Module provider 

Provider + model resolution. Mirrors the provider/model selection and request-auth portions of native Pi’s model runtime.

The built-in lane uses Anthropic’s protocol, while models.json may add named Anthropic-compatible, OpenAI Completions, and OpenAI Responses providers. OAuth/Copilot remains deferred. This module resolves one provider identity and its isolated model catalog for each run.

Auth resolution and isolation

Credentials are resolved independently for every provider id:

1. --api-key overrides only the finally selected provider.
2. auth.json[provider-id] wins over that provider’s configured key.
3. models.json.providers[provider-id].apiKey (plus authHeader) applies only to models owned by that provider.
4. Provider-specific environment variables are fallbacks. The global ANTHROPIC_* and OPENAI_API_KEY variables belong only to the built-in anthropic and openai identities respectively.

A credential never makes another provider’s model available and is never passed to another provider’s runtime, even when endpoints or model ids are identical.

Endpoint + catalog

• --base-url overrides the selected model.base_url at resolve time; ANTHROPIC_BASE_URL is the fallback for the built-in anthropic identity only (the request URL is built from it per-request in rpi-ai).
• ~/.rpi/models.json (if present) merges/overrides the built-in catalog: each anthropic-messages provider contributes its models, with provider-level base_url/headers/authHeader folded in. The models.json provider id (e.g. gateway) remains the routing and credential identity, so providers may safely share a protocol, endpoint, or model id.

Model pattern precedence (mirrors resolveCliModel)

1. --model may carry provider/id[:thinking]. The prefix is interpreted as a provider only when it names a known built-in or models.json provider. Otherwise the slash remains part of the raw model id (for example meta-llama/llama-*). If both interpretations exist, the known provider wins while authenticated; an unauthenticated inferred provider yields to one uniquely authenticated raw-id match, as in native Pi.
2. Otherwise treat --model as id[:thinking]: if a trailing :level is a valid thinking level, strip it and apply it (overriding --thinking); else the whole string is the id.
3. --provider must name a built-in provider or a configured models.json provider and restricts selection to that identity.
4. The model id is matched exactly, case-insensitively against the catalog. The TS resolver additionally does fuzzy/partial matching; v1 keeps it exact to avoid surprising model picks (partial match is a common source of “got the wrong model” bugs — documented as a divergence in docs/m6-cli-open-questions.md).
5. No --model ⇒ [pick_default_model]: (a) scan native Pi’s defaultModelPerProvider entries in their declared order and take the first authenticated match; otherwise (b) take the first authenticated model in the catalog — mirroring the TS findInitialModel fallback over availableModels. This lets a models.json-only gateway config “just work”: the built-in Anthropic models carry no auth, so the gateway model (the only authenticated one) is picked. The all-builtin/no-custom-code default (ANTHROPIC_API_KEY path) selects claude-opus-4-8. Last resort falls back to DEFAULT_MODEL_ID (or the catalog head) — unreachable in practice because the auth gate refuses an unauthed catalog earlier.

Structs

ResolvedModel

The resolved run configuration: the provider handle, the chosen model, and the effective thinking level (after --thinking / :level / model-clamp).

Enums

ResolveError

A resolution error. The TS resolver returns { error, warning }; v1 folds both into a single enum since the CLI treats them the same (print + non-zero exit) except NoApiKey, which prints guidance then exits.

Constants

ANTHROPIC_API_KEY_ENV

The env var consulted for the API key. Mirrors TS ANTHROPIC_API_KEY.

ANTHROPIC_AUTH_TOKEN_ENV

The env var consulted for a bearer token (routed as Authorization: Bearer). Mirrors TS ANTHROPIC_AUTH_TOKEN — used by third-party Anthropic-compatible gateways (one-api/new-api/claude-code-router and private reverse proxies) that authenticate via Authorization rather than x-api-key.

ANTHROPIC_BASE_URL_ENV

The env var that overrides the Anthropic endpoint base URL. Mirrors TS ANTHROPIC_BASE_URL — point this at a gateway/proxy that speaks the /v1/messages protocol.

DEFAULT_MODEL_ID

The default Anthropic model when --model is absent. Kept in sync with the current native Pi defaultModelPerProvider.anthropic entry.

DEFAULT_THINKING_LEVEL

The default thinking level when neither --thinking nor a :level suffix is present. Mirrors the TS DEFAULT_THINKING_LEVEL ("medium", clamped to model capabilities by the harness’s provider build_params).

NO_API_KEY_HINT

Hint text surfaced when no credential source is available. Lists every accepted source so the user can pick the one that fits their setup.

OPENAI_API_KEY_ENV

Standard OpenAI API-key environment variable used by the openai-completions provider.

Functions

available_catalog

The catalog the TUI’s /model selector displays (read-only). Re-derives the auth-filtered snapshot the provider was built from so the selector shows exactly the models that can actually run (mirrors pi getAvailableSnapshot: available = all.filter(m => configuredProviders.has(m.provider)) — v1’s single-provider equivalent of “configured” is [model_is_authed]).

catalog_all

Return the merged built-in + models.json catalog without requiring a credential or selecting a runnable model. This is used by CLI commands such as --list-models, which must remain useful before authentication.

resolve

Resolve the provider + model + thinking level from the CLI flags + env + ~/.rpi/ config.

resolve_for_cwd

Resolve using native Pi’s global -> trusted-project settings precedence.