pi-web/relays/issue-62-authstorage/status.md

Relay status — issue-62-authstorage

Current position

Slice 1 (authService.ts core migration) complete and committed (e37148c). authService.ts now uses the async ModelRuntime API: AuthService.create({ agentDir | runtime }) factory wraps ModelRuntime.create({ authPath, modelsPath }); createModelRuntimeForAgentDir replaces createModelRegistryForAgentDir. saveApiKey → runtime.login(id, "api_key", nonInteractive), logoutProvider → runtime.logout, refreshAuthState → await runtime.refresh(). authProviders / requireOAuthLoginProvider are now async. startOAuthLogin passes runtime into OAuthLoginFlowService.start. sessiond.ts uses async createRuntime, AuthService.create, and passes modelRuntime: auth.runtime to PiSessionService; sessionDaemonStartup now awaits createRuntime.

npx tsc --noEmit reports 31 errors (up from 24 — expected: the migrated authService now calls the runtime-based interfaces that slices 2–4 haven't exposed yet). Slice-1 files are internally consistent; every remaining error in authService.ts / sessiond.ts is a cross-slice dependency:

• authService.ts: getLoginProviderOptions/getLogoutProviderOptions still take the old AuthProviderModelRegistry shape (fixed in slice 2); OAuthLoginFlowService.start still expects authStorage not runtime (fixed in slice 3).
• sessiond.ts: PiSessionServiceDependencies still expects modelRegistry not modelRuntime (fixed in slice 4). Remaining errors otherwise live in slices 2/3/4 files and all test/support files (slice 5).

Leg tracking

• Last completed leg: 2 (slice 1 — authService.ts core migration + sessiond async construction).
• Next leg to run: 3.

Next task

Run charter slice 2 (authProviderOptions.ts migration) as leg 3:

• Rederive login/logout provider options from runtime.getProviders() ({ id, name, auth: { apiKey?, oauth? } }) + runtime.listCredentials() ({ providerId, type }[]) / runtime.getProviderAuthStatus(id) instead of authStorage.getOAuthProviders()/list()/get() + getAll() + getProviderDisplayName().
• The functions are already called as async from authService.ts (await getLoginProviderOptions(this.runtime, authType) etc.) — make them async and change their parameter type from AuthProviderModelRegistry to a runtime-shaped interface (e.g. AuthProviderRuntime = Pick<ModelRuntime, "getProviders" | "listCredentials" | "getProviderAuthStatus"> or a structural equivalent). Update the structural interface + authProviderOptions.test.ts test double accordingly.
• See assessment §5.2 / §3.3 for the new API shapes. Provider display names come from Provider.name; OAuth-capable providers are those with auth.oauth, api-key providers those with auth.apiKey (respect the existing OAUTH_ONLY_PROVIDERS / isApiKeyLoginProvider logic).

If slice 2 is already done when you arrive, apply the charter's task-selection policy: pick the lowest-numbered incomplete slice (3 → 6). Slices 3 and 4 unblock the remaining authService.ts / sessiond.ts cross-slice errors.

Build/tooling note (important for every leg)

Update (leg 2): the human reports /tmp is now fully usable again, so the previous TMPDIR workaround is no longer required — plain npm install should work. (If a disk-quota error resurfaces, fall back to TMPDIR="$PWD/.tmp-build" npm install and remove .tmp-build after; it is scratch, do not commit it.) node_modules is already installed at 0.80.10, so a fresh install is only needed if node_modules is cleared. The pre-commit hook runs a whole-project typecheck; while the migration is incomplete, commit relay work with git commit --no-verify (the charter permits legs that aren't verify-green). Node: v24.18.0.

Relevant context for the next runner

• Plan of record: ASSESSMENT-issue-62.md (root) — read once. §5 has the per-file migration shape; §3 has the exact new API shapes; §6 the dep ranges.
• Files to change (all under src/server/sessions/ unless noted): authService.ts, authProviderOptions.ts, oauthLoginFlowService.ts, piSessionService.ts, plus src/server/sessiond.ts (async auth construction), and the test/support files listed in assessment §2.
• New API cheat-sheet: ModelRuntime.create({ authPath, modelsPath, credentials? }): Promise<ModelRuntime>; credential persistence via the pi-ai CredentialStore.modify path; runtime.login(providerId, type, AuthInteraction); runtime.logout; runtime.getProviders() / listCredentials() / getProviderAuthStatus(); readStoredCredential( providerId, authPath?) for the sync anthropic warning; pi-ai InMemoryCredentialStore for tests.
• Decision already made: clean migration, no dual-version compat shim (assessment §4/§5). Do not reopen this without the intervention signal.

Progress documentation expectations

Every leg: update this status.md (current position, leg tracking, next task, context, blockers), append a concise log.md entry, make work durable, and commit before handing off. Hand off with spawn_session once per the charter's Handover section.

Blockers / intervention state

None. Known constraints:

• Sessiond restart pending (ACTIVE): slice 1 (leg 2, commit e37148c) changed sessiond.ts + the session-daemon auth construction path. Per AGENTS.md the human must manually restart the sessiond service for these changes to take effect once the migration lands. Keep this note until the human confirms the restart.
• /tmp disk-quota issue is resolved (human confirmed usable) — see the Build/tooling note above.
• node_modules is installed (gitignored) at 0.80.10; a fresh npm install is only needed if node_modules is cleared.