pi-web/relays/issue-62-authstorage/status.md

# Relay status — issue-62-authstorage

## RELAY COMPLETE — goal reached (leg 7, slice 6)
All charter goal criteria (1–5) are met and committed on branch
`fix/issue-62-authstorage`. **No PR was opened, by design (out of scope).**
The relay is finished; no further leg was spawned.

**Surface to the human:**
- (a) `npm run verify` is fully GREEN (typecheck + lint + knip + 1390 tests,
  2 skipped).
- (b) **Sessiond restart is still PENDING** — slices 1 + 4 changed
  session-daemon paths (`sessiond.ts`, `piSessionService.ts`). The human must
  manually restart the sessiond service for the migration to take effect. Only
  the human clears this note.
- (c) No PR opened (explicitly out of scope for this relay).

Leg 7 (slice 6) added the changeset, re-verified green, confirmed goal
criteria, and confirmed no scratch files remain:
- **`.changeset/fix-pi-0-80-8-modelruntime-auth.md`** — a single `patch`
  fragment for `@jmfederico/pi-web` describing the user-visible fix (session
  daemon crash with Pi 0.80.8+ fixed by migrating to the new `ModelRuntime`
  auth APIs; Pi Web now requires Pi `>=0.80.8`). Per the `changeset-changelog`
  skill this repo uses **patch** for all non-breaking changes (CalVer: the
  `minor` slot is the release month, not feature size; `major` only on explicit
  request), so `patch` was chosen over the "minor is defensible" note. Commit
  `<this leg>`.
- Re-ran full `npm run verify`: GREEN.
- Double-checked `package.json`: peerDeps for the three `@earendil-works/*`
  packages are `>=0.80.8 <0.81`, devDeps are `^0.80.8` — correct.
- Confirmed no scratch files in the repo (no `probe*.mjs`, `.tmp-build/`,
  etc.). `ASSESSMENT-issue-62.md` intentionally stays (plan of record).
- Only `src` mention of the old API is an explanatory comment in
  `piSessionService.testSupport.ts` (documents what the seam replaced) — no
  live import/use.

## Prior position (slice 5, leg 6, commit `d0cc55c`)
Slice 5 (tests + testSupport) complete and committed (`d0cc55c`).
**`npm run verify` was fully GREEN** — typecheck + lint + knip + 1390 tests
pass (2 skipped). All production code and all test/support code are off the
removed `AuthStorage` / `ModelRegistry.create|inMemory` surface.

What slice 5 changed (all under `src/server/sessions/`):
- **`piSessionService.testSupport.ts`** (central helper): dropped
  `AuthStorage`/`ModelRegistry` imports; added pi-ai `InMemoryCredentialStore`.
  New seams: `createTestModelRuntime(credentials?)` (wraps
  `ModelRuntime.create({ credentials })`), a shared `testModelRuntime`
  (top-level `await createTestModelRuntime()` — the common no-auth catalog
  runtime), and `seedCredential(store, providerId, credential)` (writes via the
  `CredentialStore.modify` path). `fakeRuntime` session now carries
  `modelRuntime: testModelRuntime`; `testModel()` reads
  `testModelRuntime.getModel(...)`.
- Threaded `modelRuntime: testModelRuntime` into every `new PiSessionService(...)`
  (now a required dep) across `archiveCleanup`/`lifecycle`/`promptQueue`/
  `spawnSession`/`spawnSubsession`/`sessionRoutes` tests, importing
  `testModelRuntime` in each.
- **`piSessionService.promptQueue.test.ts`** auth-loss test rewritten: builds a
  live `InMemoryCredentialStore` + `createTestModelRuntime(credentials)`, and
  simulates auth changes via `credentials.delete/seedCredential` +
  `modelRuntime.refresh()` + `applyAuthChange(...)` (matching AuthService's
  real refresh-then-emit sequence). Removed the `modelRegistry` dep line.
- **`piSessionService.warnings.test.ts`**: `anthropicSubscriptionWarning` now
  reads `readStoredCredential("anthropic", authPath)`, so the test seam is a
  temp `auth.json` written per case (helper `anthropicAuthPath(...)`), passed
  as the 2nd arg. `SubscriptionSession` type narrowed to
  `Pick<PiAgentSession, "model" | "settingsManager">`. The "no credential"
  case points at a temp dir with no auth.json (deterministic).
- **`authService.test.ts`** fully reworked to the async `AuthService.create({
  runtime | agentDir })` + `InMemoryCredentialStore` model. `saveApiKey`/
  `logoutProvider`/`startOAuthLogin` are awaited; OAuth-complete test asserts
  `startOptions.runtime === runtime` and uses `vi.waitFor` for the async
  refresh; credential assertions go through `credentials.read(...)`.
- Lint fixes surfaced by running lint green for the first time this relay:
  `getLoginProviderOptions` made **synchronous** (it did no async work) and its
  call sites in `authService.ts` + `authProviderOptions.test.ts` de-awaited;
  `authRoutes.ts` handlers now `return await ...` (return-await rule);
  `authService.ts` api-key interaction uses `() => Promise.resolve(key)` /
  `notify: () => undefined`; test `modify` arrows use `() => Promise.resolve(...)`.

SDK behavior verified empirically before writing doubles (throwaway probe
scripts, since removed): `ModelRuntime.create({ credentials })` exposes 36
providers / 1072 models; `login(id, "api_key", interaction)` persists to the
store; `getModel("anthropic", "claude-sonnet-4-5-20250929")` resolves;
`hasConfiguredAuth` flips correctly across `delete`/`modify` + `refresh`;
`readStoredCredential(id, authPath)` reads a temp auth.json and returns
`undefined` for a missing file.

### Prior position (slice 4, leg 5, commit `4ccd4f8`)
Slice 4 (`piSessionService.ts` migration) complete and committed (`4ccd4f8`).
`piSessionService.ts` now uses the new `ModelRuntime` API end to end:
- `createDefaultRuntimeFactory(modelRuntime, ...)` passes `modelRuntime` to
  `createAgentSessionServices({ cwd, agentDir, modelRuntime })` (no more
  `authStorage` + `modelRegistry`).
- `PiAgentSession.modelRegistry` → `PiAgentSession.modelRuntime: ModelRuntime`.
- `anthropicSubscriptionWarning(session, authPath?)` now reads via
  `readStoredCredential("anthropic", authPath)` (sync); `warningsForSession`
  passes `join(this.agentDir, "auth.json")`. Its `session` param narrowed to
  `Pick<PiAgentSession, "model" | "settingsManager">` (no longer needs the
  registry).
- Model reads rederived onto the runtime: `availableModels`/`setModel` use
  `await modelRuntime.refresh()` + `getAvailableSnapshot()` + `getModel(...)`;
  `syncCurrentModelAuthWarning` uses `getModel(...)` +
  `hasConfiguredAuth(providerId)`.
- `applyAuthChange` no longer refreshes a registry (the shared runtime is
  refreshed by AuthService before it emits, and all sessions share that
  runtime), so the `auth.subscribe` callback stays synchronous.
- **`modelRuntime` is now a REQUIRED `PiSessionServiceDependencies` field**
  (the old `modelRegistry?` fallback used a *sync* `ModelRegistry.create`; a
  `ModelRuntime` can only be built by the async `ModelRuntime.create`, which
  can't run inside a constructor). `sessiond.ts` already injects
  `modelRuntime: auth.runtime` (slice 1), so it typechecks unchanged.
- Dropped the `AuthStorage` / `ModelRegistry` imports and the
  `createModelRegistryForAgentDir` import (only `AuthChange` is still imported
  from `authService.js`).

`npx tsc --noEmit`: **`sessiond.ts` and `piSessionService.ts` are at 0 errors**
(production code is fully migrated; `grep -vE '\.test\.ts|testSupport\.ts'` on
tsc output is empty). All remaining errors are slice-5 test/support files.
`piSessionService.ts` lints clean.

### Prior position (slice 3, leg 4, commit `1c3d6db`)
Slice 3 (`oauthLoginFlowService.ts` migration) complete and committed (`1c3d6db`).
`OAuthLoginFlowService` is reimplemented against the pi-ai `AuthInteraction`
contract (`{ signal?, prompt(AuthPrompt), notify(AuthEvent) }`); the old
`OAuthLoginCallbacks`/`AuthStorage` imports are gone. `start()` now takes a
`ModelRuntime` (narrowed to `Pick<ModelRuntime, "login">`) instead of
`authStorage`, and drives login via `runtime.login(providerId, "oauth",
interaction)`. Mapping: `AuthPrompt` `text`/`secret`/`manual_code` → web-UI
`prompt` (kind `prompt`, `manual_code` → kind `manual`); `select` → web-UI
`select` (options `{id,label}` → `{value,label}`, returns chosen id);
`AuthEvent` `auth_url` → `auth: {url, instructions?}`; `device_code` → reuse
`auth` field (`url: verificationUri`, `instructions: "Enter code: <userCode>"`);
`info`/`progress` → append `message` to `progress`. Per-prompt
`AuthPrompt.signal` now aborts just that pending request (rejects
`"Prompt cancelled"`) without ending the overall flow — needed because a
`manual_code` prompt can race a callback server. `oauthLoginFlowService.test.ts`
rewritten to the new contract via a `fakeRuntime` login double; **9 tests pass**,
files lint clean.

`npx tsc --noEmit` now reports **26 errors** (down from 28). `authService.ts`
is now at **0 errors** (as predicted). Remaining errors are all slice 4/5:
`sessiond.ts` (1) + `piSessionService.ts` (6) = slice 4;
`authService.test.ts` (10), `piSessionService.testSupport.ts` (3),
`.promptQueue.test.ts` (2), `.warnings.test.ts` (4) = slice 5.

### Prior position (slice 2, leg 3, commit `d09d7cc`)
Slice 2 (`authProviderOptions.ts` migration) complete and committed (`d09d7cc`).
`authProviderOptions.ts` now derives options from a runtime-shaped
`AuthProviderRuntime` interface (`getProviders()` + `listCredentials()` +
`getProviderAuthStatus()`). `getLoginProviderOptions`/`getLogoutProviderOptions`
are now `async` (matching the `await` call sites already in `authService.ts`).
The old `AuthProviderModelRegistry` interface is gone; a real `ModelRuntime`
satisfies `AuthProviderRuntime` structurally. The test double in
`authProviderOptions.test.ts` was rewritten to the runtime shape and its 3
tests pass. OAuth-capable = `auth.oauth` present; api-key = `auth.apiKey`
present; `OAUTH_ONLY_PROVIDERS` / `isApiKeyLoginProvider` logic preserved;
display names come from `Provider.name`.

`npx tsc --noEmit` now reports **28 errors** (down from 31). No
`authProviderOptions` errors remain and the `getLoginProviderOptions` /
`getLogoutProviderOptions` call sites in `authService.ts` typecheck cleanly.
Remaining errors are all cross-slice: `authService.ts` (1: line-83
`OAuthLoginFlowService.start` still expects `authStorage` not `runtime` —
slice 3), `sessiond.ts` (1) + `piSessionService.ts` (6, slice 4), and the
test/support files (slice 5): `authService.test.ts` (9),
`oauthLoginFlowService.ts`/`.test.ts` (1+1, slice 3),
`piSessionService.testSupport.ts` (3), `.promptQueue.test.ts` (2),
`.warnings.test.ts` (4).

### Prior position (slice 1, leg 2, commit `e37148c`)
Slice 1 (`authService.ts` core migration) complete and committed (`e37148c`).
`authService.ts` now uses the async `ModelRuntime` API: `AuthService.create({
agentDir | runtime })` factory wraps `ModelRuntime.create({ authPath,
modelsPath })`; `createModelRuntimeForAgentDir` replaces
`createModelRegistryForAgentDir`. `saveApiKey` → `runtime.login(id, "api_key",
nonInteractive)`, `logoutProvider` → `runtime.logout`, `refreshAuthState` →
`await runtime.refresh()`. `authProviders` / `requireOAuthLoginProvider` are now
async. `startOAuthLogin` passes `runtime` into `OAuthLoginFlowService.start`.
`sessiond.ts` uses async `createRuntime`, `AuthService.create`, and passes
`modelRuntime: auth.runtime` to `PiSessionService`; `sessionDaemonStartup` now
awaits `createRuntime`.

`npx tsc --noEmit` reports **31 errors** (up from 24 — expected: the migrated
authService now calls the runtime-based interfaces that slices 2–4 haven't
exposed yet). Slice-1 files are internally consistent; every remaining error
in `authService.ts` / `sessiond.ts` is a **cross-slice** dependency:
- `authService.ts`: `getLoginProviderOptions/getLogoutProviderOptions` still
  take the old `AuthProviderModelRegistry` shape (fixed in slice 2);
  `OAuthLoginFlowService.start` still expects `authStorage` not `runtime`
  (fixed in slice 3).
- `sessiond.ts`: `PiSessionServiceDependencies` still expects `modelRegistry`
  not `modelRuntime` (fixed in slice 4).
Remaining errors otherwise live in slices 2/3/4 files and all test/support
files (slice 5).

## Leg tracking
- **Last completed leg:** 7 (slice 6 — changeset + final verify + cleanup). **FINAL LEG.**
- **Next leg to run:** none — relay complete, no handoff spawned.

## Next task
None — the relay goal is reached. If new work is needed (e.g. opening a PR),
that is a separate task outside this relay's charter.

### Build/tooling note (important for every leg)
**Update (leg 2):** the human reports `/tmp` is now fully usable again, so the
previous `TMPDIR` workaround is no longer required — plain `npm install` should
work. (If a disk-quota error resurfaces, fall back to
`TMPDIR="$PWD/.tmp-build" npm install` and remove `.tmp-build` after; it is
scratch, do not commit it.) node_modules is already installed at 0.80.10, so a
fresh install is only needed if node_modules is cleared. The pre-commit hook
runs a whole-project typecheck; while the migration is incomplete, commit relay
work with `git commit --no-verify` (the charter permits legs that aren't
verify-green). Node: v24.18.0.

## Relevant context for the next runner
- **Plan of record:** `ASSESSMENT-issue-62.md` (root) — read once. §5 has the
  per-file migration shape; §3 has the exact new API shapes; §6 the dep ranges.
- **Changeset skill:** `.agents/skills/changeset-changelog/SKILL.md` (and
  `changeset-changelog` in the skills list). Follow it for the fragment format.
- **The migration is done** — slice 6 is docs/changeset + confirmation only.
  No further source changes are expected; if you find yourself editing
  `src/`, re-check whether that's really in scope.
- **New API cheat-sheet:** `ModelRuntime.create({ authPath, modelsPath,
  credentials? }): Promise<ModelRuntime>`; credential persistence via the
  pi-ai `CredentialStore.modify` path; `runtime.login(providerId, type,
  AuthInteraction)`; `runtime.logout`; `runtime.getProviders()` /
  `listCredentials()` / `getProviderAuthStatus()`; `readStoredCredential(
  providerId, authPath?)` for the sync anthropic warning; pi-ai
  `InMemoryCredentialStore` for tests.
- **Decision already made:** clean migration, **no dual-version compat shim**
  (assessment §4/§5). Do not reopen this without the intervention signal.

## Progress documentation expectations
Every leg: update this `status.md` (current position, leg tracking, next task,
context, blockers), append a concise `log.md` entry, make work durable, and
commit before handing off. Hand off with `spawn_session` **once** per the
charter's Handover section.

## Blockers / intervention state
None blocking. Relay complete. Known constraints:
- **Sessiond restart pending (ACTIVE):** slice 1 (leg 2, commit `e37148c`)
  changed `sessiond.ts` + the session-daemon auth construction path; slice 4
  (leg 5, commit `4ccd4f8`) added `piSessionService.ts` (a session-daemon path)
  to this surface. Per AGENTS.md the human must **manually restart the sessiond
  service** for these changes to take effect once the migration lands. Keep
  this note until the human confirms the restart.
- `/tmp` disk-quota issue is resolved (human confirmed usable) — see the
  Build/tooling note above.
- node_modules is installed (gitignored) at 0.80.10; a fresh `npm install` is
  only needed if node_modules is cleared.