feat: unify installation model catalog

backend/src/pi/provider-smoke.ts

@@ -17,6 +17,10 @@ import {
   readConfiguredPiAgentFile,
   validateDeclarativePiConfig,
 } from "./managed-config.js";
+import {
+  loadRuntimeModelCatalog,
+  type RuntimeModelCatalog,
+} from "../models/runtime-model-catalog.js";
 
 const SMOKE_PROMPT = "Provider health check. Reply with exactly OK.";
 const SMOKE_ARGS = [
@@ -49,6 +53,7 @@ interface ProviderSmokeOptions {
   authProviders?: () => ReadonlySet<string>;
   readAuthStore?: () => string;
   readModelsStore?: () => string | undefined;
+  modelCatalog?: RuntimeModelCatalog;
 }
 
 export function createPiProviderSmoke(
@@ -69,12 +74,24 @@ export function createPiProviderSmoke(
       const configuredModels = options.readModelsStore
         ? options.readModelsStore()
         : readConfiguredPiAgentFile("models.json", true);
+      const catalog = options.modelCatalog ?? loadRuntimeModelCatalog(config.modelCatalogFile);
+      const catalogConfigured = config.modelCatalogFile !== undefined
+        || catalog.defaultSession !== null;
+      const catalogModel = catalog.sessionModels()
+        .find((entry) => entry.provider === canonicalProvider && entry.model === model);
+      const credentialName = catalogModel?.authentication.mode === "secret_env"
+        ? catalogModel.authentication.apiKeyEnv
+        : undefined;
+      const projectedApiKey = configuredPiProviderApiKey(configuredModels, canonicalProvider)
+        ?? (credentialName ? `$${credentialName}` : undefined);
       const env = buildPiChildEnv({
         provider: canonicalProvider,
         authProviders: configuredAuthProviders,
-        credentialValue: secretValue(config, "THT_MODEL_API_KEY"),
+        credentialValue: credentialName
+          ? secretValue(config, credentialName)
+          : catalogConfigured ? undefined : secretValue(config, "THT_MODEL_API_KEY"),
         credentialFile: config.modelApiKeyFile,
-        configuredApiKey: configuredPiProviderApiKey(configuredModels, canonicalProvider),
+        configuredApiKey: projectedApiKey,
       });
       clearPrincipalEnvironment(env);
       delete env.THT_DATA_ROOT;