my-durable 0.0.12 → 0.0.14

package/apps/dpi-backend/src/main.ts

@@ -170,6 +170,11 @@ server.listen(config.port, config.host, () => {
         if (a.family === "IPv4" && !a.internal)
           console.log(`LAN: http://${a.address}:${config.port}`);
   console.log(`background: dpi device start | stop | status | install (service)`);
+  {
+    const providers = [...new Set(store.modelList.map((m) => m.provider))];
+    if (providers.length) console.log(`providers: ${providers.join(", ")} (pi auth/models.json + env)`);
+    for (const s of store.pi.skipped) console.log(`  custom provider ${s.id} skipped: ${s.reason}`);
+  }
   if (store.keyless)
     console.log(
       `no provider key: the model list is the built-in catalog; set OPENROUTER_API_KEY in ${config.envFile} to chat`,

package/apps/dpi-backend/src/pi-config.ts

@@ -0,0 +1,206 @@
+/**
+ * The device is pi: it reuses the SAME credentials and custom providers the pi
+ * CLI already has on this machine — the fix for "pi đầy đủ key, sao durable
+ * lại không". Nothing is copied or re-entered:
+ *
+ *   ~/.pi/agent/auth.json    provider credentials pi saved via /login
+ *                            (api_key and oauth entries, keyed by provider id)
+ *   ~/.pi/agent/models.json  custom providers ({baseUrl, api, apiKey?, models})
+ *
+ * PI_AGENT_DIR moves both (same variable pi honors). The device never WRITES
+ * pi's files: its credential store is a read-only view, so a headless daemon
+ * cannot corrupt an interactive login.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.lazy";
+import {
+  createProvider,
+  envApiKeyAuth,
+  type ApiKeyCredential,
+  type Credential,
+  type CredentialInfo,
+  type CredentialStore,
+  type Provider,
+} from "@earendil-works/pi-ai";
+
+/** pi's agent directory on this machine (PI_AGENT_DIR overrides, like pi). */
+export function piAgentDir(env: NodeJS.ProcessEnv = process.env): string {
+  return env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+
+/** auth.json: one type-tagged credential per provider id. */
+export function readPiAuth(dir: string): Record<string, Credential> {
+  return readJson(join(dir, "auth.json"));
+}
+
+/** models.json custom providers: {providers: {name: {baseUrl, api, apiKey?, models[]}}}. */
+export function readPiModelsJson(dir: string): PiModelsJson {
+  return readJson(join(dir, "models.json"));
+}
+
+function readJson(path: string): Record<string, never> | never {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {}; // absent or unreadable: the device simply has no pi credentials
+  }
+}
+
+export interface PiModelsJson {
+  providers?: Record<
+    string,
+    {
+      baseUrl?: string;
+      api?: string;
+      apiKey?: string;
+      name?: string;
+      models?: PiCustomModel[];
+    }
+  >;
+}
+
+export interface PiCustomModel {
+  id: string;
+  name?: string;
+  contextWindow?: number;
+  reasoning?: boolean;
+  cost?: { input?: number; output?: number };
+  [key: string]: unknown;
+}
+
+/**
+ * Read-only credential view over pi's files, honoring pi's precedence
+ * (auth.json credential, then the models.json apiKey, then provider env vars —
+ * env resolution stays inside pi-ai). Writes are refused by returning the
+ * current value: the daemon must not touch an interactive login.
+ */
+export function piCredentialStore(auth: Record<string, Credential>, modelsJson: PiModelsJson): CredentialStore {
+  const of = (providerId: string): Credential | undefined => {
+    const fromAuth = auth[providerId];
+    if (fromAuth) return fromAuth;
+    const key = modelsJson.providers?.[providerId]?.apiKey;
+    if (key) {
+      const credential: ApiKeyCredential = { type: "api_key", key };
+      return credential;
+    }
+    return undefined;
+  };
+  return {
+    async read(providerId) {
+      return of(providerId);
+    },
+    async list(): Promise<readonly CredentialInfo[]> {
+      const ids = new Set([...Object.keys(auth), ...Object.keys(modelsJson.providers ?? {})]);
+      return [...ids]
+        .map(of)
+        .filter((c): c is Credential => !!c)
+        .map((c, i) => ({ providerId: [...new Set([...Object.keys(auth), ...Object.keys(modelsJson.providers ?? {})])][i]!, type: c.type }));
+    },
+    async modify(providerId, fn) {
+      const current = of(providerId);
+      const next = await fn(current);
+      return next === current ? current : current; // read-only: never persist
+    },
+    async delete() {
+      /* read-only */
+    },
+  };
+}
+
+/** Provider ids the device has SOME credential for (auth.json or models.json). */
+export function credentialedProviders(auth: Record<string, Credential>, modelsJson: PiModelsJson): string[] {
+  return [...new Set([...Object.keys(auth), ...Object.keys(modelsJson.providers ?? {})])].filter((id) => {
+    if (auth[id]) return true;
+    return !!modelsJson.providers?.[id]?.apiKey;
+  });
+}
+
+/** pi models.json api id → pi-ai API implementation. Unknown ids are skipped. */
+const API_IMPLS: Record<string, () => ReturnType<typeof openAICompletionsApi>> = {
+  "openai-completions": () => openAICompletionsApi(),
+  "openai-responses": () => openAIResponsesApi() as never,
+  "anthropic-messages": () => anthropicMessagesApi() as never,
+};
+
+/**
+ * Build pi-ai providers for the models.json custom entries. An entry with an
+ * api we cannot serve (or no models) is skipped and REPORTED, not silently
+ * dropped — the operator should learn why a model is missing.
+ */
+export function piCustomProviders(
+  modelsJson: PiModelsJson,
+  onSkip?: (id: string, reason: string) => void,
+): Provider[] {
+  const out: Provider[] = [];
+  for (const [id, entry] of Object.entries(modelsJson.providers ?? {})) {
+    const reason = !entry.baseUrl
+      ? "no baseUrl"
+      : !entry.api || !API_IMPLS[entry.api]
+        ? `unsupported api ${String(entry.api)}`
+        : !entry.models?.length
+          ? "no models"
+          : "";
+    if (reason) {
+      onSkip?.(id, reason);
+      continue;
+    }
+    out.push(
+      createProvider({
+        id,
+        name: entry.name ?? id,
+        baseUrl: entry.baseUrl,
+        auth: { apiKey: envApiKeyAuth(`${id} API key`, [`${id.toUpperCase().replace(/-/g, "_")}_API_KEY`]) },
+        models: entry.models!.map((m) => ({
+          type: "chat",
+          id: m.id,
+          name: m.name ?? m.id,
+          provider: id,
+          api: entry.api!,
+          baseUrl: entry.baseUrl,
+          contextWindow: m.contextWindow ?? 128000,
+          reasoning: m.reasoning ?? false,
+          input: ["text"],
+          cost: { input: m.cost?.input ?? 0, output: m.cost?.output ?? 0 },
+          ...(m as Record<string, unknown>),
+        })) as never,
+        api: API_IMPLS[entry.api!]!(),
+      }),
+    );
+  }
+  return out;
+}
+
+/** Everything pi brings on this machine: credentials + custom providers. */
+export interface PiConfig {
+  dir: string;
+  auth: Record<string, Credential>;
+  modelsJson: PiModelsJson;
+  credentials: CredentialStore;
+  customProviders: Provider[];
+  /** Provider ids with a usable credential (auth.json or models.json key). */
+  credentialed: string[];
+  skipped: Array<{ id: string; reason: string }>;
+}
+
+/** Load pi's configuration; absent files mean simply "nothing from pi". */
+export function loadPiConfig(env: NodeJS.ProcessEnv = process.env): PiConfig {
+  const dir = piAgentDir(env);
+  const auth = existsSync(join(dir, "auth.json")) ? readPiAuth(dir) : {};
+  const modelsJson = existsSync(join(dir, "models.json")) ? readPiModelsJson(dir) : {};
+  const skipped: Array<{ id: string; reason: string }> = [];
+  const customProviders = piCustomProviders(modelsJson, (id, reason) => skipped.push({ id, reason }));
+  return {
+    dir,
+    auth,
+    modelsJson,
+    credentials: piCredentialStore(auth, modelsJson),
+    customProviders,
+    credentialed: credentialedProviders(auth, modelsJson),
+    skipped,
+  };
+}

package/apps/dpi-backend/src/store.ts

@@ -41,6 +41,8 @@ import { createRequire } from "node:module";
 import { BACKGROUND_CONTEXT as ctx, withAbortSignal } from "@earendil-works/chord/context";
 import { createModels } from "@earendil-works/pi-ai/models";
 import { openrouterProvider } from "@earendil-works/pi-ai/providers/openrouter";
+import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
+import { loadPiConfig } from "./pi-config.js";
 import { curatedModels, defaultModelId } from "./model-catalog.js";
 import { fauxModels, installFaux } from "./faux.js";
 import {
@@ -161,7 +163,9 @@ const decodeCursor = (cursor?: string) => {
 };
 
 export class Store {
-  readonly models = createModels();
+  /** pi's credentials + custom providers on THIS machine (auth.json / models.json). */
+  readonly pi = loadPiConfig();
+  readonly models = createModels({ credentials: this.pi.credentials });
   readonly opened = new Map<string, Opened>();
   readonly errors = new Map<string, string>();
   readonly catalog: DatabaseSync;
@@ -199,6 +203,12 @@ export class Store {
   private constructor(readonly options: StoreOptions) {
     if (options.provider === "faux") installFaux(this.models);
     else {
+      // The device is pi: register EVERY built-in provider (the same registry
+      // the pi CLI uses), then keep OpenRouter narrowed to the curated list.
+      // Credentials arrive through pi's own files via the credential store;
+      // env keys still work through each provider.
+      for (const provider of builtinProviders()) this.models.setProvider(provider);
+      for (const provider of this.pi.customProviders) this.models.setProvider(provider);
       const provider = openrouterProvider();
       const catalog = provider.getModels();
       for (const model of curatedModels)
@@ -311,30 +321,82 @@ export class Store {
         reasoning: false,
         cost: { input: 0, output: 0 },
       }));
-    // getAvailable only lists AUTHENTICATED providers — no OPENROUTER_API_KEY
-    // means an empty list even though the built-in catalog needs no key. Fall
-    // back to it (static metadata) so picking a model is never blocked; the
-    // keyless flag tells the client chat will need the key.
-    const hasChatFields = (
-      m: unknown,
-    ): m is { id: string; contextWindow: number; reasoning: boolean; cost: { input: number; output: number } } =>
-      typeof m === "object" && m !== null && "contextWindow" in m && "reasoning" in m;
-    let available: ReadonlyArray<{ id: string; contextWindow: number; reasoning: boolean; cost: { input: number; output: number } }> =
-      await this.models.getAvailable("openrouter", { signal: AbortSignal.timeout(10000) }).catch(() => []);
-    if (!available.length) {
-      this.modelsKeyless = true;
-      // The provider's static catalog (no key, no network): chat models only —
-      // image/classifier entries carry no context window.
-      available = this.models
-        .getAllModels("openrouter")
-        .filter((m) => hasChatFields(m))
-        .map((m) => ({ id: m.id, contextWindow: m.contextWindow, reasoning: m.reasoning, cost: { input: m.cost.input, output: m.cost.output } }));
+    // The device serves every provider pi can authenticate on this machine:
+    // OpenRouter (the curated default) plus each provider pi holds a credential
+    // for (auth.json / models.json). Asking per-provider keeps providers with
+    // no credential out of the auth check entirely.
+    const ids = new Set(["openrouter", ...this.pi.credentialed]);
+    const out: ModelInfo[] = [];
+    let authenticated = false;
+    for (const id of ids) {
+      const available = await this.models
+        .getAvailable(id, { signal: AbortSignal.timeout(10_000) })
+        .catch(() => [] as ReadonlyArray<{ id: string }>);
+      if (!available.length) continue;
+      authenticated = true;
+      if (id === "openrouter") {
+        // The curated list, with live context/pricing when the key allows it.
+        out.push(
+          ...curatedModels.flatMap((c) => {
+            const m = available.find((x) => x.id === c.id) as
+              | { id: string; contextWindow?: number; reasoning?: boolean; cost?: { input: number; output: number } }
+              | undefined;
+            return m
+              ? [{
+                  id: c.id,
+                  provider: "openrouter",
+                  name: c.name,
+                  tier: c.tier,
+                  icon: c.icon,
+                  contextWindow: m.contextWindow ?? 128000,
+                  reasoning: m.reasoning ?? false,
+                  cost: { input: m.cost?.input ?? 0, output: m.cost?.output ?? 0 },
+                }]
+              : [];
+          }),
+        );
+      } else {
+        for (const m of available as ReadonlyArray<{
+          id: string;
+          name?: string;
+          contextWindow?: number;
+          reasoning?: boolean;
+          cost?: { input: number; output: number };
+        }>)
+          out.push({
+            id: m.id,
+            provider: id,
+            name: m.name ?? m.id,
+            tier: "·",
+            icon: "lab.png",
+            contextWindow: m.contextWindow ?? 128000,
+            reasoning: m.reasoning ?? false,
+            cost: { input: m.cost?.input ?? 0, output: m.cost?.output ?? 0 },
+          });
+      }
     }
-    return curatedModels.flatMap((c) => {
-      const m = available.find((m) => m.id === c.id);
-      return m
-        ? [
-            {
+    if (!authenticated) {
+      this.modelsKeyless = true;
+      // No credential anywhere: the built-in curated catalog (static metadata)
+      // so picking a model is never blocked; chat needs a key.
+      const hasChatFields = (m: unknown): m is { id: string; contextWindow: number; reasoning: boolean; cost: { input: number; output: number } } =>
+        typeof m === "object" && m !== null && "contextWindow" in m && "reasoning" in m;
+      out.push(
+        ...this.models
+          .getAllModels("openrouter")
+          .filter((m) => hasChatFields(m) && curatedModels.some((c) => c.id === m.id))
+          .map(
+            (m) =>
+              hasChatFields(m)
+                ? { id: m.id, contextWindow: m.contextWindow, reasoning: m.reasoning, cost: { input: m.cost.input, output: m.cost.output } }
+                : undefined,
+          )
+          .filter(
+            (m): m is { id: string; contextWindow: number; reasoning: boolean; cost: { input: number; output: number } } => !!m,
+          )
+          .map((m) => {
+            const c = curatedModels.find((x) => x.id === m.id)!;
+            return {
               id: m.id,
               provider: "openrouter",
               name: c.name,
@@ -343,10 +405,11 @@ export class Store {
               contextWindow: m.contextWindow,
               reasoning: m.reasoning,
               cost: { input: m.cost.input, output: m.cost.output },
-            },
-          ]
-        : [];
-    });
+            } satisfies ModelInfo;
+          }),
+      );
+    }
+    return out;
   }
 
   routedModel(model?: ModelRef): ModelRef {
@@ -354,6 +417,10 @@ export class Store {
       const id = fauxModels.some((m) => m.id === model?.modelId) ? model!.modelId : fauxModels[0].id;
       return { provider: "faux", modelId: id };
     }
+    // A model the device actually serves (pi provider or curated openrouter)
+    // keeps its provider; everything else routes to the OpenRouter default.
+    if (model && this.modelList.some((m) => m.provider === model.provider && m.id === model.modelId))
+      return { provider: model.provider, modelId: model.modelId };
     const exact = model?.provider === "openrouter" ? model.modelId : `${model?.provider}/${model?.modelId}`;
     return {
       provider: "openrouter",
@@ -365,12 +432,9 @@ export class Store {
     const m = model as ModelRef | undefined;
     if (!m || typeof m.provider !== "string" || typeof m.modelId !== "string")
       throw invalid("model must be { provider, modelId }");
-    const known =
-      this.options.provider === "faux"
-        ? m.provider === "faux" && fauxModels.some((f) => f.id === m.modelId)
-        : m.provider === "openrouter" &&
-          curatedModels.some((c) => c.id === m.modelId) &&
-          !!this.models.getModel(m.provider, m.modelId);
+    // Known = listed in this device's catalog (faux models, curated OpenRouter,
+    // or any provider pi authenticated here). The list IS the contract.
+    const known = this.modelList.some((x) => x.provider === m.provider && x.id === m.modelId);
     if (!known) throw invalid(`Unknown model ${m.provider}/${m.modelId}. Choose one from GET /v1/device models`);
     return { provider: m.provider, modelId: m.modelId };
   }

package/bin/update.d.mts

@@ -22,3 +22,5 @@ export function daemonControl(
   dpiPath: string,
   port: number,
 ): { running: () => Promise<boolean>; stop: () => Promise<number>; start: () => Promise<number> };
+/** Below this the app cannot run at all (node:sqlite). The only hard block. */
+export const REQUIRED_NODE_FLOOR: string;

package/bin/update.mjs

@@ -31,6 +31,12 @@ export function compareVersions(a, b) {
   return 0;
 }
 
+/**
+ * The floor we KNOW breaks: below 22.5.0 there is no node:sqlite, and the
+ * device dies at boot. This — and only this — is a hard block.
+ */
+export const REQUIRED_NODE_FLOOR = "22.5.0";
+
 /**
  * Does `current` satisfy `required` when required looks like ">=22.19.0" /
  * ">=22" / "22.x"? Only the forms our own package.json can carry are supported;
@@ -94,15 +100,22 @@ export async function runUpdate(deps) {
     return 0;
   }
 
-  // Refuse before touching npm: a warned-about engine is a broken install later.
+  // pi's philosophy, which we follow: engines metadata is ADVICE. pi declares
+  // node >=22.19.0 too, npm only warns, and nothing enforces it at runtime —
+  // so an update proceeds with a visible warning. We hard-block ONLY below the
+  // floor we know is broken (no node:sqlite ⇒ the device cannot even boot).
   const required = pkg.engines?.node;
-  if (required && !satisfiesEngine(deps.nodeVersion, required)) {
+  if (compareVersions(deps.nodeVersion, REQUIRED_NODE_FLOOR) < 0) {
     printErr(
-      `dpi update: this release needs Node ${required}, you have ${deps.nodeVersion}.`,
+      `dpi update: Node ${deps.nodeVersion} is too old — durable needs Node >= ${REQUIRED_NODE_FLOOR} (node:sqlite).`,
     );
-    printErr("  Upgrade Node first (nvm install --lts / winget upgrade OpenJS.NodeJS.LTS), then retry.");
+    printErr("  Upgrade Node (nvm install --lts / winget upgrade OpenJS.NodeJS.LTS) and retry.");
     return 1;
   }
+  if (required && !satisfiesEngine(deps.nodeVersion, required)) {
+    print(`note: this release declares Node ${required}, you have ${deps.nodeVersion}.`);
+    print(`      like pi, it installs and runs anyway; upgrade Node if anything misbehaves.`);
+  }
 
   // Windows: the daemon (and a TUI) hold files inside the package folder, so npm
   // cannot rename it. Stop the daemon, install, then bring it back.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-durable",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "Durable Pi \u2014 the durable agent network: hub web UI, device backend daemon, TUI admin and the shared SDK, packaged as one runnable monorepo install",
   "license": "MIT",
   "repository": {