feat: unify installation model catalog

backend/test/pi-provider-smoke.test.ts

@@ -1,9 +1,11 @@
 import { EventEmitter } from "node:events";
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { afterEach, expect, test, vi } from "vitest";
 import { loadConfig } from "../src/config.js";
 import { createPiProviderSmoke } from "../src/pi/provider-smoke.js";
+import type { RuntimeModel, RuntimeModelCatalog } from "../src/models/runtime-model-catalog.js";
 
 afterEach(() => vi.unstubAllEnvs());
 
@@ -44,6 +46,50 @@ function successfulProviderChild() {
 
 const MANAGED_CONFIG_ERROR = "Pi provider/model configuration is invalid";
 
+test("provider smoke resolves the selected catalog credential from the secret bundle", async () => {
+  const root = mkdtempSync(join(tmpdir(), "thothii-smoke-catalog-credential-"));
+  const secret = join(root, "thothii.secrets");
+  writeFileSync(secret, "ZAI_API_KEY=catalog-secret\nTHT_MODEL_API_KEY=legacy-secret\n", { mode: 0o600 });
+  const model: RuntimeModel = {
+    id: "openai/test-model",
+    provider: "openai",
+    model: "test-model",
+    label: "Test model",
+    upstreamModel: "test-model",
+    authentication: { mode: "secret_env", apiKeyEnv: "ZAI_API_KEY" },
+    sessionAdapter: { mode: "pi_builtin" },
+    session: { reasoning: false },
+  };
+  const modelCatalog: RuntimeModelCatalog = {
+    defaultSession: model.id,
+    defaultMetadataGeneration: null,
+    embedding: null,
+    sessionModels: () => [model],
+    metadataModels: () => [],
+    hasSession: (id) => id === model.id,
+  };
+  let spawnEnv: NodeJS.ProcessEnv | undefined;
+  const smoke = createPiProviderSmoke(loadConfig({ THT_SECRETS_FILE: secret }), {
+    modelCatalog,
+    authProviders: () => new Set(),
+    readModelsStore: () => undefined,
+    spawnFn: (_command, _args, options) => {
+      spawnEnv = options.env;
+      return successfulProviderChild();
+    },
+  });
+  try {
+    await expect(smoke({
+      provider: "openai", model: "test-model", reasoning: "medium", timeoutMs: 750,
+    })).resolves.toBeUndefined();
+    expect(spawnEnv?.ZAI_API_KEY).toBe("catalog-secret");
+    expect(spawnEnv).not.toHaveProperty("OPENAI_API_KEY");
+    expect(spawnEnv).not.toHaveProperty("THT_MODEL_API_KEY");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 // Catches an isolated smoke agent that copies auth.json but drops the selected custom
 // provider/model from models.json, causing set_model to fail before the real request.
 test("provider smoke reaches the selected custom provider from an isolated models.json", async () => {