pi-fabric 0.110.3 → 0.111.0

package/README.md

@@ -90,6 +90,8 @@ Requires Node.js 24+ and Pi 1.0.0+. Monty's optional native package installs on
 pi install npm:pi-fabric
 ```
 
+Fabric bundles the [Coral Bricks provider](docs/configuration.md#bundled-coral-bricks-provider): run `/login coralbricks` to use `coralbricks/*` models, or opt out with a package filter. Fabric's maintainers work at Coral Bricks.
+
 <details>
 <summary>Other install methods</summary>
 

package/THIRD_PARTY_NOTICES.md

@@ -8,6 +8,13 @@ Haydn Paterson, licensed under MIT. This private artifact is not loaded by the
 Pi extension, which continues to use Pi's host-provided TypeBox. The complete
 license is distributed at [docs/licenses/typebox-mit.txt](docs/licenses/typebox-mit.txt).
 
+## pi-coralbricks-provider
+
+The package bundles [`pi-coralbricks-provider`](https://github.com/monotykamary/pi-coralbricks-provider)
+unmodified under `node_modules/pi-coralbricks-provider`, at the exact version
+pinned in `package.json`. It is licensed under MIT, and its complete license is
+distributed beside it at `node_modules/pi-coralbricks-provider/LICENSE`.
+
 ## Bend 2.0.36
 
 The generated policy kernel includes Bend's emitted JavaScript trampoline and

package/dist/agents/provider-bridge.d.ts

@@ -38,7 +38,12 @@ export declare function orderProviderCandidates(paths: readonly string[], provid
     named: string[];
     rest: string[];
 };
-/** Fabric's own manifest entries: they never register chat providers. */
+/**
+ * Fabric's own manifest entries: they never register chat providers. Entries
+ * of bundled Pi packages (pi-coralbricks-provider) are not Fabric's own: they
+ * stay probe candidates, so the bundled provider resolves without loading
+ * Fabric's main extension.
+ */
 export declare function fabricExtensionEntries(moduleUrl?: string): string[];
 /**
  * Find the extension registrations that make `model` resolvable in a child
@@ -48,6 +53,22 @@ export declare function fabricExtensionEntries(moduleUrl?: string): string[];
  * installed extension registers the provider.
  */
 export declare function resolveExtensionProviders(options: ResolveExtensionProvidersOptions, sdk?: PiSdk): Promise<ExtensionProviderRegistrations | undefined>;
+/**
+ * The SDK entry of the bundled Pi CLI running this process, if it is one. The
+ * published `pi` bin is `dist/bundle/cli.js`; its `dist/bundle/index.js` SDK
+ * entry is built from the same chunks the CLI has already evaluated.
+ */
+export declare function hostBundleSdkEntry(cliPath?: string | undefined): string | undefined;
+/**
+ * The host's own SDK. Pi imports this bridge natively (it is ESM JavaScript),
+ * so jiti's virtual modules do not apply, and a bare package import from here
+ * evaluates the separate unbundled SDK: about 1,800 more modules in the
+ * bundled CLI. Besides the startup cost, that CLI enables Node's compile cache,
+ * which serializes every one of those modules on exit; with a cold cache that
+ * held a Windows child past the worker's exit grace after it had settled.
+ * The bundle's SDK entry shares the CLI's already loaded chunks instead.
+ */
+export declare function loadHostSdk(cliPath?: string | undefined): Promise<PiSdk>;
 /**
  * Loaded with `-e` into Pi children launched with `extensions: false`. It
  * registers only the requested model's provider, as its extension registered

package/dist/agents/provider-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-bridge.d.ts","sourceRoot":"","sources":["../../src/agents/provider-bridge.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAErG;;;GAGG;AACH,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,KAAK,KAAK,GAAG,cAAc,iCAAiC,CAAC,CAAC;AAE9D,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CASrC;AAUD,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,SAAS,SAAkB,GAAG,MAAM,EAAE,CAc5E;AA0CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gCAAgC,EACzC,GAAG,CAAC,EAAE,KAAK,GACV,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4CrD;AAED;;;;;GAKG;AACH,wBAA8B,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF"}
+{"version":3,"file":"provider-bridge.d.ts","sourceRoot":"","sources":["../../src/agents/provider-bridge.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAmB,MAAM,iCAAiC,CAAC;AAErG;;;GAGG;AACH,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,KAAK,KAAK,GAAG,cAAc,iCAAiC,CAAC,CAAC;AAE9D,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAKvF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CASrC;AAcD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,SAAkB,GAAG,MAAM,EAAE,CAgB5E;AA0CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gCAAgC,EACzC,GAAG,CAAC,EAAE,KAAK,GACV,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAAC,CA4CrD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,MAAM,GAAG,SAA2B,GAAG,MAAM,GAAG,SAAS,CAiBpG;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,OAAO,GAAE,MAAM,GAAG,SAA2B,GAAG,OAAO,CAAC,KAAK,CAAC,CAU/F;AAED;;;;;GAKG;AACH,wBAA8B,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF"}

package/dist/agents/provider-bridge.js

@@ -1,7 +1,7 @@
 // src/agents/provider-bridge.ts
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 var PROVIDER_BRIDGE_MODEL_ENV = "PI_FABRIC_EXTENSION_MODEL";
 function parseModelKey(key) {
   const value = key.trim();
@@ -26,13 +26,14 @@ var realPath = (file) => {
     return path.resolve(file);
   }
 };
+var isBundledPackageEntry = (entry) => entry.replace(/\\/g, "/").replace(/^(?:\.\/)+/, "").startsWith("node_modules/");
 function fabricExtensionEntries(moduleUrl = import.meta.url) {
   const root = path.resolve(path.dirname(fileURLToPath(moduleUrl)), "..", "..");
   try {
     const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
     if (manifest.name !== "pi-fabric") return [];
     const entries = [manifest.main, ...Array.isArray(manifest.pi?.extensions) ? manifest.pi.extensions : []];
-    return entries.filter((entry) => typeof entry === "string").map((entry) => path.resolve(root, entry));
+    return entries.filter((entry) => typeof entry === "string" && !isBundledPackageEntry(entry)).map((entry) => path.resolve(root, entry));
   } catch {
     return [];
   }
@@ -92,11 +93,39 @@ async function resolveExtensionProviders(options, sdk) {
     `Model "${options.model}" needs provider "${key.provider}", which is not built into Pi or defined in models.json, and no installed Pi extension registers it for this extensions: false child. Install the extension that provides it, or run the child with extensions: true.` + (failures.length > 0 ? ` Extensions that failed to load while searching: ${[...new Set(failures)].join(", ")}.` : "")
   );
 }
+function hostBundleSdkEntry(cliPath = process.argv[1]) {
+  if (!cliPath) return void 0;
+  let cli;
+  try {
+    cli = fs.realpathSync(cliPath);
+  } catch {
+    return void 0;
+  }
+  const bundle = path.dirname(cli);
+  if (path.basename(cli) !== "cli.js" || path.basename(bundle) !== "bundle") return void 0;
+  const entry = path.join(bundle, "index.js");
+  try {
+    const manifest = JSON.parse(fs.readFileSync(path.join(bundle, "..", "..", "package.json"), "utf8"));
+    return manifest.name === "@earendil-works/pi-coding-agent" && fs.existsSync(entry) ? entry : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function loadHostSdk(cliPath = process.argv[1]) {
+  const entry = hostBundleSdkEntry(cliPath);
+  if (entry) {
+    try {
+      return await import(pathToFileURL(entry).href);
+    } catch {
+    }
+  }
+  return import("@earendil-works/pi-coding-agent");
+}
 async function fabricProviderBridge(pi) {
   const model = process.env[PROVIDER_BRIDGE_MODEL_ENV]?.trim();
   if (!model) return;
-  const { getAgentDir } = await import("@earendil-works/pi-coding-agent");
-  const found = await resolveExtensionProviders({ model, cwd: process.cwd(), agentDir: getAgentDir() });
+  const sdk = await loadHostSdk();
+  const found = await resolveExtensionProviders({ model, cwd: process.cwd(), agentDir: sdk.getAgentDir() }, sdk);
   if (!found) return;
   for (const { name, config } of found.configs) pi.registerProvider(name, config);
   for (const { provider } of found.natives) pi.registerProvider(provider);
@@ -105,6 +134,8 @@ export {
   PROVIDER_BRIDGE_MODEL_ENV,
   fabricProviderBridge as default,
   fabricExtensionEntries,
+  hostBundleSdkEntry,
+  loadHostSdk,
   orderProviderCandidates,
   parseModelKey,
   resolveExtensionProviders

package/dist/agents/provider-bridge.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/agents/provider-bridge.ts"],
-  "sourcesContent": ["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { Provider } from \"@earendil-works/pi-ai\";\nimport type { ExtensionAPI, ProviderConfig, SettingsManager } from \"@earendil-works/pi-coding-agent\";\n\n/**\n * The `provider/id` key a Pi child launched with `extensions: false` must\n * resolve. The worker sets it only when it also loads this bridge with `-e`.\n */\nexport const PROVIDER_BRIDGE_MODEL_ENV = \"PI_FABRIC_EXTENSION_MODEL\";\n\nexport interface ExtensionProviderRegistrations {\n  configs: Array<{ name: string; config: ProviderConfig; extensionPath: string }>;\n  natives: Array<{ provider: Provider; extensionPath: string }>;\n}\n\nexport interface ResolveExtensionProvidersOptions {\n  model: string;\n  cwd: string;\n  agentDir: string;\n  /** Extension entry files never probed (Fabric's own entries by default). */\n  exclude?: readonly string[];\n}\n\ntype PiSdk = typeof import(\"@earendil-works/pi-coding-agent\");\n\n/** Split a canonical `provider/id` key at its first slash. */\nexport function parseModelKey(key: string): { provider: string; id: string } | undefined {\n  const value = key.trim();\n  const slash = value.indexOf(\"/\");\n  if (slash <= 0 || slash === value.length - 1) return undefined;\n  return { provider: value.slice(0, slash), id: value.slice(slash + 1) };\n}\n\n/**\n * Probe extensions whose own path names the provider first (the usual\n * `pi-<provider>-provider` package), so the common case runs one registration\n * function instead of every installed extension.\n */\nexport function orderProviderCandidates(\n  paths: readonly string[],\n  provider: string,\n): { named: string[]; rest: string[] } {\n  const needle = provider.toLowerCase();\n  const named: string[] = [];\n  const rest: string[] = [];\n  for (const candidate of paths) {\n    const tail = candidate.split(/[\\\\/]+/).filter(Boolean).slice(-3);\n    (tail.some((segment) => segment.toLowerCase().includes(needle)) ? named : rest).push(candidate);\n  }\n  return { named, rest };\n}\n\nconst realPath = (file: string): string => {\n  try {\n    return fs.realpathSync(file);\n  } catch {\n    return path.resolve(file);\n  }\n};\n\n/** Fabric's own manifest entries: they never register chat providers. */\nexport function fabricExtensionEntries(moduleUrl = import.meta.url): string[] {\n  const root = path.resolve(path.dirname(fileURLToPath(moduleUrl)), \"..\", \"..\");\n  try {\n    const manifest = JSON.parse(fs.readFileSync(path.join(root, \"package.json\"), \"utf8\")) as {\n      name?: unknown;\n      main?: unknown;\n      pi?: { extensions?: unknown };\n    };\n    if (manifest.name !== \"pi-fabric\") return [];\n    const entries = [manifest.main, ...(Array.isArray(manifest.pi?.extensions) ? manifest.pi.extensions : [])];\n    return entries.filter((entry): entry is string => typeof entry === \"string\").map((entry) => path.resolve(root, entry));\n  } catch {\n    return [];\n  }\n}\n\nconst emptyRegistrations = (): ExtensionProviderRegistrations => ({ configs: [], natives: [] });\n\n/**\n * Load extension paths with Pi's own loader into an isolated runtime and keep\n * only the requested provider's registrations. The loaded extensions are\n * discarded: their tools, commands, flags, shortcuts, renderers, and event\n * handlers never bind to the child session, and their event bus is private.\n */\nasync function loadProviderRegistrations(\n  sdk: PiSdk,\n  paths: readonly string[],\n  provider: string,\n  options: { cwd: string; agentDir: string; settingsManager: SettingsManager },\n  failures: string[],\n): Promise<ExtensionProviderRegistrations> {\n  if (paths.length === 0) return emptyRegistrations();\n  const loader = new sdk.DefaultResourceLoader({\n    cwd: options.cwd,\n    agentDir: options.agentDir,\n    settingsManager: options.settingsManager,\n    noExtensions: true,\n    additionalExtensionPaths: [...paths],\n    noSkills: true,\n    noPromptTemplates: true,\n    noThemes: true,\n    noContextFiles: true,\n  });\n  await loader.reload();\n  const { runtime, errors } = loader.getExtensions();\n  failures.push(...errors.map((error) => error.path));\n  return {\n    configs: runtime.pendingProviderRegistrations\n      .filter((registration) => registration.name === provider)\n      .map(({ name, config, extensionPath }) => ({ name, config, extensionPath })),\n    natives: runtime.pendingNativeProviderRegistrations\n      .filter((registration) => registration.provider.id === provider)\n      .map(({ provider: registered, extensionPath }) => ({ provider: registered, extensionPath })),\n  };\n}\n\n/**\n * Find the extension registrations that make `model` resolvable in a child\n * without its other extensions. Returns `undefined` when Pi already knows the\n * model (built in, models.json, or a cached catalog), so those children keep\n * their exact extension-free behaviour. Throws an actionable error when no\n * installed extension registers the provider.\n */\nexport async function resolveExtensionProviders(\n  options: ResolveExtensionProvidersOptions,\n  sdk?: PiSdk,\n): Promise<ExtensionProviderRegistrations | undefined> {\n  const key = parseModelKey(options.model);\n  if (!key) return undefined;\n  const pi = sdk ?? await import(\"@earendil-works/pi-coding-agent\");\n  const models = await pi.ModelRuntime.create({\n    authPath: path.join(options.agentDir, \"auth.json\"),\n    modelsPath: path.join(options.agentDir, \"models.json\"),\n    refreshOnCreate: false,\n  });\n  if (models.getModel(key.provider, key.id)) return undefined;\n  await models.refresh({ allowNetwork: false, signal: AbortSignal.timeout(15_000) });\n  if (models.getModel(key.provider, key.id)) return undefined;\n\n  // Same trust a headless child applies without consulting extension\n  // project_trust handlers: those belong to the extensions left out here.\n  const untrusted = pi.SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: false });\n  const trusted = !pi.hasTrustRequiringProjectResources(options.cwd) ||\n    (new pi.ProjectTrustStore(options.agentDir).get(options.cwd) ?? untrusted.getDefaultProjectTrust() === \"always\");\n  const settingsManager = trusted\n    ? pi.SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: true })\n    : untrusted;\n  const resolved = await new pi.DefaultPackageManager({\n    cwd: options.cwd,\n    agentDir: options.agentDir,\n    settingsManager,\n  }).resolve();\n  const excluded = new Set((options.exclude ?? fabricExtensionEntries()).map(realPath));\n  const candidates = resolved.extensions\n    .filter((resource) => resource.enabled && !resource.path.startsWith(\"builtin:\"))\n    .map((resource) => resource.path)\n    .filter((candidate) => !excluded.has(realPath(candidate)));\n  const { named, rest } = orderProviderCandidates(candidates, key.provider);\n  const context = { cwd: options.cwd, agentDir: options.agentDir, settingsManager };\n  const failures: string[] = [];\n  for (const group of [named, rest]) {\n    const found = await loadProviderRegistrations(pi, group, key.provider, context, failures);\n    if (found.configs.length > 0 || found.natives.length > 0) return found;\n  }\n  throw new Error(\n    `Model \"${options.model}\" needs provider \"${key.provider}\", which is not built into Pi or defined in models.json, ` +\n      \"and no installed Pi extension registers it for this extensions: false child. \" +\n      \"Install the extension that provides it, or run the child with extensions: true.\" +\n      (failures.length > 0 ? ` Extensions that failed to load while searching: ${[...new Set(failures)].join(\", \")}.` : \"\"),\n  );\n}\n\n/**\n * Loaded with `-e` into Pi children launched with `extensions: false`. It\n * registers only the requested model's provider, as its extension registered\n * it, so credentials still resolve in the child through auth.json, the\n * environment, or the credential store. Nothing else from that extension loads.\n */\nexport default async function fabricProviderBridge(pi: ExtensionAPI): Promise<void> {\n  const model = process.env[PROVIDER_BRIDGE_MODEL_ENV]?.trim();\n  if (!model) return;\n  const { getAgentDir } = await import(\"@earendil-works/pi-coding-agent\");\n  const found = await resolveExtensionProviders({ model, cwd: process.cwd(), agentDir: getAgentDir() });\n  if (!found) return;\n  for (const { name, config } of found.configs) pi.registerProvider(name, config);\n  for (const { provider } of found.natives) pi.registerProvider(provider);\n}\n"],
-  "mappings": ";AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAQvB,IAAM,4BAA4B;AAkBlC,SAAS,cAAc,KAA2D;AACvF,QAAM,QAAQ,IAAI,KAAK;AACvB,QAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,MAAI,SAAS,KAAK,UAAU,MAAM,SAAS,EAAG,QAAO;AACrD,SAAO,EAAE,UAAU,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,MAAM,QAAQ,CAAC,EAAE;AACvE;AAOO,SAAS,wBACd,OACA,UACqC;AACrC,QAAM,SAAS,SAAS,YAAY;AACpC,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAiB,CAAC;AACxB,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,UAAU,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAE,MAAM,EAAE;AAC/D,KAAC,KAAK,KAAK,CAAC,YAAY,QAAQ,YAAY,EAAE,SAAS,MAAM,CAAC,IAAI,QAAQ,MAAM,KAAK,SAAS;AAAA,EAChG;AACA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEA,IAAM,WAAW,CAAC,SAAyB;AACzC,MAAI;AACF,WAAO,GAAG,aAAa,IAAI;AAAA,EAC7B,QAAQ;AACN,WAAO,KAAK,QAAQ,IAAI;AAAA,EAC1B;AACF;AAGO,SAAS,uBAAuB,YAAY,YAAY,KAAe;AAC5E,QAAM,OAAO,KAAK,QAAQ,KAAK,QAAQ,cAAc,SAAS,CAAC,GAAG,MAAM,IAAI;AAC5E,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,MAAM,cAAc,GAAG,MAAM,CAAC;AAKpF,QAAI,SAAS,SAAS,YAAa,QAAO,CAAC;AAC3C,UAAM,UAAU,CAAC,SAAS,MAAM,GAAI,MAAM,QAAQ,SAAS,IAAI,UAAU,IAAI,SAAS,GAAG,aAAa,CAAC,CAAE;AACzG,WAAO,QAAQ,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAAE,IAAI,CAAC,UAAU,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA,EACvH,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,IAAM,qBAAqB,OAAuC,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,EAAE;AAQ7F,eAAe,0BACb,KACA,OACA,UACA,SACA,UACyC;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO,mBAAmB;AAClD,QAAM,SAAS,IAAI,IAAI,sBAAsB;AAAA,IAC3C,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,IACd,0BAA0B,CAAC,GAAG,KAAK;AAAA,IACnC,UAAU;AAAA,IACV,mBAAmB;AAAA,IACnB,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,QAAM,EAAE,SAAS,OAAO,IAAI,OAAO,cAAc;AACjD,WAAS,KAAK,GAAG,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AAClD,SAAO;AAAA,IACL,SAAS,QAAQ,6BACd,OAAO,CAAC,iBAAiB,aAAa,SAAS,QAAQ,EACvD,IAAI,CAAC,EAAE,MAAM,QAAQ,cAAc,OAAO,EAAE,MAAM,QAAQ,cAAc,EAAE;AAAA,IAC7E,SAAS,QAAQ,mCACd,OAAO,CAAC,iBAAiB,aAAa,SAAS,OAAO,QAAQ,EAC9D,IAAI,CAAC,EAAE,UAAU,YAAY,cAAc,OAAO,EAAE,UAAU,YAAY,cAAc,EAAE;AAAA,EAC/F;AACF;AASA,eAAsB,0BACpB,SACA,KACqD;AACrD,QAAM,MAAM,cAAc,QAAQ,KAAK;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,KAAK,OAAO,MAAM,OAAO,iCAAiC;AAChE,QAAM,SAAS,MAAM,GAAG,aAAa,OAAO;AAAA,IAC1C,UAAU,KAAK,KAAK,QAAQ,UAAU,WAAW;AAAA,IACjD,YAAY,KAAK,KAAK,QAAQ,UAAU,aAAa;AAAA,IACrD,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,OAAO,SAAS,IAAI,UAAU,IAAI,EAAE,EAAG,QAAO;AAClD,QAAM,OAAO,QAAQ,EAAE,cAAc,OAAO,QAAQ,YAAY,QAAQ,IAAM,EAAE,CAAC;AACjF,MAAI,OAAO,SAAS,IAAI,UAAU,IAAI,EAAE,EAAG,QAAO;AAIlD,QAAM,YAAY,GAAG,gBAAgB,OAAO,QAAQ,KAAK,QAAQ,UAAU,EAAE,gBAAgB,MAAM,CAAC;AACpG,QAAM,UAAU,CAAC,GAAG,kCAAkC,QAAQ,GAAG,MAC9D,IAAI,GAAG,kBAAkB,QAAQ,QAAQ,EAAE,IAAI,QAAQ,GAAG,KAAK,UAAU,uBAAuB,MAAM;AACzG,QAAM,kBAAkB,UACpB,GAAG,gBAAgB,OAAO,QAAQ,KAAK,QAAQ,UAAU,EAAE,gBAAgB,KAAK,CAAC,IACjF;AACJ,QAAM,WAAW,MAAM,IAAI,GAAG,sBAAsB;AAAA,IAClD,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,EACF,CAAC,EAAE,QAAQ;AACX,QAAM,WAAW,IAAI,KAAK,QAAQ,WAAW,uBAAuB,GAAG,IAAI,QAAQ,CAAC;AACpF,QAAM,aAAa,SAAS,WACzB,OAAO,CAAC,aAAa,SAAS,WAAW,CAAC,SAAS,KAAK,WAAW,UAAU,CAAC,EAC9E,IAAI,CAAC,aAAa,SAAS,IAAI,EAC/B,OAAO,CAAC,cAAc,CAAC,SAAS,IAAI,SAAS,SAAS,CAAC,CAAC;AAC3D,QAAM,EAAE,OAAO,KAAK,IAAI,wBAAwB,YAAY,IAAI,QAAQ;AACxE,QAAM,UAAU,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,UAAU,gBAAgB;AAChF,QAAM,WAAqB,CAAC;AAC5B,aAAW,SAAS,CAAC,OAAO,IAAI,GAAG;AACjC,UAAM,QAAQ,MAAM,0BAA0B,IAAI,OAAO,IAAI,UAAU,SAAS,QAAQ;AACxF,QAAI,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,QAAM,IAAI;AAAA,IACR,UAAU,QAAQ,KAAK,qBAAqB,IAAI,QAAQ,2NAGrD,SAAS,SAAS,IAAI,oDAAoD,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM;AAAA,EACtH;AACF;AAQA,eAAO,qBAA4C,IAAiC;AAClF,QAAM,QAAQ,QAAQ,IAAI,yBAAyB,GAAG,KAAK;AAC3D,MAAI,CAAC,MAAO;AACZ,QAAM,EAAE,YAAY,IAAI,MAAM,OAAO,iCAAiC;AACtE,QAAM,QAAQ,MAAM,0BAA0B,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,UAAU,YAAY,EAAE,CAAC;AACpG,MAAI,CAAC,MAAO;AACZ,aAAW,EAAE,MAAM,OAAO,KAAK,MAAM,QAAS,IAAG,iBAAiB,MAAM,MAAM;AAC9E,aAAW,EAAE,SAAS,KAAK,MAAM,QAAS,IAAG,iBAAiB,QAAQ;AACxE;",
+  "sourcesContent": ["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport type { Provider } from \"@earendil-works/pi-ai\";\nimport type { ExtensionAPI, ProviderConfig, SettingsManager } from \"@earendil-works/pi-coding-agent\";\n\n/**\n * The `provider/id` key a Pi child launched with `extensions: false` must\n * resolve. The worker sets it only when it also loads this bridge with `-e`.\n */\nexport const PROVIDER_BRIDGE_MODEL_ENV = \"PI_FABRIC_EXTENSION_MODEL\";\n\nexport interface ExtensionProviderRegistrations {\n  configs: Array<{ name: string; config: ProviderConfig; extensionPath: string }>;\n  natives: Array<{ provider: Provider; extensionPath: string }>;\n}\n\nexport interface ResolveExtensionProvidersOptions {\n  model: string;\n  cwd: string;\n  agentDir: string;\n  /** Extension entry files never probed (Fabric's own entries by default). */\n  exclude?: readonly string[];\n}\n\ntype PiSdk = typeof import(\"@earendil-works/pi-coding-agent\");\n\n/** Split a canonical `provider/id` key at its first slash. */\nexport function parseModelKey(key: string): { provider: string; id: string } | undefined {\n  const value = key.trim();\n  const slash = value.indexOf(\"/\");\n  if (slash <= 0 || slash === value.length - 1) return undefined;\n  return { provider: value.slice(0, slash), id: value.slice(slash + 1) };\n}\n\n/**\n * Probe extensions whose own path names the provider first (the usual\n * `pi-<provider>-provider` package), so the common case runs one registration\n * function instead of every installed extension.\n */\nexport function orderProviderCandidates(\n  paths: readonly string[],\n  provider: string,\n): { named: string[]; rest: string[] } {\n  const needle = provider.toLowerCase();\n  const named: string[] = [];\n  const rest: string[] = [];\n  for (const candidate of paths) {\n    const tail = candidate.split(/[\\\\/]+/).filter(Boolean).slice(-3);\n    (tail.some((segment) => segment.toLowerCase().includes(needle)) ? named : rest).push(candidate);\n  }\n  return { named, rest };\n}\n\nconst realPath = (file: string): string => {\n  try {\n    return fs.realpathSync(file);\n  } catch {\n    return path.resolve(file);\n  }\n};\n\n/** A manifest entry that loads a Pi package Fabric bundles (`node_modules/<package>/...`). */\nconst isBundledPackageEntry = (entry: string): boolean =>\n  entry.replace(/\\\\/g, \"/\").replace(/^(?:\\.\\/)+/, \"\").startsWith(\"node_modules/\");\n\n/**\n * Fabric's own manifest entries: they never register chat providers. Entries\n * of bundled Pi packages (pi-coralbricks-provider) are not Fabric's own: they\n * stay probe candidates, so the bundled provider resolves without loading\n * Fabric's main extension.\n */\nexport function fabricExtensionEntries(moduleUrl = import.meta.url): string[] {\n  const root = path.resolve(path.dirname(fileURLToPath(moduleUrl)), \"..\", \"..\");\n  try {\n    const manifest = JSON.parse(fs.readFileSync(path.join(root, \"package.json\"), \"utf8\")) as {\n      name?: unknown;\n      main?: unknown;\n      pi?: { extensions?: unknown };\n    };\n    if (manifest.name !== \"pi-fabric\") return [];\n    const entries = [manifest.main, ...(Array.isArray(manifest.pi?.extensions) ? manifest.pi.extensions : [])];\n    return entries\n      .filter((entry): entry is string => typeof entry === \"string\" && !isBundledPackageEntry(entry))\n      .map((entry) => path.resolve(root, entry));\n  } catch {\n    return [];\n  }\n}\n\nconst emptyRegistrations = (): ExtensionProviderRegistrations => ({ configs: [], natives: [] });\n\n/**\n * Load extension paths with Pi's own loader into an isolated runtime and keep\n * only the requested provider's registrations. The loaded extensions are\n * discarded: their tools, commands, flags, shortcuts, renderers, and event\n * handlers never bind to the child session, and their event bus is private.\n */\nasync function loadProviderRegistrations(\n  sdk: PiSdk,\n  paths: readonly string[],\n  provider: string,\n  options: { cwd: string; agentDir: string; settingsManager: SettingsManager },\n  failures: string[],\n): Promise<ExtensionProviderRegistrations> {\n  if (paths.length === 0) return emptyRegistrations();\n  const loader = new sdk.DefaultResourceLoader({\n    cwd: options.cwd,\n    agentDir: options.agentDir,\n    settingsManager: options.settingsManager,\n    noExtensions: true,\n    additionalExtensionPaths: [...paths],\n    noSkills: true,\n    noPromptTemplates: true,\n    noThemes: true,\n    noContextFiles: true,\n  });\n  await loader.reload();\n  const { runtime, errors } = loader.getExtensions();\n  failures.push(...errors.map((error) => error.path));\n  return {\n    configs: runtime.pendingProviderRegistrations\n      .filter((registration) => registration.name === provider)\n      .map(({ name, config, extensionPath }) => ({ name, config, extensionPath })),\n    natives: runtime.pendingNativeProviderRegistrations\n      .filter((registration) => registration.provider.id === provider)\n      .map(({ provider: registered, extensionPath }) => ({ provider: registered, extensionPath })),\n  };\n}\n\n/**\n * Find the extension registrations that make `model` resolvable in a child\n * without its other extensions. Returns `undefined` when Pi already knows the\n * model (built in, models.json, or a cached catalog), so those children keep\n * their exact extension-free behaviour. Throws an actionable error when no\n * installed extension registers the provider.\n */\nexport async function resolveExtensionProviders(\n  options: ResolveExtensionProvidersOptions,\n  sdk?: PiSdk,\n): Promise<ExtensionProviderRegistrations | undefined> {\n  const key = parseModelKey(options.model);\n  if (!key) return undefined;\n  const pi = sdk ?? await import(\"@earendil-works/pi-coding-agent\");\n  const models = await pi.ModelRuntime.create({\n    authPath: path.join(options.agentDir, \"auth.json\"),\n    modelsPath: path.join(options.agentDir, \"models.json\"),\n    refreshOnCreate: false,\n  });\n  if (models.getModel(key.provider, key.id)) return undefined;\n  await models.refresh({ allowNetwork: false, signal: AbortSignal.timeout(15_000) });\n  if (models.getModel(key.provider, key.id)) return undefined;\n\n  // Same trust a headless child applies without consulting extension\n  // project_trust handlers: those belong to the extensions left out here.\n  const untrusted = pi.SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: false });\n  const trusted = !pi.hasTrustRequiringProjectResources(options.cwd) ||\n    (new pi.ProjectTrustStore(options.agentDir).get(options.cwd) ?? untrusted.getDefaultProjectTrust() === \"always\");\n  const settingsManager = trusted\n    ? pi.SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: true })\n    : untrusted;\n  const resolved = await new pi.DefaultPackageManager({\n    cwd: options.cwd,\n    agentDir: options.agentDir,\n    settingsManager,\n  }).resolve();\n  const excluded = new Set((options.exclude ?? fabricExtensionEntries()).map(realPath));\n  const candidates = resolved.extensions\n    .filter((resource) => resource.enabled && !resource.path.startsWith(\"builtin:\"))\n    .map((resource) => resource.path)\n    .filter((candidate) => !excluded.has(realPath(candidate)));\n  const { named, rest } = orderProviderCandidates(candidates, key.provider);\n  const context = { cwd: options.cwd, agentDir: options.agentDir, settingsManager };\n  const failures: string[] = [];\n  for (const group of [named, rest]) {\n    const found = await loadProviderRegistrations(pi, group, key.provider, context, failures);\n    if (found.configs.length > 0 || found.natives.length > 0) return found;\n  }\n  throw new Error(\n    `Model \"${options.model}\" needs provider \"${key.provider}\", which is not built into Pi or defined in models.json, ` +\n      \"and no installed Pi extension registers it for this extensions: false child. \" +\n      \"Install the extension that provides it, or run the child with extensions: true.\" +\n      (failures.length > 0 ? ` Extensions that failed to load while searching: ${[...new Set(failures)].join(\", \")}.` : \"\"),\n  );\n}\n\n/**\n * The SDK entry of the bundled Pi CLI running this process, if it is one. The\n * published `pi` bin is `dist/bundle/cli.js`; its `dist/bundle/index.js` SDK\n * entry is built from the same chunks the CLI has already evaluated.\n */\nexport function hostBundleSdkEntry(cliPath: string | undefined = process.argv[1]): string | undefined {\n  if (!cliPath) return undefined;\n  let cli: string;\n  try {\n    cli = fs.realpathSync(cliPath);\n  } catch {\n    return undefined;\n  }\n  const bundle = path.dirname(cli);\n  if (path.basename(cli) !== \"cli.js\" || path.basename(bundle) !== \"bundle\") return undefined;\n  const entry = path.join(bundle, \"index.js\");\n  try {\n    const manifest = JSON.parse(fs.readFileSync(path.join(bundle, \"..\", \"..\", \"package.json\"), \"utf8\")) as { name?: unknown };\n    return manifest.name === \"@earendil-works/pi-coding-agent\" && fs.existsSync(entry) ? entry : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * The host's own SDK. Pi imports this bridge natively (it is ESM JavaScript),\n * so jiti's virtual modules do not apply, and a bare package import from here\n * evaluates the separate unbundled SDK: about 1,800 more modules in the\n * bundled CLI. Besides the startup cost, that CLI enables Node's compile cache,\n * which serializes every one of those modules on exit; with a cold cache that\n * held a Windows child past the worker's exit grace after it had settled.\n * The bundle's SDK entry shares the CLI's already loaded chunks instead.\n */\nexport async function loadHostSdk(cliPath: string | undefined = process.argv[1]): Promise<PiSdk> {\n  const entry = hostBundleSdkEntry(cliPath);\n  if (entry) {\n    try {\n      return await import(pathToFileURL(entry).href) as PiSdk;\n    } catch {\n      // Unexpected bundle layout: fall back to the package entry.\n    }\n  }\n  return import(\"@earendil-works/pi-coding-agent\");\n}\n\n/**\n * Loaded with `-e` into Pi children launched with `extensions: false`. It\n * registers only the requested model's provider, as its extension registered\n * it, so credentials still resolve in the child through auth.json, the\n * environment, or the credential store. Nothing else from that extension loads.\n */\nexport default async function fabricProviderBridge(pi: ExtensionAPI): Promise<void> {\n  const model = process.env[PROVIDER_BRIDGE_MODEL_ENV]?.trim();\n  if (!model) return;\n  const sdk = await loadHostSdk();\n  const found = await resolveExtensionProviders({ model, cwd: process.cwd(), agentDir: sdk.getAgentDir() }, sdk);\n  if (!found) return;\n  for (const { name, config } of found.configs) pi.registerProvider(name, config);\n  for (const { provider } of found.natives) pi.registerProvider(provider);\n}\n"],
+  "mappings": ";AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,eAAe,qBAAqB;AAQtC,IAAM,4BAA4B;AAkBlC,SAAS,cAAc,KAA2D;AACvF,QAAM,QAAQ,IAAI,KAAK;AACvB,QAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,MAAI,SAAS,KAAK,UAAU,MAAM,SAAS,EAAG,QAAO;AACrD,SAAO,EAAE,UAAU,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,MAAM,QAAQ,CAAC,EAAE;AACvE;AAOO,SAAS,wBACd,OACA,UACqC;AACrC,QAAM,SAAS,SAAS,YAAY;AACpC,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAiB,CAAC;AACxB,aAAW,aAAa,OAAO;AAC7B,UAAM,OAAO,UAAU,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAE,MAAM,EAAE;AAC/D,KAAC,KAAK,KAAK,CAAC,YAAY,QAAQ,YAAY,EAAE,SAAS,MAAM,CAAC,IAAI,QAAQ,MAAM,KAAK,SAAS;AAAA,EAChG;AACA,SAAO,EAAE,OAAO,KAAK;AACvB;AAEA,IAAM,WAAW,CAAC,SAAyB;AACzC,MAAI;AACF,WAAO,GAAG,aAAa,IAAI;AAAA,EAC7B,QAAQ;AACN,WAAO,KAAK,QAAQ,IAAI;AAAA,EAC1B;AACF;AAGA,IAAM,wBAAwB,CAAC,UAC7B,MAAM,QAAQ,OAAO,GAAG,EAAE,QAAQ,cAAc,EAAE,EAAE,WAAW,eAAe;AAQzE,SAAS,uBAAuB,YAAY,YAAY,KAAe;AAC5E,QAAM,OAAO,KAAK,QAAQ,KAAK,QAAQ,cAAc,SAAS,CAAC,GAAG,MAAM,IAAI;AAC5E,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,MAAM,cAAc,GAAG,MAAM,CAAC;AAKpF,QAAI,SAAS,SAAS,YAAa,QAAO,CAAC;AAC3C,UAAM,UAAU,CAAC,SAAS,MAAM,GAAI,MAAM,QAAQ,SAAS,IAAI,UAAU,IAAI,SAAS,GAAG,aAAa,CAAC,CAAE;AACzG,WAAO,QACJ,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,CAAC,sBAAsB,KAAK,CAAC,EAC7F,IAAI,CAAC,UAAU,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,IAAM,qBAAqB,OAAuC,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,EAAE;AAQ7F,eAAe,0BACb,KACA,OACA,UACA,SACA,UACyC;AACzC,MAAI,MAAM,WAAW,EAAG,QAAO,mBAAmB;AAClD,QAAM,SAAS,IAAI,IAAI,sBAAsB;AAAA,IAC3C,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ;AAAA,IACzB,cAAc;AAAA,IACd,0BAA0B,CAAC,GAAG,KAAK;AAAA,IACnC,UAAU;AAAA,IACV,mBAAmB;AAAA,IACnB,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,QAAM,EAAE,SAAS,OAAO,IAAI,OAAO,cAAc;AACjD,WAAS,KAAK,GAAG,OAAO,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AAClD,SAAO;AAAA,IACL,SAAS,QAAQ,6BACd,OAAO,CAAC,iBAAiB,aAAa,SAAS,QAAQ,EACvD,IAAI,CAAC,EAAE,MAAM,QAAQ,cAAc,OAAO,EAAE,MAAM,QAAQ,cAAc,EAAE;AAAA,IAC7E,SAAS,QAAQ,mCACd,OAAO,CAAC,iBAAiB,aAAa,SAAS,OAAO,QAAQ,EAC9D,IAAI,CAAC,EAAE,UAAU,YAAY,cAAc,OAAO,EAAE,UAAU,YAAY,cAAc,EAAE;AAAA,EAC/F;AACF;AASA,eAAsB,0BACpB,SACA,KACqD;AACrD,QAAM,MAAM,cAAc,QAAQ,KAAK;AACvC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,KAAK,OAAO,MAAM,OAAO,iCAAiC;AAChE,QAAM,SAAS,MAAM,GAAG,aAAa,OAAO;AAAA,IAC1C,UAAU,KAAK,KAAK,QAAQ,UAAU,WAAW;AAAA,IACjD,YAAY,KAAK,KAAK,QAAQ,UAAU,aAAa;AAAA,IACrD,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,OAAO,SAAS,IAAI,UAAU,IAAI,EAAE,EAAG,QAAO;AAClD,QAAM,OAAO,QAAQ,EAAE,cAAc,OAAO,QAAQ,YAAY,QAAQ,IAAM,EAAE,CAAC;AACjF,MAAI,OAAO,SAAS,IAAI,UAAU,IAAI,EAAE,EAAG,QAAO;AAIlD,QAAM,YAAY,GAAG,gBAAgB,OAAO,QAAQ,KAAK,QAAQ,UAAU,EAAE,gBAAgB,MAAM,CAAC;AACpG,QAAM,UAAU,CAAC,GAAG,kCAAkC,QAAQ,GAAG,MAC9D,IAAI,GAAG,kBAAkB,QAAQ,QAAQ,EAAE,IAAI,QAAQ,GAAG,KAAK,UAAU,uBAAuB,MAAM;AACzG,QAAM,kBAAkB,UACpB,GAAG,gBAAgB,OAAO,QAAQ,KAAK,QAAQ,UAAU,EAAE,gBAAgB,KAAK,CAAC,IACjF;AACJ,QAAM,WAAW,MAAM,IAAI,GAAG,sBAAsB;AAAA,IAClD,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,EACF,CAAC,EAAE,QAAQ;AACX,QAAM,WAAW,IAAI,KAAK,QAAQ,WAAW,uBAAuB,GAAG,IAAI,QAAQ,CAAC;AACpF,QAAM,aAAa,SAAS,WACzB,OAAO,CAAC,aAAa,SAAS,WAAW,CAAC,SAAS,KAAK,WAAW,UAAU,CAAC,EAC9E,IAAI,CAAC,aAAa,SAAS,IAAI,EAC/B,OAAO,CAAC,cAAc,CAAC,SAAS,IAAI,SAAS,SAAS,CAAC,CAAC;AAC3D,QAAM,EAAE,OAAO,KAAK,IAAI,wBAAwB,YAAY,IAAI,QAAQ;AACxE,QAAM,UAAU,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,UAAU,gBAAgB;AAChF,QAAM,WAAqB,CAAC;AAC5B,aAAW,SAAS,CAAC,OAAO,IAAI,GAAG;AACjC,UAAM,QAAQ,MAAM,0BAA0B,IAAI,OAAO,IAAI,UAAU,SAAS,QAAQ;AACxF,QAAI,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,QAAM,IAAI;AAAA,IACR,UAAU,QAAQ,KAAK,qBAAqB,IAAI,QAAQ,2NAGrD,SAAS,SAAS,IAAI,oDAAoD,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM;AAAA,EACtH;AACF;AAOO,SAAS,mBAAmB,UAA8B,QAAQ,KAAK,CAAC,GAAuB;AACpG,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,GAAG,aAAa,OAAO;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,KAAK,SAAS,GAAG,MAAM,YAAY,KAAK,SAAS,MAAM,MAAM,SAAU,QAAO;AAClF,QAAM,QAAQ,KAAK,KAAK,QAAQ,UAAU;AAC1C,MAAI;AACF,UAAM,WAAW,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,QAAQ,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAClG,WAAO,SAAS,SAAS,qCAAqC,GAAG,WAAW,KAAK,IAAI,QAAQ;AAAA,EAC/F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,YAAY,UAA8B,QAAQ,KAAK,CAAC,GAAmB;AAC/F,QAAM,QAAQ,mBAAmB,OAAO;AACxC,MAAI,OAAO;AACT,QAAI;AACF,aAAO,MAAM,OAAO,cAAc,KAAK,EAAE;AAAA,IAC3C,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO,OAAO,iCAAiC;AACjD;AAQA,eAAO,qBAA4C,IAAiC;AAClF,QAAM,QAAQ,QAAQ,IAAI,yBAAyB,GAAG,KAAK;AAC3D,MAAI,CAAC,MAAO;AACZ,QAAM,MAAM,MAAM,YAAY;AAC9B,QAAM,QAAQ,MAAM,0BAA0B,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,UAAU,IAAI,YAAY,EAAE,GAAG,GAAG;AAC7G,MAAI,CAAC,MAAO;AACZ,aAAW,EAAE,MAAM,OAAO,KAAK,MAAM,QAAS,IAAG,iBAAiB,MAAM,MAAM;AAC9E,aAAW,EAAE,SAAS,KAAK,MAAM,QAAS,IAAG,iBAAiB,QAAQ;AACxE;",
   "names": []
 }

package/docs/configuration.md

@@ -338,16 +338,34 @@ Credentials stay with Pi. Fabric hands a child agent only the model key, and the
 
 With `extensions: false` (per call, or as `agents.extensions`), a Pi child loads none of the user's extensions, so it gets the native tool surface without their tools, commands, or hooks. A model that comes from an extension still resolves. A small Fabric bridge loads the extension that registers the requested provider in an isolated runtime, keeps only that provider registration, and discards every tool, command, flag, renderer, and event handler the extension registered. Fabric first tries extensions whose path names the provider, then the other installed extensions; each tried extension's registration function runs once, and its event handlers never run. Project-local extensions count only in a project that Pi already trusts. Models built into Pi or defined in `models.json` skip the bridge entirely. When no installed extension registers the provider, the child fails before the task is sent, with an error that names the provider and suggests `extensions: true`. Strict model admission is unchanged. This covers both Pi runners (`pi-durable` and `pi`). Provider code that depends on its extension's session hooks, and virtual models routed with `pi.registerVirtualModel()`, still need `extensions: true`. Claude, Veda, and custom runners use their own model catalogs and are unaffected.
 
-### Example: Coral Bricks
+### Bundled Coral Bricks provider
 
-Coral Bricks models come from the separate `pi-coralbricks-provider` extension. It is one example; every provider extension works the same way.
+Fabric bundles the Coral Bricks provider extension, [`pi-coralbricks-provider`](https://www.npmjs.com/package/pi-coralbricks-provider), so `coralbricks/*` models are available after installing Fabric alone. Disclosure: Fabric's maintainers work at Coral Bricks.
+
+Add a key once, in either form:
 
 ```sh
-pi install npm:pi-coralbricks-provider
-export CORALBRICKS_API_KEY=...   # or run /login coralbricks once in Pi
+/login coralbricks                # inside Pi; stores the key in auth.json
+export CORALBRICKS_API_KEY=...    # or in the environment
+```
+
+The provider registers keys such as `coralbricks/glm-5.3-fast` and `coralbricks/deepseek-v4.1-flash-fast`. Without a key it serves the model list shipped in the package and makes no network request. With a key it refreshes that list from Coral's API at session start and after `/login`. It loads as its own entry in Fabric's package (`node_modules/pi-coralbricks-provider/index.ts`), outside Fabric's startup graph, so `extensions: false` children resolve `coralbricks/*` models through the bridge above without loading Fabric's main extension.
+
+You can also install `pi-coralbricks-provider` yourself, for example to pick up a newer release before Fabric bundles it. When both copies load, the newest version registers the provider and the other one stays idle, so `/model` lists each model once.
+
+To leave the bundled provider out, replace the plain `npm:pi-fabric` entry in `~/.pi/agent/settings.json` (or a project's `.pi/settings.json`) with the package object form and exclude its path:
+
+```json
+{
+  "packages": [
+    { "source": "npm:pi-fabric", "extensions": ["!node_modules/pi-coralbricks-provider/**"] }
+  ]
+}
 ```
 
-The extension registers keys such as `coralbricks/glm-5.3-fast` and `coralbricks/deepseek-v4.1-flash-fast`. Use them wherever Fabric takes a model, for example in aliases that mix providers:
+Fabric's own extension keeps loading. Use the same `source` you installed from (`git:github.com/fabric-runtime/pi-fabric` or a local path). After opting out, `coralbricks/*` models resolve only if you install the provider separately, and an `extensions: false` child that asks for one fails before the task is sent.
+
+Use the Coral Bricks keys wherever Fabric takes a model, for example in aliases that mix providers:
 
 ```json
 {
@@ -371,6 +389,10 @@ const [coral, gemini] = await Promise.all([
 return { coral: coral.text, gemini: gemini.text };
 ```
 
+### Other providers
+
+Every other provider works the same way. Install its Pi extension with `pi install`, or define it in Pi's `models.json`, and its `provider/id` keys work in each place listed at the start of this section, including `extensions: false` children.
+
 ## Result formatting
 
 `executor.resultFormat` sets the default for `fabric_exec` return values. Find it under `/fabric settings` → **Executor**. `"auto"` keeps strings as text and renders structured values as syntax-highlighted YAML. `"yaml"`, `"json"`, and `"text"` each force their named behavior. A call-level `resultFormat` parameter overrides the configured default.

package/node_modules/pi-coralbricks-provider/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/pi-coralbricks-provider/README.md

@@ -0,0 +1,306 @@
+<div align="center">
+
+# 🪸 pi-coralbricks-provider
+
+**GLM 5.3 & DeepSeek V4.1 Flash through [Coral Bricks](https://www.coralbricks.ai)**
+
+_A [pi](https://github.com/earendil-works/pi-coding-agent) provider extension for Coral's OpenAI-compatible inference gateway — up to **1M context** on open models._
+
+[![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://github.com/earendil-works/pi-coding-agent)
+[![npm](https://img.shields.io/npm/v/pi-coralbricks-provider)](https://www.npmjs.com/package/pi-coralbricks-provider)
+[![license](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)
+[![synbad](https://img.shields.io/badge/synbad-evals_passing-brightgreen)](https://github.com/synthetic-lab/synbad)
+
+</div>
+
+## Pi 1.0 compatibility
+
+Tested with Pi **1.0.0**. Host-provided packages remain wildcard peers; development uses exact SDK pins.
+Run `bun run test:pi` for offline manifest, catalog, lifecycle and streaming checks. To test an installed host, set `PI1_HOST_PACKAGE` to its package directory; add `PI1_HOST_ENTRY=bundle` for its bundled CLI runtime. The probe stubs all network requests and never uses a live provider endpoint.
+
+---
+
+## Features
+
+- **2 reasoning models** from Coral's live catalog — GLM 5.3 and DeepSeek V4.1 Flash (the `-fp4` twin slugs Coral still serves are hidden as duplicates)
+- **1M token context** on GLM and DeepSeek, with vision (image input) on DeepSeek V4.1 Flash
+- **OpenAI-compatible API** — standard `/v1/chat/completions`, streaming, and tool calling
+- **Per-family thinking levels** — zai-style `thinking` control for GLM (including a *real* off switch), `reasoning_effort` for DeepSeek V4.1 Flash
+- **Accurate cost tracking** — input, cache-write and output rates mirror Coral's [published pricing](https://www.coralbricks.ai/pricing), and cached reads are **$0 on every model**
+- **Self-healing model sync** — stale-while-revalidate from the authenticated `/v1/models`, hot-swapped at session start and after `/login`. Without a key it makes no network request and serves the cached or embedded catalog
+- **Quiet startup sync** — startup never waits on the network, and the catalog is refreshed at most hourly, by one pi process at a time, so `/new`, `pi -p` and fan-out child agents share one cache (see [Model Sync](#model-sync))
+- **Safe to install twice** — when a standalone install and a copy bundled in another Pi package (such as [pi-fabric](https://github.com/fabric-runtime/pi-fabric)) load together, only the newest copy registers the provider (see [Installed more than once](#installed-more-than-once))
+- **synbad-validated** — [synbad](https://github.com/synthetic-lab/synbad) tool-calling and reasoning-parsing evals pass 13/13 in every run on GLM 5.3 in both unary and streaming modes
+
+## Installation
+
+### Option 1: Using `pi install` (Recommended)
+
+Install directly from GitHub:
+
+```bash
+pi install https://github.com/monotykamary/pi-coralbricks-provider
+```
+
+or from npm:
+
+```bash
+pi install npm:pi-coralbricks-provider
+```
+
+Then set your API key and run pi:
+
+```bash
+# Recommended: run /login coralbricks inside pi (saves it to auth.json)
+# See Authentication section below
+
+# Or set as environment variable
+export CORALBRICKS_API_KEY=cb_your-key-here
+
+pi
+```
+
+### Option 2: Manual Clone
+
+1. Clone this repository:
+   ```bash
+   git clone https://github.com/monotykamary/pi-coralbricks-provider.git
+   cd pi-coralbricks-provider
+   bun install
+   ```
+
+2. Set your Coral API key:
+   ```bash
+   # Recommended: run /login coralbricks inside pi (saves it to auth.json)
+   # See Authentication section below
+
+   # Or set as environment variable
+   export CORALBRICKS_API_KEY=cb_your-key-here
+   ```
+
+3. Run pi with the extension:
+   ```bash
+   pi -e /path/to/pi-coralbricks-provider
+   ```
+
+### Installed more than once
+
+Another Pi package can bundle this extension; [pi-fabric](https://github.com/fabric-runtime/pi-fabric) does. You can still install it yourself, for example to get a newer version first. When two or more copies load into one Pi session, the newest version registers `coralbricks`, syncs models and serves `/coralbricks-settings`. The other copies register nothing and make no requests, so `/model` lists each model once and `/v1/models` is fetched once. Copies of the same version keep the one that loaded first.
+
+The copies find each other through a process-global registry (`Symbol.for("pi-coralbricks-provider.registry.v1")`), scoped to the Pi extension runtime through the event bus Pi shares among that runtime's extensions. The newest copy wins whichever order Pi loads them in. If it loads second, it takes over before the session starts, and Pi serves its registration because a provider registered later under the same id replaces the earlier one. Ownership never moves back, and it ends with the session, so `/reload`, `/new`, `/resume` and `/fork` start from a clean slate. Versions before 1.0.32 do not take part and always register.
+
+## Available Models
+
+| Model | Context | Vision | Reasoning | Input $/M | Cache Read $/M | Cache Write $/M | Output $/M |
+|-------|---------|--------|-----------|-----------|-----------------|------------------|------------|
+| DeepSeek V4.1 Flash | 1.0M | ✅ | ✅ | $0.01 | — | $0.09 | $1.20 |
+| GLM 5.3 | 1.0M | ❌ | ✅ | $1.12 | — | $1.68 | $4.40 |
+
+*Costs are per million tokens. Cache Read shows — because Coral bills cached input at **$0** on every model. Prompt tokens Coral has not cached yet are billed once at the Cache Write rate, in place of the Input rate. Prices subject to change — check [Coral's live catalog](https://www.coralbricks.ai/api/public/models).*
+
+## Usage
+
+After loading the extension, use the `/model` command in pi to select your preferred model:
+
+```
+/model coralbricks glm-5.3-fp4
+```
+
+Or start pi directly with a Coral model:
+
+```bash
+pi -e /path/to/pi-coralbricks-provider --model coralbricks/deepseek-v4.1-flash-fast-fp4:high
+```
+
+Thinking levels attach to the model id with `:<level>` — e.g. `:low`, `:high`, `:max`, or `:off` (GLM and DeepSeek).
+
+## Provider Settings
+
+Run `/coralbricks-settings` to choose the **API surface** and, for Responses,
+whether to **park turns**. The searchable,
+bordered settings list matches pi's settings UI; GUI/RPC clients get a selection
+dialog. Changes are saved immediately and apply to the next request without a
+restart, including when a CoralBricks model is already selected.
+
+Settings live at `~/.pi/agent/extensions/coralbricks.json` (or under
+`PI_CODING_AGENT_DIR` when set):
+
+```json
+{ "api": "responses", "park": false }
+```
+
+- **`chat-completions`** (default): uses `/v1/chat/completions`; existing behavior
+  is unchanged. Select this to opt back out.
+- **`responses`** (opt-in): uses `/v1/responses` with pi's native text, reasoning,
+  tool-call, image, usage, and cancellation handling. The same model IDs and API
+  key work on both surfaces. Thinking levels map to `reasoning.effort` here.
+
+By default, Responses requests replay the full local conversation and send
+`store: false`. This integration does not use background jobs or resumable
+streams. Coral's broader Responses API is documented at
+[coralbricks.ai/docs](https://www.coralbricks.ai/docs).
+
+### Parking (`"park": true`)
+
+With parking on, every Responses request is sent with `store: true` and the
+next request continues it with `previous_response_id`. pi still builds the full
+transcript, but only the items after the parked response (tool results, the
+next user message) go over the wire. Tools are re-sent every time because Coral
+does not carry them across a chain.
+
+A turn is chained only when the full input starts with exactly what was sent
+for the parked response, followed by that response's own output. Compaction, a
+model switch, an edited or branched history, or a pi restart falls back to a
+full replay, and that request is parked again. If Coral no longer has the parent
+(`previous_response_not_found`), the same request is re-sent once in full.
+Parked ids live in memory only.
+
+Things to know before turning it on:
+
+- Coral keeps every parked response on its side. Deleting a parent breaks the
+  chain, so the extension does not delete them.
+- Coral bills a chained request as the tool definitions plus the new items. The
+  first chained request in a session writes the tool block to cache once, and
+  later ones read it back. With a warm cache, a 7-request tool loop cost about
+  the same as a full replay on DeepSeek V4.1 Flash and about a third more on
+  GLM 5.3 Flash. The parked history itself is not billed again, which matters
+  when Coral evicts a long session's cache.
+
+Live probes verified text, automatic tool calls, tool-result replay, and switching
+back to Chat Completions on all current models. The gateway currently rejects
+Responses requests that force a named tool (`tool_choice: {"type":"function",
+"name":"..."}`); leave tool selection automatic (pi's default). Errors are surfaced
+without silently falling back to a different API.
+
+Missing, invalid, or unreadable settings default to Chat Completions. Unknown
+JSON fields are preserved when toggling; malformed files must be fixed before
+saving. If editing the file manually, run `/reload` to apply it.
+
+## Authentication
+
+The Coral API key can be configured in multiple ways (resolved in this order):
+
+1. **Runtime override** — Use the `--api-key` CLI flag
+2. **`auth.json`** (recommended) — Run `/login coralbricks` inside pi and paste your key; pi saves it to `~/.pi/agent/auth.json` and refreshes the model list from the authenticated `/v1/models`. Or add it by hand:
+   ```json
+   { "coralbricks": { "type": "api_key", "key": "cb_your-key" } }
+   ```
+   The `key` field supports literal values, env var names, and shell commands (prefix with `!`). `/logout` (pick CoralBricks) removes the stored key; `CORALBRICKS_API_KEY` is left alone.
+3. **Environment variable** — Set `CORALBRICKS_API_KEY`
+
+With [localterm](https://www.npmjs.com/package/localterm), store it once and it's exposed everywhere:
+
+```bash
+localterm secret set coralbricks_api_key
+```
+
+### Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `CORALBRICKS_API_KEY` | No | Your Coral API key (fallback if not in `auth.json` or `--api-key`) |
+| `PI_PROVIDER_SYNC_TTL_MS` | No | Model sync freshness window in ms (default `3600000`; `0` = revalidate every session start) |
+
+> Coral Inference is currently in a design-partner program — mint keys at [coralbricks.ai/api-keys](https://www.coralbricks.ai/api-keys). Newly-minted keys may take ~30 seconds to be honored, and `403 access_denied` means the account isn't on the allowlist yet.
+
+## Thinking Levels
+
+Verified against the live gateway:
+
+| Model | Format | off | low | medium | high | max |
+|-------|--------|-----|-----|--------|------|-----|
+| GLM 5.3 FP4 | `thinking: {type}` + `reasoning_effort` | ✅ | ✅ | — | ✅ | ✅ |
+| GLM 5.3 Flash (retired) | `thinking: {type}` + `reasoning_effort` | ✅ | ✅ | — | ✅ | ✅ |
+| DeepSeek V4.1 Flash | `reasoning_effort` | ✅ | ✅ | — | ✅ | ✅ |
+
+- **GLM** accepts zai-style `thinking: {type: "disabled"}` on Coral — pi's *off* level turns thinking off, though a short preamble of a few dozen tokens can still appear (the upstream Z.ai API has no off at all, so this differs from the canonical Z.ai map).
+- **DeepSeek V4.1 Flash** reasons only when asked: a request without `reasoning_effort`, or with `"none"`, gets no reasoning, which is what pi's *off* sends. `thinking: {type}` has no effect on this model.
+- Coral streams a duplicate `reasoning` field alongside `reasoning_content`; pi dedupes these automatically.
+
+## Compat Settings
+
+Coral's gateway follows the OpenAI Chat Completions API:
+
+- **`supportsStore: false`** / **`supportsDeveloperRole: false`** — all models; Coral serves open models on the classic roles.
+- **`maxTokensField: "max_tokens"`** — all models.
+- **`thinkingFormat: "zai"`** — GLM 5.3: `thinking: {type: "enabled"|"disabled"}` toggles reasoning, `reasoning_effort` picks the depth.
+- **`thinkingFormat: "openai"`** — DeepSeek V4.1 Flash: `reasoning_effort` drives thinking depth.
+
+### Patch Overrides & Custom Models
+
+- **`patch.json`** — per-model overrides applied on top of `models.json` (reasoning flags, pricing corrections, compat settings, thinking level maps, `"hidden"`). One entry per model Coral serves: GLM 5.3 and DeepSeek V4.1 Flash carry the reasoning and compat settings, and their `-fp4` twins set `"hidden": true` so `/model` and the table above list each model once.
+- **`custom-models.json`** — full model definitions for models Coral doesn't list. Merged after patch.
+
+Merge order: `[live|cache|embedded] → patch.json → custom-models.json`
+
+## Inference-Quality Testing
+
+Validated with [synbad](https://github.com/synthetic-lab/synbad) — Synthetic's tool-calling and reasoning-parsing eval suite for LLM inference providers (current 13-eval suite, `--reasoning-effort high`, five `--count 1` runs per mode on 2026-09-15, DeepSeek on 2026-09-22; a cell shows the evals that passed in every run):
+
+| Model | Unary | Stream | Notes |
+|-------|-------|--------|-------|
+| GLM 5.3 FP4 | 13/13 ✅ | 13/13 ✅ | 5/5 runs |
+| GLM 5.3 Flash (retired) | 12/13 ⚠️ | 12/13 ⚠️ | `reasoning/reasoning-parsing` passes 4 of 5 runs; see below |
+| GPT-OSS 120B (retired) | 12/13 ⚠️ | 12/13 ⚠️ | `tools/parallel-tool` 0 of 5 runs, before Coral retired the model |
+| DeepSeek V4.1 Flash | 12/13 ⚠️ | 12/13 ⚠️ | `tools/octo-list-no-optional-args` passes 1 of 5 runs; see below |
+| Kimi K3 (retired) | 13/13 ✅ | 13/13 ✅ | 5/5 runs, before Coral retired the model |
+| GLM 5.2 FP4 (retired) | 15/15 ✅ | 15/15 ✅ | 15-eval suite, single run, before Coral retired the model |
+
+The misses are model-side, not transport: gpt-oss answered "Paris and London" with one call after another instead of two parallel calls even when `parallel_tool_calls: true`, in every run; on the trivial prompt `reasoning-parsing` uses, GLM 5.3 Flash answers without a think block about one run in five, in both modes, with the answer itself unaffected; and asked to "call the list tool with no args", DeepSeek V4.1 Flash usually fills in the optional `dirPath` as `"."`.
+
+Reproduce:
+
+```bash
+CORALBRICKS_API_KEY=cb_... node ../synbad/dist/source/index.js eval \
+  --env-var CORALBRICKS_API_KEY \
+  --base-url https://inference.coralbricks.ai/v1 \
+  --model glm-5.3-fp4 --count 1 --reasoning-effort high
+```
+
+## Model Sync
+
+At startup the extension serves the last catalog it cached (`~/.pi/agent/cache/coralbricks-models.json`), or the catalog embedded in the package. Once Pi resolves a key (`/login coralbricks`, `auth.json`, `--api-key` or `CORALBRICKS_API_KEY`), it refreshes from the authenticated `/v1/models` at session start and after `/login`, caches the result and swaps it in. With no key it makes no network request at all.
+
+Startup never waits on the network: the session-start refresh runs in the background, and only when:
+
+- a Coral API key is configured (no key, no request),
+- the cache is older than 1 hour, missing or unreadable, was fetched with a different API key, or was written by a version before this sync policy, and
+- no other pi process is already refreshing it (a `coralbricks-models.lock` file next to the cache).
+
+So `/new`, `/reload`, `pi -p` and fan-out child agents share one cache instead of each calling the API; a session that skips the fetch still picks up a cache another process refreshed, and every cache write is atomic. `/login coralbricks` and a changed key always refresh, whatever the cache's age. A failed refresh is retried after 5 minutes at the earliest. `PI_PROVIDER_SYNC_TTL_MS` changes the window (`0` revalidates on every session start). Only a hash fingerprint of the key is stored (`coralbricks-models.sync.json`), never the key itself. When several copies of the extension load (see [Installed more than once](#installed-more-than-once)), only the owning copy touches the lock or the network.
+
+## Updating Models
+
+Run the update script to fetch the latest models from Coral's API:
+
+```bash
+export CORALBRICKS_API_KEY=cb_your-key
+node scripts/update-models.js
+```
+
+This will:
+1. Fetch models from `https://inference.coralbricks.ai/v1/models` (falls back to the unauthenticated [public catalog](https://www.coralbricks.ai/api/public/models) without a key)
+2. Preserve existing model data (pricing, compat, thinking maps) for known models
+3. Apply overrides from `patch.json`
+4. Update `models.json` and the README model table
+
+To regenerate just the README model table from local data — no API key needed:
+
+```bash
+node scripts/update-models.js --readme-only
+```
+
+## Troubleshooting
+
+| Symptom | Meaning |
+|---------|---------|
+| `403 access_denied` | Account not on the Coral Inference allowlist yet |
+| `404 model_not_accepted` | Model id not enabled for your key |
+| `401 invalid_api_key` | Re-mint at [coralbricks.ai/api-keys](https://www.coralbricks.ai/api-keys); fresh keys take ~30s to activate |
+| `429 rate_limit_exceeded` | Per-key rate limit — retry with backoff |
+| `502 upstream_error` / `503 backend_unconfigured` | Transient — retry |
+| `504 timeout` | Sync request waited too long; re-issue smaller or use Coral's background Responses API |
+
+## License
+
+MIT

package/node_modules/pi-coralbricks-provider/auth.ts

@@ -0,0 +1,30 @@
+import { envApiKeyAuth, type ApiKeyAuth } from "@earendil-works/pi-ai";
+
+export const CORALBRICKS_ENV_VAR = "CORALBRICKS_API_KEY";
+export const CORALBRICKS_KEYS_URL = "https://www.coralbricks.ai/api-keys";
+
+/**
+ * API-key auth for `/login coralbricks`, the pattern Pi's built-in OpenRouter and
+ * Vercel AI Gateway providers use (pi-ai `envApiKeyAuth`): a stored auth.json
+ * `coralbricks` api_key wins, then CORALBRICKS_API_KEY. Login stores
+ * `{ "type": "api_key", "key": ... }` under `coralbricks`, the entry this
+ * extension has always read, and `/logout` removes it.
+ */
+export function coralApiKeyAuth(): ApiKeyAuth {
+  const base = envApiKeyAuth("CoralBricks API key", [CORALBRICKS_ENV_VAR]);
+  return {
+    ...base,
+    login: async (interaction) => {
+      interaction.signal.throwIfAborted();
+      interaction.notify({
+        type: "info",
+        message: "Create a Coral Inference API key at https://www.coralbricks.ai (API keys page). New keys can take ~30 seconds to be honored.",
+        links: [{ url: CORALBRICKS_KEYS_URL, label: "coralbricks.ai/api-keys" }],
+      });
+      const key = (await interaction.prompt({ type: "secret", message: "Enter CoralBricks API key", placeholder: "cb_..." })).trim();
+      interaction.signal.throwIfAborted();
+      if (!key) throw new Error("No CoralBricks API key entered");
+      return { type: "api_key", key };
+    },
+  };
+}

package/node_modules/pi-coralbricks-provider/custom-models.json

@@ -0,0 +1 @@
+[]