fix(providers,engine,agent-adapter): per-leg gateway routing and account model ids for pi

Author: lucas77778

packages/foundation/providers/src/catalog.ts

@@ -21,6 +21,10 @@ export interface ServiceVariant {
   /** Ids for this endpoint in an agent's own provider catalog. Present means the agent already
    * carries the wire adapter and model metadata, so it needs only the key injected. */
   knownProvider?: Partial<Record<AgentKind, string>>;
+  /** `endpointParams` key → the env name that agent's own provider entry reads it under. Present
+   * means the agent templates a per-model URL, so injecting one base URL would flatten routes that
+   * differ per model — declare this instead of a base URL for such a provider. */
+  endpointEnv?: Partial<Record<AgentKind, Record<string, string>>>;
 }
 
 /**
@@ -211,6 +215,12 @@ export const SERVICE_CATALOG: ServiceDescriptor[] = [
       'openai-chat': {
         baseUrl: 'https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/compat',
         knownProvider: { opencode: 'cloudflare-ai-gateway', pi: 'cloudflare-ai-gateway' },
+        // Pi's own entry routes each model to the leg its wire needs — Claude to `/anthropic`, GPT
+        // to `/openai`, Workers AI to `/compat` — so pinning every one of them to `/compat` answers
+        // `400 Compatibility endpoint: v1/messages is not supported` on all but the last group.
+        endpointEnv: {
+          pi: { account_id: 'CLOUDFLARE_ACCOUNT_ID', gateway_id: 'CLOUDFLARE_GATEWAY_ID' },
+        },
       },
     },
   },

packages/foundation/providers/src/resolve.ts

@@ -1,6 +1,7 @@
 import type { Account, AccountEndpoint, AccountProtocol, AgentKind } from '@linkcode/schema';
 import { AccountProtocolSchema } from '@linkcode/schema';
 import { never } from 'foxts/guard';
+import { isObjectEmpty } from 'foxts/is-object-empty';
 import type { EndpointService, ServiceVariant } from './catalog';
 import { endpointServiceById } from './catalog';
 import { fillTemplate, isTemplateFilled } from './template';
@@ -37,6 +38,9 @@ export type ResolvedBinding =
       baseUrl?: string;
       /** The endpoint's id in this agent's own provider catalog, when it has one. */
       knownProvider?: string;
+      /** Endpoint params under the env names this agent's provider entry reads them by. Present
+       * means the agent owns its per-model URL, so `baseUrl` must not be injected. */
+      providerEnv?: Record<string, string>;
     }
   | { tier: 'unavailable'; reason: BindingUnavailableReason };
 
@@ -95,9 +99,16 @@ function resolveService(
   for (const protocol of preferredProtocols(service, kind)) {
     const variant = service.variants[protocol];
     if (!variant) continue;
-    const baseUrl = fillTemplate(variant.baseUrl, account.endpointParams ?? {});
+    const params = account.endpointParams ?? {};
+    const baseUrl = fillTemplate(variant.baseUrl, params);
     if (!isTemplateFilled(baseUrl)) return { tier: 'unavailable', reason: 'endpoint-incomplete' };
-    return bind(kind, protocol, baseUrl, knownProviderFor(variant, kind));
+    return bind(
+      kind,
+      protocol,
+      baseUrl,
+      knownProviderFor(variant, kind),
+      providerEnvFor(variant, kind, params),
+    );
   }
   return { tier: 'unavailable', reason: 'protocol-unsupported' };
 }
@@ -133,8 +144,14 @@ function bind(
   protocol: AccountProtocol,
   baseUrl: string,
   knownProvider: string | undefined,
+  providerEnv?: Record<string, string>,
 ): ResolvedBinding {
-  const resolved = { protocol, baseUrl, ...(knownProvider !== undefined && { knownProvider }) };
+  const resolved = {
+    protocol,
+    baseUrl,
+    ...(knownProvider !== undefined && { knownProvider }),
+    ...(providerEnv !== undefined && { providerEnv }),
+  };
   switch (kind) {
     case 'claude-code':
       if (protocol === 'anthropic') return { tier: 'native', ...resolved };
@@ -163,6 +180,24 @@ function knownProviderFor(
   return variant?.knownProvider?.[kind];
 }
 
+/** The variant's declared env names carrying this account's endpoint params, for agents that
+ * template their own per-model URL. Only the pinned-endpoint path skips it: a URL the user typed
+ * outranks whatever the agent's own catalog would build. */
+function providerEnvFor(
+  variant: ServiceVariant,
+  kind: AgentKind,
+  params: Record<string, string>,
+): Record<string, string> | undefined {
+  const mapping = variant.endpointEnv?.[kind];
+  if (!mapping) return undefined;
+  const env: Record<string, string> = {};
+  for (const [param, name] of Object.entries(mapping)) {
+    const value = params[param];
+    if (value !== undefined) env[name] = value;
+  }
+  return isObjectEmpty(env) ? undefined : env;
+}
+
 /**
  * The endpoint the user named, if any. A stored endpoint the catalog itself produces is not one:
  * the pre-variant add flow wrote one onto every catalog account, back when an account could only

packages/host/agent-adapter/src/__tests__/pi-model-registry.test.ts

@@ -54,7 +54,9 @@ describe('Pi model registry integration', () => {
       config: { authToken: 'dummy', baseUrl, knownProvider: provider },
     });
 
-    expect(events).toContainEqual({ type: 'model-update', model: `${provider}/${modelId}` });
+    // An account-bound session reflects the account's own id, unprefixed: the client's picker is
+    // built from the account's model list and has no other vocabulary to match against.
+    expect(events).toContainEqual({ type: 'model-update', model: modelId });
     await adapter.stop();
   });
 });

packages/host/agent-adapter/src/credential.ts

@@ -16,6 +16,10 @@ export interface AgentCredential {
   /** This endpoint's id in the agent's own provider catalog, when it has one. Provider-routed
    * agents (opencode, pi) inject the credential under it instead of guessing a provider. */
   knownProvider?: string;
+  /** Endpoint params under the env names that provider entry reads them by. Present means the agent
+   * builds its own per-model URL, so `baseUrl` must not be injected — one URL cannot serve a
+   * provider whose models sit on different routes. */
+  providerEnv?: Record<string, string>;
   /** Extra environment for the agent process. */
   extraEnv?: Record<string, string>;
 }
@@ -24,11 +28,13 @@ export interface AgentCredential {
 export function readAgentCredential(config: StartOptions['config']): AgentCredential {
   if (!config) return {};
   const extraEnv = readStringRecord(config.extraEnv);
+  const providerEnv = readStringRecord(config.providerEnv);
   return {
     apiKey: readString(config.apiKey),
     authToken: readString(config.authToken),
     baseUrl: readString(config.baseUrl),
     knownProvider: readString(config.knownProvider),
+    ...(providerEnv && { providerEnv }),
     ...(extraEnv && { extraEnv }),
   };
 }

packages/host/agent-adapter/src/native/pi/adapter.ts

@@ -94,9 +94,18 @@ function effortLevels(model: PiModel): PiEffort[] {
     return level !== 'xhigh' || mapped !== undefined;
   });
 }
-function modelOptions(models: PiModel[]) {
+/**
+ * How a session names a model on the wire. An account-bound session speaks the account's own
+ * vocabulary — endpoint-owned ids, unprefixed — because that is the list the client picks from;
+ * qualifying them leaves the picker unable to match the id the session reflects back at it.
+ */
+function advertisedModelId(model: PiModel, accountProvider: string | undefined): string {
+  return model.provider === accountProvider ? model.id : `${model.provider}/${model.id}`;
+}
+
+function modelOptions(models: PiModel[], accountProvider?: string) {
   return models.map((model) => ({
-    id: `${model.provider}/${model.id}`,
+    id: advertisedModelId(model, accountProvider),
     label: model.name,
     description: `${model.provider}/${model.id}`,
     effortLevels: effortLevels(model),
@@ -177,14 +186,21 @@ function createConfiguredRegistry(
   opts: Pick<AgentStartCatalogOptions, 'model' | 'config'>,
   fallbackProvider?: string,
 ) {
-  const authStorage = pi.AuthStorage.create();
-  const modelRegistry = pi.ModelRegistry.create(authStorage);
   const cred = readAgentCredential(opts.config);
+  const key = cred.apiKey ?? cred.authToken;
+  // Pi reads a provider's endpoint params only off a *stored* credential — `setRuntimeApiKey` carries
+  // no env and `registerProvider` has no env field — so seed the store instead. In-memory, because
+  // `set()` on the file-backed store would leave the account's secret in ~/.pi/agent/auth.json.
+  const seeded =
+    key && cred.knownProvider && cred.providerEnv
+      ? { [cred.knownProvider]: { type: 'api_key' as const, key, env: cred.providerEnv } }
+      : undefined;
+  const authStorage = seeded ? pi.AuthStorage.inMemory(seeded) : pi.AuthStorage.create();
+  const modelRegistry = pi.ModelRegistry.create(authStorage);
   const ref = opts.model
     ? resolveModelRef(modelRegistry, opts.model, cred, fallbackProvider)
     : null;
 
-  const key = cred.apiKey ?? cred.authToken;
   // An explicit model fixes routing; without one, resume evidence outranks the account default.
   const provider =
     ref?.provider ??
@@ -194,12 +210,13 @@ function createConfiguredRegistry(
   if (!provider && (key || cred.baseUrl)) {
     throw new Error('pi: cannot target credential without a provider/model');
   }
-  if (key && provider) authStorage.setRuntimeApiKey(provider, key);
-  if (cred.baseUrl) {
+  if (key && provider && !seeded) authStorage.setRuntimeApiKey(provider, key);
+  if (!seeded && cred.baseUrl) {
     // baseUrl override only: a models-less registerProvider rewrites the URL and leaves each
     // model's wire at pi's built-in value, so this works exactly when that provider's built-in
     // wire already matches the endpoint. Pointing a provider at a differently-shaped endpoint is
     // not expressible without supplying full model metadata (see @linkcode/providers AGENTS.md).
+    // A seeded provider is the escape hatch: it templates its own per-model URL from the env above.
     modelRegistry.registerProvider(provider, {
       baseUrl: cred.baseUrl,
       ...(key && { apiKey: key }),
@@ -254,8 +271,8 @@ export class PiAdapter extends BaseAgentAdapter {
 
   override async startCatalog(opts: AgentStartCatalogOptions = {}): Promise<AgentStartCatalog> {
     const pi = await this.importSdk();
-    const { modelRegistry } = createConfiguredRegistry(pi, opts);
-    const models = modelOptions(modelRegistry.getAvailable());
+    const { modelRegistry, credential } = createConfiguredRegistry(pi, opts);
+    const models = modelOptions(modelRegistry.getAvailable(), credential.knownProvider);
     return {
       models,
       policies: [...POLICIES],
@@ -374,14 +391,17 @@ export class PiAdapter extends BaseAgentAdapter {
       if (this.lifecycle === generation && this.session === session) this.handleEvent(ev);
     });
     const runningModel = session.model ?? model;
-    if (runningModel) this.emitModel(`${runningModel.provider}/${runningModel.id}`);
+    if (runningModel) {
+      this.emitModel(advertisedModelId(runningModel, this.credential.knownProvider));
+    }
     this.emitModels(
       modelOptions(
         this.credentialProviderId
           ? modelRegistry
               .getAvailable()
               .filter((item) => item.provider === this.credentialProviderId)
           : modelRegistry.getAvailable(),
+        this.credential.knownProvider,
       ),
     );
     this.emitApprovalPolicy({ availablePolicies: [...POLICIES], currentPolicyId: this.policyId });
@@ -476,7 +496,9 @@ export class PiAdapter extends BaseAgentAdapter {
     const model = registry.find(ref.provider, ref.modelId);
     if (!model) throw new Error(`pi: unknown model '${value}'`);
     await session.setModel(model);
-    if (session.model) this.emitModel(`${session.model.provider}/${session.model.id}`);
+    if (session.model) {
+      this.emitModel(advertisedModelId(session.model, this.credential.knownProvider));
+    }
     if (isEffort(session.thinkingLevel)) this.emitEffort(session.thinkingLevel);
   }
 

packages/host/engine/src/agent/provider-config.ts

@@ -88,6 +88,7 @@ function accountConfigBundle(
   if (binding.baseUrl !== undefined) bundle.baseUrl = binding.baseUrl;
   if (binding.protocol !== undefined) bundle.protocol = binding.protocol;
   if (binding.knownProvider !== undefined) bundle.knownProvider = binding.knownProvider;
+  if (binding.providerEnv !== undefined) bundle.providerEnv = binding.providerEnv;
   if (extraEnv) bundle.extraEnv = extraEnv;
   return { bundle };
 }