-url <url>] [--api-key-stdin] [--json]
        larkin pi-auth logout <provider> [--agent <App ID>]
-Show non-sensitive official Pi credential metadata or remove one target provider credential.`,
+Show a redacted builtin Pi provider catalog, configure one existing Agent with a known preset or custom OpenAI-compatible endpoint, or remove one target provider credential. API keys are accepted only from a TTY prompt or --api-key-stdin.`,
     comment: `Usage: larkin comment reply --message-id <doc_comment_message_id> --text '<reply>' --json
 Reply as the Runtime-bound Bot to the exact cloud-document comment locator supplied by canonical Inbox. Retrying the same body is idempotent; a different body appends a follow-up reply to the same comment.`,
     telemetry: `Usage: larkin telemetry <status|export|import|flush>
@@ -130,7 +132,7 @@ Usage: larkin <command>
   config           Inspect effective config/source, edit mention inheritance, or explicitly apply runtime changes
   session reset    Replace one idle, zero-backlog Agent Runtime session for a fresh scenario
   session recover  Explicitly recover a context-overflowed session and replay retained Inbox deliveries
-  pi-auth          Show non-sensitive built-in Pi auth status or logout one provider
+  pi-auth          Show, configure, or logout one built-in Pi Agent provider credential
   comment reply    Reply to the exact cloud-document comment bound by a polled Inbox message
   telemetry        Inspect, export, import, or flush the durable OpenTelemetry trace queue
   <lark-cli 命令组>  im/docs/wiki/drive 等 lark-cli 命令原样转发，机器人身份已锁定（如 larkin im +chat-list）
@@ -144,7 +146,15 @@ Process persistence is managed externally. larkin start stays in the foreground
 }
 const [mode, ...presetArguments] = routes[command];
 const childSpec = internalCommandSpec(mode, [...presetArguments, ...rest]);
-const child = spawn(childSpec.command, childSpec.args, { stdio: "inherit" });
+// 管道 stdin 必须显式转发：Linux 上 inherit 会在父进程排空后再交给子进程，导致 --api-key-stdin 读到空。
+const pipeStdin = command === "pi-auth" && rest.includes("--api-key-stdin") && !process.stdin.isTTY;
+if (pipeStdin && typeof process.stdin.pause === "function")
+    process.stdin.pause();
+const child = spawn(childSpec.command, childSpec.args, {
+    stdio: [pipeStdin ? "pipe" : "inherit", "inherit", "inherit"],
+});
+if (pipeStdin && child.stdin)
+    process.stdin.pipe(child.stdin);
 // Package-manager bin shims add a wrapper process. Forward terminal signals so the actual command
 // does not become an orphan that keeps the machine lock or Feishu connection.
 const signalForwarders = new Map();

package/dist/app/local-control.mjs

@@ -14,6 +14,7 @@ const WINDOWS_SOCKET_BINDING = { device: "0", inode: "0", owner: "0", changeTime
 const AGENT_ID = /^cli_[A-Za-z0-9]+$/;
 const OPERATION_ID = /^[A-Za-z0-9_-]{8,128}$/;
 const AUTHORIZATION = /^[A-Za-z0-9_-]{43,128}$/;
+const CONFIG_SIGNATURE = /^sha256:[a-f0-9]{64}$/;
 const UNIX_SOCKET_PATH_MAX_BYTES = process.platform === "darwin" ? 103 : 107;
 function recoveryErrorText(code) {
     switch (code) {
@@ -159,9 +160,13 @@ function parseRequest(line) {
     if (value.waitReadyMs !== undefined) {
         throw new Error("invalid session reset waitReadyMs");
     }
-    if (Object.keys(value).some((key) => !["operationId", "agentId", "authorization"].includes(key))) {
+    if (Object.keys(value).some((key) => !["operationId", "agentId", "authorization", "expectedSignature"].includes(key))) {
         throw new Error("agent control request 包含未知字段");
     }
+    if (value.expectedSignature !== undefined
+        && (typeof value.expectedSignature !== "string" || !CONFIG_SIGNATURE.test(value.expectedSignature))) {
+        throw new Error("invalid agent upsert expectedSignature");
+    }
     return value;
 }
 function atomicWritePrivateJson(file, value) {
@@ -741,7 +746,11 @@ export function createAgentControlServer({ larkinHome, authorityToken, upsert, r
                         }
                         const execute = async () => {
                             try {
-                                await upsert({ operationId: upsertRequest.operationId, agentId: upsertRequest.agentId });
+                                await upsert({
+                                    operationId: upsertRequest.operationId,
+                                    agentId: upsertRequest.agentId,
+                                    ...(upsertRequest.expectedSignature ? { expectedSignature: upsertRequest.expectedSignature } : {}),
+                                });
                                 return { ok: true, operationId: upsertRequest.operationId, agentId: upsertRequest.agentId };
                             }
                             catch (error) {
@@ -926,7 +935,11 @@ async function requestAgentControl({ larkinHome, timeoutMs = 30_000, request, })
 }
 export async function requestAgentUpsert(input) {
     return requestAgentControl({ larkinHome: input.larkinHome, timeoutMs: input.timeoutMs,
-        request: { operationId: input.operationId ?? crypto.randomUUID(), agentId: input.agentId } });
+        request: {
+            operationId: input.operationId ?? crypto.randomUUID(),
+            agentId: input.agentId,
+            ...(input.expectedSignature ? { expectedSignature: input.expectedSignature } : {}),
+        } });
 }
 export async function requestSessionReset({ larkinHome, agentId, waitReadyMs = 30_000, }) {
     return requestAgentControl({

package/dist/app/pi-auth-cli.mjs

@@ -1,13 +1,234 @@
+import fs from "node:fs";
 import * as larkinConfig from "../platform/config.mjs";
-import { beginBuiltinPiCredentialTransaction, createOfficialPiCredentialRuntime, createOfficialPiLogoutRuntime, logoutOfficialPiProvider, officialPiAuthStatus, } from "../runtime/pi-official-auth.mjs";
+import { createOfficialPiCredentialRuntime, officialPiAuthStatus, } from "../runtime/pi-official-auth.mjs";
+import { configureBuiltinPiProvider, listBuiltinPiProviderCatalog, logoutBuiltinPiProvider, } from "../runtime/pi-provider-login.mjs";
+import { MAX_BUILTIN_PI_API_KEY_LENGTH } from "../runtime/pi-provider-config.mjs";
 const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const USAGE = "Usage: larkin pi-auth status [--agent <App ID>] [--json] | larkin pi-auth providers [--json] | larkin pi-auth login <preset|custom> --agent <App ID> [--model <model>] [--base-url <url>] [--api-key-stdin] [--json] | larkin pi-auth logout <provider> [--agent <App ID>]";
+const API_KEY_ARGV_MESSAGE = "existing-Agent login does not accept --api-key. Use --api-key-stdin or an interactive TTY prompt.";
+const API_KEY_BUDGET_MESSAGE = "API Key 不能为空或包含控制字符";
+const STDIN_CHUNK_BYTES = 1024;
+const STDIN_BOM_BYTES = 3;
+const STDIN_TRAILING_NEWLINE_SLACK = 32;
+const MAX_STDIN_API_KEY_BYTES = MAX_BUILTIN_PI_API_KEY_LENGTH + STDIN_BOM_BYTES + STDIN_TRAILING_NEWLINE_SLACK;
 function flag(args, name) {
     const index = args.indexOf(name);
     return index >= 0 ? args[index + 1] : undefined;
 }
-export async function main(args = process.argv.slice(2), env = process.env) {
+function hasApiKeyArgv(args) {
+    return args.some((argument) => argument === "--api-key" || argument.startsWith("--api-key="));
+}
+function consumeFlags(args, allowed, unary) {
+    let index = 0;
+    while (index < args.length) {
+        const argument = args[index];
+        if (!argument.startsWith("--"))
+            return false;
+        if (unary.has(argument)) {
+            index += 1;
+            continue;
+        }
+        if (allowed.has(argument) && args[index + 1] && !args[index + 1].startsWith("--")) {
+            index += 2;
+            continue;
+        }
+        return false;
+    }
+    return true;
+}
+/** 去掉 BOM 与全部尾部换行；保留内部控制字符给后续校验拒绝。 */
+export function normalizeStdinApiKey(raw) {
+    return raw.replace(/^\uFEFF/, "").replace(/[\r\n]+$/g, "");
+}
+function assertStdinApiKeyBudget(size) {
+    if (size > MAX_STDIN_API_KEY_BYTES)
+        throw new Error(API_KEY_BUDGET_MESSAGE);
+}
+function finishStdinApiKey(chunks) {
+    const normalized = normalizeStdinApiKey(Buffer.concat(chunks).toString("utf8"));
+    if (normalized.length > MAX_BUILTIN_PI_API_KEY_LENGTH)
+        throw new Error(API_KEY_BUDGET_MESSAGE);
+    return normalized;
+}
+function readFdChunk(fd, buffer) {
+    return new Promise((resolve, reject) => {
+        fs.read(fd, buffer, 0, buffer.length, null, (error, bytesRead) => {
+            if (error)
+                reject(error);
+            else
+                resolve(bytesRead);
+        });
+    });
+}
+/** 按块读取 fd，超过 key 上限立即停止，不等待管道 EOF。 */
+async function readBoundedFdSecret(fd) {
+    const chunks = [];
+    let size = 0;
+    const buffer = Buffer.alloc(STDIN_CHUNK_BYTES);
+    while (true) {
+        const bytesRead = await readFdChunk(fd, buffer);
+        if (bytesRead === 0)
+            break;
+        size += bytesRead;
+        assertStdinApiKeyBudget(size);
+        chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+    }
+    return finishStdinApiKey(chunks);
+}
+async function readBoundedStreamSecret(stdin) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of stdin) {
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        assertStdinApiKeyBudget(size);
+        chunks.push(bytes);
+    }
+    return finishStdinApiKey(chunks);
+}
+export async function readStdinSecret(stdin) {
+    const stream = stdin;
+    if (typeof stream.fd === "number" && stream.fd >= 0 && !stream.isTTY) {
+        if (typeof stream.pause === "function")
+            stream.pause();
+        try {
+            return await readBoundedFdSecret(stream.fd);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === API_KEY_BUDGET_MESSAGE)
+                throw error;
+            // 回退到异步收集，例如测试传入的假 stream。
+        }
+    }
+    return readBoundedStreamSecret(stdin);
+}
+function createNoEchoQuestioner(stdin, stdout) {
+    return {
+        close() { },
+        secret(prompt) {
+            if (!stdin.isTTY || typeof stdin.setRawMode !== "function") {
+                throw new Error("non-interactive API-key login requires --api-key-stdin");
+            }
+            stdout.write(prompt);
+            const wasRaw = stdin.isRaw;
+            stdin.setRawMode(true);
+            stdin.resume();
+            return new Promise((resolve, reject) => {
+                let value = "";
+                const finish = (error) => {
+                    stdin.off("data", onData);
+                    stdin.setRawMode(Boolean(wasRaw));
+                    stdin.pause();
+                    stdout.write("\n");
+                    if (error)
+                        reject(error);
+                    else
+                        resolve(value);
+                };
+                const onData = (chunk) => {
+                    const bytes = Buffer.from(chunk);
+                    for (const byte of bytes) {
+                        if (byte === 3)
+                            return finish(new Error("pi-auth login cancelled"));
+                        if (byte === 10 || byte === 13)
+                            return finish();
+                        if (byte === 8 || byte === 127) {
+                            value = value.slice(0, -1);
+                            continue;
+                        }
+                        if (byte >= 32 && byte <= 126)
+                            value += String.fromCharCode(byte);
+                    }
+                };
+                stdin.on("data", onData);
+            });
+        },
+    };
+}
+function resolveAgentId(args, env) {
+    const loaded = larkinConfig.loadConfig(env);
+    const agentId = flag(args, "--agent") || loaded.config.activeAgent || undefined;
+    if (!agentId || !APP_ID.test(agentId))
+        throw new Error("请用 --agent <App ID> 选择 Agent");
+    const agent = loaded.config.agents[agentId];
+    if (!agent)
+        throw new Error(`Agent ${agentId} 不存在`);
+    if (agent.runtime !== "pi" || agent.piDistribution !== "builtin")
+        throw new Error(`Agent ${agentId} 不是内置 Pi`);
+    return agentId;
+}
+export async function main(args = process.argv.slice(2), env = process.env, io = { stdin: process.stdin, stdout: process.stdout, isTTY: Boolean(process.stdin.isTTY) }) {
     const action = args[0] || "status";
     const json = args.includes("--json");
+    if (hasApiKeyArgv(args))
+        throw new Error(API_KEY_ARGV_MESSAGE);
+    if (action === "providers") {
+        if (!consumeFlags(args.slice(1), new Set(), new Set(["--json"])))
+            throw new Error(USAGE);
+        const providers = listBuiltinPiProviderCatalog();
+        if (json) {
+            console.log(JSON.stringify({ providers }));
+            return;
+        }
+        console.log("Builtin Pi providers:");
+        for (const entry of providers) {
+            const model = entry.defaultModel ? ` default=${entry.defaultModel}` : " (requires --base-url and --model)";
+            console.log(`  ${entry.id}  ${entry.name}${model}`);
+        }
+        return;
+    }
+    if (action === "login") {
+        const preset = args[1];
+        const rest = args.slice(2);
+        if (!preset || preset.startsWith("--")
+            || !consumeFlags(rest, new Set(["--agent", "--model", "--base-url"]), new Set(["--json", "--api-key-stdin"]))) {
+            throw new Error(USAGE);
+        }
+        const agentId = resolveAgentId(rest, env);
+        const stdinKey = rest.includes("--api-key-stdin");
+        let apiKey = "";
+        if (stdinKey)
+            apiKey = await readStdinSecret(io.stdin);
+        else if (io.isTTY) {
+            const questioner = createNoEchoQuestioner(io.stdin, io.stdout);
+            try {
+                apiKey = await questioner.secret("API Key:\n> ");
+            }
+            finally {
+                questioner.close();
+            }
+        }
+        else {
+            throw new Error("non-interactive API-key login requires --api-key-stdin");
+        }
+        const result = await configureBuiltinPiProvider({
+            agentId,
+            preset,
+            apiKey,
+            model: flag(rest, "--model"),
+            baseUrl: flag(rest, "--base-url"),
+            env,
+        });
+        const payload = {
+            agentId: result.agentId,
+            provider: result.provider,
+            model: result.model,
+            credentialType: result.credentialType,
+            applyState: result.applyState,
+            ...(result.applyError ? { applyError: result.applyError } : {}),
+        };
+        if (json)
+            console.log(JSON.stringify(payload));
+        else {
+            const pending = result.applyState === "applied"
+                ? "applied"
+                : result.applyState === "pending"
+                    ? `pending${result.applyError ? ` (${result.applyError})` : ""}`
+                    : "saved; will apply on larkin start";
+            console.log(`Agent ${result.agentId} provider=${result.provider} model=${result.model} credential=${result.credentialType} apply=${pending}`);
+        }
+        return;
+    }
     const requestedAgent = flag(args, "--agent");
     let index = action === "logout" ? 2 : 1;
     let valid = action === "status" || action === "logout";
@@ -23,9 +244,8 @@ export async function main(args = process.argv.slice(2), env = process.env) {
         }
         valid = false;
     }
-    if (!valid) {
-        throw new Error("Usage: larkin pi-auth status [--agent <App ID>] [--json] | larkin pi-auth logout <provider> [--agent <App ID>]");
-    }
+    if (!valid)
+        throw new Error(USAGE);
     const loaded = larkinConfig.loadConfig(env);
     const agentId = requestedAgent || loaded.config.activeAgent || undefined;
     if (!agentId || !APP_ID.test(agentId))
@@ -50,18 +270,8 @@ export async function main(args = process.argv.slice(2), env = process.env) {
         return;
     }
     const providerId = args[1];
-    if (!providerId || providerId.startsWith("--") || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(providerId)) {
+    if (!providerId || providerId.startsWith("--"))
         throw new Error("logout 需要安全的 provider ID");
-    }
-    const transaction = beginBuiltinPiCredentialTransaction(loaded.configDir, agentId);
-    try {
-        const runtime = await createOfficialPiLogoutRuntime(loaded.configDir, agentId);
-        await logoutOfficialPiProvider(runtime, providerId);
-        transaction.commit();
-    }
-    catch (error) {
-        transaction.rollback();
-        throw error;
-    }
+    await logoutBuiltinPiProvider({ agentId, providerId, env });
     console.log(`Agent ${agentId} 已退出 ${providerId}；其他 provider 未修改`);
 }

package/dist/app/runtime-process.mjs

@@ -6,22 +6,58 @@ import { ContextPromptBuilder } from "../agent/context-prompt.mjs";
 import { createNativeRuntimeAdapter } from "../runtime/runtime-adapters.mjs";
 import { createRuntimeHost } from "../runtime/runtime-host.mjs";
 import { createAgentStateStore } from "../agent/agent-state-store.mjs";
-import { loadConfig, markConfigApplied, runtimeConfigSignature } from "../platform/config.mjs";
+import { loadConfig, markConfigApplied, runtimeConfigSignature, withConfigMutationLock, withConfigMutationLockAsync, } from "../platform/config.mjs";
 import { traceProcessBoundary } from "../platform/process-boundary-trace.mjs";
 import { createAgentControlServer, requestSupervisorAgentUpsert } from "./local-control.mjs";
-import { hydrateRuntimeAgent, syncAgentProfile } from "./runtime-agent-config.mjs";
+import { hydrateRuntimeAgent, syncAgentProfile, } from "./runtime-agent-config.mjs";
 import { loadTelemetryConfig } from "../platform/telemetry-config.mjs";
 import { telemetrySingleton } from "../platform/telemetry-tracing.mjs";
 import { packageVersion } from "../platform/build-info.mjs";
-export function loadAndSyncRuntimeAgent(env, agentId, dependencies = {}) {
+function readRuntimeAgent(env, agentId, expectedSignature) {
     const loaded = loadConfig(env);
     const stored = loaded.config.agents[agentId];
     if (!stored)
         throw new Error(`Agent ${agentId} 不存在于 canonical config`);
+    if (expectedSignature) {
+        const current = runtimeConfigSignature(loaded.config, agentId);
+        if (current !== expectedSignature) {
+            throw new Error("配置在 apply 期间发生变化；未热加载已切换的 Agent");
+        }
+    }
+    return { loaded, stored };
+}
+function hydrateAndSyncRuntimeAgent(env, loaded, stored, dependencies) {
     const agent = hydrateRuntimeAgent(loaded.configDir, stored);
     syncAgentProfile(agent, { ...env, LARKIN_CONFIG_DIR: loaded.configDir }, dependencies);
     return agent;
 }
+export function loadAndSyncRuntimeAgent(env, agentId, dependencies = {}, options = {}) {
+    const snapshot = readRuntimeAgent(env, agentId, options.expectedSignature);
+    options.afterCanonicalValidate?.();
+    if (!options.expectedSignature) {
+        return hydrateAndSyncRuntimeAgent(env, snapshot.loaded, snapshot.stored, dependencies);
+    }
+    return withConfigMutationLock(env, () => {
+        const locked = readRuntimeAgent(env, agentId, options.expectedSignature);
+        return hydrateAndSyncRuntimeAgent(env, locked.loaded, locked.stored, dependencies);
+    });
+}
+/** 签名校验贯穿实际 Host upsert；并发 config mutation 不能热挂载已失效的 snapshot。 */
+export async function applyRuntimeAgentUpsert(env, agentId, dependencies = {}, options = {}, upsert = () => undefined) {
+    const snapshot = readRuntimeAgent(env, agentId, options.expectedSignature);
+    options.afterCanonicalValidate?.();
+    if (!options.expectedSignature) {
+        const agent = hydrateAndSyncRuntimeAgent(env, snapshot.loaded, snapshot.stored, dependencies);
+        await upsert(agent);
+        return agent;
+    }
+    return withConfigMutationLockAsync(env, async () => {
+        const locked = readRuntimeAgent(env, agentId, options.expectedSignature);
+        const agent = hydrateAndSyncRuntimeAgent(env, locked.loaded, locked.stored, dependencies);
+        await upsert(agent);
+        return agent;
+    });
+}
 export async function markConfigAppliedAfterRuntimeReady(env, runningAgents, runtimeReady) {
     await runtimeReady;
     try {
@@ -100,10 +136,11 @@ export async function main(env = process.env, overrides = {}) {
         larkinHome: env.LARKIN_HOME,
         authorityToken: env.LARKIN_CONTROL_AUTHORIZATION,
         async upsert(request) {
-            const agent = loadAndSyncRuntimeAgent(env, request.agentId);
+            const agent = await applyRuntimeAgentUpsert(env, request.agentId, {}, {
+                ...(request.expectedSignature ? { expectedSignature: request.expectedSignature } : {}),
+            }, (candidate) => hostShell.upsertAgent(candidate));
             // Only the selected profile is synchronized; active profiles and their directory
             // are never quarantined or rebuilt during hot attach.
-            await hostShell.upsertAgent(agent);
             const tracked = await requestSupervisorAgentUpsert({
                 larkinHome: env.LARKIN_HOME, agentId: agent.agentId, operationId: request.operationId,
             });

package/dist/dashboard/dashboard-config-controller.mjs

@@ -9,6 +9,8 @@ import { discoverPiModelCatalog } from "../runtime/pi-model-catalog.mjs";
 import { managedOfficialLarkCli } from "../app/agent-lark-cli-workspace.mjs";
 import { ownedPiCatalogAgentDir, piCatalogCommandSpec } from "../runtime/pi-provider-config.mjs";
 import { RUNTIME_OPTIONS, piCatalogDistributionForUserRuntime, toUserRuntime } from "../runtime/user-runtime.mjs";
+import { configureBuiltinPiProvider, listBuiltinPiProviderCatalog, logoutBuiltinPiProvider, sanitizeProviderLoginError, } from "../runtime/pi-provider-login.mjs";
+import { createOfficialPiCredentialRuntime, officialPiAuthStatus, } from "../runtime/pi-official-auth.mjs";
 function pruneCache(cache, expired, maxEntries) {
     for (const [key, value] of cache)
         if (expired(value))
@@ -170,9 +172,38 @@ export function createPiModelDirectoryResolver(options = {}) {
     const cache = new Map();
     const failures = new Map();
     const inFlight = new Map();
+    const generations = new Map();
+    // 单调序号：targeted 后再 global 时，in-flight 的 started 不能与新 generation 相等。
+    let seq = 0;
+    let baseline = 0;
+    const generationOf = (agentId) => Math.max(baseline, generations.get(agentId) ?? 0);
+    const dropPrefixed = (store, agentId) => {
+        if (!agentId) {
+            store.clear();
+            return;
+        }
+        const prefix = `${agentId}\u0000`;
+        for (const key of store.keys())
+            if (key.startsWith(prefix))
+                store.delete(key);
+    };
     return {
+        invalidate(agentId) {
+            dropPrefixed(cache, agentId);
+            dropPrefixed(failures, agentId);
+            dropPrefixed(inFlight, agentId);
+            seq += 1;
+            if (!agentId) {
+                baseline = seq;
+                generations.clear();
+            }
+            else {
+                generations.set(agentId, seq);
+            }
+        },
         async resolve(input) {
             const key = [input.agentId, input.cwd, input.agentDir, input.command ?? "", ...(input.commandArgs ?? [])].join("\u0000");
+            const started = generationOf(input.agentId);
             pruneCache(cache, (entry) => now() >= entry.expiresAt, 64);
             pruneCache(failures, (entry) => now() >= entry.expiresAt, 64);
             const cached = cache.get(key);
@@ -196,17 +227,23 @@ export function createPiModelDirectoryResolver(options = {}) {
                                 id, label, ...(contextWindow ? { contextWindow } : {}), supportedReasoningEfforts, ...(defaultReasoningEffort ? { defaultReasoningEffort } : {}),
                             })),
                         ];
-                        failures.delete(key);
-                        cache.set(key, { expiresAt: now() + ttlMs, value: models });
+                        if (generationOf(input.agentId) === started) {
+                            failures.delete(key);
+                            cache.set(key, { expiresAt: now() + ttlMs, value: models });
+                        }
                         return models;
                     }
                     catch (error) {
-                        failures.set(key, { expiresAt: now() + negativeTtlMs });
+                        if (generationOf(input.agentId) === started)
+                            failures.set(key, { expiresAt: now() + negativeTtlMs });
                         throw error;
                     }
                 })();
                 inFlight.set(key, pending);
-                void pending.finally(() => inFlight.delete(key)).catch(() => undefined);
+                void pending.finally(() => {
+                    if (inFlight.get(key) === pending)
+                        inFlight.delete(key);
+                }).catch(() => undefined);
             }
             return await pending;
         },
@@ -383,7 +420,7 @@ function dashboardMutation(value) {
         return { kind: operation, agentId, model: String(value.model || "") };
     return { kind: "set-agent-effort", agentId, effort: value.effort === null || value.effort === "default" ? null : String(value.effort || "") };
 }
-export function createDashboardConfigController({ csrfCapability, env = process.env, requestUpsert = requestAgentUpsert, chatDirectoryResolver = createChatDirectoryResolver(), claudeModelDirectoryResolver = createClaudeModelDirectoryResolver(), codexModelDirectoryResolver = createCodexModelDirectoryResolver(), piModelDirectoryResolver = createPiModelDirectoryResolver(), }) {
+export function createDashboardConfigController({ csrfCapability, env = process.env, requestUpsert = requestAgentUpsert, chatDirectoryResolver = createChatDirectoryResolver(), claudeModelDirectoryResolver = createClaudeModelDirectoryResolver(), codexModelDirectoryResolver = createCodexModelDirectoryResolver(), piModelDirectoryResolver = createPiModelDirectoryResolver(), configureProvider = configureBuiltinPiProvider, logoutProvider = logoutBuiltinPiProvider, listProviderCatalog = listBuiltinPiProviderCatalog, loadProviderStatus = async (configDir, agentId) => officialPiAuthStatus(await createOfficialPiCredentialRuntime(configDir, agentId)), }) {
     const resolvePiModelDirectory = async (agentId, userRuntime) => {
         const { config, configDir } = loadConfig(env);
         const agent = config.agents[agentId];
@@ -511,6 +548,94 @@ export function createDashboardConfigController({ csrfCapability, env = process.
                 }
                 return true;
             }
+            if (requestUrl.pathname === "/api/pi-auth/providers" && req.method === "GET") {
+                try {
+                    assertPrivateReadRequest(req, csrfCapability);
+                    json(res, 200, { providers: listProviderCatalog() });
+                }
+                catch (error) {
+                    json(res, error instanceof Error && /host|capability/.test(error.message) ? 403 : 500, { error: "provider catalog unavailable" });
+                }
+                return true;
+            }
+            if (requestUrl.pathname === "/api/pi-auth/status" && req.method === "GET") {
+                try {
+                    assertPrivateReadRequest(req, csrfCapability);
+                    const agentId = requestUrl.searchParams.get("agent") || "";
+                    const { config, configDir } = loadConfig(env);
+                    const agent = config.agents[agentId];
+                    if (!agent || agent.runtime !== "pi" || agent.piDistribution !== "builtin")
+                        throw new Error("unknown agent");
+                    const credentials = await loadProviderStatus(configDir, agentId);
+                    json(res, 200, { agentId, model: agent.model, credentials });
+                }
+                catch (error) {
+                    json(res, error instanceof Error && /host|capability/.test(error.message) ? 403 : 500, { error: "provider status unavailable" });
+                }
+                return true;
+            }
+            if (requestUrl.pathname === "/api/pi-auth/login" && req.method === "POST") {
+                let secret = "";
+                try {
+                    assertWriteRequest(req, csrfCapability);
+                    const body = await boundedJson(req);
+                    const allowed = ["agentId", "preset", "apiKey", "model", "baseUrl"];
+                    if (Object.keys(body).some((key) => !allowed.includes(key)))
+                        throw new Error("unsupported field");
+                    const agentId = String(body.agentId || "");
+                    const preset = String(body.preset || "");
+                    const apiKey = typeof body.apiKey === "string" ? body.apiKey : "";
+                    secret = apiKey;
+                    if (!/^cli_[A-Za-z0-9]+$/.test(agentId) || !preset)
+                        throw new Error("invalid login request");
+                    const { config } = loadConfig(env);
+                    const agent = config.agents[agentId];
+                    if (!agent || agent.runtime !== "pi" || agent.piDistribution !== "builtin")
+                        throw new Error("Agent is not builtin Pi");
+                    const result = await configureProvider({
+                        agentId,
+                        preset,
+                        apiKey,
+                        ...(typeof body.model === "string" ? { model: body.model } : {}),
+                        ...(typeof body.baseUrl === "string" ? { baseUrl: body.baseUrl } : {}),
+                        env,
+                    });
+                    piModelDirectoryResolver.invalidate?.(agentId);
+                    json(res, 200, {
+                        ok: true,
+                        agentId: result.agentId,
+                        provider: result.provider,
+                        preset: result.preset,
+                        model: result.model,
+                        credentialType: result.credentialType,
+                        applyState: result.applyState,
+                        ...(result.applyError ? { applyError: sanitizeProviderLoginError(result.applyError, secret || undefined) } : {}),
+                    });
+                }
+                catch (error) {
+                    json(res, 400, { error: sanitizeProviderLoginError(error, secret || undefined) });
+                }
+                return true;
+            }
+            if (requestUrl.pathname === "/api/pi-auth/logout" && req.method === "POST") {
+                try {
+                    assertWriteRequest(req, csrfCapability);
+                    const body = await boundedJson(req);
+                    if (Object.keys(body).sort().join(",") !== "agentId,provider")
+                        throw new Error("invalid logout request");
+                    const agentId = String(body.agentId || "");
+                    const provider = String(body.provider || "");
+                    if (!/^cli_[A-Za-z0-9]+$/.test(agentId))
+                        throw new Error("invalid logout request");
+                    const result = await logoutProvider({ agentId, providerId: provider, env });
+                    piModelDirectoryResolver.invalidate?.(agentId);
+                    json(res, 200, { ok: true, agentId: result.agentId, provider: result.provider });
+                }
+                catch (error) {
+                    json(res, 400, { error: sanitizeProviderLoginError(error) });
+                }
+                return true;
+            }
             if (requestUrl.pathname === "/api/config/apply" && req.method === "POST") {
                 try {
                     assertWriteRequest(req, csrfCapability);