fix: preserve custom provider smoke config

backend/src/pi/provider-smoke.ts

@@ -1,5 +1,8 @@
 import { spawn as nodeSpawn, type ChildProcessWithoutNullStreams } from "node:child_process";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  closeSync, constants, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync,
+  readFileSync, rmSync, writeFileSync,
+} from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import type { AppConfig } from "../config.js";
@@ -11,6 +14,7 @@ import { buildPiChildEnv, canonicalPiProvider } from "./provider-credentials.js"
 import type { PiReasoning } from "./management.js";
 
 const SMOKE_PROMPT = "Provider health check. Reply with exactly OK.";
+const MAX_AGENT_CONFIG_BYTES = 1024 * 1024;
 const SMOKE_ARGS = [
   "--mode", "rpc",
   "--no-session",
@@ -40,6 +44,7 @@ interface ProviderSmokeOptions {
   ) => ChildProcessWithoutNullStreams;
   authProviders?: () => ReadonlySet<string>;
   readAuthStore?: () => string;
+  readModelsStore?: () => string | undefined;
 }
 
 export function createPiProviderSmoke(
@@ -77,11 +82,26 @@ export function createPiProviderSmoke(
       mkdirSync(isolatedAgentDir, { mode: 0o700 });
       if (configuredAuthProviders.has(canonicalProvider)) {
         const authStore = selectedProviderAuthStore(
-          options.readAuthStore?.() ?? readConfiguredAuthStore(),
+          options.readAuthStore?.() ?? readConfiguredAgentFile("auth.json"),
           canonicalProvider,
         );
         writeFileSync(join(isolatedAgentDir, "auth.json"), authStore, { mode: 0o600, flag: "wx" });
       }
+      const configuredModels = options.readModelsStore
+        ? options.readModelsStore()
+        : readConfiguredAgentFile("models.json", true);
+      if (configuredModels !== undefined) {
+        const modelsStore = selectedProviderModelsStore(
+          configuredModels,
+          canonicalProvider,
+          model,
+        );
+        if (modelsStore !== undefined) {
+          writeFileSync(join(isolatedAgentDir, "models.json"), modelsStore, {
+            mode: 0o600, flag: "wx",
+          });
+        }
+      }
       env.PI_CODING_AGENT_DIR = isolatedAgentDir;
 
       child = spawnFn(config.piBin, [...SMOKE_ARGS], { cwd: isolatedCwd, env });
@@ -147,9 +167,35 @@ function messageUsesTool(message: any): boolean {
       && message.content.some((content: any) => content?.type === "toolCall"));
 }
 
-function readConfiguredAuthStore(): string {
+function readConfiguredAgentFile(name: "auth.json"): string;
+function readConfiguredAgentFile(name: "models.json", optional: true): string | undefined;
+function readConfiguredAgentFile(
+  name: "auth.json" | "models.json",
+  optional = false,
+): string | undefined {
   const configuredAgentDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
-  return readFileSync(join(configuredAgentDir, "auth.json"), "utf8");
+  const path = join(configuredAgentDir, name);
+  let fd: number | undefined;
+  try {
+    const before = lstatSync(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_AGENT_CONFIG_BYTES) {
+      throw providerFailure();
+    }
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.size > MAX_AGENT_CONFIG_BYTES
+      || before.dev !== opened.dev || before.ino !== opened.ino) {
+      throw providerFailure();
+    }
+    return readFileSync(fd, "utf8");
+  } catch (error) {
+    if (optional && (error as NodeJS.ErrnoException)?.code === "ENOENT") return undefined;
+    throw providerFailure();
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); } catch { /* preserve the sanitized smoke outcome */ }
+    }
+  }
 }
 
 function selectedProviderAuthStore(raw: string, provider: string): string {
@@ -161,6 +207,52 @@ function selectedProviderAuthStore(raw: string, provider: string): string {
   return JSON.stringify({ [entry[0]]: entry[1] });
 }
 
+const PROVIDER_CONFIG_FIELDS = [
+  "name", "baseUrl", "apiKey", "api", "headers", "compat", "authHeader",
+] as const;
+
+function selectedProviderModelsStore(raw: string, provider: string, model: string): string | undefined {
+  const parsed: unknown = JSON.parse(raw);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw providerFailure();
+  const providers = (parsed as { providers?: unknown }).providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
+    throw providerFailure();
+  }
+  const entry = Object.entries(providers as Record<string, unknown>)
+    .find(([key]) => key.trim().toLowerCase() === provider);
+  if (!entry) return undefined;
+  const providerConfig = entry[1];
+  if (!providerConfig || typeof providerConfig !== "object" || Array.isArray(providerConfig)) {
+    throw providerFailure();
+  }
+  const source = providerConfig as Record<string, unknown>;
+  const selected: Record<string, unknown> = {};
+  for (const field of PROVIDER_CONFIG_FIELDS) {
+    if (Object.hasOwn(source, field)) selected[field] = source[field];
+  }
+  if (Object.hasOwn(source, "models")) {
+    if (!Array.isArray(source.models)) throw providerFailure();
+    let selectedModel: unknown;
+    for (const candidate of source.models) {
+      if (candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        && (candidate as { id?: unknown }).id === model) {
+        selectedModel = candidate;
+      }
+    }
+    if (selectedModel !== undefined) selected.models = [selectedModel];
+  }
+  if (Object.hasOwn(source, "modelOverrides")) {
+    const overrides = source.modelOverrides;
+    if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) {
+      throw providerFailure();
+    }
+    if (Object.hasOwn(overrides, model)) {
+      selected.modelOverrides = { [model]: (overrides as Record<string, unknown>)[model] };
+    }
+  }
+  return JSON.stringify({ providers: { [entry[0]]: selected } });
+}
+
 function waitForProviderTurn(rpc: RpcClient, child: ChildProcessWithoutNullStreams): Promise<void> {
   return new Promise((resolve, reject) => {
     let failed = false;