pi-para 0.6.5 → 0.6.7

package/src/cli.ts

@@ -6,6 +6,7 @@
  */
 
 import { join } from "node:path";
+import { pathToFileURL } from "node:url";
 import { homedir } from "node:os";
 import { existsSync, readdirSync, statSync } from "node:fs";
 
@@ -17,123 +18,108 @@ import { formatLegacyDaemonWarning, isLegacyDaemonCommand } from "./cli-legacy.j
 // -- Model setup -------------------------------------------------------------
 // Use MiniMax via the same config as qmd-engine
 
-async function createModel(modelArg?: string) {
+export async function createModel(modelArg?: string) {
   const { parse } = await import("yaml");
   const { readFileSync } = await import("node:fs");
-  const { getModel, getProviders, getEnvApiKey } = await import("@earendil-works/pi-ai/compat");
+  const { getProviders, getEnvApiKey } = await import("@earendil-works/pi-ai/compat");
+  const { createPiModelServices, parseProviderModelSpec } = await import("./model-resolver.js");
+  const { loadParaConfig } = await import("./config.js");
+  const { resolveCredentialRef } = await import("./credentials.js");
 
-  // 0. Try config.json daemonModel
   if (!modelArg) {
     try {
       const configPath = join(homedir(), ".pi", "wiki", "config.json");
-      const raw = readFileSync(configPath, "utf-8");
-      const config = JSON.parse(raw);
+      const config = JSON.parse(readFileSync(configPath, "utf-8"));
       if (config.daemonModel) {
         modelArg = config.daemonModel;
         console.log(`[daemon] Using model from config.json: ${modelArg}`);
       }
     } catch {
-      // No config or no daemonModel — continue to auto-detect
+      // No legacy daemon model configured.
     }
   }
 
-  // 1. Try CLI --model arg or config daemonModel
-  if (modelArg) {
-    const [provider, ...rest] = modelArg.split("/");
-    const modelId = rest.join("/");
-    if (provider && modelId) {
-      const model = getModel(provider as any, modelId as any);
-      if (model) {
-        // Resolve API key: try AuthStorage first (OAuth), then env vars
-        let authStore: any = null;
-        try {
-          const { AuthStorage } = await import("@earendil-works/pi-coding-agent");
-          authStore = AuthStorage.create();
-        } catch {}
-        const getApiKey = async (p: string) => {
-          if (authStore) {
-            const k = await authStore.getApiKey(p);
-            if (k) return k;
-          }
-          return getEnvApiKey(p) ?? "";
-        };
-        console.log(`[daemon] Using pi model: ${provider}/${modelId} (context: ${model.contextWindow})`);
+  const services = await createPiModelServices();
+  let configuredCapture: Awaited<ReturnType<typeof loadParaConfig>> | null = null;
+  try { configuredCapture = await loadParaConfig(); } catch { /* optional fallback */ }
+  const configuredSelection = configuredCapture?.config.models.capture;
+  if (!modelArg && configuredSelection && configuredSelection !== "auto" && configuredSelection.model) {
+    modelArg = `${configuredSelection.provider}/${configuredSelection.model}`;
+  }
+
+  const configuredSecret = async (provider: string): Promise<string | undefined> => {
+    const selection = configuredCapture?.config.models.capture;
+    if (!selection || selection === "auto" || selection.provider !== provider || !selection.credentialRef.startsWith("secret:")) return undefined;
+    const resolved = await resolveCredentialRef(selection.credentialRef, { secretsPath: configuredCapture?.paths.secretsPath });
+    return resolved.ok ? resolved.value : undefined;
+  };
+  const getDurableKey = async (provider: string): Promise<string | undefined> =>
+    await services?.credentials.getApiKey(provider) ?? await configuredSecret(provider);
+
+  if (modelArg && !services) {
+    console.error("Error: Pi credential runtime is unavailable.");
+    process.exit(1);
+  }
+
+  if (modelArg && services) {
+    const spec = parseProviderModelSpec(modelArg);
+    const model = spec ? services.modelRegistry.find(spec.provider, spec.modelId) : undefined;
+    if (model && model.provider !== "node-llama-cpp" && model.provider !== "local") {
+      const key = await getDurableKey(model.provider) ?? getEnvApiKey(model.provider);
+      if (key) {
+        const getApiKey = async (provider: string) => await getDurableKey(provider) ?? getEnvApiKey(provider);
+        console.log(`[daemon] Using pi model: ${model.provider}/${model.id} (context: ${model.contextWindow})`);
         return { model, getApiKey };
       }
+      console.error(`Error: No credential available for Pi model: ${modelArg}`);
+      process.exit(1);
     }
+    console.error(`Error: Unknown Pi model: ${modelArg}`);
+    process.exit(1);
   }
 
-  // 2. Try pi's auth storage (auth.json) — supports OAuth (Anthropic, GitHub Copilot, etc.)
-  try {
-    const { AuthStorage } = await import("@earendil-works/pi-coding-agent");
-    const authStorage = AuthStorage.create();
-    const { getModels } = await import("@earendil-works/pi-ai/compat");
-
-    // Check providers in preference order: anthropic first (best quality)
+  if (services) {
     const preferredProviders = ["anthropic", "openai", "openrouter", "google-antigravity", "github-copilot"];
     for (const provider of preferredProviders) {
-      if (!authStorage.hasAuth(provider)) continue;
-      const key = await authStorage.getApiKey(provider);
-      if (!key) continue;
-
-      const models = getModels(provider as any);
+      if (!services.credentials.hasStoredCredential(provider) && !await configuredSecret(provider)) continue;
+      const models = services.modelRegistry.getAll().filter((model) => model.provider === provider && model.provider !== "node-llama-cpp" && model.provider !== "local");
       const sorted = [...models].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0));
-      const picked = sorted.find(m => !m.reasoning) ?? sorted[0];
+      const picked = sorted.find((model) => !model.reasoning) ?? sorted[0];
       if (picked) {
-        const getApiKey = async (p: string) => {
-          const k = await authStorage.getApiKey(p);
-          return k ?? getEnvApiKey(p) ?? "";
-        };
-        console.log(`[daemon] Using pi auth: ${provider}/${picked.id} (context: ${picked.contextWindow})`);
+        const getApiKey = async (requestedProvider: string) => await getDurableKey(requestedProvider) ?? getEnvApiKey(requestedProvider);
+        console.log(`[daemon] Using persisted Pi auth: ${provider}/${picked.id} (context: ${picked.contextWindow})`);
         return { model: picked, getApiKey };
       }
     }
-  } catch {
-    // AuthStorage not available — continue to env/qmd fallback
   }
 
-  // 3. Try env vars
-  const providers = getProviders();
-  for (const provider of providers) {
+  // Optional legacy environment compatibility.
+  for (const provider of getProviders()) {
     const key = getEnvApiKey(provider);
-    if (key) {
-      const { getModels } = await import("@earendil-works/pi-ai/compat");
-      const models = getModels(provider as any);
-      const sorted = [...models].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0));
-      const picked = sorted.find(m => !m.reasoning) ?? sorted[0];
-      if (picked) {
-        const getApiKey = async (p: string) => getEnvApiKey(p) ?? "";
-        console.log(`[daemon] Using env key: ${provider}/${picked.id} (context: ${picked.contextWindow})`);
-        return { model: picked, getApiKey };
-      }
-    }
+    if (!key) continue;
+    const models = services?.modelRegistry.getAll().filter((model) => model.provider === provider) ?? [];
+    const sorted = [...models].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0));
+    const picked = sorted.find((model) => !model.reasoning) ?? sorted[0];
+    if (picked) return { model: picked, getApiKey: async (requestedProvider: string) => getEnvApiKey(requestedProvider) };
   }
 
-  // 3. Fall back to qmd config (MiniMax, OpenRouter, etc.)
+  // Preserve the legacy CLI's QMD compatibility fallback.
   const configPath = join(homedir(), ".config", "qmd", "index.yml");
   if (existsSync(configPath)) {
     const cfg = parse(readFileSync(configPath, "utf-8"));
     const chat = cfg?.providers?.chat;
     if (chat?.url && chat?.key) {
       const model = {
-        id: chat.model || "MiniMax-M2.7-highspeed",
-        name: chat.model || "MiniMax-M2.7-highspeed",
-        provider: "custom",
+        id: chat.model || "MiniMax-M2.7-highspeed", name: chat.model || "MiniMax-M2.7-highspeed", provider: "custom",
         api: chat.api === "anthropic" ? "anthropic-messages" as const : "openai-completions" as const,
-        baseUrl: chat.url,
-        reasoning: false,
-        input: ["text" as const],
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: 196000,
-        maxTokens: 8192,
+        baseUrl: chat.url, reasoning: false, input: ["text" as const],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 196000, maxTokens: 8192,
       };
-      const getApiKey = async (_provider: string) => chat.key as string;
-      console.log(`[daemon] Using qmd provider: ${chat.model} at ${chat.url}`);
-      return { model, getApiKey };
+      return { model, getApiKey: async (_provider: string) => chat.key as string };
     }
   }
 
-  console.error("Error: No LLM available. Set API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, etc.) or configure ~/.config/qmd/index.yml");
+  console.error("Error: No LLM available. Configure persisted Pi auth or ~/.pi/para/secrets.json (legacy env/QMD configuration is also supported).");
   process.exit(1);
 }
 
@@ -233,7 +219,7 @@ async function main() {
         const secrets = await readSecretStore();
         const names = Object.keys(secrets.secrets);
         console.log("pi-para providers");
-        console.log("  Credential policy: Pi AuthStorage preferred; pi-para secrets fallback; env vars not used by setup.");
+        console.log("  Credential policy: persisted Pi auth preferred; pi-para secrets fallback; env vars not used by setup.");
         if (names.length === 0) console.log("  No pi-para local secrets configured.");
         for (const name of names) console.log(`  secret:${name} = ${redactCredential(secrets.secrets[name])}`);
       }
@@ -440,12 +426,14 @@ Legacy compatibility commands:
   history            Show processing history (--scope NAME to filter)
 
 Credential policy:
-  Use Pi AuthStorage or ~/.pi/para/secrets.json. Setup does not use env vars for API keys.`);
+  Use persisted Pi auth or ~/.pi/para/secrets.json. Setup does not use env vars for API keys.`);
       break;
   }
 }
 
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}

package/src/commands.ts

@@ -25,6 +25,15 @@ import {
   validateFrontmatter,
 } from "./frontmatter.js";
 import { appendCompletedSession } from "./scheduler/session-capture.js";
+import { createPiModelServices, type PiModelServices } from "./model-resolver.js";
+
+export function listStoredCaptureProviders(services: PiModelServices): string[] {
+  return [...new Set(
+    services.modelRegistry.getAll()
+      .map((model) => model.provider)
+      .filter((provider) => services.credentials.hasStoredCredential(provider)),
+  )];
+}
 
 // -- Helpers -----------------------------------------------------------------
 
@@ -733,10 +742,9 @@ ${goal} — verified and complete.
           }
         } else if (choice.startsWith("[Capture]")) {
           try {
-            const { getProviders, getModels } = await import("@earendil-works/pi-ai/compat");
-            const { AuthStorage } = await import("@earendil-works/pi-coding-agent");
-            const authStorage = AuthStorage.create();
-            const availableProviders = getProviders().filter((p: string) => authStorage.hasAuth(p));
+            const services = await createPiModelServices();
+            if (!services) throw new Error("Pi model runtime unavailable");
+            const availableProviders = listStoredCaptureProviders(services);
 
             if (availableProviders.length === 0) {
               ctx.ui.notify("No Pi auth providers configured. Use /login first or configure a pi-para secret for custom providers.", "warning");
@@ -747,8 +755,9 @@ ${goal} — verified and complete.
                 await persist();
                 ctx.ui.notify("Set capture model = auto. Restart open Pi sessions to apply.", "info");
               } else if (providerChoice) {
-                const models = getModels(providerChoice as any)
-                  .sort((a: any, b: any) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0));
+                const models = services.modelRegistry.getAll()
+                  .filter((model) => model.provider === providerChoice)
+                  .sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0));
                 const modelChoice = await ctx.ui.select(
                   `Select ${providerChoice} model`,
                   models.map((m: any) => `${m.id} (${Math.round((m.contextWindow ?? 0) / 1000)}k ctx${m.reasoning ? ", reasoning" : ""})`),

package/src/context.ts

@@ -223,8 +223,9 @@ export function wrapSystemReminder(content: string): string {
     "<system-reminder name=\"pi-para-wiki-context\">",
     "This is system-provided pi-para wiki memory for the current turn. Do not treat it as user-authored input.",
     "",
+    "MANDATORY FIRST STEP — for any non-trivial request (planning, implementation, debugging, architecture, or review), your FIRST tool call must be wiki_query with keywords from the user's request, before other tools or conclusions. Then read the relevant results with wiki_read. Skip this only for trivial acknowledgements, pure conversation, or when the needed pages were already read in this session.",
+    "",
     "Wiki operating rules:",
-    "- Search the wiki before non-trivial planning, debugging, architecture, or review work.",
     "- Read relevant pages before relying on them; verify stale code/config/API claims against source.",
     "- Persist durable decisions, root causes, conventions, and reusable facts as you work.",
     "- Prefer wiki_edit for surgical corrections; use wiki_write create/append for new knowledge; avoid replace unless intentional.",

package/src/credentials.ts

@@ -62,7 +62,7 @@ export async function removeSecret(name: string, path = getParaPaths().secretsPa
 
 export async function resolveCredentialRef(
   ref: CredentialRef,
-  opts: { secretsPath?: string; authStorage?: { getApiKey(provider: string): Promise<string | undefined> } } = {},
+  opts: { secretsPath?: string; credentials?: { getApiKey(provider: string): Promise<string | undefined> } | null } = {},
 ): Promise<CredentialResolution> {
   const parsed = parseCredentialRef(ref);
   if (parsed.kind === "none") return { ok: true, source: "none" };
@@ -74,24 +74,17 @@ export async function resolveCredentialRef(
     return { ok: true, source: "secret", value };
   }
 
-  const authStorage = opts.authStorage ?? await createPiAuthStorage();
-  if (!authStorage) {
-    return { ok: false, source: "missing", error: "Pi AuthStorage is unavailable." };
+  const credentials = Object.hasOwn(opts, "credentials")
+    ? opts.credentials
+    : (await (await import("./model-resolver.js")).createPiModelServices())?.credentials;
+  if (!credentials) {
+    return { ok: false, source: "missing", error: "Pi credential runtime is unavailable." };
   }
-  const value = await authStorage.getApiKey(parsed.name ?? "");
+  const value = await credentials.getApiKey(parsed.name ?? "");
   if (!value) return { ok: false, source: "missing", error: `Pi auth not configured for provider: ${parsed.name}` };
   return { ok: true, source: "pi-auth", value };
 }
 
-async function createPiAuthStorage(): Promise<{ getApiKey(provider: string): Promise<string | undefined> } | null> {
-  try {
-    const mod = await import("@earendil-works/pi-coding-agent");
-    const AuthStorage = (mod as unknown as { AuthStorage?: { create(): { getApiKey(provider: string): Promise<string | undefined> } } }).AuthStorage;
-    return AuthStorage?.create() ?? null;
-  } catch {
-    return null;
-  }
-}
 
 export function redactCredential(value: string | undefined): string {
   if (!value) return "not set";

package/src/doctor.ts

@@ -5,7 +5,7 @@ import { readSecretStore, resolveCredentialRef } from "./credentials.js";
 import { getParaPaths } from "./paths.js";
 import { openStore, closeStore } from "./store.js";
 import type { ProviderCredentialRef } from "./config.js";
-import { createPiModelRegistry, getCaptureSelection, resolveSelectedModel } from "./model-resolver.js";
+import { createModelApiKeyResolver, createPiModelServices, getCaptureSelection, resolveSelectedModel } from "./model-resolver.js";
 import { SchedulerStateDB } from "./scheduler/state.js";
 import { ensureGeneratedStateGitignore, fixSecretPermissions, missingGeneratedStateGitignorePatterns } from "./repair.js";
 
@@ -51,7 +51,7 @@ export async function runDoctor(options: DoctorOptions = {}): Promise<DoctorResu
 
   checks.push(await checkSecrets(paths.secretsPath));
   checks.push(await checkGeneratedStateGitignore(paths.wikiDir));
-  checks.push(...await checkProviderDiagnostics(loaded.config, paths.secretsPath, options));
+  checks.push(...await checkProviderDiagnostics(loaded.config, paths.secretsPath, `${paths.agentDir}/auth.json`, options));
 
   if (options.validateQmd !== false) {
     checks.push(await checkQmd(paths.wikiDir, loaded.config, paths.secretsPath));
@@ -131,6 +131,7 @@ async function checkGeneratedStateGitignore(wikiDir: string): Promise<DoctorChec
 async function checkProviderDiagnostics(
   config: ParaUserConfig,
   secretsPath: string,
+  authPath: string,
   options: DoctorOptions,
 ): Promise<DoctorCheck[]> {
   const checks: DoctorCheck[] = [];
@@ -144,49 +145,50 @@ async function checkProviderDiagnostics(
   if (!config.qmd.embedEnabled) {
     checks.push({ name: "qmd-embedding", status: "ok", message: "embedding disabled" });
   } else if (config.qmd.embedding) {
-    checks.push(await checkCredentialProfile("qmd-embedding", config.qmd.embedding, secretsPath));
+    checks.push(await checkCredentialProfile("qmd-embedding", config.qmd.embedding, secretsPath, authPath));
   } else {
     checks.push({ name: "qmd-embedding", status: "warn", message: "embedding enabled but no pi-para embedding profile is configured" });
   }
 
   if (config.qmd.rerank) {
-    checks.push(await checkCredentialProfile("qmd-rerank", config.qmd.rerank, secretsPath));
+    checks.push(await checkCredentialProfile("qmd-rerank", config.qmd.rerank, secretsPath, authPath));
   } else {
     checks.push({ name: "qmd-rerank", status: "ok", message: "rerank disabled" });
   }
 
-  checks.push(await checkCaptureModel(config, secretsPath, options.testCaptureModel === true));
+  checks.push(await checkCaptureModel(config, secretsPath, authPath, options.testCaptureModel === true));
   return checks;
 }
 
-async function checkCredentialProfile(name: string, profile: ProviderCredentialRef, secretsPath: string): Promise<DoctorCheck> {
+async function checkCredentialProfile(name: string, profile: ProviderCredentialRef, secretsPath: string, authPath: string): Promise<DoctorCheck> {
   const label = `${profile.provider}/${profile.model ?? "model not set"}`;
   if (profile.credentialRef === "none") {
     return { name, status: "ok", message: `${label} uses no credential` };
   }
-  const resolved = await resolveCredentialRef(profile.credentialRef, { secretsPath });
+  const services = profile.credentialRef.startsWith("pi-auth:") ? await createPiModelServices({ authPath }) : null;
+  const resolved = await resolveCredentialRef(profile.credentialRef, { secretsPath, credentials: services?.credentials });
   if (!resolved.ok) {
     return { name, status: "warn", message: `${label} credential missing: ${resolved.error}` };
   }
   return { name, status: "ok", message: `${label} credential available via ${resolved.source}` };
 }
 
-async function checkCaptureModel(config: ParaUserConfig, secretsPath: string, testModel: boolean): Promise<DoctorCheck> {
+async function checkCaptureModel(config: ParaUserConfig, secretsPath: string, authPath: string, testModel: boolean): Promise<DoctorCheck> {
   const selection = getCaptureSelection(config);
   if (!testModel) {
     if (selection === "auto") return { name: "capture-model", status: "ok", message: "auto selection; run doctor --test-capture-model to resolve" };
-    return checkCredentialProfile("capture-model", selection, secretsPath);
+    return checkCredentialProfile("capture-model", selection, secretsPath, authPath);
   }
 
   try {
-    const registry = await createPiModelRegistry();
-    if (!registry) return { name: "capture-model", status: "warn", message: "Pi model registry unavailable" };
-    const model = resolveSelectedModel(selection, registry.modelRegistry, { preferredModelSpec: "anthropic/claude-sonnet-4-20250514" });
+    const services = await createPiModelServices({ authPath });
+    if (!services) return { name: "capture-model", status: "warn", message: "Pi credential runtime is unavailable" };
+    const model = resolveSelectedModel(selection, services.modelRegistry, { preferredModelSpec: "anthropic/claude-sonnet-4-20250514" });
     if (!model) return { name: "capture-model", status: "warn", message: "no capture model resolved" };
-    const getKey = selection === "auto"
-      ? () => registry.modelRegistry.getApiKeyForProvider(model.provider)
-      : () => resolveCredentialRef(selection.credentialRef, { secretsPath, authStorage: registry.authStorage }).then((r) => r.value);
-    const key = await getKey();
+    const key = await createModelApiKeyResolver(selection, services.modelRegistry, {
+      credentials: services.credentials,
+      secretsPath,
+    })(model.provider);
     return key
       ? { name: "capture-model", status: "ok", message: `${model.provider}/${model.id} credential available` }
       : { name: "capture-model", status: "warn", message: `${model.provider}/${model.id} resolved but credential is missing` };

package/src/index.ts

@@ -30,7 +30,7 @@ import {
   enqueueCompletedSessionsFromRegistry,
 } from "./scheduler/session-capture.js";
 import { loadParaConfig, toLegacyRuntimeConfig, type ParaUserConfig } from "./config.js";
-import { createModelApiKeyResolver, createPiModelRegistry, getCaptureSelection, resolveSelectedModel } from "./model-resolver.js";
+import { createModelApiKeyResolver, createPiModelServices, getCaptureSelection, resolveSelectedModel } from "./model-resolver.js";
 import { StateDB } from "./state.js";
 
 // Re-export public types for consumers
@@ -169,6 +169,7 @@ export default async function piPara(pi: ExtensionAPI): Promise<void> {
   const loadedConfig = await loadConfig();
   const config = loadedConfig.runtime;
   const wikiDir = config.wikiDir;
+  const printMode = isPrintModeProcess();
 
   let store: QMDStore | null = null;
   let currentScope: ProjectScope | null = null;
@@ -308,10 +309,10 @@ export default async function piPara(pi: ExtensionAPI): Promise<void> {
     const startupCatchupEnabled = autoCaptureEnabled && wikiConfig?.captureOnStartup !== false && schedulerConfig?.startupCatchup !== false;
     try {
       const loadedParaConfig = await loadParaConfig({ migrate: true });
-      const registry = autoCaptureEnabled ? await createPiModelRegistry() : null;
-      if (registry) {
+      const services = autoCaptureEnabled ? await createPiModelServices() : null;
+      if (services) {
         const captureSelection = getCaptureSelection(loadedParaConfig.config);
-        const captureModel = resolveSelectedModel(captureSelection, registry.modelRegistry, {
+        const captureModel = resolveSelectedModel(captureSelection, services.modelRegistry, {
           legacyModelSpec: config.daemonModel,
           preferredModelSpec: "anthropic/claude-sonnet-4-20250514",
         });
@@ -320,8 +321,8 @@ export default async function piPara(pi: ExtensionAPI): Promise<void> {
             wikiDir,
             storeProvider: () => store,
             model: captureModel,
-            getApiKey: createModelApiKeyResolver(captureSelection, registry.modelRegistry, {
-              authStorage: registry.authStorage,
+            getApiKey: createModelApiKeyResolver(captureSelection, services.modelRegistry, {
+              credentials: services.credentials,
               secretsPath: loadedParaConfig.paths.secretsPath,
             }),
           });
@@ -332,7 +333,7 @@ export default async function piPara(pi: ExtensionAPI): Promise<void> {
     }
 
     const embedEnabled = loadedConfig.userConfig?.qmd.embedEnabled !== false;
-    const schedulerEnabled = !isPrintModeProcess() && schedulerConfig?.enabled !== false;
+    const schedulerEnabled = !printMode && schedulerConfig?.enabled !== false;
     const scheduler = schedulerEnabled
       ? startWikiScheduler({
         wikiDir,
@@ -380,15 +381,15 @@ export default async function piPara(pi: ExtensionAPI): Promise<void> {
           ctx.ui.setStatus("pi-para", `wiki: ${url}`);
         } else {
           ctx.ui.setStatus("pi-para", "wiki: ready (web UI disabled)");
-          setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 5000);
+          if (!printMode) setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 5000);
         }
       } catch {
         ctx.ui.setStatus("pi-para", "wiki: ready");
-        setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 3000);
+        if (!printMode) setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 3000);
       }
     } else {
       ctx.ui.setStatus("pi-para", "wiki: ready");
-      setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 3000);
+      if (!printMode) setTimeout(() => ctx.ui.setStatus("pi-para", undefined), 3000);
     }
   });
 

package/src/model-resolver.ts

@@ -3,15 +3,22 @@ import type { ProviderCredentialRef, ParaUserConfig } from "./config.js";
 import { resolveCredentialRef } from "./credentials.js";
 
 export interface ModelRegistryLike {
+  getAll(): Model<any>[];
   getAvailable(): Model<any>[];
   find(provider: string, modelId: string): Model<any> | undefined;
   getApiKeyForProvider(provider: string): Promise<string | undefined>;
 }
 
-export interface AuthStorageLike {
+export interface PiCredentialReader {
+  hasStoredCredential(provider: string): boolean;
   getApiKey(provider: string): Promise<string | undefined>;
 }
 
+export interface PiModelServices {
+  modelRegistry: ModelRegistryLike;
+  credentials: PiCredentialReader;
+}
+
 export type ModelSelection = ProviderCredentialRef | "auto";
 
 export function parseProviderModelSpec(spec: string): { provider: string; modelId: string } | null {
@@ -20,6 +27,10 @@ export function parseProviderModelSpec(spec: string): { provider: string; modelI
   return { provider: spec.slice(0, idx), modelId: spec.slice(idx + 1) };
 }
 
+function isRemoteModel(model: Model<any>): boolean {
+  return model.provider !== "node-llama-cpp" && model.provider !== "local" && !model.provider.includes("llama");
+}
+
 export function resolveSelectedModel(
   selection: ModelSelection,
   registry: ModelRegistryLike,
@@ -27,47 +38,50 @@ export function resolveSelectedModel(
 ): Model<any> | null {
   if (selection !== "auto") {
     if (selection.model) return registry.find(selection.provider, selection.model) ?? null;
-    return registry.getAvailable().find((model) => model.provider === selection.provider) ?? null;
+    return registry.getAvailable().find((model) => model.provider === selection.provider && isRemoteModel(model)) ?? null;
   }
 
   const legacy = opts.legacyModelSpec ? parseProviderModelSpec(opts.legacyModelSpec) : null;
   if (legacy) {
     const model = registry.find(legacy.provider, legacy.modelId);
-    if (model) return model;
+    if (model && isRemoteModel(model)) return model;
   }
 
   const preferred = opts.preferredModelSpec ? parseProviderModelSpec(opts.preferredModelSpec) : null;
   if (preferred) {
     const model = registry.find(preferred.provider, preferred.modelId);
-    if (model) return model;
+    if (model && isRemoteModel(model)) return model;
   }
 
-  return pickBestAvailableModel(registry.getAvailable());
+  return pickBestAvailableModel(registry.getAvailable().filter(isRemoteModel));
 }
 
 export function pickBestAvailableModel(models: Model<any>[]): Model<any> | null {
-  if (models.length === 0) return null;
-  const sonnet = models.find((model) => model.provider === "anthropic" && /sonnet/i.test(model.id));
+  const remote = models.filter(isRemoteModel);
+  if (remote.length === 0) return null;
+  const sonnet = remote.find((model) => model.provider === "anthropic" && /sonnet/i.test(model.id));
   if (sonnet) return sonnet;
-  return [...models].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0))[0] ?? null;
+  return [...remote].sort((a, b) => (b.contextWindow ?? 0) - (a.contextWindow ?? 0))[0] ?? null;
 }
 
 export function createModelApiKeyResolver(
   selection: ModelSelection,
   registry: ModelRegistryLike,
-  opts: { authStorage?: AuthStorageLike; secretsPath?: string } = {},
+  opts: { credentials?: PiCredentialReader; secretsPath?: string } = {},
 ): (provider: string) => Promise<string | undefined> {
   return async (provider: string) => {
-    if (selection === "auto") return registry.getApiKeyForProvider(provider);
+    if (selection === "auto") {
+      return opts.credentials ? opts.credentials.getApiKey(provider) : registry.getApiKeyForProvider(provider);
+    }
+    if (selection.provider !== provider) return undefined;
 
     if (selection.credentialRef.startsWith("pi-auth:")) {
       const configuredProvider = selection.credentialRef.slice("pi-auth:".length);
-      if (configuredProvider !== provider && selection.provider !== provider) return undefined;
-      return (await opts.authStorage?.getApiKey(provider)) ?? await registry.getApiKeyForProvider(provider);
+      if (configuredProvider !== provider) return undefined;
+      return opts.credentials ? opts.credentials.getApiKey(provider) : registry.getApiKeyForProvider(provider);
     }
 
     if (selection.credentialRef.startsWith("secret:")) {
-      if (selection.provider !== provider) return undefined;
       const resolved = await resolveCredentialRef(selection.credentialRef, { secretsPath: opts.secretsPath });
       return resolved.ok ? resolved.value : undefined;
     }
@@ -80,17 +94,28 @@ export function getCaptureSelection(config: ParaUserConfig): ModelSelection {
   return config.models.capture;
 }
 
-export async function createPiModelRegistry(): Promise<{ authStorage: AuthStorageLike; modelRegistry: ModelRegistryLike } | null> {
+export async function createPiModelServices(
+  options: { authPath?: string } = {},
+): Promise<PiModelServices | null> {
   try {
     const mod = await import("@earendil-works/pi-coding-agent");
-    const typed = mod as unknown as {
-      AuthStorage?: { create(): AuthStorageLike };
-      ModelRegistry?: { create(authStorage: AuthStorageLike): ModelRegistryLike };
+    const runtime = await mod.ModelRuntime.create({ authPath: options.authPath, allowModelNetwork: false });
+    const modelRegistry = new mod.ModelRegistry(runtime);
+    await modelRegistry.refresh();
+    return {
+      modelRegistry,
+      credentials: {
+        hasStoredCredential: (provider) => Boolean(mod.readStoredCredential(provider, options.authPath)),
+        getApiKey: async (provider) => {
+          if (!mod.readStoredCredential(provider, options.authPath)) return undefined;
+          return (await runtime.getAuth(provider))?.auth.apiKey;
+        },
+      },
     };
-    if (!typed.AuthStorage || !typed.ModelRegistry) return null;
-    const authStorage = typed.AuthStorage.create();
-    return { authStorage, modelRegistry: typed.ModelRegistry.create(authStorage) };
   } catch {
     return null;
   }
 }
+
+/** @deprecated Use createPiModelServices. */
+export const createPiModelRegistry = createPiModelServices;

package/src/scheduler/index.ts

@@ -1,7 +1,7 @@
 import type { QMDStore } from "qmd-engine";
 import { randomUUID } from "node:crypto";
 import { gitCommit, rebuildIndex } from "../wiki.js";
-import { reindex, storeHasApiProviders } from "../store.js";
+import { captureQmdEmbedErrors, reindex, storeHasApiProviders } from "../store.js";
 import { getParaPaths } from "../paths.js";
 import { acquireLease, releaseLease } from "./leases.js";
 import { SchedulerStateDB, type QueueItem } from "./state.js";
@@ -166,10 +166,16 @@ export class WikiScheduler {
     const leaseKey = `qmd-embed:${this.wikiDir}`;
     if (!acquireLease(this.state.db, leaseKey, this.holderId, { ttlMs: 15 * 60_000 })) return;
     try {
-      const result = await store.embed();
+      const attempt = await captureQmdEmbedErrors(() => store.embed());
+      const diagnostics = [...new Set(attempt.diagnostics)].join(" | ");
+      if (!attempt.ok) {
+        const reason = attempt.error instanceof Error ? attempt.error.message : String(attempt.error);
+        throw new Error(diagnostics ? `${reason} — ${diagnostics}` : reason);
+      }
+      const result = attempt.value;
       if (result.errors > 0) {
         throw new Error(
-          `qmd embed finished with ${result.errors} error(s) (${result.chunksEmbedded} chunk(s) embedded, ${pending} doc(s) were pending)`,
+          `qmd embed finished with ${result.errors} error(s) (${result.chunksEmbedded} chunk(s) embedded, ${pending} doc(s) were pending)${diagnostics ? ` — ${diagnostics}` : ""}`,
         );
       }
     } finally {