pi2dsh 0.12.3 → 0.13.0

package/dist/{runtime-B_Ig28og.mjs → runtime-B-SlR8mJ.mjs}

@@ -1,8 +1,8 @@
 
-import { F as AssistantMessageEventStream, I as isContextOverflow, a as builtinProviders, h as getSupportedThinkingLevels, i as __setPiAiLlmBridge } from "./pi-ai-Dyg4zyLZ.mjs";
-import { P as generateBranchSummary, Tn as PiCapabilityError, b as Theme, d as ExtensionRunner, w as __setSubagentSessionFactory, wn as CapabilityLedger } from "./pi-coding-agent-CYnmeJEx.mjs";
+import { J as AssistantMessageEventStream, Y as isContextOverflow, c as builtinProviders, i as __setPiAiLlmBridge, x as getSupportedThinkingLevels } from "./pi-ai-BA3V_J0V.mjs";
+import { P as generateBranchSummary, Tn as PiCapabilityError, b as Theme, d as ExtensionRunner, w as __setSubagentSessionFactory, wn as CapabilityLedger } from "./pi-coding-agent-D9skobb6.mjs";
 import { t as getAgentDir } from "./pi-config-shim-CZ1wFzqM.mjs";
-import { a as resolvePiProviderAuth, n as loginPiProvider, r as providerSupportsOAuth, t as FileCredentialStore } from "./oauth-bridge-CfyImWx4.mjs";
+import { a as FileCredentialStore, c as providerSupportsOAuth, i as oauthCredentialRef, l as resolvePiProviderAuth, o as joinSignals, s as loginPiProvider, u as storedOAuthCredential } from "./credentials-oauth-BakY-0PA.mjs";
 import { createRequire } from "node:module";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
@@ -16,6 +16,7 @@ import { CONTEXT_WINDOW_EXCEEDED_CODE, EMPTY_RESPONSE_CODE, LlmError, QUOTA_EXCE
 import { renderPrompt } from "@deepseek-ai/dsh-system-prompt";
 import { randomUUID } from "node:crypto";
 import { foldSurface } from "@deepseek-ai/dsh-session";
+import { spawn } from "node:child_process";
 import { Compile } from "typebox/compile";
 import { Value } from "typebox/value";
 //#region src/session-bridge.ts
@@ -102,6 +103,29 @@ var PiSessionBridge = class {
 		});
 		return id;
 	}
+	/**
+	* The custom entries a package appended to one session, oldest first.
+	*
+	* Addressed by id alone: the browser half asks for a session it is showing,
+	* and has no DSH session object to hand over.
+	* @param sessionId - session whose sidecar to read.
+	* @returns each custom entry with its type, data and id.
+	*/
+	customEntries(sessionId) {
+		this.load(sessionId);
+		const out = [];
+		for (const record of this.records.get(sessionId) ?? []) {
+			if (record.kind !== "custom") continue;
+			const entry = record;
+			out.push({
+				id: entry.id,
+				customType: entry.customType,
+				data: entry.data,
+				timestamp: entry.timestamp
+			});
+		}
+		return out;
+	}
 	appendBranchSummary(sessionId, summary, fromId) {
 		const id = randomUUID();
 		this.persist(sessionId, {
@@ -721,7 +745,24 @@ async function createBridgedAgentSession(host, options) {
 	return { session: new PiBridgedAgentSession(host, handle, tools) };
 }
 //#endregion
-//#region src/side-panel.ts
+//#region src/compat/vendor/pi-open-browser.ts
+/**
+* Open a URL or file in the platform browser/default handler.
+*
+* This intentionally never invokes a shell. On Windows, do not use
+* `cmd /c start`: cmd.exe re-parses metacharacters (&, |, ^, ...) before
+* `start` runs, which would make attacker-controlled URLs injectable.
+* @param target - the URL or file to hand to the platform handler.
+*/
+function openBrowser(target) {
+	const [cmd, args] = process.platform === "darwin" ? ["open", [target]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", target]] : ["xdg-open", [target]];
+	spawn(cmd, args, {
+		stdio: "ignore",
+		detached: true
+	}).on("error", () => {}).unref();
+}
+//#endregion
+//#region src/browser-surfaces.ts
 /** Flatten one Pi message's content to the text a panel row shows. */
 function messageText(message) {
 	const content = message.content;
@@ -738,8 +779,22 @@ function messageText(message) {
 * Host-level (one per engine instance, like the provider directory): the panel
 * is one surface, however many Pi packages contribute threads to it.
 */
-var SidePanelRegistry = class {
+var BrowserSurfaces = class {
 	#byParent = /* @__PURE__ */ new Map();
+	#surfaces = /* @__PURE__ */ new Map();
+	#entrySources = /* @__PURE__ */ new Map();
+	#draftRequests = /* @__PURE__ */ new Map();
+	#liveDrafts = /* @__PURE__ */ new Map();
+	#completionSources = /* @__PURE__ */ new Map();
+	#imageToolNames = /* @__PURE__ */ new Set();
+	/** Register one known image tool's exact DSH wire name. */
+	registerImageTool(name) {
+		if (name.length > 0) this.#imageToolNames.add(name);
+	}
+	/** Exact wire names needing the generic Pi image-result browser view. */
+	imageToolNames() {
+		return [...this.#imageToolNames];
+	}
 	/**
 	* Track one child session under its parent.
 	* @param parentSessionId - the session the panel floats over.
@@ -776,11 +831,246 @@ var SidePanelRegistry = class {
 			})).filter((entry) => !entry.text.startsWith(`<${SEED_CARRIER_TAG}>`)).filter((entry) => entry.text.length > 0)
 		}));
 	}
+	/**
+	* Pi's `setStatus(key, text)`: one keyed status entry in the status bar.
+	* The key is the entry's identity; passing undefined removes that entry,
+	* exactly like Pi clears one status.
+	* @param sessionId - session the calling agent belongs to.
+	* @param packageName - Pi package making the call, when known.
+	* @param key - the status entry's key.
+	* @param text - the text to show, or undefined to remove the entry.
+	*/
+	setStatus(sessionId, packageName, key, text) {
+		if (sessionId.length === 0) return;
+		const view = this.#view(sessionId, packageName);
+		const rendered = text === void 0 || text === null ? void 0 : String(text);
+		if (rendered === void 0 || rendered.length === 0) delete view.statuses[key];
+		else view.statuses[key] = rendered;
+	}
+	/**
+	* Pi's `setWidget(key, content)`: one keyed widget. Only string arrays are
+	* recorded — anything else is ignored exactly like Pi's own rpc mode, where
+	* widgets are transmitted to a host as lines and factory content needs TUI
+	* access the host never provides.
+	* @param sessionId - session the calling agent belongs to.
+	* @param packageName - Pi package making the call, when known.
+	* @param key - the widget's key.
+	* @param content - the widget's lines, or undefined to remove the widget.
+	*/
+	setWidget(sessionId, packageName, key, content, theme) {
+		if (sessionId.length === 0) return;
+		const view = this.#view(sessionId, packageName);
+		const text = surfaceText(content, theme);
+		if (text === void 0) delete view.widgets[key];
+		else view.widgets[key] = text;
+	}
+	/**
+	* Record one simple presentation call (working chrome, title, header,
+	* footer). The value is a string, a Pi component, a working-indicator
+	* options object, or a header/footer factory; each renders to text here so
+	* the browser half never runs Pi code.
+	* @param sessionId - session the calling agent belongs to.
+	* @param packageName - Pi package making the call, when known.
+	* @param key - which surface.
+	* @param value - the value the package passed; undefined clears it.
+	* @param theme - the bridge's headless theme, for factories that style with it.
+	*/
+	setSurface(sessionId, packageName, key, value, theme) {
+		if (sessionId.length === 0) return;
+		const view = this.#view(sessionId, packageName);
+		const text = surfaceText(value, theme);
+		if (text === void 0) delete view.values[key];
+		else view.values[key] = text;
+	}
+	/**
+	* Pi's `setWorkingVisible`: hide the working chrome without forgetting it.
+	* @param sessionId - session the calling agent belongs to.
+	* @param packageName - Pi package making the call, when known.
+	* @param visible - whether the working chrome should show.
+	*/
+	setWorkingVisible(sessionId, packageName, visible) {
+		if (sessionId.length === 0) return;
+		this.#view(sessionId, packageName).workingVisible = visible;
+	}
+	/**
+	* Register one package's custom-entry renderer.
+	*
+	* Pulled rather than pushed: a renderer's output depends on the session being
+	* looked at, and the package registers once at mount for every session it
+	* will ever be asked about.
+	* @param packageName - owning Pi package.
+	* @param source - called with the session id the browser is showing.
+	* @returns a disposer that unregisters the source.
+	*/
+	trackEntries(packageName, source) {
+		this.#entrySources.set(packageName, source);
+		return () => {
+			this.#entrySources.delete(packageName);
+		};
+	}
+	/**
+	* Custom entries every package renders for one session, in package order.
+	* @param sessionId - session the browser is showing.
+	* @returns rendered entries; a renderer that throws contributes nothing.
+	*/
+	entries(sessionId) {
+		const out = [];
+		for (const [packageName, source] of this.#entrySources) try {
+			for (const entry of source(sessionId)) out.push({
+				...entry,
+				package: packageName
+			});
+		} catch {}
+		return out;
+	}
+	/**
+	* Ask the browser to put text in the composer.
+	*
+	* A revision rather than a flag: the seat applies a request once, and the
+	* next call — even with identical text — is a new request rather than a
+	* no-op, which is what a package retrying a paste means.
+	* @param sessionId - session whose composer to write.
+	* @param text - the full next draft.
+	*/
+	requestDraft(sessionId, text) {
+		if (sessionId.length === 0) return;
+		const current = this.#draftRequests.get(sessionId);
+		this.#draftRequests.set(sessionId, {
+			text,
+			rev: (current?.rev ?? 0) + 1
+		});
+		this.#liveDrafts.set(sessionId, text);
+	}
+	/**
+	* The pending composer write for one session, if any.
+	* @param sessionId - session the browser is showing.
+	* @returns the request, or undefined when nothing is pending.
+	*/
+	draftRequest(sessionId) {
+		return this.#draftRequests.get(sessionId);
+	}
+	/**
+	* Record what the composer actually holds, as reported by the browser.
+	* @param sessionId - session the report is about.
+	* @param text - the live draft.
+	*/
+	reportDraft(sessionId, text) {
+		if (sessionId.length === 0) return;
+		this.#liveDrafts.set(sessionId, text);
+	}
+	/**
+	* The composer text for one session.
+	* @param sessionId - session to read.
+	* @returns the browser's last report, or the last requested text.
+	*/
+	liveDraft(sessionId) {
+		return this.#liveDrafts.get(sessionId) ?? "";
+	}
+	/**
+	* Register one package's completion provider.
+	* @param packageName - owning Pi package.
+	* @param source - asked with the trigger character and the typed query.
+	* @returns a disposer that unregisters the source.
+	*/
+	trackCompletions(packageName, source) {
+		this.#completionSources.set(packageName, source);
+		return () => {
+			this.#completionSources.delete(packageName);
+		};
+	}
+	/**
+	* Completions every package offers for one trigger token.
+	* @param trigger - the trigger character the menu opened on.
+	* @param query - what the user has typed after it.
+	* @returns candidates in package order; a provider that throws contributes none.
+	*/
+	async completions(trigger, query) {
+		const out = [];
+		for (const source of this.#completionSources.values()) try {
+			out.push(...await source(trigger, query));
+		} catch {}
+		return out;
+	}
+	/**
+	* What packages have put on screen for one session.
+	* @param sessionId - session the browser is showing.
+	* @returns one entry per package that has driven a surface, empties dropped.
+	*/
+	surfaces(sessionId) {
+		const bySession = this.#surfaces.get(sessionId);
+		if (bySession === void 0) return [];
+		return [...bySession.values()].filter((view) => viewHasContent(view));
+	}
+	/** Get-or-create one package's view for a session. */
+	#view(sessionId, packageName) {
+		const owner = packageName ?? "pi";
+		const bySession = this.#surfaces.get(sessionId) ?? /* @__PURE__ */ new Map();
+		let view = bySession.get(owner);
+		if (view === void 0) {
+			view = {
+				...packageName === void 0 ? {} : { package: packageName },
+				values: {},
+				statuses: {},
+				widgets: {},
+				workingVisible: true
+			};
+			bySession.set(owner, view);
+			this.#surfaces.set(sessionId, bySession);
+		}
+		return view;
+	}
 };
+/** Whether a view still carries something to show. */
+function viewHasContent(view) {
+	return Object.keys(view.values).length > 0 || Object.keys(view.statuses).length > 0 || Object.keys(view.widgets).length > 0;
+}
+/**
+* Render whatever Pi handed a presentation call into displayable text.
+*
+* Pi's UI methods accept a string, a string array (widget lines), one of its
+* components (`render(width): string[]`), a working-indicator options object
+* (`{ frames?: string[] }`), or a header/footer factory
+* (`(tui, theme) => Component`). Every shape is projected to text here — the
+* pi-tui shims honour `render(width)` headlessly, and a factory is called with
+* the bridge's headless theme (and no TUI, which Pi's own rpc mode never
+* provides either); anything that cannot render leaves the surface empty
+* rather than faking output.
+* @param value - the value the package passed.
+* @param theme - the bridge's headless theme, for factories that style with it.
+* @returns the text to show, or undefined to clear the surface.
+*/
+function surfaceText(value, theme) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string") return value.length === 0 ? void 0 : value;
+	if (Array.isArray(value)) {
+		const text = value.map(String).join("\n").trimEnd();
+		return text.length === 0 ? void 0 : text;
+	}
+	const record = value;
+	if (typeof record.render === "function") try {
+		const lines = record.render(80);
+		const text = (Array.isArray(lines) ? lines : [lines]).map((line) => String(line)).join("\n").trimEnd();
+		return text.length === 0 ? void 0 : text;
+	} catch {
+		return;
+	}
+	if (Array.isArray(record.frames)) {
+		const text = record.frames.map(String).join("").trimEnd();
+		return text.length === 0 ? void 0 : text;
+	}
+	if (typeof value === "function") try {
+		return surfaceText(value(void 0, theme), theme);
+	} catch {
+		return;
+	}
+	const text = String(value);
+	return text.length === 0 || text === "[object Object]" ? void 0 : text;
+}
 /**
-* Serve the panel's own read route on the host's web server.
+* Serve the browser half's own read route on the host's web server.
 *
-* One prefix, one GET: the client half polls it for the session it is showing.
+* One prefix, one GET, one payload: the client half polls it for the session
+* it is showing and gets every surface at once.
 * A composition with no web server (the CLI profile) simply has no panel, which
 * is the correct outcome rather than an error — the side conversation itself
 * still runs, and the host's subagent catalog still lists it.
@@ -788,7 +1078,43 @@ var SidePanelRegistry = class {
 * @param registry - live thread registry to read from.
 * @returns whether the route was registered.
 */
-function registerSidePanelRoute(ctx, registry) {
+/**
+* Short, clickable stand-ins for the authorization URLs a login flow announces.
+*
+* An OAuth authorize URL is 400 characters of query string. Putting it in a
+* dialog produces six wrapped lines with the question buried under them, and a
+* link that long is unusable even when the surface makes it clickable. These
+* are the short links shown instead; hitting one redirects to the real address.
+*/
+const pendingAuthorizations = /* @__PURE__ */ new Map();
+/**
+* Publish a short link for one authorization URL.
+* @param url - the address the flow wants the user to open.
+* @returns the path to show, or undefined when the URL is not http(s).
+*/
+function publishAuthorization(url) {
+	if (!/^https?:\/\//u.test(url)) return void 0;
+	const token = Math.random().toString(36).slice(2, 10);
+	pendingAuthorizations.set(token, url);
+	if (pendingAuthorizations.size > 8) {
+		const oldest = pendingAuthorizations.keys().next().value;
+		if (oldest !== void 0) pendingAuthorizations.delete(oldest);
+	}
+	return `/pi2dsh/authorize/${token}`;
+}
+/**
+* Retire a published link when its flow is over.
+*
+* A finished (or superseded) flow's address still resolves at the provider, and
+* following it produces a callback the flow that is now listening cannot match
+* — the provider answers "State mismatch", which reads like a bug in the login
+* rather than a link that has expired. Saying so is the honest answer.
+* @param path - what {@link publishAuthorization} returned.
+*/
+function revokeAuthorization(path) {
+	pendingAuthorizations.delete(path.slice(18));
+}
+function registerBrowserSurfaceRoute(ctx, registry) {
 	const web = ctx.get("webServer");
 	if (web === void 0 || typeof web.register !== "function") return false;
 	ctx.effect(() => web.register({
@@ -797,26 +1123,81 @@ function registerSidePanelRoute(ctx, registry) {
 		handler: async (req, res) => {
 			const response = res;
 			const method = String(req.method ?? "GET");
+			const url = new URL(String(req.url ?? "/"), "http://pi2dsh.invalid");
+			if (method === "POST" && url.pathname === "/pi2dsh/editor-draft") {
+				const chunks = [];
+				const body = await new Promise((settle) => {
+					const stream = req;
+					stream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+					stream.on("end", () => settle(Buffer.concat(chunks).toString("utf8")));
+				});
+				try {
+					const payload = JSON.parse(body || "{}");
+					if (typeof payload.session === "string" && typeof payload.draft === "string") registry.reportDraft(payload.session, payload.draft);
+				} catch {}
+				response.writeHead(204);
+				response.end();
+				return;
+			}
 			if (method !== "GET" && method !== "HEAD") {
 				response.writeHead(405);
 				response.end();
 				return;
 			}
-			const url = new URL(String(req.url ?? "/"), "http://pi2dsh.invalid");
-			if (url.pathname !== "/pi2dsh/side-panel") {
+			if (url.pathname.startsWith("/pi2dsh/authorize/")) {
+				const target = pendingAuthorizations.get(url.pathname.slice(18));
+				if (target === void 0) {
+					response.writeHead(404);
+					response.end("this login link has expired");
+					return;
+				}
+				response.writeHead(302, {
+					location: target,
+					"cache-control": "no-store"
+				});
+				response.end();
+				return;
+			}
+			if (url.pathname === "/pi2dsh/completions") {
+				const items = await registry.completions(url.searchParams.get("trigger") ?? "@", url.searchParams.get("query") ?? "");
+				response.writeHead(200, {
+					"content-type": "application/json; charset=utf-8",
+					"cache-control": "no-store"
+				});
+				response.end(JSON.stringify({ items }));
+				return;
+			}
+			if (url.pathname === "/pi2dsh/image-tool-names") {
+				response.writeHead(200, {
+					"content-type": "application/json; charset=utf-8",
+					"cache-control": "no-store"
+				});
+				response.end(method === "HEAD" ? void 0 : JSON.stringify({ names: registry.imageToolNames() }));
+				return;
+			}
+			if (url.pathname !== "/pi2dsh/browser-state") {
 				response.writeHead(404);
 				response.end();
 				return;
 			}
 			const session = url.searchParams.get("session") ?? "";
-			const body = JSON.stringify({ threads: session === "" ? [] : registry.snapshot(session) });
+			const body = JSON.stringify(session === "" ? {
+				threads: [],
+				surfaces: [],
+				entries: []
+			} : {
+				threads: registry.snapshot(session),
+				surfaces: registry.surfaces(session),
+				entries: registry.entries(session),
+				...registry.draftRequest(session) === void 0 ? {} : { draft: registry.draftRequest(session) }
+			});
 			response.writeHead(200, {
 				"content-type": "application/json; charset=utf-8",
 				"cache-control": "no-store"
 			});
 			response.end(method === "HEAD" ? void 0 : body);
 		}
-	}), "pi2dsh: side-panel route");
+	}), "pi2dsh: browser-state route");
 	return true;
 }
 //#endregion
@@ -1776,12 +2157,27 @@ function providerCarriesTransport(value) {
 }
 function providerModels(provider) {
 	try {
-		const models = provider.getModels?.();
+		const models = typeof provider.getModels === "function" ? provider.getModels() : provider.models;
 		return Array.isArray(models) ? models : [];
 	} catch {
 		return [];
 	}
 }
+/**
+* The environment variable a Pi config value names, when that is all it names.
+*
+* Pi's config values (`resolve-config-value.ts`) are `$VAR` / `${VAR}`
+* interpolation, `!command` execution, or a literal. Only a value that is
+* exactly one reference can become a DSH credential reference; a command, a
+* template, or a literal secret must not be copied into settings, which carry
+* references and never values.
+* @param value - the package's declared config value, if it declared one.
+*/
+function envReferenceOf(value) {
+	if (typeof value !== "string") return void 0;
+	const match = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$|^\$([A-Za-z_][A-Za-z0-9_]*)$/u.exec(value.trim());
+	return match?.[1] ?? match?.[2];
+}
 const PI_CARRIED_FIELDS = [
 	"api",
 	"baseUrl",
@@ -1986,6 +2382,159 @@ function imageAdmissionCompanionAdapter(options) {
 		}
 	};
 }
+/** A wire protocol DSH's official adapter can serve, or undefined. */
+function protocolOf(value) {
+	return typeof value === "string" && DSH_PROTOCOLS.has(value) ? value : void 0;
+}
+const DSH_PROTOCOLS = /* @__PURE__ */ new Set([
+	"openai-completions",
+	"openai-responses",
+	"anthropic-messages"
+]);
+const DSH_MODALITIES = /* @__PURE__ */ new Set(["text", "image"]);
+const DSH_THINKING_FORMATS = /* @__PURE__ */ new Set([
+	"openai",
+	"deepseek",
+	"openrouter",
+	"together",
+	"zai",
+	"qwen",
+	"string-thinking",
+	"ant-ling"
+]);
+/** A positive whole number, or undefined — the profile schema rejects 0 and fractions. */
+function wholeAbove(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : void 0;
+}
+/**
+* One Pi model as a DSH model profile.
+*
+* Field by field on purpose. The two vocabularies overlap but do not match:
+* Pi's `maxTokens` is routinely 0 for "unstated" while DSH requires at least 1,
+* Pi's `compat` carries gateway dialect flags DSH's profile has no slot for,
+* and Pi's `reasoning` is a boolean where DSH's `reasoningEfforts` is a map of
+* offered levels. Forwarding any of those verbatim rejects the whole settings
+* section — one bad key takes down every route in it.
+* @param model - the Pi model descriptor as its package declared it.
+* @param api - the wire protocol this route resolved to, which decides whether
+*   the reasoning compat switches are even a legal thing to state.
+*/
+function modelProfileOf(model, api) {
+	const compat = model.compat;
+	const reasoningCompatAllowed = api === "openai-completions";
+	const thinkingFormat = reasoningCompatAllowed && typeof compat?.thinkingFormat === "string" && DSH_THINKING_FORMATS.has(compat.thinkingFormat) ? { thinkingFormat: compat.thinkingFormat } : {};
+	const supportsReasoningEffort = reasoningCompatAllowed && typeof compat?.supportsReasoningEffort === "boolean" ? { supportsReasoningEffort: compat.supportsReasoningEffort } : {};
+	const carriedCompat = {
+		...thinkingFormat,
+		...supportsReasoningEffort
+	};
+	const input = Array.isArray(model.input) ? model.input.filter((entry) => typeof entry === "string" && DSH_MODALITIES.has(entry)) : [];
+	const contextWindow = wholeAbove(model.contextWindow);
+	const maxTokens = wholeAbove(model.maxTokens);
+	return {
+		id: String(model.id ?? ""),
+		...typeof model.name === "string" ? { name: model.name } : {},
+		...contextWindow === void 0 ? {} : { contextWindow },
+		...maxTokens === void 0 ? {} : { maxTokens },
+		...input.length === 0 ? {} : { input },
+		...Object.keys(carriedCompat).length === 0 ? {} : { compat: carriedCompat }
+	};
+}
+/**
+* Serve a catalog-only Pi provider through DSH's OWN llm adapter.
+*
+* A Pi package may declare a gateway without shipping any code to call it —
+* on Pi that is complete, because pi-ai supplies the transport for the wire
+* protocol the models name. The bridge used to refuse those and tell the user
+* to configure the gateway by hand in DSH settings, which is the translation
+* this package exists to do for them.
+*
+* The translation is configuration, not transport: the declaration becomes an
+* `llm-pi-ai` provider profile — the official adapter's own shape, which
+* carries `api`, `baseURL` and per-model `compat` — and that official plugin
+* is mounted with it. Nothing here speaks HTTP.
+* @returns a disposer for the mounted route, or undefined when it cannot be built.
+*/
+function registerCatalogOnlyRoute(options) {
+	const { ctx, providerId, provider, host } = options;
+	if (ctx === void 0) return void 0;
+	return mountOfficialAdapter(ctx, providerId, host, () => {
+		const models = providerModels(provider);
+		const first = models[0] ?? {};
+		const apiKeyEnv = envReferenceOf(provider.apiKey);
+		const api = protocolOf(provider.api) ?? protocolOf(first.api);
+		const baseURL = typeof provider.baseUrl === "string" ? provider.baseUrl : typeof first.baseUrl === "string" ? first.baseUrl : void 0;
+		return {
+			displayName: typeof provider.name === "string" ? provider.name : providerId,
+			...apiKeyEnv === void 0 ? {} : { apiKeyEnv },
+			...api === void 0 ? {} : { api },
+			...baseURL === void 0 ? {} : { baseURL },
+			...models.length === 0 ? {} : { models: models.map((model) => modelProfileOf(model, api)) }
+		};
+	}, `[pi2dsh] Pi provider ${JSON.stringify(providerId)} declares a catalog only; DSH's official llm-pi-ai adapter now serves it as a native route`);
+}
+/**
+* Mount DSH's official llm-pi-ai adapter for one route, rebuildable on demand.
+* @param buildProfile - called per mount, so a re-announce picks up new facts.
+* @param announcement - what to tell the user once the route is up.
+*/
+function mountOfficialAdapter(ctx, providerId, host, buildProfile, announcement) {
+	let mounted;
+	let disposed = false;
+	let generation = 0;
+	const mount = () => {
+		const profile = buildProfile();
+		const mine = ++generation;
+		(async () => {
+			try {
+				if (await declareInSettings(ctx, providerId, profile)) {
+					if (!disposed && mine === generation) mounted = void 0;
+					host.warn(announcement);
+					return;
+				}
+				const official = await import("@deepseek-ai/dsh-llm-pi-ai");
+				const fiber = await ctx.plugin(official.default ?? official, { providers: { [providerId]: profile } });
+				if (disposed || mine !== generation) fiber?.dispose?.();
+				else mounted = fiber;
+				host.warn(announcement);
+			} catch (error) {
+				host.warn(`[pi2dsh] Pi provider ${JSON.stringify(providerId)} could not be served by the official adapter (${error instanceof Error ? error.message : String(error)}); configure the gateway in the host's llm settings instead`);
+			}
+		})();
+	};
+	mount();
+	const route = (() => {
+		disposed = true;
+		mounted?.dispose?.();
+	});
+	route.reannounce = () => {
+		if (disposed) return;
+		mounted?.dispose?.();
+		mounted = void 0;
+		mount();
+	};
+	return route;
+}
+/**
+* Hand one provider profile to the official adapter through DSH's settings.
+*
+* `ctx.settings.update` merges into the user layer of a namespace its OWNER
+* registered, so this only works where that adapter is mounted — which is the
+* normal composition, and exactly where mounting a second copy would collide.
+* A composition without it (a bare test host, an embedded runtime) rejects and
+* the caller falls back to mounting the plugin itself.
+* @returns whether the profile was stored.
+*/
+async function declareInSettings(ctx, providerId, profile) {
+	const settings = ctx.get?.("settings");
+	if (typeof settings?.update !== "function") return false;
+	try {
+		await settings.update("llm-pi-ai", { providers: { [providerId]: profile } });
+		return true;
+	} catch {
+		return false;
+	}
+}
 /**
 * Register the provider as a live DSH route when an llm service is mounted.
 * A provider carrying its own transport streams through it; a config-only
@@ -1998,11 +2547,16 @@ function registerPiProviderRoute(options) {
 	const { llm, providerId, provider, host } = options;
 	if (llm === void 0) return void 0;
 	if (!providerCarriesTransport(provider)) {
-		host.warn(`[pi2dsh] Pi provider ${JSON.stringify(providerId)} declares a model catalog but no transport; it was not added as a DSH llm route — configure the gateway in the host's llm settings instead`);
-		return;
+		if (providerModels(provider).length === 0 && provider.oauth !== void 0) return void 0;
+		return registerCatalogOnlyRoute(options);
 	}
 	try {
-		return llm.registerAdapter([providerId], piProviderDshAdapter(providerId, provider, host));
+		const registration = llm.registerAdapter([providerId], piProviderDshAdapter(providerId, provider, host));
+		const route = (() => {
+			registration();
+		});
+		if (typeof registration.replace === "function") route.reannounce = () => registration.replace?.([providerId]);
+		return route;
 	} catch (error) {
 		host.warn(`[pi2dsh] Pi provider ${JSON.stringify(providerId)} was not added as a DSH llm route (${error instanceof Error ? error.message : String(error)}); the existing route keeps the name`);
 		return;
@@ -2012,6 +2566,10 @@ function registerPiProviderRoute(options) {
 //#region src/runtime.ts
 /** Fallback thread ids when a child session reports none. */
 let sidePanelSerial = 0;
+const KNOWN_IMAGE_TOOLS_BY_PACKAGE = /* @__PURE__ */ new Map([["@crazygit/pi-codex-image-gen", /* @__PURE__ */ new Set(["codex_generate_image"])]]);
+function isKnownImageTool(packageName, toolName) {
+	return KNOWN_IMAGE_TOOLS_BY_PACKAGE.get(packageName)?.has(toolName) === true;
+}
 function logger(ctx) {
 	const candidate = ctx.logger;
 	return {
@@ -2277,6 +2835,30 @@ function currentPiModel(state, agent) {
 		reasoning: false
 	};
 }
+/** A session's durable events, whether the store exposes them as value or method. */
+function eventsOf(session) {
+	const events = session.events;
+	if (typeof events === "function") return events.call(session) ?? [];
+	return Array.isArray(events) ? events : [];
+}
+/** The session id a presentation call belongs to, or '' outside a session. */
+function sessionIdOf(state, agent) {
+	const session = agentSession(agent ?? currentAgent(state));
+	return session === void 0 ? "" : String(session.id ?? "");
+}
+/**
+* Record one Pi presentation call against the session that made it.
+* @param ctx - context, for the logger on an unmounted host.
+* @param state - runtime state carrying the shared surface registry.
+* @param agent - the agent whose context the call came through.
+* @param key - which surface.
+* @param value - a string or Pi component; undefined clears it.
+*/
+function putSurface(ctx, state, agent, key, value) {
+	const surfaces = state.shared.browserSurfaces;
+	if (surfaces === void 0) return;
+	surfaces.setSurface(sessionIdOf(state, agent), state.packageName, key, value, state.theme);
+}
 function thinkingLevelOf(state, agent) {
 	if (agent !== void 0) {
 		const scoped = state.thinkingLevels.get(agent);
@@ -2333,11 +2915,15 @@ function contextFor(ctx, state, agent, signal, command = false, sessionOverride)
 			const level = type === "warning" || type === "error" ? "warn" : "info";
 			logger(ctx)[level](`[pi2dsh] ${text}`);
 		},
-		select: (title, options) => askOne(ctx, agent, signal, {
-			id: "pi2dsh-select",
-			question: String(title),
-			options: options.map((option) => ({ label: String(option) }))
-		}),
+		select: async (title, options, promptSignal) => {
+			const labels = options.map((option) => String(option));
+			const answered = await askOne(ctx, agent, joinSignals(signal, promptSignal), {
+				id: "pi2dsh-select",
+				question: String(title),
+				options: labels.map((label) => ({ label }))
+			});
+			return answered === void 0 ? void 0 : resolveOfferedChoice(answered, labels);
+		},
 		async confirm(title, message) {
 			return await askOne(ctx, agent, signal, {
 				id: "pi2dsh-confirm",
@@ -2346,7 +2932,7 @@ function contextFor(ctx, state, agent, signal, command = false, sessionOverride)
 				options: [{ label: "Yes" }, { label: "No" }]
 			}) === "Yes";
 		},
-		input: (title, placeholder) => askOne(ctx, agent, signal, {
+		input: (title, placeholder, promptSignal) => askOne(ctx, agent, joinSignals(signal, promptSignal), {
 			id: "pi2dsh-input",
 			question: String(title),
 			...placeholder === void 0 ? {} : { detail: String(placeholder) }
@@ -2356,24 +2942,45 @@ function contextFor(ctx, state, agent, signal, command = false, sessionOverride)
 			question: String(title),
 			...prefill === void 0 ? {} : { detail: `Current text:\n${String(prefill)}` }
 		}),
-		setStatus: () => void 0,
-		setWidget: () => void 0,
+		setStatus: (key, text) => {
+			const surfaces = state.shared.browserSurfaces;
+			if (surfaces === void 0) return;
+			surfaces.setStatus(sessionIdOf(state, agent), state.packageName, String(key), text);
+		},
+		setWidget: (key, content) => {
+			const surfaces = state.shared.browserSurfaces;
+			if (surfaces === void 0) return;
+			surfaces.setWidget(sessionIdOf(state, agent), state.packageName, String(key), content, state.theme);
+		},
 		onTerminalInput: () => () => void 0,
-		setWorkingMessage: () => void 0,
-		setWorkingVisible: () => void 0,
-		setWorkingIndicator: () => void 0,
-		setHiddenThinkingLabel: () => void 0,
-		setFooter: () => void 0,
-		setHeader: () => void 0,
-		setTitle: () => void 0,
+		setWorkingMessage: (message) => putSurface(ctx, state, agent, "workingMessage", message),
+		setWorkingVisible: (visible) => {
+			const surfaces = state.shared.browserSurfaces;
+			if (surfaces === void 0) return;
+			surfaces.setWorkingVisible(sessionIdOf(state, agent), state.packageName, visible !== false);
+		},
+		setWorkingIndicator: (options) => putSurface(ctx, state, agent, "workingIndicator", options),
+		setHiddenThinkingLabel: (label) => putSurface(ctx, state, agent, "hiddenThinkingLabel", label),
+		setFooter: (factory) => putSurface(ctx, state, agent, "footer", factory),
+		setHeader: (factory) => putSurface(ctx, state, agent, "header", factory),
+		setTitle: (title) => putSurface(ctx, state, agent, "title", title),
 		custom: async () => void 0,
 		pasteToEditor(text) {
-			if (agent !== void 0) state.editorBuffers.set(agent, (state.editorBuffers.get(agent) ?? "") + String(text));
+			const surfaces = state.shared.browserSurfaces;
+			const sessionId = sessionIdOf(state, agent);
+			const next = (surfaces?.liveDraft(sessionId) ?? (agent === void 0 ? "" : state.editorBuffers.get(agent) ?? "")) + String(text);
+			if (agent !== void 0) state.editorBuffers.set(agent, next);
+			surfaces?.requestDraft(sessionId, next);
 		},
 		setEditorText(text) {
 			if (agent !== void 0) state.editorBuffers.set(agent, String(text));
+			state.shared.browserSurfaces?.requestDraft(sessionIdOf(state, agent), String(text));
+		},
+		getEditorText: () => {
+			const live = state.shared.browserSurfaces?.liveDraft(sessionIdOf(state, agent)) ?? "";
+			if (live.length > 0) return live;
+			return agent === void 0 ? "" : state.editorBuffers.get(agent) ?? "";
 		},
-		getEditorText: () => agent === void 0 ? "" : state.editorBuffers.get(agent) ?? "",
 		addAutocompleteProvider(factory) {
 			state.autocompleteProviders.push(factory);
 		},
@@ -3206,7 +3813,7 @@ function subscribeInterceptors(ctx, state) {
 	});
 	const systemPrompt = optionalService(ctx, "systemPrompt");
 	if (systemPrompt !== void 0) ctx.effect(() => systemPrompt.section({
-		name: "pi2dsh:tool-guidance",
+		name: `pi2dsh:tool-guidance:${state.packageName ?? "pi"}`,
 		order: 150,
 		text: () => piToolPromptContribution(ctx, state)
 	}));
@@ -3423,6 +4030,7 @@ function sharedHostStateOf(ctx) {
 		shared = {
 			companionRoutes: /* @__PURE__ */ new Map(),
 			providerRouteDisposers: /* @__PURE__ */ new Map(),
+			publishedOAuthKeys: /* @__PURE__ */ new Map(),
 			providers: /* @__PURE__ */ new Map()
 		};
 		SHARED_HOST_STATE.set(key, shared);
@@ -3561,6 +4169,206 @@ function ensureLoginCommand(ctx, state) {
 		logger(ctx).warn(`[pi2dsh] /login is already registered by an earlier package in this host; this package's providers use that command (${error instanceof Error ? error.message : String(error)})`);
 	}
 }
+/**
+* Turn what the user answered into one of the offered options.
+* @param answer - the label, a differently-cased label, or a 1-based position.
+* @param offered - the options as they were shown, in order.
+* @returns the matching option, or undefined when nothing matches.
+*/
+function resolveOfferedChoice(answer, offered) {
+	const trimmed = answer.trim();
+	if (offered.includes(trimmed)) return trimmed;
+	const insensitive = offered.find((name) => name.toLowerCase() === trimmed.toLowerCase());
+	if (insensitive !== void 0) return insensitive;
+	if (/^\d+$/u.test(trimmed)) {
+		const at = Number(trimmed) - 1;
+		if (at >= 0 && at < offered.length) return offered[at];
+	}
+}
+/**
+* Cancel the login already in flight, if any, and wait for it to let go.
+*
+* Waiting matters: the next flow binds the same fixed callback port, and Pi's
+* flow answers a taken port by silently degrading to a listener that never
+* receives a code. Starting the new flow before the old one has closed
+* reproduces exactly that.
+* @param state - the mounting package's state, holding the shared host state.
+* @returns the cancelled provider's name, or undefined when nothing was running.
+*/
+async function supersedeActiveLogin(state) {
+	const previous = state.shared.activeLogin;
+	if (previous === void 0) return void 0;
+	state.shared.activeLogin = void 0;
+	previous.controller.abort();
+	for (const path of previous.published) revokeAuthorization(path);
+	let timer;
+	const released = await Promise.race([previous.finished.then(() => true), new Promise((resolve) => {
+		timer = setTimeout(() => resolve(false), 5e3);
+	})]);
+	if (timer !== void 0) clearTimeout(timer);
+	if (!released) throw new Error(`the ${previous.providerName} login is still shutting down; try /login again in a moment`);
+	return previous.providerName;
+}
+/**
+* Give a logged-in provider a route, if nothing else already gave it one.
+*
+* Pi's built-in OAuth providers (openai-codex, anthropic, github-copilot,
+* kimi-coding) are seeded so `/login` can offer them, but they carry no
+* transport and no catalog — so the registration path above never builds them
+* a route, and a successful login used to leave the model picker unchanged.
+* A stored credential is the whole precondition: with one, the models pi-ai's
+* installed catalog describes become selectable through DSH's own adapter.
+* @param name - the Pi provider id, which is also its DSH route name.
+* @param config - the provider config, whose oauth block made it loginable.
+* @returns whether this call put a route in place.
+*/
+async function ensureLoggedInProviderRoute(ctx, state, name, config) {
+	if (!providerSupportsOAuth(config)) return false;
+	if (providerCarriesTransport(config) || state.providerRouteDisposers.has(name)) return false;
+	const alreadyRouted = llmOf(ctx)?.listProviders().some((provider) => provider.id === name) === true;
+	if (await storedOAuthCredential(oauthStoreOf(state), name).catch(() => void 0) === void 0) return false;
+	const published = await publishOAuthCredential(ctx, state, name, config);
+	if (!published.ok) return false;
+	keepOAuthCredentialFresh(ctx, state);
+	if (alreadyRouted) return false;
+	const settings = optionalService(ctx, "settings");
+	if (settings === void 0) {
+		logger(ctx).warn(`[pi2dsh] logged in to ${JSON.stringify(name)}, but this composition has no settings service to declare its model route in`);
+		return false;
+	}
+	await settings.update("llm-pi-ai", { providers: { [name]: {
+		...typeof config.name === "string" ? { displayName: config.name } : {},
+		...published.baseUrl === void 0 ? {} : { baseURL: published.baseUrl },
+		apiKeyEnv: oauthCredentialRef(name)
+	} } });
+	return true;
+}
+/**
+* Put a logged-in provider's current key where the official adapter reads it.
+*
+* Pi keeps the OAuth credential (access + refresh + expiry) in its own store;
+* DSH's adapter reads one opaque value through the credentials seam. This is
+* the join: Pi's resolution runs — including its double-checked-lock refresh
+* when the token is inside the five-minute window — and whatever key that
+* yields is stored under the reference the profile names.
+* @returns whether a key is now behind the reference, plus any endpoint the
+*   credential itself decided (some providers read their host out of the token).
+*/
+async function publishOAuthCredential(ctx, state, name, config) {
+	const credentials = optionalService(ctx, "credentials");
+	if (credentials === void 0) {
+		logger(ctx).warn(`[pi2dsh] logged in to ${JSON.stringify(name)}, but this composition has no credentials service to hand the token to`);
+		return { ok: false };
+	}
+	const resolvedAuth = (await resolvePiProviderAuth({
+		providerId: name,
+		providerConfig: config,
+		store: oauthStoreOf(state)
+	}).catch(() => void 0))?.auth;
+	const key = typeof resolvedAuth?.apiKey === "string" ? resolvedAuth.apiKey : void 0;
+	if (key === void 0 || key.length === 0) {
+		logger(ctx).warn(`[pi2dsh] logged in to ${JSON.stringify(name)}, but this provider authenticates with a request header rather than an api key — DSH routes name a credential reference, so no model route was added for it`);
+		return { ok: false };
+	}
+	const ref = oauthCredentialRef(name);
+	const endpoint = typeof resolvedAuth?.baseUrl === "string" ? { baseUrl: resolvedAuth.baseUrl } : {};
+	if ((await credentials.describe(ref).catch(() => void 0))?.writable === false) return {
+		ok: true,
+		...endpoint
+	};
+	if (state.publishedOAuthKeys.get(name) === key) return {
+		ok: true,
+		...endpoint
+	};
+	await credentials.set(ref, key);
+	state.publishedOAuthKeys.set(name, key);
+	return {
+		ok: true,
+		...endpoint
+	};
+}
+/**
+* Re-publish rotating OAuth keys at the moment a request needs them.
+*
+* An access token expires (codex's in about an hour), so a value stored once at
+* login goes stale and every later request fails on a credential the user
+* believes they supplied. DSH's own credentials contract is per-operation for
+* exactly this reason, and `llm/stream` is the per-operation seam.
+*
+* Whether the refresh is awaited depends on whether this request can still be
+* served by what is stored. Inside Pi's refresh window the stored token is
+* still VALID, so refreshing beside the request costs nothing and the rotated
+* key is there for the next one. Past expiry it is not: publishing in the
+* background there means the first request after an idle stretch goes out with
+* a dead token and fails, every time, and only the second one works. So an
+* expired credential blocks its own request until it has been renewed.
+*/
+function keepOAuthCredentialFresh(ctx, state) {
+	if (state.shared.oauthRefreshHooked === true) return;
+	state.shared.oauthRefreshHooked = true;
+	ctx.on("llm/stream", ((options, next) => {
+		const provider = typeof options.provider === "string" ? options.provider : void 0;
+		const config = provider === void 0 ? void 0 : state.providers.get(provider);
+		if (provider === void 0 || config === void 0 || !providerSupportsOAuth(config)) return next();
+		const publish = () => publishOAuthCredential(ctx, state, provider, config).catch((error) => logger(ctx).warn(`[pi2dsh] could not refresh the stored credential for ${JSON.stringify(provider)}: ${error instanceof Error ? error.message : String(error)}`));
+		return (async function* () {
+			const stored = await storedOAuthCredential(oauthStoreOf(state), provider).catch(() => void 0);
+			const expires = typeof stored?.expires === "number" ? stored.expires : void 0;
+			if (expires === void 0 || expires <= Date.now()) await publish();
+			else publish();
+			yield* next();
+		})();
+	}));
+}
+/**
+* Ask a provider package to discover its models, then let the host see them.
+*
+* Gateway discovery needs a credential, and a credential is not always there
+* when the provider registers: OAuth providers get theirs from a `/login` the
+* user runs later. So this is called at registration AND after a login — the
+* two moments a credential can appear — and it ends by re-announcing the
+* route, because DSH's directory observers (the model picker among them)
+* re-read on the route-set notification and nothing else.
+* @param name - the Pi provider id, which is also its DSH route name.
+* @param value - the provider config the package registered.
+* @returns how many models the route lists afterwards, or undefined when the
+*   package has no discovery of its own.
+*/
+async function discoverProviderModels(ctx, state, name, value) {
+	const refreshModels = value.refreshModels;
+	if (typeof refreshModels !== "function") return void 0;
+	try {
+		const apiKey = ((await resolvePiProviderAuth({
+			providerId: name,
+			providerConfig: value,
+			store: oauthStoreOf(state)
+		}).catch(() => void 0))?.auth)?.apiKey;
+		await Promise.resolve(refreshModels.call(value, {
+			stored: void 0,
+			...apiKey === void 0 ? {} : { credential: {
+				type: "api_key",
+				key: apiKey
+			} },
+			store: {
+				read: async () => void 0,
+				write: async () => {},
+				delete: async () => {}
+			},
+			allowNetwork: true,
+			signal: new AbortController().signal,
+			publish: async (publication) => {
+				publication.update?.();
+				return true;
+			}
+		}));
+	} catch (error) {
+		logger(ctx).warn(`[pi2dsh] model catalog refresh for Pi provider ${JSON.stringify(name)} failed (its registry entries stay static): ${error instanceof Error ? error.message : String(error)}`);
+		return;
+	}
+	state.modelCatalog?.refresh();
+	state.providerRouteDisposers.get(name)?.reannounce?.();
+	return await llmOf(ctx)?.listModels(name).then((models) => models.length).catch(() => void 0);
+}
 function registerLoginCommand(ctx, state) {
 	registerCommand(ctx, state, {
 		name: "login",
@@ -3570,22 +4378,55 @@ function registerLoginCommand(ctx, state) {
 			const oauthProviders = [...state.providers.entries()].filter(([, config]) => providerSupportsOAuth(config)).map(([name]) => name);
 			if (oauthProviders.length === 0) throw new Error("no registered Pi provider supports OAuth login");
 			const ui = commandContext.ui;
-			let providerId = args.trim().split(/\s+/u)[0] ?? "";
-			if (providerId.length === 0) providerId = oauthProviders.length === 1 ? oauthProviders[0] : String(await ui.select("Log in to which provider?", oauthProviders) ?? "");
-			const config = state.providers.get(providerId);
-			if (config === void 0 || !providerSupportsOAuth(config)) throw new Error(`unknown OAuth provider ${JSON.stringify(providerId)}; available: ${oauthProviders.join(", ")}`);
+			let answer = args.trim().split(/\s+/u)[0] ?? "";
+			if (answer.length === 0) answer = oauthProviders.length === 1 ? oauthProviders[0] : String(await ui.select("Log in to which provider?", oauthProviders) ?? "");
+			if (answer.length === 0) return "Login cancelled";
+			const providerId = resolveOfferedChoice(answer, oauthProviders);
+			const config = providerId === void 0 ? void 0 : state.providers.get(providerId);
+			if (providerId === void 0 || config === void 0 || !providerSupportsOAuth(config)) throw new Error(`unknown OAuth provider ${JSON.stringify(answer)}; available: ${oauthProviders.join(", ")}`);
 			const oauthName = config.oauth?.name ?? providerId;
 			const commandSignal = commandContext.signal;
-			await loginPiProvider({
+			const superseded = await supersedeActiveLogin(state);
+			if (superseded !== void 0) ui.notify(`Cancelled the ${superseded} login that was still waiting.`);
+			const active = {
+				providerName: oauthName,
+				controller: new AbortController(),
+				finished: Promise.resolve(),
+				published: []
+			};
+			if (commandSignal !== void 0) {
+				if (commandSignal.aborted) active.controller.abort();
+				else commandSignal.addEventListener("abort", () => active.controller.abort(), { once: true });
+			}
+			const attempt = loginPiProvider({
+				open: openBrowser,
+				shorten: (url) => {
+					const path = publishAuthorization(url);
+					const web = ctx.get("webServer");
+					if (path === void 0 || web?.port === void 0) return void 0;
+					active.published.push(path);
+					return `http://${web.host === "0.0.0.0" || web.host === void 0 ? "127.0.0.1" : web.host}:${web.port}${path}`;
+				},
 				providerId,
 				providerName: oauthName,
 				providerConfig: config,
 				store: oauthStoreOf(state),
 				ui,
-				...commandSignal !== void 0 ? { signal: commandSignal } : {}
+				signal: active.controller.signal
 			});
-			ui.notify(`Logged in to ${oauthName}; credential stored in ${oauthStoreOf(state).path}`);
-			return `Logged in to ${oauthName}`;
+			active.finished = attempt.then(() => void 0, () => void 0);
+			state.shared.activeLogin = active;
+			try {
+				await attempt;
+			} finally {
+				for (const path of active.published) revokeAuthorization(path);
+				if (state.shared.activeLogin === active) state.shared.activeLogin = void 0;
+			}
+			const declared = await ensureLoggedInProviderRoute(ctx, state, providerId, config);
+			const discovered = await discoverProviderModels(ctx, state, providerId, config) ?? (declared ? await llmOf(ctx)?.listModels(providerId).then((list) => list.length).catch(() => void 0) : void 0);
+			const models = discovered === void 0 ? "" : `; ${discovered} models available`;
+			ui.notify(`Logged in to ${oauthName}${models}`);
+			return `Logged in to ${oauthName}${models}`;
 		}
 	});
 }
@@ -3641,6 +4482,7 @@ function registerTool(ctx, state, tool) {
 	};
 	const dispose = ctx.tools.register(definition);
 	state.toolDisposers.set(tool.name, dispose);
+	if (isKnownImageTool(state.packageName, tool.name)) state.shared.browserSurfaces?.registerImageTool(tool.name);
 }
 function unregisterTool(state, name) {
 	const dispose = state.toolDisposers.get(name);
@@ -4011,6 +4853,7 @@ function createPiApi(ctx, state) {
 			}
 			const routeDisposer = registerPiProviderRoute({
 				llm: llmOf(ctx),
+				ctx,
 				providerId: name,
 				provider: value,
 				host: {
@@ -4026,35 +4869,9 @@ function createPiApi(ctx, state) {
 			if (routeDisposer !== void 0) {
 				state.providerRouteDisposers.set(name, routeDisposer);
 				state.modelCatalog?.refresh();
-				logger(ctx).info(`[pi2dsh] Pi provider ${JSON.stringify(name)} registered as a native DSH llm route`);
+				if (providerCarriesTransport(value)) logger(ctx).info(`[pi2dsh] Pi provider ${JSON.stringify(name)} registered as a native DSH llm route`);
 			} else if (!providerSupportsOAuth(value)) logger(ctx).info(`[pi2dsh] recorded Pi provider ${JSON.stringify(name)}; model calls stay on DSH llm adapters`);
-			const refreshModels = value.refreshModels;
-			if (typeof refreshModels === "function") (async () => {
-				const apiKey = ((await resolvePiProviderAuth({
-					providerId: name,
-					providerConfig: value,
-					store: oauthStoreOf(state)
-				}).catch(() => void 0))?.auth)?.apiKey;
-				await Promise.resolve(refreshModels.call(value, {
-					stored: void 0,
-					...apiKey === void 0 ? {} : { credential: {
-						type: "api_key",
-						key: apiKey
-					} },
-					store: {
-						read: async () => void 0,
-						write: async () => {},
-						delete: async () => {}
-					},
-					allowNetwork: true,
-					signal: new AbortController().signal,
-					publish: async (publication) => {
-						publication.update?.();
-						return true;
-					}
-				}));
-				state.modelCatalog?.refresh();
-			})().catch((error) => logger(ctx).warn(`[pi2dsh] model catalog refresh for Pi provider ${JSON.stringify(name)} failed (its registry entries stay static): ${error instanceof Error ? error.message : String(error)}`));
+			discoverProviderModels(ctx, state, name, value);
 		},
 		unregisterProvider(name) {
 			state.providers.delete(name);
@@ -4265,6 +5082,20 @@ async function loadExtensions(rootDir, manifest, api, onExtensionError, onCapabi
 		aliases[`${family}/pi-ai/compat`] = aiShim;
 		aliases[`${family}/pi-ai/oauth`] = aiShim;
 		aliases[`${family}/pi-ai/providers/all`] = aiShim;
+		aliases[`${family}/pi-ai/bedrock-provider`] = aiShim;
+		aliases[`${family}/pi-ai/bun-oauth`] = aiShim;
+		for (const api of [
+			"anthropic-messages",
+			"openai-completions",
+			"openai-responses",
+			"openai-codex-responses",
+			"azure-openai-responses",
+			"google-generative-ai",
+			"google-vertex",
+			"mistral-conversations",
+			"bedrock-converse-stream",
+			"pi-messages"
+		]) aliases[`${family}/pi-ai/api/${api}`] = aiShim;
 	}
 	const require = createRequire(import.meta.url);
 	for (const entry of [
@@ -4357,7 +5188,8 @@ async function applyPiPackage(ctx, options) {
 		argMutations: /* @__PURE__ */ new WeakMap(),
 		streamingTexts: /* @__PURE__ */ new Map(),
 		lastLoggedModels: /* @__PURE__ */ new WeakMap(),
-		providerRouteDisposers: shared.providerRouteDisposers
+		providerRouteDisposers: shared.providerRouteDisposers,
+		publishedOAuthKeys: shared.publishedOAuthKeys
 	};
 	subscribeLifecycle(ctx, state);
 	subscribeInterceptors(ctx, state);
@@ -4367,6 +5199,11 @@ async function applyPiPackage(ctx, options) {
 		oauth: provider.auth.oauth
 	});
 	ensureLoginCommand(ctx, state);
+	for (const [name, config] of [...state.providers]) try {
+		await ensureLoggedInProviderRoute(ctx, state, name, config);
+	} catch (error) {
+		logger(ctx).warn(`[pi2dsh] could not restore the route for logged-in provider ${JSON.stringify(name)}: ${error instanceof Error ? error.message : String(error)}`);
+	}
 	if (options.manifest.skillDirs.length > 0) {
 		if (ctx.get("skills") === void 0) logger(ctx).warn("[pi2dsh] migrated skills were not mounted because this DSH composition has no ctx.skills");
 		else {
@@ -4397,14 +5234,69 @@ async function applyPiPackage(ctx, options) {
 		}));
 		ctx.effect(() => () => __setPiAiLlmBridge(void 0));
 	}
-	const sidePanel = state.shared.sidePanel ??= new SidePanelRegistry();
-	if (state.shared.sidePanelRouted !== true) state.shared.sidePanelRouted = registerSidePanelRoute(ctx, sidePanel);
+	const browserSurfaces = state.shared.browserSurfaces ??= new BrowserSurfaces();
+	if (state.shared.browserSurfacesRouted !== true) state.shared.browserSurfacesRouted = registerBrowserSurfaceRoute(ctx, browserSurfaces);
+	ctx.effect(() => browserSurfaces.trackCompletions(state.packageName ?? "pi", async (trigger, query) => {
+		if (state.autocompleteProviders.length === 0) return [];
+		let provider = { getSuggestions: async () => null };
+		for (const factory of state.autocompleteProviders) {
+			if (typeof factory !== "function") continue;
+			provider = factory(provider) ?? provider;
+		}
+		const getSuggestions = provider.getSuggestions;
+		if (typeof getSuggestions !== "function") return [];
+		const line = `${trigger}${query}`;
+		return ((await getSuggestions([line], 0, line.length, { signal: new AbortController().signal }))?.items ?? []).filter((item) => typeof item.value === "string").map((item) => ({
+			value: String(item.value),
+			label: String(item.label ?? item.value),
+			...typeof item.description === "string" ? { description: item.description } : {}
+		}));
+	}));
+	ctx.effect(() => browserSurfaces.trackEntries(state.packageName ?? "pi", (sessionId) => {
+		const rendered = [];
+		const draw = (renderer, subject) => typeof renderer !== "function" ? void 0 : surfaceText(renderer(subject, {}, state.theme), state.theme);
+		for (const entry of state.bridge.customEntries(sessionId)) {
+			const text = draw(state.entryRenderers.get(entry.customType), {
+				type: "custom",
+				id: entry.id,
+				customType: entry.customType,
+				data: entry.data,
+				timestamp: entry.timestamp
+			});
+			if (text !== void 0) rendered.push({
+				id: entry.id,
+				customType: entry.customType,
+				text
+			});
+		}
+		if (state.messageRenderers.size > 0) {
+			const session = optionalService(ctx, "sessions")?.get(sessionId);
+			const events = session === void 0 ? [] : eventsOf(session);
+			for (const event of events) {
+				const data = event.data ?? {};
+				const customType = data.source?.piCustomType;
+				if (typeof customType !== "string") continue;
+				const text = draw(state.messageRenderers.get(customType), {
+					role: "custom",
+					customType,
+					content: data.content,
+					id: `dsh-${String(event.seq ?? "")}`
+				});
+				if (text !== void 0) rendered.push({
+					id: `dsh-${String(event.seq ?? "")}`,
+					customType,
+					text
+				});
+			}
+		}
+		return rendered;
+	}));
 	__setSubagentSessionFactory(async (subagentOptions) => {
 		const created = await createBridgedAgentSession(subagentHost(), subagentOptions);
 		const parent = agentSession(currentAgent(state));
 		const parentId = parent === void 0 ? "" : String(parent.id ?? "");
 		if (parentId.length > 0) {
-			const dispose = sidePanel.track(parentId, {
+			const dispose = browserSurfaces.track(parentId, {
 				id: String(created.session.sessionId ?? "") || `pi2dsh-thread-${parentId}-${sidePanelSerial++}`,
 				label: childLabel(subagentOptions.label, state.packageName),
 				package: state.packageName,
@@ -4467,14 +5359,17 @@ async function applyPiPackage(ctx, options) {
 }
 const runtimeInternals = {
 	compactionReason,
+	resolveOfferedChoice,
 	dshToPiContent,
 	expandPrompt,
+	isKnownImageTool,
 	isSubagentOrigin,
 	normalizeToolResult,
 	splitArguments,
+	supersedeActiveLogin,
 	textBlocks
 };
 //#endregion
 export { runtimeInternals as i, normalizeToolSchema as n, registerVisionCompanions as r, applyPiPackage as t };
 
-//# sourceMappingURL=runtime-B_Ig28og.mjs.map
+//# sourceMappingURL=runtime-B-SlR8mJ.mjs.map