[dizys]

Summary

Pi landed as install-only on the Agents page (#76). It had a "Pi" text tile, a status line telling you to run t3-login pi, and no sign-in status or controls. This PR gives it the same treatment as the other agents.

• Icon. Pi's own mark, from T3 Code's Pi provider definition (packages/provider-pi/src/client.ts). It is one colour, so it follows the theme.

• Sign-in status. The probe runs pi --list-models with PI_OFFLINE=1. Pi lists only providers it holds credentials for, so this covers saved keys, /login subscriptions, environment keys, models.json and extensions. T3 Code uses the same signal to decide Pi can start a turn. A probe that cannot answer still shows "Couldn't check its sign-in", never "Not signed in".

• Sign in. The row's Sign in button opens a sheet that:

  • saves an API key for one of 35 providers, or any id through Other, into Pi's auth.json;
  • lists what Pi is signed in to, by provider and kind (subscription, API key or environment variable), never the secret, and removes one provider's sign-in;
  • gives the steps for subscriptions (Claude Pro or Max, ChatGPT, Copilot): t3-login pi, then /login. Only Pi itself can do that sign-in, and it has no command Setup could run.

  The row menu also has Sign in with a subscription…, which opens the sheet on those steps.

• Manage keys. OpenCode and Pi take a key per provider, and their sheet also lists and removes saved keys. Their button now reads Add key until a key is saved and Manage keys after. Keys in Pi's environment don't count, since the sheet can't change them. The README picture shows OpenCode's row, so it is regenerated.

How keys are written

Pi has no command that saves a key, so Setup writes auth.json itself:

• under the same proper-lockfile lock (auth.json.lock) that Pi takes for its own writes and token refreshes, with Pi's 30 second staleness rule;
• replaced in one step, through a link if auth.json is one (a link to a missing file is refused);
• in PI_CODING_AGENT_DIR when that is set, keeping every other provider and any extra settings saved with an earlier key;
• never over a /login subscription without confirmation, because Pi keeps one sign-in per provider;
• never with a key that starts with ! or contains $, because Pi would run it as a command or expand it as a variable.

Screenshots

The same fixture data on main and on this branch.

Agents, desktop

Before	After, signed out	After, signed in

Agents, phone (dark)

Before	After

Sign-in sheet

Desktop, light	Desktop, dark

Phone	Phone, from "Sign in with a subscription…"	Replacing a subscription

Testing

• node --test tests/*.test.mjs: 1081 of 1082 pass. The one failure, "saved API token works through the CLI and connection test" in credentials-api.test.mjs, is flaky under parallel load. It passes 3 of 3 times alone, on this branch and on main, and touches nothing here.
• New tests/pi-auth.test.mjs (12 tests): saving beside subscriptions, replacement only on request, refused keys and ids, removal, unreadable files left untouched, links, waiting for and clearing Pi's lock, PI_CODING_AGENT_DIR, environment keys, model-list parsing, the probe, and the HTTP routes against the real setup server (no secret in any response).
• scripts/pi-auth-smoke.mjs against real Pi 0.80.5 (the supported floor) and 1.4.0: passes on both.
• The probe against those real binaries: signed out, then signed in after saving a key, then signed out after removing it; a key in the environment reads as signed in.
• scripts/opencode-auth-ui-audit.mjs (the key sheet is shared with OpenCode): every layout passes, now opening the sheet from Manage keys once accounts are loaded. scripts/harness-ui-audit.js: 29 of 29. shellcheck on smoke-test.sh: clean.
• 360 px phone and the embedded frame, light and dark: no horizontal overflow in the row or the sheet.
• Not run locally: the image smoke test (no Docker here). It gains two checks: the native round trip against the installed Pi, and signing Pi in and out through the Setup API.

Not in this PR

• Running Pi's subscription /login from the console. Pi has no CLI or RPC command for it.
• pi auth check per provider (Pi 0.84.1 and newer). The model list already covers every credential source and also works on older versions.

🤖 Generated with Claude Code