Fix provider auth issues

Author: timothykassis

AGENTS.md

@@ -80,6 +80,7 @@ projects/
 - **Local model servers.** Two parallel discovery paths, deliberately not factored together: Ollama (`/ollama/models` → `OLLAMA_BASE_URL/api/tags`) and any OpenAI-compatible server (`/openai-compatible/models` → `OPENAI_COMPATIBLE_BASE_URL/v1/models`, default LM Studio's `:1234`). The latter's picker section stays hidden unless the env var was set (`configured`) or a server answers. Both URLs are live: `config.ts` exposes getters (`ollamaBaseUrl()`, `openaiCompatibleBaseUrl()`, `openaiCompatibleConfigured()`) read per call rather than import-time constants, and `api/credentials.ts` manages them as non-secret fields (`ollamaBaseUrl`, `openaiCompatibleBaseUrl`, echoed unmasked, http(s) `validate` hook) whose `onChange` calls `registerLocalProviders()` (`agent/models.ts`), so Settings → Providers → Local model servers applies without a restart and clearing one falls back to the default. Only `id` is read from `/v1/models`; refs are `openai-compatible/<id>` and may contain slashes, so only the prefix is stripped. Both providers are billed `local`/$0 in `cost/billing.ts`, `cost/ledger.ts`, and `agent/subagent-bridge.ts` — that trio must stay in sync or a local run defaults to `payg` and counts against the spend cap. Local-only by design: a hosted gateway would need real pricing, so route those through `OPENROUTER_BASE_URL` instead.
 - **Outbound proxy.** `server/src/http-proxy.ts` installs undici's `EnvHttpProxyAgent` as the global dispatcher at boot (`index.ts`, `isMain` block) when `HTTP_PROXY`/`HTTPS_PROXY` is set, and is a no-op otherwise. Node's fetch ignores those variables on its own (`NODE_USE_ENV_PROXY` is Node ≥ 24 and we support ≥ 22.19), and Pi's `configureHttpDispatcher` isn't in the package's public exports — without this the lead agent would dial providers directly while the subagent runner honoured the proxy. Note undici tunnels with `CONNECT` even for `http://` targets.
 - Pi OAuth tokens default to `~/.kady/pi-agent/auth.json`. `KADY_PI_AGENT_DIR` relocates that app-scoped directory; an explicitly supplied `PI_CODING_AGENT_DIR` takes precedence and can intentionally share a standalone Pi directory. The value is inherited by child `pi` processes, so lead and subagents share one auth store.
+- **Provider authentication contract.** `ProviderAuthManager` passes Pi's `LoginOptions.getDeviceId`, backed by `SettingsManager.getOrCreateDeviceId()` in the global agent directory, for current ChatGPT sign-in. Do not promote `.env` keys to `setRuntimeApiKey`: that overlay masks stored OAuth and is invisible to child runtimes. Pi's stored credential wins over environment keys; an explicit Settings key save removes the previous stored credential to select environment-key auth. Clearing an environment key preserves an independent OAuth login and writes empty `.env` assignments (including aliases) so stale shell/legacy keys do not reappear at restart. `setupModelRuntime` normalizes `OR_API_KEY` into the inherited `OPENROUTER_API_KEY`. `/model-providers.configured` describes effective key-or-OAuth availability; `connected` describes OAuth specifically. Real-Pi callback/manual-login regressions with mocked token exchanges live in `server/test/provider-auth-integration.test.ts`.
 - Settings exposes API keys (`/credentials`; model keys under Providers, web-search keys and the Modal pair under Services) plus Pi subscription authentication (`/model-providers`, `/model-auth/flows`; the row's **Sign in** button) for OpenAI (Sign in with ChatGPT; Pi 0.99 relabelled the older `openai-codex` login "OpenAI Codex (legacy)", kept for existing tokens), Anthropic (Claude Pro/Max), GitHub Copilot, xAI, Kimi Code, and Meta (Muse). OAuth browser/device/manual prompts are mediated by `server/src/agent/provider-auth.ts` and `server/src/api/model-providers.ts`. MCP servers, native web search (pi-web-access), and **durable Modal remote compute** (hybrid tools + per-chat selector + project Compute tab) are also implemented. **Not built in:** automated citation verification, first-party literature search, and document conversion (MCP connectors are the extension point).
 
 **Capability hub.** The **Settings** dialog (`web/src/components/settings-dialog.tsx`, opened from the header gear) is the only customization surface, a grouped sidebar: **Models** (Providers · Defaults · Fusion), **Project · <name>** (General · Skills · Prompt templates · Specialists · Connectors) and **Workspace** (Services · Appearance). Panels live under `web/src/components/settings/` (`primitives.tsx`, `providers-panel.tsx`, `defaults-panel.tsx`, `project-settings-panel.tsx`, `services-panel.tsx`, `fusion-panel.tsx`, `key-row.tsx`, and `model-field.tsx` — the model picker with a "type a model id" escape hatch used by Defaults, Specialists and Watchdog). Providers merges OAuth sign-in and API-key entry into one row per provider (connected first; "Add a provider" has search, an All / Sign in / API key filter and "Show all"), plus Local model servers and Custom model servers cards; Services holds the web-search keys, the Modal token pair and a Remote cache card (`GET/DELETE /modal/cache`). Project → General replaces the old Edit project dialog (new projects still use the New project dialog) with four independently saved cards: General & budget, Agent instructions (AGENTS.md), Raw-data guard, Context compaction. Deep links go through `web/src/lib/settings-nav.ts` (`openSettings({tab, projectId?, section?})` dispatches `kady:open-settings`; legacy ids `model-providers`→`providers`, `api-keys`→`services`; last tab in localStorage `kady:settings:lastTab`) and `web/src/components/settings-link.tsx`; `app/page.tsx` listens gated on the active workspace and `project-view.tsx` gated on the Projects screen. Project settings are reached from the gear on a project row in the header switcher, "Project settings…" in a project card's ⋯ menu, spend-limit banner links, and the sliders button beside the context gauge (section `context`). With no usable model source (`useModels().hasAnyModelAccess === false`) an empty chat renders `connect-model-card.tsx` ("Connect a model to get started" → Providers), and the picker offers "Manage providers" and "Connect…" for a disconnected selection. Destructive actions in the Project tabs (delete specialist, restore default specialists/templates, clear memory, remove connector) confirm first. Enable/disable is non-destructive: skills move between `sandbox/.pi/skills/` and `sandbox/.pi/skills-disabled/`, project specialists between `sandbox/.pi/agents/` and `sandbox/.pi/agents-disabled/`, and MCP servers keep their entry with Pi's `enabled: false` (a legacy `sandbox/.pi/mcp-disabled.json` is folded in by `migrateDisabledMcpServers`). Builtin (pi-subagents package) specialists are disabled via `subagents.agentOverrides.<name>.disabled` in `sandbox/.pi/settings.json`. Sessions read only the canonical locations, so toggles apply to new chat tabs/subagent runs (live sessions keep their set).

docs/installation.md

@@ -47,6 +47,18 @@ agents. `KADY_PI_AGENT_DIR` relocates that directory. An explicit
 `PI_CODING_AGENT_DIR` takes precedence; use it only when you intend to share
 Pi authentication and settings with another installation.
 
+For providers with both methods, a successful sign-in takes precedence over an
+existing environment API key. Saving a new API key in Settings switches that
+provider back to API-key authentication. Disconnecting a sign-in removes its
+stored Pi credential; an API key still set in the environment remains usable.
+
+Keep the sign-in dialog open while completing the provider's browser flow. If
+the browser runs on another machine, or the callback port is occupied, paste
+the final redirect URL into the dialog. ChatGPT requires the complete URL,
+including its state and issued client ID. Kady supplies Pi with a persistent
+installation ID in the global Pi settings; existing legacy Codex logins remain
+separate from the newer OpenAI sign-in.
+
 ## Optional services
 
 **Settings → Services** accepts Exa, Perplexity and Gemini search keys and a

server/src/agent/models.ts

@@ -324,15 +324,17 @@ export function registerLocalProviders(modelRuntime: ModelRuntime): void {
   });
 }
 
-/** Configure app-specific providers and runtime credentials. */
+/** Configure app-specific providers and normalize the legacy OpenRouter alias. */
 export async function setupModelRuntime(modelRuntime: ModelRuntime): Promise<void> {
   registerLocalProviders(modelRuntime);
 
-  // Pi reads every direct provider's key straight from process.env (loaded
-  // from .env by env.ts), so only OpenRouter needs a push here — its legacy
-  // OR_API_KEY alias is unknown to Pi.
-  const orKey = process.env.OPENROUTER_API_KEY || process.env.OR_API_KEY;
-  if (orKey) await modelRuntime.setRuntimeApiKey("openrouter", orKey);
+  // Let Pi resolve stored credentials before ambient keys, consistently in
+  // lead/child runtimes and after restart. A runtime override masks OAuth.
+  // Normalize the legacy alias into the inherited environment for children.
+  if (!process.env.OPENROUTER_API_KEY?.trim() && process.env.OR_API_KEY?.trim()) {
+    process.env.OPENROUTER_API_KEY = process.env.OR_API_KEY.trim();
+    await modelRuntime.refresh({ providers: ["openrouter"], allowNetwork: false });
+  }
 }
 
 export class ModelResolutionError extends Error {

server/src/agent/provider-auth.ts

@@ -6,9 +6,11 @@ import type {
   AuthInteraction,
   AuthPrompt,
   CredentialInfo,
+  LoginOptions,
   Model,
 } from "@earendil-works/pi-ai";
-import type { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { SettingsManager, type ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { KADY_PI_AGENT_DIR } from "../config.ts";
 import type { DirectProviderBilling, DirectProviderDefinition } from "./provider-catalog.ts";
 
 /**
@@ -350,10 +352,19 @@ function isTerminal(status: AuthFlowStatus): boolean {
 export class ProviderAuthManager {
   private readonly flows = new Map<string, AuthFlow>();
   private readonly activeByProvider = new Map<SubscriptionProviderId, string>();
+  private authSettings?: SettingsManager;
 
   constructor(
     private readonly runtime: ProviderAuthRuntime,
     private readonly flowTtlMs = DEFAULT_FLOW_TTL_MS,
+    private readonly loginOptions: LoginOptions = {
+      // Match Pi's interactive login: ChatGPT requires a stable, global
+      // installation UUID. A project must never supply the installation ID.
+      getDeviceId: () => {
+        this.authSettings ??= SettingsManager.create(KADY_PI_AGENT_DIR, KADY_PI_AGENT_DIR);
+        return this.authSettings.getOrCreateDeviceId();
+      },
+    },
   ) {}
 
   getRuntime(): ProviderAuthRuntime {
@@ -395,7 +406,8 @@ export class ProviderAuthManager {
         `${subscriptionProvider(providerId)?.name ?? providerId} is already connected`,
       );
     }
-    if (configured.needsReauth) await this.runtime.logout(providerId);
+    // Pi atomically replaces the stored credential on successful login.
+    // Keep the previous credential if a reconnect is cancelled or fails.
     const activeId = this.activeByProvider.get(providerId);
     if (activeId) {
       const active = this.flows.get(activeId);
@@ -497,8 +509,7 @@ export class ProviderAuthManager {
   dispose(): void {
     for (const flow of this.flows.values()) {
       if (!isTerminal(flow.status)) {
-        flow.controller.abort();
-        flow.pending?.reject(new Error("Login cancelled"));
+        this.cancel(flow.id);
       }
       if (flow.expiryTimer) clearTimeout(flow.expiryTimer);
       if (flow.removalTimer) clearTimeout(flow.removalTimer);
@@ -532,7 +543,7 @@ export class ProviderAuthManager {
     };
 
     try {
-      await this.runtime.login(flow.providerId, "oauth", interaction);
+      await this.runtime.login(flow.providerId, "oauth", interaction, this.loginOptions);
       if (!isTerminal(flow.status)) {
         this.finish(flow, "complete");
       } else {
@@ -544,6 +555,7 @@ export class ProviderAuthManager {
     } catch (error) {
       if (!isTerminal(flow.status)) this.fail(flow, error);
     } finally {
+      await this.authSettings?.flush();
       flow.running = false;
       flow.resolveSettled();
       if (this.activeByProvider.get(flow.providerId) === flow.id) {
@@ -583,7 +595,12 @@ export class ProviderAuthManager {
         settled = true;
         cleanup();
         if (flow.pending?.id === promptId) flow.pending = undefined;
-        if (flow.prompt?.id === promptId) flow.prompt = undefined;
+        if (flow.prompt?.id === promptId) {
+          flow.prompt = undefined;
+          // Pi cancels the manual prompt when the browser callback wins.
+          if (!isTerminal(flow.status)) flow.status = "running";
+          flow.updatedAt = Date.now();
+        }
         reject(error);
       };
       const onAbort = () => settleReject(new Error("Login cancelled"));

server/src/agent/provider-catalog.ts

@@ -70,8 +70,8 @@ export interface DirectProviderDefinition {
   /** Unknown ids resolve to a synthesized $0 model instead of an error. */
   synthesizeUnknownIds: boolean;
   /**
-   * Push the key into Pi's runtime credential on change (`setRuntimeApiKey`),
-   * as the OpenRouter/NVIDIA rows always did. False for providers whose
+   * Select environment-key auth on save by removing the previous stored Pi
+   * credential. Never install a runtime-only override. False for providers whose
    * `resolve()` mixes several ambient sources — there process.env is the only
    * safe channel, and Pi reads it live.
    */